The malware uses invisible Unicode characters to hide its code and blockchain-based infrastructure to prevent takedowns. The post Supply Chain Attack Targets VS Code Extensions With ‘GlassWorm’ Malware appeared first on SecurityWeek .
Myanmar is notorious for hosting cyberscam operations responsible for bilking people all over the world. The post Myanmar Military Shuts Down Major Cybercrime Center and Detains Over 2,000 People appeared first on SecurityWeek .
COLDRIVER, a Russian state-sponsored threat group, swiftly shifted operations after their LOSTKEYS malware was exposed in May 2025. They developed new malware families, including NOROBOT, YESROBOT, and MAYBEROBOT, within days. The infection chain begins with a COLDCOPY lure disguised as a CAPTCHA, leading to the deployment of NOROBOT, a DLL that retrieves subsequent stages. YESROBOT, a Python backdoor, was briefly used before being replaced by MAYBEROBOT, a more flexible PowerShell backdoor. The malware chain has undergone constant evolution, with COLDRIVER focusing on evading detection while maintaining intelligence collection capabilities against high-value targets. The group's tactics include using HTTPS for command retrieval, encrypting commands, and implementing various evasion techniques.
A new phishing campaign is impersonating top firms by sending fake job offer emails to steal Facebook login credentials. The emails lure victims with employment opportunities, prompting them to enter their Facebook credentials on fraudulent websites. This threat targets individuals rather than specific software vulnerabilities and relies on social engineering. The campaign has been recently reported but lacks evidence of widespread exploitation or advanced technical sophistication. European organizations could face reputational risks if their employees fall victim, potentially leading to compromised personal or corporate Facebook accounts. Mitigation requires user awareness training focused on phishing recognition, verification of job offers through official channels, and enforcing multi-factor authentication on social media accounts. Countries with high social media usage and significant employment in multinational firms are more likely to be targeted. Given the medium severity rating, the threat poses moderate risk primarily through credential theft and potential subsequent misuse. Defenders should prioritize phishing detection and response capabilities to reduce impact.
This research focuses on detecting Kerberos attacks through network traffic analysis and developing detection signatures for the Suricata IDS. It aims to improve identification of malicious activity targeting Kerberos authentication, a critical component in many enterprise environments. Although no specific vulnerabilities or exploits are detailed, the work enhances defensive capabilities against potential Kerberos-based threats. The threat does not describe active exploitation but provides tools to detect attack patterns. European organizations relying heavily on Kerberos for authentication could benefit from these detection improvements. Mitigation involves deploying updated IDS signatures and monitoring network traffic for anomalous Kerberos behavior. Countries with significant enterprise IT infrastructure and high adoption of Microsoft Active Directory environments are most relevant. Given the medium severity and absence of active exploits, the threat is primarily a detection enhancement rather than an immediate risk. Defenders should prioritize integrating these detection capabilities to strengthen their security posture against Kerberos attacks.
The DNS0. EU private DNS service has shut down due to sustainability issues, impacting users relying on this service for DNS resolution. While this is not a direct security vulnerability or exploit, the sudden unavailability of a DNS service can cause disruptions in network connectivity and potentially increase exposure to DNS-related attacks if users switch to less secure alternatives. European organizations using DNS0. EU may face operational challenges and should ensure they migrate to trusted DNS providers promptly. No known exploits or vulnerabilities are associated with this shutdown. The threat is primarily operational and availability-related rather than a direct cybersecurity compromise. Organizations should review their DNS configurations and monitor for any unusual DNS traffic or redirection attempts during the transition. Countries with higher adoption of DNS0. EU or critical infrastructure relying on it are more likely to be affected.
The GlassWorm malware is a self-spreading malicious software targeting OpenVSX and VS Code extension registries. It propagates by infecting extensions within these registries, potentially compromising developers and users who download affected extensions. This malware can lead to unauthorized code execution, data theft, and supply chain compromise. European organizations relying on VS Code and OpenVSX for software development are at risk of indirect infection through compromised extensions. The malware's self-spreading nature increases the risk of rapid proliferation across development environments. Mitigation requires rigorous extension vetting, monitoring for unusual extension behavior, and restricting extension installation policies. Countries with significant software development sectors and high adoption of VS Code and OpenVSX, such as Germany, France, and the UK, are most likely to be affected. Given the high impact on confidentiality and integrity, ease of spread, and no need for user interaction beyond extension installation, the threat severity is assessed as high.
Five newly exploited vulnerabilities affecting Oracle and Microsoft products have been added to CISA's catalog, highlighting an ongoing risk to organizations using these technologies. Although specific technical details and affected versions are not provided, the inclusion in CISA's catalog indicates these bugs are actively exploited or pose a high risk. The threat is rated high severity due to the critical nature of Oracle and Microsoft software in enterprise environments. European organizations relying on these vendors face potential risks to confidentiality, integrity, and availability of their systems. No known exploits in the wild have been confirmed yet, but the threat landscape suggests imminent or ongoing exploitation attempts. Mitigation requires prompt patching once updates are available, enhanced monitoring for suspicious activity, and prioritization of critical infrastructure systems. Countries with significant Oracle and Microsoft market penetration and strategic IT infrastructure, such as Germany, France, the UK, and the Netherlands, are most likely to be impacted. Given the high impact potential and ease of exploitation implied by active exploitation status, the suggested severity is high. Defenders should prioritize awareness, patch management, and incident response readiness to mitigate potential damage.
Salt Typhoon, a China-linked cyber espionage group, exploited a zero-day vulnerability (CVE-2024-40766) in Citrix NetScaler Gateway appliances to target a European telecommunications organization. The attackers used DLL sideloading to deploy the SNAPPYBEE backdoor and leveraged LightNode VPS endpoints for command and control. The intrusion involved lateral movement from the compromised gateway to Citrix VDA hosts with the intent of data exfiltration. Darktrace detected the attack early through anomaly-based detection, enabling containment before significant damage occurred. No known exploits are currently in the wild. The threat demonstrates sophisticated stealth techniques by state-sponsored actors targeting critical infrastructure. Organizations using Citrix infrastructure, especially in telecommunications, should monitor proactively and apply patches when available. The suggested severity is medium due to the targeted nature and exploitation complexity.
The ClickFix analysis highlights the growing threat of copy/paste attacks as a significant driver of security breaches. These attacks exploit the common user behavior of copying and pasting data, often leading to credential theft, injection of malicious commands, or unauthorized data exfiltration. Although no specific software vulnerability or exploit is detailed, the threat emphasizes the human and process weaknesses that facilitate these breaches. European organizations are at risk due to widespread use of affected platforms and the high value of their data. Mitigation requires targeted user training, enhanced endpoint monitoring for clipboard activity, and implementation of strict data handling policies. Countries with advanced digital economies and high adoption of remote work technologies, such as Germany, France, and the UK, are particularly vulnerable. Given the ease of exploitation and potential impact on confidentiality and integrity without requiring sophisticated tools or authentication, the threat severity is assessed as high. Defenders should prioritize awareness campaigns and technical controls to detect and prevent malicious copy/paste activities.
For the latest discoveries in cyber research for the week of 20th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES F5 has disclosed a cyber attack, reportedly carried out by a nation-state actor with long-term, persistent access to critical product development environments. The attacker exfiltrated files that included portions of BIG-IP source […] The post 20th October – Threat Intelligence Report appeared first on Check Point Research .
A significant AWS outage caused widespread service disruptions affecting major platforms such as Amazon, PrimeVideo, Fortnite, and Perplexity. The outage was reported on October 20, 2025, and led to downtime and degraded service availability for these high-profile services. Although no direct security breach or exploit has been reported, the incident highlights the risks associated with reliance on cloud infrastructure providers. European organizations using AWS or dependent on affected services may experience operational impacts. The outage underscores the importance of cloud resilience, multi-region deployments, and incident response preparedness. No known exploits or vulnerabilities were identified in relation to this outage. Mitigation involves enhancing cloud architecture redundancy and monitoring. Countries with significant AWS adoption and digital service dependencies, such as Germany, the UK, France, and the Netherlands, are most likely to be affected. The severity of this threat is assessed as high due to the broad impact on availability and critical business services without requiring user interaction or authentication.
A comprehensive guide to configuring privacy and security in ChatGPT: data collection and usage, memory, Temporary Chats, connectors, and account security.
The judge ruled that punitive damages of $167 million awarded by a jury were excessive. The post NSO Ordered to Stop Hacking WhatsApp, but Damages Cut to $4 Million appeared first on SecurityWeek .
The info is spreading across the news websites: For approximatively two hours, many online services or websites are suffering of an Amazon Web Services outage. Some affected services:
The MSS alleges that the NSA conducted a sophisticated multi-stage cyberattack on Beijing's time synchronization systems using 42 distinct cyber tools. This campaign reportedly involved complex intrusion techniques targeting critical infrastructure components responsible for timekeeping. While specific technical details and exploited vulnerabilities remain undisclosed, the scale and coordination suggest a high level of operational capability. The attack's potential impact includes disruption of time-dependent services, which could cascade into broader operational failures. European organizations relying on synchronized time for financial transactions, telecommunications, and critical infrastructure could face indirect risks if similar tactics are employed or if supply chains are affected. Mitigation requires enhanced monitoring of time synchronization systems, strict network segmentation, and collaboration with international cybersecurity entities. Countries with significant critical infrastructure and advanced cyber capabilities, such as Germany, France, and the UK, are most likely to be affected or targeted in analogous campaigns. Given the complexity, potential impact, and lack of authentication barriers, the threat severity is assessed as high. Defenders should prioritize detection of multi-stage intrusions and protect time-critical systems accordingly.
WaterPlum, a North Korean-associated attack group, has been using a new malware called OtterCandy in their ClickFake Interview campaign. OtterCandy, implemented in Node.js, combines features of RATatouille and OtterCookie. It targets Windows, macOS, and Linux systems, stealing browser credentials, cryptocurrency wallets, and confidential files. The malware communicates with C2 servers via Socket.IO and has persistence mechanisms. An August 2025 update (v2) enhanced user identification, expanded theft targets, and added trace deletion capabilities. OtterCandy's evolution and its use in ongoing campaigns highlight the need for continued vigilance against WaterPlum's activities.
I found another piece of malware this weekend. This one looks more like a proof-of-concept because the second-stage payload is really "simple", but it attracted my attention because it uses a nice technique to obfuscate the code.
Experian was fined $3.2 million for mass-collecting personal data, highlighting significant privacy and regulatory compliance issues. This incident underscores risks related to unauthorized or excessive data collection practices by large data brokers. Although no direct technical exploit or vulnerability is reported, the event signals potential privacy violations that could lead to reputational damage and regulatory penalties. European organizations should be aware of similar risks under GDPR and other data protection laws. The fine emphasizes the importance of strict data governance and compliance with privacy regulations. No active exploitation or technical attack vectors are indicated. The threat is primarily regulatory and compliance-related rather than a direct cybersecurity vulnerability. Organizations handling personal data must ensure lawful data collection and processing practices. Countries with strong data protection enforcement and large financial or data services sectors are most likely to be impacted.
