The threat actor uses a signed driver file containing two user-mode shellcodes to execute its ToneShell backdoor. The post Chinese APT Mustang Panda Caught Using Kernel-Mode Rootkit appeared first on SecurityWeek .
Coupang, a major e-commerce platform, suffered a significant data breach affecting approximately 33.7 million victims. The company is set to distribute $1.17 billion as compensation to those impacted by the breach. Although specific technical details of the breach are not provided, the incident is classified as high severity due to the scale and sensitivity of the compromised data. No known exploits are currently active in the wild, and the breach was reported through a trusted cybersecurity news source. European organizations may face indirect impacts, especially if they have business relationships or data exchanges with Coupang or its ecosystem. Mitigation focuses on monitoring for potential secondary attacks leveraging leaked data, enhancing data protection measures, and ensuring robust incident response plans. Countries with strong e-commerce ties to South Korea and significant digital trade volumes, such as Germany, the UK, and France, are more likely to be affected. Given the breach's scale and potential for identity theft or fraud, the suggested severity is high.
Mustang Panda, a known threat actor, has deployed a signed kernel-mode rootkit to stealthily load the TONESHELL backdoor on targeted systems. This advanced malware leverages a legitimate digital signature to evade detection and gain deep system privileges, enabling persistent and covert access. The rootkit operates at the kernel level, allowing it to manipulate core OS functions and hide its presence effectively. Although no known exploits are currently observed in the wild, the sophistication and stealth capabilities of this threat pose a significant risk. European organizations, especially those in critical infrastructure and government sectors, could face severe confidentiality and integrity breaches if targeted. Mitigation requires advanced endpoint detection, strict driver signature enforcement, and continuous monitoring for anomalous kernel activity. Countries with high adoption of Windows systems and strategic geopolitical relevance are most likely to be affected. Given the high potential impact and complexity of exploitation, this threat is assessed as high severity. Defenders must prioritize detection of signed kernel drivers and implement layered security controls to prevent unauthorized kernel-level code execution.
Roughly 30,000 Korean Air employees had their data stolen by hackers in a breach at former subsidiary KC&D. The post Korean Air Data Compromised in Oracle EBS Hack appeared first on SecurityWeek .
A hacker involved in distributing the KMSAuto malware campaign, which amassed approximately 2.8 million downloads, has been arrested. KMSAuto is a known malware family often disguised as software activation tools, commonly used to illegally activate Microsoft products. The campaign's large scale indicates widespread infection potential, posing risks to confidentiality and system integrity. Although no specific affected versions or exploits in the wild are detailed, the malware's presence on millions of systems suggests significant impact. European organizations are at risk due to the popularity of Microsoft products and the prevalence of software piracy tools like KMSAuto. Mitigation requires targeted detection of KMSAuto variants, user education against unauthorized activation tools, and robust endpoint protection. Countries with high Microsoft usage and historical malware infection rates, such as Germany, France, the UK, Italy, and Spain, are most likely affected. Given the malware's broad reach, ease of distribution, and potential for persistent compromise, the threat severity is assessed as high. Defenders should focus on proactive monitoring, incident response readiness, and user awareness to reduce infection vectors.
A new phishing campaign impersonating Google has targeted over 3,000 organizations worldwide, aiming to deceive users into divulging sensitive credentials or installing malware. The campaign leverages Google-themed lures to increase credibility and success rates. Although no specific technical details or exploits are disclosed, the widespread scale and use of a trusted brand make this a significant threat. The phishing wave primarily threatens confidentiality by harvesting login credentials and potentially enabling further network compromise. European organizations, especially those with heavy reliance on Google services, are at risk. Mitigation requires targeted user awareness training, enhanced email filtering tuned to detect Google-themed phishing, and multi-factor authentication enforcement. Countries with large technology sectors and high Google Workspace adoption, such as Germany, France, and the UK, are most likely to be affected. Given the medium severity rating and the nature of phishing attacks, the threat is moderately easy to exploit but requires user interaction. Defenders should prioritize detection and response capabilities for phishing attempts mimicking trusted brands like Google.
A former Coinbase support agent was arrested for assisting hackers in compromising user accounts. This insider threat highlights risks associated with privileged access abuse within cryptocurrency platforms. Although no specific technical exploit details or affected software versions are provided, the incident underscores the potential for social engineering and insider collusion to facilitate unauthorized access. European organizations involved in cryptocurrency trading or custodial services could face similar insider risks. Mitigation requires stringent internal controls, enhanced monitoring of privileged users, and robust verification processes for support interactions. Countries with significant cryptocurrency adoption and financial sectors, such as Germany, the UK, and the Netherlands, are most likely to be impacted. The threat severity is assessed as high due to the potential for significant financial loss and reputational damage, ease of exploitation via insider access, and the broad impact on user trust. Defenders should prioritize insider threat programs and continuous behavioral analytics to detect anomalous support agent activities.
The OWASP Agentic AI Top 10 highlights the most critical security risks associated with agentic AI systems, reflecting real-world attack scenarios. These attacks exploit vulnerabilities in AI agents that operate autonomously or semi-autonomously, potentially leading to unauthorized actions, data breaches, or manipulation of AI behavior. Although no specific CVEs or exploits are currently documented in the wild, the high severity rating underscores the significant risk posed by these emerging threats. European organizations leveraging agentic AI technologies must be vigilant, as these systems can impact confidentiality, integrity, and availability of critical services. Mitigations require tailored security controls focusing on AI model governance, input validation, and monitoring of AI decision-making processes. Countries with advanced AI adoption and critical infrastructure integration, such as Germany, France, and the UK, are more likely to be affected. Given the complexity and novelty of agentic AI threats, the suggested severity is high, reflecting the potential for substantial operational and reputational damage if exploited. Defenders should prioritize understanding these AI-specific risks and implement robust AI security frameworks to mitigate emerging attack vectors.
A recent high-severity crypto theft campaign targeted Trust Wallet users, resulting in the draining of 2,596 wallets and a loss of approximately $7 million. The attack exploited vulnerabilities or weaknesses related to Trust Wallet, a widely used cryptocurrency wallet application. While specific technical details of the exploit are not disclosed, the campaign demonstrates significant financial impact and risk to users' digital assets. European organizations and individuals using Trust Wallet or related services are at risk of financial loss and reputational damage. The attack does not require user interaction beyond wallet usage, and the compromised wallets indicate a breach of confidentiality and integrity of user assets. Mitigation requires immediate wallet security hygiene, including private key management, use of hardware wallets, and vigilance against phishing or malicious apps. Countries with higher cryptocurrency adoption and Trust Wallet user bases, such as Germany, the UK, France, and the Netherlands, are more likely to be affected. Given the financial impact, ease of exploitation, and scope, the threat severity is assessed as high. Defenders should prioritize securing wallet credentials, monitoring for suspicious transactions, and educating users on safe crypto practices.
A persistent nine-month RondoDoX botnet campaign has been targeting IoT devices and web applications. The threat actors have recently shifted to weaponizing a critical Next.js vulnerability, deploying malicious payloads like 'React2Shell' and cryptominers. The campaign, spanning from March to December 2025, shows quick adaptation to latest attack trends. The activity is divided into three phases: initial reconnaissance, web application exploitation, and IoT botnet deployment. The attackers have been using multiple command and control servers and deploying various malware variants. The campaign has intensified in December 2025 with a focus on Next.js exploitation. The impact includes widespread IoT device compromise, Next.js application risks, credential harvesting, and persistent multi-architecture threats.
It took Sax well over a year to complete its investigation after detecting hackers on its network. The post Top US Accounting Firm Sax Discloses 2024 Data Breach Impacting 220,000 appeared first on SecurityWeek .
A data breach at Korean Air has exposed personal data of thousands of its employees. The breach was reported via Reddit and covered by BleepingComputer, indicating a high-priority incident. Although technical details about the breach vector or exploited vulnerabilities are not disclosed, the exposure of employee data poses significant risks to confidentiality and privacy. There are no known exploits in the wild related to this breach, and no patches or affected software versions have been identified. European organizations, especially those with business ties or partnerships with Korean Air, may face indirect risks such as phishing or social engineering attacks leveraging leaked employee data. Mitigation should focus on monitoring for suspicious activity, enhancing employee awareness, and securing any interconnected systems. Countries with strong aviation sectors and close economic ties to South Korea, such as Germany, the UK, and France, are more likely to be affected. Given the breach involves sensitive employee data exposure without requiring user interaction for exploitation, the suggested severity is high. Defenders should prioritize incident response, data protection, and communication strategies to mitigate potential downstream impacts.
In mid-2025, a malicious driver file was discovered on Asian computer systems, signed with a compromised digital certificate. This driver injects a backdoor Trojan and protects malicious files, processes, and registry keys. The final payload is a new variant of the ToneShell backdoor, associated with the HoneyMyte APT group. The attacks, which began in February 2025, primarily target government organizations in Southeast and East Asia, especially Myanmar and Thailand. The malware uses various techniques to evade detection, including API obfuscation, process protection, and registry key protection. The ToneShell backdoor communicates with command-and-control servers using fake TLS headers and supports remote operations such as file transfer and shell access.
A critical zero-day vulnerability has been discovered in XSpeeder devices, affecting approximately 70,000 units. The vendor has reportedly ignored alerts about this flaw, leaving these devices exposed to potential exploitation. Although no known exploits are currently observed in the wild, the vulnerability's critical nature suggests it could allow attackers to compromise device confidentiality, integrity, or availability. The lack of patches or vendor response increases the risk for organizations relying on these devices. European organizations using XSpeeder devices should urgently assess their exposure and implement compensating controls. Countries with higher adoption of these devices and strategic infrastructure relying on them are at greater risk. Immediate mitigation steps include network segmentation, monitoring for unusual activity, and restricting device access. Given the critical severity and vendor inaction, proactive defense is essential to prevent potential exploitation.
The ecommerce giant will provide purchase vouchers to the 33.7 million individuals impacted by the incident. The post Coupang to Issue $1.17 Billion in Vouchers Over Data Breach appeared first on SecurityWeek .
Hackers stole names, addresses, Social Security numbers, ID numbers, and medical and health insurance information from Aflac’s systems. The post 22 Million Affected by Aflac Data Breach appeared first on SecurityWeek .
For the latest discoveries in cyber research for the week of 29th December, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Romanian Waters, the country’s national water management authority, was hit by a ransomware attack that resulted in nearly 1,000 computer systems across national and regional offices being encrypted. The attack affected geographic […] The post 29th December – Threat Intelligence Report appeared first on Check Point Research .
The ‘download’ button on the official EmEditor website served a malicious installer. The post Infostealer Malware Delivered in EmEditor Supply Chain Attack appeared first on SecurityWeek .
The Evasive Panda cyberespionage campaign employs DNS poisoning techniques to deliver the MgBot backdoor malware. This campaign manipulates DNS responses to redirect victims to malicious servers, enabling stealthy installation of the backdoor without direct user interaction. MgBot provides persistent remote access, facilitating espionage activities by exfiltrating sensitive data and potentially enabling further network compromise. Although currently assessed as medium severity, the campaign’s use of DNS poisoning increases its stealth and difficulty to detect. European organizations, especially those in critical infrastructure and government sectors, face risks due to potential data breaches and operational disruptions. Mitigation requires enhanced DNS security measures, network monitoring for anomalous DNS activity, and endpoint detection capabilities tailored to identify MgBot behaviors. Countries with significant deployments of vulnerable DNS infrastructure and high-value targets, such as Germany, France, and the UK, are most likely to be affected. The threat’s exploitation does not require user interaction, increasing its risk profile. Defenders should prioritize DNS security hardening and incident response readiness to counter this evolving espionage threat.
