The botnet’s propagation is fueled by the AI-generated server deployments that use weak credentials, and legacy web stacks. The post GoBruteforcer Botnet Targeting Crypto, Blockchain Projects appeared first on SecurityWeek .
The law firm Fried Frank seems to be informing high-profile clients about a recent data security incident. The post After Goldman, JPMorgan Discloses Law Firm Data Breach appeared first on SecurityWeek .
AI will assist companies in finding their external attack surface, but it will also assist bad actors in locating and attacking the weak points. The post Cyber Insights 2026: External Attack Surface Management appeared first on SecurityWeek .
CVE-2025-58409 is a vulnerability in Imagination Technologies Graphics DDK that allows non-privileged software to misuse GPU system calls to write to arbitrary physical memory. This improper restriction of operations within GPU memory buffers (CWE-119) can corrupt kernel and driver memory pages, potentially altering system behavior. The vulnerability affects multiple versions of the Graphics DDK and does not require user interaction or privileges to exploit. Although the CVSS score is low (3.5), the ability to write to arbitrary physical memory poses risks to system integrity. No known exploits are currently in the wild, and no patches have been released yet. European organizations using affected GPU drivers in embedded or specialized systems may be at risk. Mitigation involves restricting access to GPU interfaces, monitoring GPU driver updates, and applying vendor patches once available. Countries with significant embedded systems manufacturing and technology sectors, such as Germany, France, and the UK, are more likely to be impacted.
CVE-2025-59922 is a medium-severity SQL Injection vulnerability affecting multiple versions of Fortinet FortiClientEMS. It allows an authenticated attacker with at least read-only admin permissions to execute unauthorized SQL commands via crafted HTTP/HTTPS requests. Exploitation can lead to full compromise of confidentiality, integrity, and availability of the affected system. No user interaction is required, but authentication with elevated privileges is necessary. There are no known exploits in the wild yet, and no patches have been linked at the time of publication. European organizations using FortiClientEMS for endpoint management are at risk, especially in countries with high Fortinet market penetration. Mitigation requires strict access control, monitoring for unusual SQL activity, and prompt application of vendor patches once available. The vulnerability’s CVSS score is 6.8, reflecting significant impact but requiring authenticated access. Countries like Germany, France, the UK, and the Netherlands are likely most affected due to their extensive use of Fortinet products and critical infrastructure reliance on endpoint security management.
This analysis examines a multi-stage Windows malware campaign called SHADOW#REACTOR. The infection chain uses obfuscated VBS, PowerShell downloaders, and text-based payloads to deliver a Remcos RAT backdoor. Key features include fragmented text staging, .NET Reactor protection, reflective loading, and MSBuild abuse as a living-off-the-land binary. The campaign leverages complex obfuscation and in-memory execution to evade detection while establishing persistent remote access. Defensive recommendations focus on script execution monitoring, LOLBin abuse detection, and enhanced PowerShell logging to counter the sophisticated evasion techniques employed.
VoidLink is an advanced malware framework designed for Linux systems, focusing on cloud and container environments. It includes custom loaders, implants, rootkits, and modular plugins for long-term access. The framework employs a flexible architecture with a Plugin API inspired by Cobalt Strike. VoidLink uses multiple security mechanisms, including runtime code encryption and adaptive behavior based on the detected environment. Developed by Chinese-affiliated developers, it demonstrates high technical expertise across multiple programming languages. The framework includes cloud-focused capabilities, credential harvesting, and various command-and-control channels. While its intended use remains unclear, VoidLink appears to be positioned for potential commercial use.
The 44-year-old individual planted remote access malware on a logistics firm’s systems, with help from employees. The post Dutch Port Hacker Sentenced to Prison appeared first on SecurityWeek .
Hackers stole complete customer information, including contact details, national identity numbers, and payment details. The post Spanish Energy Company Endesa Hacked appeared first on SecurityWeek .
According to the World Economic Forum's Global Cybersecurity Outlook 2026 report, cyber fraud has surpassed ransomware as the top concern for CEOs, while ransomware remains the primary worry for CISOs. This shift highlights evolving threat landscapes where financial deception and fraud schemes increasingly threaten organizational leadership. Although no specific vulnerability or exploit details are provided, the medium severity rating reflects the significant but indirect risk posed by cyber fraud activities. European organizations face heightened risks due to their economic stature and digital integration, necessitating tailored fraud detection and prevention strategies. Mitigation requires advanced fraud analytics, employee training focused on social engineering, and enhanced transactional monitoring beyond traditional ransomware defenses. Countries with large financial sectors and digital economies, such as the UK, Germany, France, and the Netherlands, are particularly susceptible. Given the broad impact potential and the complexity of fraud schemes, the suggested severity is medium. Defenders should prioritize adaptive fraud risk management alongside ransomware preparedness to address this emerging CEO-level concern effectively.
Key takeaways VoidLink – a Cloud-First Malware Framework In December 2025, Check Point Research identified a small cluster of previously unseen Linux malware samples that appear to originate from a Chinese-affiliated development environment. Many of the binaries included debug symbols and other development artifacts, suggesting we were looking at in-progress builds rather than a finished, […] The post Unveiling VoidLink – A Stealthy, Cloud-Native Linux Malware Framework appeared first on Check Point Research .
Threat actors exploited Cloudflare's free-tier infrastructure and Python environments to deploy AsyncRAT, demonstrating advanced evasion techniques. The attack begins with phishing emails containing Dropbox links to malicious files. It uses legitimate Python downloads and sophisticated code injection targeting explorer.exe. The campaign ensures persistence through multiple vectors, including startup folder scripts and WebDAV mounting. It abuses trusted infrastructure like Cloudflare to mask activities and evade detection. The attackers employ social engineering tactics, such as displaying legitimate PDF documents, to reduce suspicion. This campaign highlights the trend of abusing cloud services for malware delivery and execution, emphasizing the need for multi-layered security approaches.
In 2025, AI did not revolutionize cyber attacks as predicted. Instead, adversaries used AI to accelerate traditional tradecraft, focusing on speed and accessibility rather than new offensive capabilities. The article examines several case studies showcasing AI-generated scripts for credential theft and browser exploitation. These attacks, while faster and more accessible to less-skilled operators, still rely on familiar techniques detectable by basic security measures. The outlook for 2026 suggests continued AI-driven commoditization of tradecraft, with more templated attacks and improved phishing attempts. However, fundamental security practices remain effective against these evolving threats.
APT28 was seen impersonating popular webmail and VPN services, including Microsoft OWA, Google, and Sophos VPN portals. The post Russia’s APT28 Targeting Energy Research, Defense Collaboration Entities appeared first on SecurityWeek .
Threat actors are hunting for misconfigured proxy servers to gain access to APIs for various LLMs. The post LLMs in Attacker Crosshairs, Warns Threat Intel Firm appeared first on SecurityWeek .
For the latest discoveries in cyber research for the week of 12th January, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Manage My Health, New Zealand’s largest patient portal, has acknowledged a cyberattack occurred on December 2025, that potentially exposed data of nearly 110K users. An alleged attacker, dubbed Kazu, claimed responsibility and […] The post 12th January – Threat Intelligence Report appeared first on Check Point Research .
CVE-2026-0854 is a high-severity OS command injection vulnerability affecting Merit LILIN DH032 DVR/NVR devices. It allows authenticated remote attackers to inject and execute arbitrary operating system commands on the device without user interaction. The vulnerability stems from improper neutralization of special elements in OS commands (CWE-78). Exploitation requires authentication but no user interaction, and the attack vector is network-based. Although no known exploits are currently reported in the wild, the vulnerability poses a significant risk to device integrity and confidentiality. The affected devices are commonly used in video surveillance systems, which are critical infrastructure components in many European organizations. Mitigation requires applying vendor patches once available and implementing network segmentation and strict access controls. Countries with high adoption of Merit LILIN products and critical surveillance infrastructure, such as Germany, France, Italy, and the UK, are most likely to be impacted. Due to the high CVSS score of 8.7, this vulnerability demands urgent attention from security teams managing these devices.
CVE-2025-69275 is a high-severity vulnerability in Broadcom DX NetOps Spectrum (version 24.3.9 and earlier) caused by a dependency on a vulnerable third-party component leading to DOM-based Cross-Site Scripting (XSS). The flaw allows an attacker to execute malicious scripts in the context of the affected application without requiring user interaction or authentication, though exploitation complexity is high. This vulnerability impacts confidentiality and integrity by potentially exposing sensitive data or enabling unauthorized actions within the management platform. European organizations using DX NetOps Spectrum for network monitoring and management are at risk, especially those in critical infrastructure sectors. No known exploits are currently in the wild, but the vulnerability’s presence in widely deployed network operations software necessitates prompt mitigation. Mitigation involves updating to a patched version once available, applying strict input validation and content security policies, and monitoring network traffic for suspicious activity. Countries with significant Broadcom DX NetOps Spectrum deployments and critical infrastructure reliance, such as Germany, France, the UK, and the Netherlands, are most likely to be affected. Given the CVSS 4.
