Threats affecting Switzerland

A new two-stage malware named LeakyInjector and LeakyStealer has been identified, targeting cryptocurrency wallets and browser history. LeakyInjector uses low-level APIs for injection to avoid detection and injects LeakyStealer into explorer.exe. LeakyStealer implements a polymorphic engine to modify its memory area at runtime. Both stages were signed with valid Extended Validation certificates. The malware performs reconnaissance on infected machines, targeting multiple crypto wallets, including browser extensions, and searches for browser history files from various browsers. It establishes persistence through registry manipulation and beacons to the C2 server at regular intervals. The malware exfiltrates sensitive data and can execute additional commands received from the C2 server.

Malware#cryptocurrency#persistenceGermany+5

LeakyInjector and LeakyStealer are malware components working together to target cryptocurrency wallets and browser history data. The duo aims to extract sensitive financial information and user browsing activity, potentially leading to financial theft and privacy breaches. Although no known exploits in the wild have been reported yet, the malware's capability to harvest valuable data poses a medium-level threat. The malware appears recently discussed on Reddit's NetSec community, with limited technical details publicly available. European organizations with users handling cryptocurrency or sensitive browser data are at risk, especially those in countries with high crypto adoption. Mitigation requires targeted detection of injection behaviors and credential-stealing activities, alongside user education about phishing and suspicious downloads. Given the lack of patches and the malware's focus, countries like Germany, the UK, and the Netherlands, with significant crypto markets and tech sectors, are more likely to be affected. The threat severity is assessed as medium due to moderate impact potential and no current widespread exploitation. Defenders should prioritize monitoring for unusual injection and data exfiltration activities related to crypto wallets and browsers.

Tool#netsec#redditGermany+4

The DeFi protocol Balancer suffered a significant theft of $128 million due to an exploit involving a rounding function vulnerability and batch swap operations. Attackers manipulated the protocol's logic to drain funds, but recovery efforts have begun. This exploit targets the integrity of smart contract operations within decentralized finance platforms. European organizations involved in DeFi or holding assets on Balancer could face financial losses and reputational damage. Mitigation requires thorough auditing of smart contract code, especially around arithmetic operations and transaction batching. Countries with active DeFi markets and blockchain development, such as Germany, the Netherlands, and the UK, are most likely to be affected. The threat is assessed as medium severity due to the complexity of exploitation and the need for specific knowledge to execute the attack. Defenders should prioritize monitoring for unusual batch swap activity and ensure robust contract validation before deployment.

NewsGermanyNetherlands+3

In September 2025, SonicWall disclosed a security breach attributed to state-sponsored hackers. The breach involved unauthorized access to SonicWall's systems, potentially compromising sensitive data and impacting the security of their customers. While specific technical details and affected product versions were not disclosed, the incident is considered high severity due to the involvement of advanced threat actors and the critical nature of SonicWall's security products. No known exploits in the wild have been reported yet. European organizations relying on SonicWall's VPN and firewall solutions may face increased risk of data exposure and operational disruption. Mitigation requires immediate review of SonicWall product configurations, enhanced monitoring for suspicious activity, and applying any forthcoming patches or guidance from SonicWall. Countries with significant SonicWall deployments and strategic sectors such as finance, government, and critical infrastructure are most at risk. Given the breach's potential impact on confidentiality and integrity, ease of exploitation by skilled attackers, and the broad scope of affected systems, the suggested severity is high. Defenders should prioritize threat detection, incident response readiness, and collaboration with SonicWall for remediation updates.

Breach#infosecnews#redditGermany+9

For several years, we have offered a "new domain" list of recently registered (or, more accurately, recently discovered) domains. This list is offered via our API (https://isc.sans.edu/api). However, the size of the list has been causing issues, resulting in a "cut-off" list being returned. To resolve this issue, I updated the API call. It is sort of backward compatible, but it will not allow you to retrieve the full list. Additionally, we offer a simple "static file" containing the complete list. This file should be used whenever possible instead of the API.

NewsGermanyFrance+8

The U. S.government has imposed sanctions on 10 North Korean entities involved in laundering approximately $12.7 million through cryptocurrency and IT fraud schemes. These entities are part of North Korea's broader cybercrime operations aimed at evading sanctions and generating revenue. The laundering activities leverage cryptocurrency's pseudonymous nature and IT fraud tactics to obscure illicit financial flows. While no specific vulnerabilities or exploits are detailed, the threat highlights ongoing risks from state-sponsored cybercrime groups targeting global financial systems. European organizations may face indirect impacts through increased cybercrime activity, potential targeting of financial institutions, and regulatory compliance challenges. Mitigation requires enhanced monitoring of cryptocurrency transactions, collaboration with law enforcement, and strengthening of anti-money laundering (AML) controls. Countries with significant cryptocurrency markets and financial hubs, such as the UK, Germany, and the Netherlands, are more likely to be affected.

News#infosecnews#redditGermany+4

By: Dikla Barda, Roaman Zaikin & Oded Vanunu On November 3, 2025, Check Point Research’s blockchain monitoring systems detected a sophisticated exploit targeting Balancer V2’s ComposableStablePool contracts. The attacker exploited arithmetic precision loss in pool invariant calculations to drain $128.64 million across six blockchain networks in under 30 minutes. The attack leveraged a rounding error […] The post How an Attacker Drained $128M from Balancer Through Rounding Error Exploitation appeared first on Check Point Research .

AnalysisGermanyFrance+6

The United States has imposed sanctions on a group of bankers, financial institutions and others accused of laundering money from cyber crime schemes. The post US Sanctions North Korean Bankers Accused of Laundering Stolen Cryptocurrency appeared first on SecurityWeek .

NewsGermanyNetherlands+3

Google's AI tool 'Big Sleep' has identified five new high-severity vulnerabilities in Apple's Safari WebKit engine. These vulnerabilities affect the core rendering engine used by Safari and other applications on Apple platforms. Although no known exploits are currently active in the wild, the discovery highlights potential risks to confidentiality, integrity, and availability for users of Safari. The vulnerabilities have not yet been assigned CVEs or patches, and technical details remain limited. European organizations relying on Safari for web access could face targeted attacks exploiting these flaws, especially in sectors with high-value data. Mitigation requires close monitoring of Apple security advisories and rapid deployment of patches once available. Countries with significant Apple user bases and strategic technology sectors are at higher risk. The threat is assessed as high severity due to the critical nature of WebKit in web browsing, the potential for remote code execution, and the lack of current mitigations. Defenders should prioritize vulnerability management and consider temporary mitigations such as limiting Safari use or sandboxing until patches are released.

News#infosecnews#redditGermany+9

Ernst & Young (EY) inadvertently exposed a 4TB SQL Server backup publicly on Microsoft Azure, potentially allowing unauthorized access to sensitive corporate data. This exposure represents a significant data breach risk due to the volume and nature of the data involved. Although no known exploits are reported in the wild, the publicly accessible backup could be downloaded or accessed by malicious actors. The breach highlights risks associated with cloud misconfigurations, especially in large enterprises handling sensitive financial and client information. European organizations, particularly those with strong business ties or data exchanges with EY, could face indirect risks such as data leakage or reputational damage. Immediate mitigation involves securing cloud storage permissions, auditing access controls, and verifying no unauthorized data exfiltration occurred. Countries with high EY presence and advanced cloud adoption, such as the UK, Germany, and France, are most likely to be affected. Given the scale and sensitivity of the data, ease of access, and potential confidentiality impact, the suggested severity is high. Defenders should prioritize cloud security hygiene and continuous monitoring to prevent similar incidents.

Breach#infosecnews#redditGermany+5

A significant data breach involving Ernst & Young's (EY) cloud environment resulted in a public exposure of a 4TB SQL Server backup. The leak was disclosed via a Neo Security Labs blog and discussed minimally on Reddit's NetSec subreddit. The exposed data volume suggests a large-scale compromise potentially containing sensitive corporate and client information. Although no known exploits are currently in the wild, the breach poses a medium severity risk due to the potential confidentiality impact and the scale of data involved. European organizations, especially those with close business ties or shared cloud infrastructure with EY, may face indirect risks from this exposure. Mitigation requires immediate audit of cloud storage permissions, encryption of backups, and enhanced monitoring for unauthorized access. Countries with significant EY presence and financial sectors, such as the UK, Germany, France, and the Netherlands, are most likely to be affected. Given the nature of the breach—large data exposure without active exploitation—the suggested severity is medium. Defenders should prioritize verifying their own cloud security postures and reviewing third-party data handling agreements.

Breach#netsec#redditGermany+6

GhostCall and GhostHire are two distinct but related cyber-espionage campaigns conducted by the BlueNoroff APT group, a Lazarus subgroup, targeting executives and developers in the cryptocurrency industry. GhostCall focuses on social engineering attacks against executives, primarily on macOS, using fake investor personas and spoofed video calls to lure victims to malicious sites that prompt malware installation. GhostHire targets blockchain developers by offering fake job opportunities and delivering malware through test tasks distributed via Telegram and GitHub. Both campaigns aim to infect victims' computers to steal cryptocurrency, credentials, and sensitive corporate secrets. The attacks leverage sophisticated social engineering and custom malware, with a shared command-and-control infrastructure. There are no known public exploits, but the campaigns demonstrate targeted, well-prepared operations. European organizations in the crypto and blockchain sectors, especially those with macOS-using executives and developers, face significant risk. Mitigation requires tailored security awareness training, advanced endpoint protection, and strict controls on software installation and external communications. Given the targeted nature, potential financial theft, and infection vectors, the threat severity is assessed as high.

CampaignGermanyFrance+5

The SideWinder threat actor group has adopted a new attack chain leveraging Microsoft's ClickOnce deployment technology to target South Asian diplomats. This campaign uses ClickOnce to deliver malicious payloads, exploiting trust in legitimate Microsoft frameworks to bypass security controls. The attacks are highly targeted, focusing on diplomatic personnel, which suggests espionage motives. Although no known exploits are currently reported in the wild, the campaign's sophistication and targeting elevate its risk. European organizations with diplomatic ties or South Asian connections could face indirect risks, especially if involved in related geopolitical activities. Mitigation requires strict control over ClickOnce application execution, enhanced email filtering, and user awareness training focused on this attack vector. Countries with significant diplomatic engagement with South Asia or hosting South Asian diplomatic missions are more likely to be affected. Given the high impact on confidentiality and the ease of exploitation via social engineering, the suggested severity is high.

Campaign#infosecnews#redditGermany+7

BlueNoroff is a financially motivated threat actor conducting sophisticated campaigns named GhostCall and GhostHire targeting macOS, Windows, and Linux systems. GhostCall focuses on tech executives and venture capitalists via fake Zoom-like meetings, while GhostHire targets Web3 developers through fraudulent recruitment processes. These campaigns deploy multi-stage malware including ZoomClutch, DownTroy, CosmicDoor, RooTroy, and SilentSiphon, leveraging social engineering and AI-generated images. The attacks aim beyond cryptocurrency theft, focusing on comprehensive data acquisition to enable supply chain attacks and exploit trust relationships. The threat involves complex malware chains and advanced persistence techniques, affecting high-value targets in the tech and crypto sectors. Exploitation requires user interaction but no prior authentication, increasing risk. The campaigns pose a medium severity threat with significant potential impact on confidentiality and integrity. European organizations involved in technology, venture capital, and blockchain development are particularly at risk, especially in countries with strong tech ecosystems. Mitigation requires targeted user awareness, enhanced endpoint detection, and strict verification of recruitment and meeting invitations.

Malware#zoomclutch#rootroyFrance+10

Comparing WhatsApp, Discord, Snapchat, Facebook Messenger, and Telegram, based on their privacy settings and the amount of data they collect.

AnalysisGermanyFrance+10

Community score -1

Over the past two months, my outlook account has been receiving phishing email regarding cloud storage payments, mostly in French and some English with the usual warning such as the account is about to be locked, space is full, loss of data, refused payment, expired payment method, etc.

PhishingFranceBelgium+3

Agenda ransomware group, also known as Qilin, has been deploying a Linux-based ransomware binary on Windows hosts using legitimate remote management and file transfer tools. This cross-platform execution technique bypasses Windows-centric detections and security solutions. The attack chain includes the use of BYOVD for defense evasion, deployment of multiple SOCKS proxy instances for C&C traffic obfuscation, and targeted theft of backup credentials. Agenda has affected 591 victims across 58 countries since January 2025, primarily targeting organizations in developed markets and high-value industries. The group's sophisticated approach combines legitimate tools, cross-platform execution, and strategic targeting of backup infrastructure, making detection significantly more challenging for organizations.

Malware#ransomware#coroxyGermany+9

Canada has imposed a $176 million fine on Cryptomus, a cryptocurrency platform identified as being friendly to cybercrime activities. This enforcement action highlights regulatory efforts to curb platforms that facilitate illicit financial transactions and cybercrime. While no direct technical vulnerability or exploit is reported, the fine underscores the risks associated with using or interacting with such platforms. European organizations involved in cryptocurrency transactions or compliance may face indirect impacts, including increased scrutiny and regulatory pressure. The threat is primarily regulatory and reputational rather than a direct cyberattack. Mitigation involves enhanced due diligence, compliance with anti-money laundering (AML) regulations, and avoiding engagement with platforms linked to cybercrime. Countries with significant cryptocurrency markets and regulatory frameworks, such as Germany, the UK, and the Netherlands, are most likely to be affected. Given the nature of the threat as regulatory enforcement rather than a technical exploit, the severity is assessed as medium. Defenders should focus on compliance and risk management related to cryptocurrency platforms rather than technical defenses against an exploit.

News#infosecnews#redditGermany+4

A fake Nethereum NuGet package was published using homoglyph characters to impersonate the legitimate package, aiming to steal cryptocurrency wallet keys from developers who inadvertently install it. This supply chain attack leverages the similarity of characters in package names to deceive users into downloading malicious code. The threat is categorized as phishing due to the deceptive nature of the package naming and distribution. Although no known exploits in the wild have been reported yet, the potential for significant financial loss is high given the theft of crypto wallet keys. European organizations involved in blockchain development or using Nethereum libraries are at risk, especially those in countries with active crypto markets and development communities. Mitigation requires vigilance in verifying package authenticity, use of package signing, and dependency monitoring tools. Countries like Germany, the UK, France, and the Netherlands are likely most affected due to their strong blockchain ecosystems and developer presence. The threat severity is assessed as high due to the direct impact on confidentiality and financial assets, ease of exploitation via developer error, and the broad scope of affected systems using the NuGet ecosystem. Defenders should prioritize supply chain security and developer education to prevent such attacks.

Phishing#infosecnews#redditGermany+5

Real-time audio deepfakes have emerged as a new security threat, enabling attackers to impersonate voices convincingly during live interactions. This technology can be exploited in vishing (voice phishing) attacks to deceive individuals or organizations into divulging sensitive information or authorizing fraudulent transactions. Although no known exploits are currently reported in the wild, the medium severity rating reflects the potential risks associated with this capability. European organizations, especially those relying heavily on voice-based authentication or customer service, face increased risks of social engineering attacks. Mitigation requires a combination of technical controls, employee training, and verification protocols to detect and prevent deepfake audio misuse. Countries with advanced financial sectors and high adoption of voice technologies, such as the UK, Germany, and France, are more likely to be targeted. Given the ease of generating convincing audio deepfakes and the broad scope of potential victims, this threat is assessed as high severity. Defenders should prioritize awareness, multi-factor authentication, and anomaly detection to reduce exposure.

News#infosecnews#redditGermany+5