The 'Game of Emperor' report details a persistent cyber intrusion campaign by the threat actor 'Earth Estries' targeting sectors such as consulting, managed service providers, NGOs, and telecoms. The campaign affects multiple countries primarily outside Europe, including Afghanistan, Brazil, India, Indonesia, Malaysia, Pakistan, Philippines, South Africa, Taiwan, Thailand, USA, and Vietnam. There are no known exploits or patches associated with this threat. The campaign is ongoing but assessed as medium severity due to its persistence and potential indirect risks to European organizations through global supply chains.
Earth Lusca, a threat actor linked to China, is reported to use the KTLVdoor backdoor for multiplatform intrusion. This backdoor enables persistent access across different operating systems, facilitating espionage or data exfiltration. Although no known exploits in the wild or patches are currently available, the threat actor's activity indicates targeted payload delivery. The severity is assessed as low based on current information, but the lack of patches and the multiplatform nature warrant attention. European organizations should be aware of potential indirect risks, especially those with ties to Chinese entities or operating in sensitive sectors. Mitigation should focus on enhanced monitoring for unusual backdoor activity and network segmentation. Countries with significant Chinese business presence or geopolitical interest in China-related cyber activities are more likely to be affected. Overall, defenders should prioritize threat intelligence integration and proactive detection mechanisms to mitigate potential future exploitation.
A phishing campaign is actively targeting services associated with Luxembourg, leveraging fake websites hosted and served from AWS infrastructure. This threat uses highly convincing psychological techniques to deceive users into divulging sensitive information. Although no specific vulnerable software versions are identified and no patches are available, the attack exploits social engineering rather than technical vulnerabilities. The campaign is categorized under MITRE ATT&CK pattern T1566 and is ongoing with no known exploits in the wild beyond phishing attempts. European organizations, especially those with ties to Luxembourg or using AWS-hosted services, face risks of credential theft and potential subsequent compromise. Mitigation requires targeted user awareness, email filtering, and monitoring of AWS-hosted domains mimicking legitimate Luxembourg services. Luxembourg is the primary affected country, but neighboring countries with close economic or governmental ties may also be at risk. Given the ease of exploitation and potential impact on confidentiality, the threat severity is assessed as medium. Defenders should prioritize detection and user education to reduce the success of these phishing attempts.
MoustachedBouncer is an espionage campaign targeting foreign diplomats in Belarus. The activity involves intelligence gathering against diplomatic personnel, as identified by open-source intelligence (OSINT) sources. There are no specific technical details, affected software versions, or known exploits associated with this campaign. The threat is assessed as high severity due to its espionage nature and targeted geopolitical focus.
The Hagga threat actor is suspected of abusing the FSociety framework for payload delivery, though details remain unclear and the certainty of this information is moderate (50%). There is no confirmed exploit or patch available, and the threat type is currently classified as unknown. The FSociety framework is known as an open-source penetration testing tool that can be repurposed by malicious actors for payload delivery. The medium severity rating reflects potential risks associated with payload delivery frameworks being leveraged by threat actors. European organizations should be vigilant, especially those in sectors commonly targeted by such actors. Mitigation requires enhanced monitoring for unusual use of penetration testing tools and restricting unauthorized use of frameworks like FSociety. Countries with higher adoption of penetration testing tools and significant critical infrastructure may be more at risk. Given the lack of confirmed exploits and limited technical details, the suggested severity is medium, emphasizing caution but not indicating immediate critical threat. Defenders should focus on detection and prevention of unauthorized tool usage and maintain strong endpoint security controls.
