WaterPlum, a North Korean-associated attack group, has been using a new malware called OtterCandy in their ClickFake Interview campaign. OtterCandy, implemented in Node.js, combines features of RATatouille and OtterCookie. It targets Windows, macOS, and Linux systems, stealing browser credentials, cryptocurrency wallets, and confidential files. The malware communicates with C2 servers via Socket.IO and has persistence mechanisms. An August 2025 update (v2) enhanced user identification, expanded theft targets, and added trace deletion capabilities. OtterCandy's evolution and its use in ongoing campaigns highlight the need for continued vigilance against WaterPlum's activities.
Sotheby's has disclosed a data breach impacting personal information, including SSNs. The post Hackers Steal Sensitive Data From Auction House Sotheby’s appeared first on SecurityWeek .
Sotheby’s, a major auction house, suffered a data breach that exposed customer financial information. The breach was publicly disclosed in October 2025 and reported by credible sources including BleepingComputer and Reddit InfoSec News. Although detailed technical specifics of the breach are not provided, the exposure of financial data indicates a significant compromise of sensitive customer information. No known exploits are currently active in the wild, and the discussion level in public forums remains minimal. The breach poses a high risk to affected individuals and organizations due to potential financial fraud, identity theft, and reputational damage. European organizations connected to Sotheby’s or using similar systems may face indirect impacts, especially those involved in luxury goods, auctions, or financial services. Mitigation should focus on enhanced monitoring, customer notification, and strengthening data protection controls. Countries with strong luxury markets and high Sotheby’s client presence, such as the UK, France, Germany, Italy, and Switzerland, are likely to be most affected. Given the sensitivity of the data and the breach context, the severity is assessed as high.
UNC5142, a financially motivated threat actor, has been tracked since late 2023 for abusing blockchain technology to distribute infostealers. The group exploits vulnerable WordPress sites and employs the 'EtherHiding' technique to obscure malicious code on the BNB Smart Chain. Their infection chain involves a multistage JavaScript downloader called CLEARSHORT, compromised WordPress sites, and smart contracts. UNC5142 has evolved its tactics, using a three-level smart contract system for dynamic payload delivery and abusing legitimate services like Cloudflare Pages. The group has distributed various infostealers, including ATOMIC, VIDAR, LUMMAC.V2, and RADTHIEF. Their operations have impacted multiple industries and geographic regions, with approximately 14,000 compromised web pages identified as of June 2025.
North Korean threat actor UNC5342 employs a novel malware delivery technique called 'EtherHiding,' embedding malicious code within smart contracts on public blockchains to create resilient command-and-control infrastructure. The attack chain begins with social engineering, targeting cryptocurrency and technology sector developers via fake recruitment schemes. Loader scripts are injected to fetch payloads from multiple blockchains and API services, complicating detection and mitigation. The malware suite includes JADESNOW, BEAVERTAIL, and INVISIBLEFERRET, which enable data theft and remote control of infected systems. This approach leverages the decentralized and immutable nature of blockchains to evade takedown efforts. The campaign primarily facilitates cryptocurrency theft and espionage. Exploitation does not require prior authentication but relies on user interaction through social engineering. The threat is medium severity but poses significant challenges due to its innovative use of blockchain technology for malware command and control.
The tech giant attributed the attacks to Vanilla Tempest, also known as Vice Spider and Vice Society. The post Microsoft Revokes Over 200 Certificates to Disrupt Ransomware Campaign appeared first on SecurityWeek .
A sophisticated cyber campaign targeting Chinese individuals in the FinTech, cryptocurrency exchange, and trading platform sectors has been uncovered. The operation uses spear-phishing emails with malicious .LNK files embedded in fake resumes. When executed, these files initiate a multi-stage infection process, ultimately deploying ValleyRAT malware. The malware establishes persistence through scheduled tasks, performs system reconnaissance, and exfiltrates sensitive data. The campaign's infrastructure is primarily hosted in Hong Kong, with multiple domains using the .work TLD to impersonate job portals. The attackers employ various techniques to evade detection, including anti-VM checks and attempts to disable antivirus software.
In an indictment, federal prosecutors charged Prince Holding Group chairman Chen Zhi with wire fraud conspiracy and money laundering conspiracy. The post US Charges Cambodian Executive in Massive Crypto Scam and Seizes More Than $14 Billion in Bitcoin appeared first on SecurityWeek .
US authorities have seized $15 billion in cryptocurrency linked to a major 'pig butchering' scam kingpin. 'Pig butchering' scams involve elaborate social engineering to defraud victims of large sums of money, often via crypto investments. While this event represents a significant law enforcement success, it does not describe a new vulnerability or active exploit targeting organizations. There is no direct technical threat or exploit vector detailed that would impact European organizations' systems. The seizure highlights the ongoing risks of crypto-related fraud but does not constitute a cybersecurity vulnerability or threat to infrastructure. European entities should remain vigilant against social engineering and crypto fraud but no immediate technical mitigation is required from this news. The event is primarily a law enforcement and financial crime development rather than a technical security threat. Given the lack of technical exploit details, the severity of this news as a threat is low. European countries with high crypto adoption and financial sectors may be indirectly impacted by related fraud schemes but not by this seizure event itself.
SonicWall has disclosed that hackers breached all of its firewall backup systems, potentially exposing sensitive firewall configurations and related data. This breach could allow attackers to analyze backup data to identify vulnerabilities or gain unauthorized access to networks protected by SonicWall firewalls. Although no known exploits are currently reported in the wild, the compromise of backup data represents a significant risk to confidentiality and network integrity. European organizations using SonicWall firewalls may face increased risk of targeted attacks or lateral movement within their networks. Immediate mitigation involves verifying backup integrity, rotating credentials, and enhancing monitoring for suspicious activity. Countries with high SonicWall market penetration and critical infrastructure reliance on these firewalls are at greater risk. Given the breach scope and potential impact, the severity is assessed as high. Defenders should prioritize incident response, forensic analysis, and communication with SonicWall for remediation updates.
A recent security news report reveals that all SonicWall Cloud Backup users have their firewall configuration files stored in a manner that may expose sensitive information. This exposure could potentially allow unauthorized access to firewall settings, leading to risks such as network compromise or data leakage. Although no known exploits are currently active in the wild, the high severity rating indicates significant potential impact. The threat primarily affects organizations using SonicWall Cloud Backup services, which are widely deployed in Europe. Attackers gaining access to these configuration files could manipulate firewall rules, bypass security controls, or extract confidential network topology information. Immediate attention is required to assess and secure backup storage configurations. European organizations, especially those in countries with high SonicWall adoption and critical infrastructure, should prioritize mitigation steps. No CVSS score is available, but the threat is assessed as high severity due to the sensitivity of the data and potential for exploitation without user interaction or authentication. Defenders should review backup storage policies, enforce strict access controls, and monitor for unusual access patterns to mitigate this risk.
Chaos-C++ is a newly identified ransomware strain targeting Windows systems that combines destructive data wiping with cryptocurrency theft. It operates by encrypting or wiping user data, rendering systems unusable, while simultaneously stealing crypto assets from victims. Although no known exploits are currently reported in the wild, the malware’s dual destructive and theft capabilities pose a significant risk. The ransomware’s medium severity rating reflects its potential to disrupt operations and cause financial loss, especially to organizations handling cryptocurrency. European organizations with Windows infrastructure and crypto holdings should be vigilant. Mitigation requires advanced endpoint protection, network segmentation, and crypto wallet security measures. Countries with high Windows usage and active crypto markets, such as Germany, the UK, and the Netherlands, are likely more at risk. Given the lack of detailed technical indicators and minimal discussion, ongoing monitoring and threat intelligence updates are critical. The threat’s combination of data destruction and asset theft elevates its impact beyond typical ransomware. Immediate defensive actions should focus on preventing initial infection and securing crypto assets.
In early September, hackers stole the firewall configuration backup files stored using the MySonicWall service. The post All SonicWall Cloud Backup Users Had Firewall Configurations Stolen appeared first on SecurityWeek .
Active Directory (AD) domain join accounts, commonly used during system build processes, are frequently exposed and inherit over-privileged access control lists (ACLs). These excessive permissions enable attackers to exploit Local Administrator Password Solution (LAPS) disclosures, Resource-Based Constrained Delegation (RBCD), and other high-impact attacks. Even with Microsoft's recommended mitigations, residual risks remain due to replication lag and Active Directory Certificate Services (AD CS) interactions that can allow recovery of pre-reset machine secrets. Hardening requires layered controls including restricting machine account creation to privileged users, ensuring Domain Admins own computer objects, and applying deny Access Control Entries (ACEs) for sensitive attributes like ms-Mcs-AdmPwd and msDS-AllowedToActOnBehalfOfOtherIdentity. The threat is high severity due to the potential for privilege escalation and lateral movement within AD environments. Detection and mitigation require careful monitoring and tailored ACL configurations. European organizations relying heavily on AD infrastructure are at risk, especially those with complex domain join automation and build pipelines. Countries with large enterprise sectors and advanced IT infrastructure such as Germany, France, the UK, and the Netherlands are likely most affected. The threat is rated high severity due to the broad impact on confidentiality, integrity, and availability, ease of exploitation via exposed accounts, and the critical role of AD in enterprise security.
Over the course of three months, Volexity observed UTA0388 using various themes and fictional identities across dozens of spear phishing campaigns. As time passed, Volexity observed UTA0388 broaden their targeting and send emails in a variety of different languages, including English, Chinese, Japanese, French, and German. In most cases, the initial email sent by UTA0388 contained a link to phishing content hosted on a cloud-based service that would lead to malware.
The hackers are believed to have stolen over $6 billion for the Pyongyang regime, financing its military programs. The post North Korean Hackers Have Stolen $2 Billion in Cryptocurrency in 2025 appeared first on SecurityWeek .
North Korean state-sponsored hackers have reportedly stolen over $2 billion in cryptocurrency in 2025, marking a significant escalation in financially motivated cybercrime linked to nation-state actors. These attacks primarily target cryptocurrency exchanges, wallets, and blockchain infrastructure globally, leveraging sophisticated techniques such as phishing, malware, and exploitation of vulnerabilities in DeFi platforms. European organizations involved in cryptocurrency trading, blockchain development, or custodial services face heightened risks of financial loss, reputational damage, and regulatory scrutiny. The threat underscores the increasing use of cybercrime by nation-states to circumvent economic sanctions and fund illicit activities. Mitigation requires enhanced threat intelligence sharing, multi-layered security controls tailored to blockchain environments, and rigorous transaction monitoring. Countries with advanced fintech sectors and high cryptocurrency adoption, such as Germany, the United Kingdom, and the Netherlands, are particularly vulnerable. Given the scale, complexity, and state sponsorship, the severity of this threat is assessed as critical. Defenders must prioritize securing crypto assets, improving incident response capabilities, and collaborating internationally to disrupt these financially motivated campaigns.
Allianz Life says July data breach impacts 1.5 million people
Source: https://www.bleepingcomputer.com/news/security/allianz-life-says-july-data-breach-impacts-15-million-people/
