Campaign threats

This report details an investigation into a North Korean infiltration operation by the Lazarus Group's Famous Chollima division. The operation aims to deploy remote IT workers in American financial and crypto/Web3 companies for corporate espionage and funding. Researchers posed as potential recruits and used sandboxed environments to monitor the operators' activities in real-time. The investigation revealed the group's tactics, including identity theft, social engineering, and the use of AI tools. The operators displayed poor operational security, sharing infrastructure and making repeated mistakes. The report provides insights into the group's recruitment methods, toolset, and communication patterns, offering a rare inside view of their operations.

Campaign#identity theft#it worker infiltrationUnited Kingdom+4

A new campaign leveraging JS#SMUGGLER techniques is distributing the NetSupport RAT malware through compromised websites targeting Windows users. The attack involves malicious JavaScript payloads that bypass traditional detection by smuggling code to deliver the remote access trojan. Once infected, systems can be remotely controlled by attackers, risking data confidentiality, integrity, and availability. This campaign is currently observed in the wild but with minimal discussion and no known exploits reported yet. European organizations using Windows systems and frequently accessing web resources are at risk, especially those in sectors targeted by RATs for espionage or disruption. Mitigation requires advanced web filtering, endpoint detection tuned for RAT behaviors, and user awareness to avoid suspicious sites. Countries with high Windows usage and strategic importance in cyber espionage are more likely to be affected. The threat severity is assessed as medium due to the complexity of exploitation and the potential impact on affected systems. Defenders should prioritize monitoring for unusual network activity and implement layered defenses against web-based malware delivery.

Campaign#infosecnews#redditGermany+6

A side-channel tracking technique leveraging WhatsApp and Signal allows an attacker to infer a target phone's device activity state (screen on/off, offline) by sending silent probe reactions to invalid message IDs and measuring delivery receipt round-trip times. This method does not generate visible notifications or messages on the victim's device, making it stealthy. Over time, attackers can profile user behavior such as when they are home, sleeping, or mobile. The attack requires the ability to send messages to the target number, which can be mitigated by restricting unknown contacts in privacy settings. Although no direct data breach occurs, this privacy-invasive tracking poses significant risks. The threat is relevant to European users given WhatsApp and Signal's widespread adoption. No known exploits in the wild exist yet, but the proof-of-concept is publicly available.

Campaign#netsec#redditGermany+9

A dual cyber campaign targets GlobalProtect VPN portals and SonicWall APIs, aiming to exploit potential weaknesses in these widely used remote access and network security products. The campaign is currently reported with medium severity and has minimal public technical details or known exploits in the wild. Attackers may be attempting to gain unauthorized access or disrupt services by leveraging vulnerabilities or misconfigurations in these platforms. European organizations using GlobalProtect or SonicWall products could face risks to confidentiality and availability if targeted. Mitigation requires focused hardening of VPN portals and API endpoints, including strict access controls, monitoring, and patch management. Countries with significant deployments of these technologies and critical infrastructure reliance, such as Germany, France, and the UK, are more likely to be affected. Given the medium severity and lack of known exploits, the threat should be taken seriously but is not currently critical. Defenders should prioritize detection and response capabilities while awaiting further technical details or patches.

Campaign#infosecnews#redditGermany+5

A new class of prompt injection attack vectors leveraging Model Context Protocol (MCP) sampling techniques has been identified. These attacks manipulate the input prompts to AI language models, causing them to execute unintended or malicious instructions. While no known exploits are currently active in the wild, the medium severity rating reflects the potential risks to confidentiality and integrity in AI-driven systems. The attack exploits weaknesses in how models process and sample context, potentially leading to unauthorized data disclosure or manipulation of AI outputs. European organizations using AI services that rely on prompt-based interactions or context sampling are at risk, especially those in sectors heavily adopting AI technologies. Mitigation requires careful input validation, context management, and monitoring of AI outputs for anomalies. Countries with advanced AI adoption and critical infrastructure integration, such as Germany, France, and the UK, are more likely to be targeted. Given the complexity and novelty of these attacks, the threat is assessed as medium severity due to the moderate impact and exploitation difficulty. Defenders should prioritize understanding MCP mechanisms and implementing strict prompt sanitization to reduce risk.

Campaign#infosecnews#redditGermany+5

CVE-2025-55182, known as React2Shell, is a critical vulnerability in React Server Components affecting React versions 19.x and Next.js versions 15.x and 16.x when using App Router. It has a maximum CVSS score of 10.0. Multiple China state-nexus threat groups, including Earth Lamia and Jackpot Panda, rapidly exploited this vulnerability within hours of its public disclosure on December 3, 2025. Public exploit code is available through Metasploit and Exploit-DB, and the vulnerability has been added to the CISA KEV catalog. Fixed versions include React 20.0.0 and Next.js 17.0.0 and later.

The Aisuru botnet recently launched the largest recorded DDoS attack, peaking at 29.7 Tbps, which was successfully mitigated by Cloudflare. This attack represents a significant escalation in volumetric DDoS capabilities, leveraging a large network of compromised devices to overwhelm targeted infrastructure. While no specific vulnerabilities or exploits were involved, the scale and sophistication of the botnet pose a serious threat to internet-facing services. European organizations, especially those with critical online infrastructure, could face service disruptions if targeted. Mitigation requires advanced DDoS protection services, network traffic filtering, and incident response preparedness. Countries with high internet infrastructure density and strategic digital assets, such as Germany, the UK, France, and the Netherlands, are likely to be primary targets. Given the attack's scale, ease of execution via botnet control, and potential for widespread disruption, the threat severity is assessed as high. Defenders should prioritize robust DDoS defenses and continuous monitoring to mitigate impact from similar future attacks.

Campaign#infosecnews#redditGermany+6

[This is a Guest Diary by Jackie Nguyen, an ISC intern as part of the SANS.edu BACS program]

CampaignGermanyFrance+8

A critical vulnerability in the WordPress King Addons plugin is actively exploited in the wild, allowing attackers to create unauthorized administrator accounts. This flaw enables privilege escalation without requiring prior authentication or user interaction, posing a significant risk to affected WordPress sites. Exploitation can lead to full site compromise, data theft, and potential use of the site for further malicious activities. The vulnerability is currently under active attack, emphasizing the urgency for site administrators to take immediate protective measures. No official patches or CVEs have been published yet, increasing the risk window. European organizations using this plugin are at heightened risk, especially those with high-value web assets. Mitigation requires immediate plugin updates once available, restricting access to WordPress admin areas, and monitoring for suspicious account creations. Countries with large WordPress user bases and significant e-commerce or media sectors are most likely to be targeted. Given the ease of exploitation and impact, the threat severity is assessed as critical. Defenders must prioritize detection and response to prevent full administrative takeover of their WordPress environments.

Campaign#infosecnews#redditGermany+7

The threat actor leveraged Evilginx (likely version 3.0), an open source, advanced phishing adversary-in-the-middle (AITM, aka MITM) framework designed to steal login credentials and session cookies. Evilginx is widely used by cybercriminals to undermine multi-factor authentication (MFA) security, and this actor has used it to target at least 18 universities and educational institutions across the United States since April 2025. The campaigns were delivered through email and the phishing domains used subdomains that mimicked the legitimate SSO sites.

Campaign#evilginx#aitmUnited Kingdom+6

The Aisuru botnet has been identified as the source of a new record-breaking distributed denial-of-service (DDoS) attack reaching 29.7 Tbps. This attack represents one of the largest volumetric DDoS attacks ever recorded, leveraging a massive network of compromised devices to overwhelm targeted infrastructure. Such an attack can severely disrupt online services, degrade network performance, and cause significant operational downtime. European organizations, especially those with critical online services or digital infrastructure, are at risk of service outages and reputational damage. Mitigation requires advanced DDoS protection strategies, including traffic filtering, rate limiting, and collaboration with upstream providers and ISPs. Countries with high internet penetration, significant digital economies, and strategic infrastructure are more likely to be targeted. Given the scale and potential impact, this threat is assessed as high severity. Defenders should prioritize monitoring for unusual traffic spikes and ensure robust incident response plans are in place.

Campaign#infosecnews#redditGermany+7

The ShadyPanda campaign is a long-running espionage operation that targeted approximately 4.3 million users of Chrome and Edge browsers over a seven-year period. It involved persistent spying activities, likely through malicious extensions or other browser-based mechanisms, to collect sensitive user data. Although no specific affected versions or technical exploit details are provided, the campaign's longevity and scale indicate a sophisticated threat actor with sustained access. The medium severity rating reflects the significant privacy and confidentiality risks, though exploitation complexity and exact attack vectors remain unclear. European organizations using Chrome and Edge browsers are at risk, particularly those in countries with high adoption of these browsers and strategic geopolitical relevance. Mitigation requires enhanced browser security hygiene, monitoring for suspicious extensions, and user awareness. Countries such as Germany, France, the UK, Italy, and the Netherlands are likely most affected due to their large user bases and critical infrastructure. Given the lack of detailed exploit information, the suggested severity is medium, balancing the impact on confidentiality against the unknown ease of exploitation and scope. Defenders should prioritize detection of unusual browser activity and ensure timely updates and audits of browser extensions.

Campaign#infosecnews#redditGermany+7

A sophisticated social engineering campaign exploits Microsoft Teams' 'Chat with Anyone' feature to impersonate IT support and trick users into initiating Quick Assist sessions. This multi-stage attack involves phishing, malware deployment (notably an infostealer named 'updater.exe'), and reconnaissance to steal credentials and potentially exfiltrate data. The threat actors leverage legitimate collaboration tools to bypass traditional security controls. Organizations are advised to disable the vulnerable Teams feature, enforce multi-factor authentication, and adopt Zero Trust principles to mitigate risks. No CVSS score is assigned, but the attack poses a medium severity risk due to its credential theft focus and social engineering complexity.

Campaign#reconnaissance#infostealerGermany+6

Felix Markets is a fraudulent forex broker platform engaging in reputation laundering by presenting false regulatory credentials and leveraging sports sponsorship to appear legitimate. It impersonates other companies, repackages authentic legal documents, and falsely claims regulatory ties to Australia, the UK, and Comoros. The platform sponsors the Spanish football team Levante U. D.for the 2025-26 season to enhance its perceived legitimacy. Hosting and metadata suggest possible Turkish involvement, while the scam exploits the identity of a legitimate Australian company. This campaign exemplifies sophisticated regulatory fraud and reputation laundering tactics in investment scams, posing risks to investors and financial institutions. European organizations should exercise heightened due diligence, especially in sectors vulnerable to such deceptive legitimacy claims. The threat is assessed as medium severity due to its potential financial impact and moderate ease of exploitation without direct technical system compromise. Spain is notably affected given the sponsorship link and geographic focus.

Campaign#impersonation#fake financial authoritySpain+2

The Lazarus APT group has been observed employing a novel remote-worker scheme, captured live on camera by researchers. This campaign highlights the evolving tactics of Lazarus, focusing on exploiting remote work environments to infiltrate targets. While no specific software vulnerabilities or exploits are detailed, the campaign represents a high-severity threat due to the advanced persistent nature of Lazarus and their history of impactful cyber espionage and sabotage. European organizations, especially those with remote workforce infrastructures, are at risk of targeted intrusion attempts leveraging social engineering and remote access exploitation. Mitigation requires tailored defenses around remote access security, employee training, and enhanced monitoring for suspicious remote activity. Countries with significant technology, finance, and critical infrastructure sectors, such as Germany, France, and the UK, are particularly vulnerable given their strategic importance and market penetration of remote work technologies. The threat is assessed as high severity due to the potential for significant confidentiality and integrity breaches, ease of exploitation through social engineering, and the broad scope of affected remote work environments without requiring user interaction beyond initial compromise. Defenders should prioritize detection of anomalous remote access patterns and reinforce endpoint security in remote setups.

Campaign#infosecnews#redditGermany+6

Arkanix Stealer is a newly discovered information-stealing malware designed for short-term financial gain. Initially developed in Python, it has evolved into a more sophisticated C++ version employing VMProtect obfuscation and a technique called 'Chrome Elevator' to bypass App Bound Encryption. It targets browsers, crypto wallets, VPN accounts, Steam accounts, and system information. Distributed primarily via Discord and online forums disguised as legitimate tools, it offers threat actors a web panel with premium features for managing stolen data. The malware demonstrates advanced capabilities and rapid evolution, highlighting the ease of launching cybercrime operations for quick profits. While no known exploits in the wild have been reported yet, its medium severity reflects the potential impact on confidentiality and financial assets. European organizations using targeted browsers, crypto wallets, or VPN services are at risk, especially those with users active on Discord or similar platforms. Mitigation requires targeted detection of obfuscated binaries, network monitoring for suspicious domains like arkanix.pw, and user education on social engineering risks. Countries with high crypto adoption and active gaming communities are more likely to be affected.

Campaign#discord#pythonGermany+6

The HashJack attack leverages the URL fragment identifier ('#') to manipulate AI-powered browser behavior, potentially allowing attackers to influence how AI browsers process and render web content. This technique exploits the way AI browsers interpret URL fragments, which are typically client-side and not sent to servers, to inject commands or control instructions. While no known exploits are currently active in the wild, the attack vector poses a medium severity risk due to its potential to affect confidentiality and integrity without requiring authentication or significant user interaction. European organizations using AI-integrated browsers or web applications that rely on AI for content rendering or decision-making could be impacted, especially those in sectors with high AI adoption. Mitigation involves updating AI browser software to properly sanitize and validate URL fragments, implementing strict input handling, and monitoring for unusual AI browser behaviors. Countries with advanced digital infrastructure and high AI technology adoption, such as Germany, France, the UK, and the Netherlands, are more likely to be affected. Given the medium severity, organizations should proactively assess their exposure and apply targeted mitigations to prevent exploitation.

Campaign#infosecnews#redditGermany+5

Shai-Hulud 2.0 is a recently identified supply chain attack campaign that demonstrates adaptive techniques to compromise software development pipelines. Although detailed technical specifics are limited, the attack targets the software supply chain, aiming to inject malicious code or backdoors into legitimate software components. This medium-severity threat poses risks to confidentiality, integrity, and availability by potentially distributing compromised software to end users. European organizations relying on affected software or development tools could face increased exposure, especially those in critical infrastructure, finance, and technology sectors. Mitigation requires enhanced supply chain security practices, including rigorous code auditing, dependency verification, and continuous monitoring of software components. Countries with strong software development industries and high dependency on third-party software, such as Germany, France, and the UK, are more likely to be impacted. Given the attack's adaptive nature and supply chain focus, the suggested severity is high, reflecting the potential widespread impact and difficulty in detection. Defenders should prioritize supply chain risk management and incident response readiness to mitigate this evolving threat.

Campaign#netsec#redditGermany+5

Ahead of Black Friday and festive sales, over 2,000 holiday-themed fake online stores have been detected, organized into two main clusters. These sites impersonate major retailers like Amazon and use uniform holiday banners, fake trust indicators, and phishing kits to deceive shoppers. They employ urgency tactics and fake checkout pages to steal sensitive financial information. The scams are timed to activate during peak shopping periods to maximize victim traffic and financial theft. This campaign leverages social engineering, typosquatting, and e-commerce impersonation to exploit consumer trust during high-volume shopping events. Although no direct exploits target software vulnerabilities, the threat poses significant risks to consumers and indirectly to organizations handling payment and customer data. European organizations involved in e-commerce, payment processing, and consumer protection are particularly at risk. Mitigation requires proactive detection of fraudulent domains, consumer awareness campaigns, and enhanced monitoring of payment fraud. Countries with high e-commerce adoption and large consumer markets are most likely affected. The threat severity is assessed as high due to the potential financial impact and widespread exposure without requiring user authentication but relying on user interaction.

Campaign#social engineering#fake online storesGermany+9

A recent report alleges the identification of a teenage leader involved in fragmented activities related to the LAPSUS$ hacking group, although the group denies these claims. The information originates from a Reddit post linking to an external news article, with minimal technical details or evidence provided. There is no indication of specific vulnerabilities, exploits, or affected software versions tied to this report. The threat is categorized as a campaign but lacks concrete technical data or confirmed exploits in the wild. Given the nature of the information, this appears to be more of an intelligence or attribution update rather than an immediate technical threat. European organizations should remain vigilant about potential social engineering or insider threats linked to such groups but no direct technical mitigation is indicated. Countries with significant technology sectors and prior exposure to LAPSUS$ activities, such as the UK and Germany, might be more attentive to developments. The overall severity is assessed as medium due to the uncertain and indirect nature of the threat. Defenders should monitor credible intelligence sources for updates and maintain robust security hygiene against potential intrusion attempts linked to this group.

Campaign#infosecnews#redditGermany+4