Campaign threats

The Shai-Hulud v2 campaign is a high-severity supply chain attack spreading from the npm ecosystem to Maven repositories, targeting software development dependencies. It involves malicious packages designed to exfiltrate thousands of secrets, such as API keys and credentials, embedded in developer environments. This campaign exploits the trust in widely used package managers, increasing the risk of widespread compromise. European organizations relying on npm and Maven for software development are at risk of data leakage and potential downstream attacks. The campaign's expansion to Maven indicates a broader targeting of Java-based projects, which are prevalent in Europe. Mitigation requires proactive dependency auditing, secret scanning, and restricting automated credential access. Countries with strong software development sectors and high adoption of Java and JavaScript ecosystems, such as Germany, France, and the UK, are most likely affected. Given the ease of exploitation through popular package managers and the significant impact on confidentiality, the threat severity is assessed as high. Defenders should prioritize monitoring for suspicious package activity and implement strict supply chain security controls.

Campaign#infosecnews#redditGermany+6

Dartmouth College suffered a data breach following a ransomware extortion attack by the Clop group. The attack involved unauthorized access to sensitive institutional data, which the threat actors likely exfiltrated before demanding ransom. Although no specific technical details about the exploitation vector or affected systems were disclosed, the incident highlights the ongoing threat posed by Clop ransomware campaigns targeting educational institutions. The breach underscores the risk of data exposure and operational disruption in higher education environments. European organizations with similar profiles should be vigilant against such ransomware threats. Mitigation requires proactive detection, network segmentation, and robust incident response planning. Countries with significant academic and research institutions, such as the UK, Germany, and France, may be more exposed due to their extensive higher education sectors. Given the high potential impact on confidentiality and availability, ease of exploitation by sophisticated ransomware groups, and the broad scope of affected systems, this threat is assessed as high severity. Defenders should prioritize monitoring for ransomware indicators and ensure comprehensive backups and recovery capabilities.

Campaign#infosecnews#redditGermany+5

A sophisticated attack chain was uncovered involving a malicious disk-cleaning utility that installed proxyware on a compromised system. The infection used PowerShell scripts, download cradles, and in-memory execution to evade detection and establish a connection to a command-and-control (C2) server. The attack was intercepted before the proxyware installation completed. This incident underscores the dangers of unauthorized software installations and the critical need to restrict PowerShell usage in corporate environments. The threat leverages multiple advanced techniques including obfuscation, living-off-the-land binaries, and scheduled task abuse. Although no known exploits are currently in the wild, the attack demonstrates a medium severity risk due to its potential for stealthy persistence and resource abuse. European organizations should be vigilant, especially those with lax software installation policies and insufficient PowerShell controls.

Campaign#download cradle#node.jsGermany+5

APT-C-26 (Lazarus) has conducted a sophisticated attack campaign deploying customized monitoring software disguised as remote IT tools. The malware includes a registration program, daemon process, and DLL, leveraging Windows Shell extensions for persistence and creating a covert remote desktop environment. It employs advanced evasion techniques such as disabling Windows Defender and manipulating firewall rules. The monitoring software captures screen data and uploads it to a remote server, enabling persistent surveillance and remote control. This campaign targets various industries globally and is attributed to the North Korean Lazarus group. The attack does not require known exploits but uses stealthy persistence and privilege escalation tactics. European organizations face risks of espionage, data leakage, and operational disruption. Mitigation requires targeted detection of the specific malware components, strict control of remote IT access, and enhanced endpoint monitoring. Countries with high adoption of Windows enterprise environments and strategic industries are most at risk, including Germany, France, the UK, and the Netherlands.

Campaign#systemuiext.dll#remote desktopGermany+6

The ToddyCat APT group has developed advanced tools and techniques to covertly access corporate email data by targeting both on-premises Outlook OST files and Microsoft 365 cloud environments. Their toolkit includes PowerShell-based TomBerBil for extracting browser data, TCSectorCopy for copying Outlook OST files, and methods to steal OAuth tokens from Microsoft 365 processes. They leverage SMB for remote file access, dump process memory, and search for access tokens to bypass security monitoring. These tactics enable stealthy data theft of sensitive email content and credentials. Detection guidance is available for each technique to help defenders identify and mitigate these intrusions. The threat is assessed as medium severity due to the complexity and targeted nature of the attacks, with no known exploits in the wild yet. European organizations using Microsoft 365 and Outlook are at risk, especially those with valuable email communications and cloud integrations.

Campaign#browser#oauthGermany+7

The emergence of agentic AI-driven cyber campaigns marks a significant evolution in the cyber threat landscape, enabling autonomous execution of routine malicious activities via APIs. This AI orchestration lowers barriers for less skilled threat actors by automating complex tasks, increasing the scale and speed of attacks. While AI enhances attacker capabilities, it still requires skilled human oversight. European organizations face increased risks as AI-driven campaigns can target diverse systems and exploit vulnerabilities more efficiently. Defensive teams can counteract by developing their own AI agentic systems for vulnerability detection and deploying honeypots to trap malicious AI. The threat is medium severity but represents a paradigm shift requiring adaptive defense strategies. No known exploits are currently in the wild, but the potential for rapid evolution and automation of attacks is high. Organizations must proactively integrate AI-aware defenses and monitor for AI-driven attack indicators. This threat is likely to impact countries with high digital infrastructure and AI adoption, especially those with critical industries and government targets.

Campaign#threat landscape#force enablerGermany+8

A hacker claims to have stolen 2.3TB of data from Almavia, an Italian rail group. The breach was publicly disclosed via Reddit and reported by BleepingComputer, highlighting a significant data exfiltration incident. Although technical details about the attack vector or exploited vulnerabilities are not provided, the volume of data stolen suggests a serious compromise of Almavia's systems. There is no evidence of known exploits in the wild or patches available at this time. The incident poses a high risk to confidentiality and potentially to operational integrity if critical rail infrastructure data was accessed. European organizations, especially those in Italy and neighboring countries with similar rail infrastructure providers, should be alert to potential follow-on attacks or data misuse. Mitigation should focus on immediate forensic investigation, network segmentation, enhanced monitoring, and credential audits. Given the lack of detailed technical information, the severity is assessed as high due to the scale of data loss and potential impact on critical infrastructure. Italy is the most directly affected country, with possible implications for other European nations reliant on interconnected rail systems or supply chains.

Campaign#infosecnews#redditItaly+4

APT24, a Chinese threat actor, has conducted a three-year cyber espionage campaign using BADAUDIO, a highly obfuscated first-stage downloader. The group has evolved from broad strategic web compromises to more sophisticated tactics, including supply chain attacks and targeted phishing. They compromised a Taiwanese digital marketing firm, affecting over 1,000 domains. APT24 uses advanced techniques like control flow flattening, fingerprinting, and covert data exfiltration. The malware integrates with Cobalt Strike Beacon and employs DLL Search Order Hijacking for execution. The campaign demonstrates the actor's persistent and adaptive capabilities, highlighting the growing sophistication of Chinese cyber threats.

Campaign#badaudio#phishingGermany+7

Sturnus is a newly identified Android banking trojan targeting financial institutions in Southern and Central Europe. It features advanced capabilities such as full device takeover, harvesting banking credentials, keylogging, and remote control via VNC. Notably, it can bypass encryption on popular messaging apps like WhatsApp, Telegram, and Signal to monitor communications. The malware uses sophisticated communication protocols including WebSocket and HTTP to interact with its command-and-control servers. Although still in development and not yet exploited in the wild, Sturnus poses a significant threat to financial security and user privacy. It employs HTML overlays for data exfiltration and extensive environment monitoring to evade detection. The malware’s complexity and targeting of Android devices make it a serious concern for European financial sectors. Defenders should prioritize detection and containment measures to mitigate potential impacts.

Campaign#banking trojan#remote controlItaly+6

A malware campaign targeting WhatsApp users primarily in Brazil uses WhatsApp's 'View Once' message feature to deliver malicious ZIP archives containing VBS or HTA files. These files execute PowerShell scripts to download additional payloads, including scripts that steal WhatsApp user data and an MSI installer deploying the Astaroth banking trojan. The campaign evolved from IMAP-based to HTTP-based command and control communication and leverages Selenium Chrome WebDriver and the WPPConnect JavaScript library to hijack WhatsApp Web sessions, steal session tokens and contacts, and distribute spam. Over 250 victims have been identified, with 95% located in Brazil and some impact noted in Austria. The attack enables credential theft, session hijacking, persistence, and financial fraud through banking trojan deployment. No CVE or known exploits in the wild are reported, and the campaign is rated medium severity. Defenders should focus on user awareness, endpoint detection of PowerShell and script execution, and monitoring for suspicious WhatsApp Web activity.

Campaign#persistence#guildmaAustria+1

The NKNShell malware campaign involves a compromised South Korean VPN provider website used to distribute a multi-stage malware payload. The threat actor Larva-24010 deploys several backdoors including MeshAgent, gs-netcat, and a novel Go-based backdoor called NKNShell, which leverages NKN and MQTT protocols for command and control. The infection chain uses trojanized installers and PowerShell scripts, employing advanced evasion techniques such as AMSI and UAC bypasses. Additional tools like SQLMap are deployed to facilitate further exploitation. While primarily targeting Korean VPN users, the sophisticated use of blockchain-based networking protocols and multiple backdoors poses risks to any users of the compromised VPN service. The campaign's medium severity reflects its complexity and targeted nature, but it has not yet been observed exploiting widespread vulnerabilities or causing large-scale impact beyond South Korea.

Campaign#nknshell#nknGermany+4

The October 2025 Infostealer Trend Report highlights the ongoing and evolving threat posed by Infostealer malware families such as Rhadamanthys, ACRStealer, and LummaC2. Attackers have shifted distribution tactics, increasingly leveraging legitimate websites to evade detection and search engine restrictions, a technique known as SEO poisoning. A notable development is the mass distribution of a new Loader malware employing DLL sideloading to execute malicious payloads stealthily. The report also details changes in LummaC2 distribution patterns and the use of sophisticated disguise and phishing techniques to target companies. These Infostealers aim to exfiltrate sensitive information, posing risks to confidentiality and potentially enabling further attacks. The threat does not require known exploits or zero-day vulnerabilities but relies on social engineering and advanced evasion methods. European organizations are at risk due to the widespread use of affected malware and the targeting of companies via phishing. Mitigation requires proactive detection of DLL sideloading, monitoring for SEO poisoning campaigns, and enhanced phishing defenses.

Campaign#seo poisoning#rhadamanthysGermany+5

In October 2025, phishing emails predominantly delivered Trojan malware via attachments, accounting for 47% of cases. These attachments included scripts, documents, and compressed files, notably RAR archives containing JavaScript files. The phishing campaigns also involved distribution of Remcos RAT malware and used document attachments to download additional payloads. Korean phishing emails were specifically analyzed, revealing targeted case names, subjects, and attachment filenames. The report highlights evolving tactics such as increased use of compressed JS files and exploitation of OLE objects within documents. The threat leverages multiple MITRE ATT&CK techniques including persistence, command execution, and credential access. This medium-severity campaign poses significant risks through social engineering and malware delivery via email attachments, requiring focused defensive measures. No known exploits in the wild are reported, but the widespread use of common file formats and compression methods increases the attack surface. European organizations should be vigilant against these evolving phishing tactics and malware payloads.

Campaign#email attachments#rar compressionGermany+9

TamperedChef is a sophisticated global malvertising and SEO-driven campaign that delivers malicious payloads via seemingly legitimate, digitally signed installers. It leverages social engineering, malvertising, and abused code-signing certificates obtained through U. S. -registered shell companies to evade detection and increase user trust. The campaign primarily targets healthcare, construction, and manufacturing sectors, establishing persistence and deploying obfuscated JavaScript for remote access and control. Attackers may use this access for credential theft, ransomware preparation, or espionage. Although currently concentrated in the Americas, European organizations in similar sectors are at risk due to the campaign's stealth and persistence techniques. Mitigation requires enhanced scrutiny of signed applications, network monitoring for unusual JavaScript execution, and strict controls on software installation sources. Countries with significant healthcare and manufacturing industries, such as Germany, France, and the UK, are most likely to be affected. Given the medium severity rating and the complexity of exploitation, the threat is assessed as high severity for European contexts due to potential impact and stealth.

Campaign#malvertising#javascriptGermany+7

The Sneaky2FA phishing-as-a-service (PhaaS) kit has integrated the Browser-in-the-Browser (BitB) attack technique, enhancing its ability to bypass two-factor authentication protections by mimicking legitimate browser pop-ups. This attack creates convincing fake login dialogs within a browser window, deceiving users into entering credentials and 2FA codes. The campaign is considered high severity due to its potential to compromise multi-factor authentication, a critical security layer. European organizations relying on 2FA for sensitive systems are at increased risk, especially those in finance, government, and critical infrastructure sectors. Mitigations include user training to recognize BitB attacks, deploying advanced anti-phishing tools that detect UI spoofing, and adopting hardware-based or phishing-resistant authentication methods. Countries with high adoption of 2FA and significant financial or governmental digital infrastructure, such as Germany, France, the UK, and the Netherlands, are most likely to be targeted. The threat does not require software vulnerabilities but exploits user trust and UI deception, making it relatively easy to execute. Defenders must prioritize awareness and technical controls to mitigate this evolving phishing technique.

Campaign#infosecnews#redditGermany+7

The China-linked cyber operation named “WrtHug” has been identified hijacking thousands of ASUS routers globally. This campaign involves compromising vulnerable ASUS routers to gain unauthorized control, potentially enabling data interception, network manipulation, and further lateral attacks. The threat is considered high severity due to the scale of affected devices and the critical role routers play in network infrastructure. European organizations using ASUS routers are at risk of exposure to espionage, data breaches, and service disruption. Mitigation requires immediate firmware updates, network segmentation, and enhanced monitoring for unusual router behavior. Countries with high ASUS router market penetration and strategic geopolitical interest in China are more likely to be targeted. Given the lack of a CVSS score, the threat is assessed as high severity due to the broad impact on confidentiality, integrity, and availability, ease of exploitation, and no requirement for user interaction. Defenders should prioritize identifying vulnerable routers, applying patches, and implementing network defenses to mitigate this campaign’s impact.

Campaign#infosecnews#redditGermany+9

A large-scale fake account creation campaign was detected involving tens of thousands of bot-driven registrations using 330 unique custom email domains created within a short timeframe. Attackers used a modified Chrome browser with anti-detection techniques such as canvas randomization to evade fingerprinting and detection. The use of numerous custom domains, which appeared legitimate and were not on public blocklists, complicated traditional anti-abuse defenses. This campaign highlights the limitations of static disposable domain lists and underscores the need for multi-layered defenses including behavioral analysis, proxy detection, fingerprinting, and email intelligence. The threat is medium severity due to the complexity of evasion and potential for abuse but does not involve direct exploitation or system compromise. European organizations with online services requiring account creation are at risk, especially those lacking advanced bot and fraud detection capabilities. Countries with high digital service adoption and significant online user bases are more likely to be targeted. Defenders should implement dynamic domain reputation systems, advanced browser fingerprinting, and continuous behavioral monitoring to mitigate this threat effectively.

Campaign#anti-abuse#fake accountsGermany+7

ShadowRay 2.0 is an active global cyber campaign that hijacks Ray AI infrastructure to create a self-propagating botnet. The attackers exploit AI systems to turn them against themselves, leveraging the compromised AI nodes to expand the botnet autonomously. This campaign is currently ongoing and has been reported by Oligo Security with limited public technical details. Although no known exploits are confirmed in the wild, the campaign's medium severity rating reflects its potential to disrupt AI-based services and infrastructure. European organizations using Ray AI infrastructure or related AI platforms could face risks of service disruption, data compromise, or being unwitting participants in botnet activities. Mitigations require proactive monitoring of AI infrastructure, network segmentation, and rapid incident response capabilities. Countries with significant AI technology adoption and critical infrastructure relying on AI are more likely to be targeted. Given the campaign's self-propagating nature and AI focus, the threat severity is assessed as high due to potential widespread impact and complexity of mitigation.

Campaign#netsec#redditGermany+7

Microsoft Azure recently mitigated an extremely large-scale Distributed Denial of Service (DDoS) attack reaching 15.72 Tbps, orchestrated by the Aisuru botnet. This attack represents one of the largest volumetric DDoS campaigns observed to date, leveraging a vast network of compromised devices to overwhelm Azure's infrastructure. Although no specific vulnerabilities were exploited, the attack demonstrates the increasing scale and sophistication of botnet-powered DDoS threats. European organizations relying on cloud services like Azure could face indirect impacts such as service degradation or collateral damage during such attacks. Mitigation requires advanced DDoS protection, traffic filtering, and collaboration with cloud providers. Countries with high Azure adoption and critical digital infrastructure, such as Germany, the UK, France, and the Netherlands, are most at risk. Given the attack's scale, ease of execution via botnets, and potential for widespread disruption, the threat severity is assessed as high. Defenders should focus on enhancing network resilience, deploying multi-layered DDoS defenses, and maintaining incident response readiness.

Campaign#infosecnews#redditGermany+5

UNC1549, an Iranian-linked threat group, has been targeting aerospace, aviation, and defense industries since mid-2024. They employ sophisticated initial access techniques, including exploiting third-party relationships and targeted phishing. The group uses custom malware like TWOSTROKE, LIGHTRAIL, and DEEPROOT for persistence, and tools like DCSYNCER.SLICK and CRASHPAD for privilege escalation. UNC1549 demonstrates advanced lateral movement, reconnaissance, and defense evasion tactics. They extensively use SSH reverse tunnels and Azure infrastructure for command and control. The group's primary objective appears to be espionage, focusing on data collection and leveraging compromised organizations to target others in the same sector.

Campaign#dcsyncer.slick#third-party compromiseFrance+6