Campaign threats

The German hosting provider aurologic GmbH has become a critical infrastructure hub for multiple high-risk and sanctioned cybercrime networks, including entities involved in disinformation and malware campaigns. Despite public scrutiny and sanctions, aurologic continues to provide upstream transit services, enabling threat actors to maintain operational stability. The provider's approach to abuse handling is reactive and legally compliant rather than proactive, allowing malicious infrastructure to persist. This situation highlights challenges in accountability within the hosting ecosystem and the risks posed by infrastructure neutrality when it enables cybercrime. Numerous suspicious domains linked to aurologic-hosted networks have been identified, associated with malware families and threat actor tools. European organizations, especially in Germany, face increased risks due to this infrastructure's stability and continued operation. Mitigation requires enhanced monitoring of traffic from these domains, collaboration with upstream providers, and pressure on hosting providers to adopt proactive abuse prevention. Countries with significant internet infrastructure and cybercrime targets in Europe are most likely to be affected.

Campaign#castleloader#neutralityGermany+5

The UNK_SmudgedSerpent threat actor, likely linked to Iranian espionage efforts, targeted academics and foreign policy experts from June to August 2025 using phishing campaigns with domestic political and health-related lures. The actor employed Remote Management & Monitoring (RMM) tools and credential harvesting techniques, showing overlapping tactics with known Iranian groups such as TA455, TA453, and TA450. Although attribution is not definitive, the targeting aligns with Iranian intelligence priorities, focusing on sensitive policy and academic sectors. The campaign's medium severity reflects moderate impact potential without known exploits in the wild. European organizations involved in foreign policy, academia, and research are at risk, especially in countries with strong diplomatic ties or geopolitical interest in Iran. Mitigation requires targeted user awareness, strict monitoring of RMM tool usage, and enhanced email filtering tuned to political and health-themed lures. Countries like Germany, France, the UK, Italy, and the Netherlands are most likely affected due to their active academic communities and diplomatic engagement with Iran. The threat's medium severity is due to its espionage focus, moderate ease of exploitation via phishing, and the absence of widespread destructive payloads or zero-day exploits. Defenders should prioritize detection of credential harvesting and suspicious RMM activity while maintaining vigilance for evolving Iranian espionage tactics.

Campaign#credential harvesting#isl onlineGermany+4

A sophisticated cyber attack targeting the defense sector was identified in October 2025, utilizing a weaponized ZIP archive disguised as a military document. The multi-stage attack employs advanced evasion techniques and deploys a complex infrastructure combining OpenSSH for Windows with a customized Tor hidden service. The malware establishes persistent backdoor access, allowing anonymous remote access via SSH, RDP, SFTP, and SMB protocols. The lure document targets Belarusian Air Force drone experts, suggesting intelligence gathering on regional UAV capabilities. The attack's tactics, techniques, and procedures align with those of Sandworm (APT44), a Russian-linked APT group, although definitive attribution remains uncertain at this stage.

Campaign#tor hidden service#defense sectorBelarus+7

A threat group known as Golden Eye Dog (APT-Q-27) has been targeting individuals involved in gambling and related activities in Southeast Asia, as well as overseas Chinese communities. The group's operations include remote control, cryptocurrency mining, DDoS attacks, and traffic-related activities. Their malware samples are primarily distributed through Telegram groups, with strong anti-detection capabilities and highly targeted lures. The article describes new watering hole activities by the group, including the use of modified MSI installers for popular messaging apps like Telegram. The group has evolved its tactics since previous reports, making their operations more covert and difficult to detect. The analysis reveals the group's use of various programming languages and sophisticated techniques, suggesting it may be part of a larger, more advanced organization called Miuuti Group.

Campaign#telegram#miuuti groupUnited Kingdom+5

The Silent Lynx APT group has been conducting espionage campaigns targeting Central Asian nations, Russia, China, and Azerbaijan. Two main campaigns were identified: one focusing on Russia-Azerbaijan relations and another on China-Central Asia relations. The group uses various malware including PowerShell scripts, .NET implants, and C++ reverse shells. They leverage spear-phishing with malicious attachments, GitHub-hosted payloads, and scheduled tasks for persistence. The campaigns aim to gather intelligence on diplomatic communications, transportation projects, and other strategic initiatives. Silent Lynx shows a pattern of targeting summit meetings and infrastructure deals in the region, with a particular focus on events in Dushanbe, Tajikistan.

Campaign#espionage#central asiaPoland+6

A new Android Trojan masquerades as legitimate news reader or digital ID apps, stealthily stealing sensitive data by exploiting Android Accessibility Services and overlay features. It primarily targets banking and cryptocurrency applications by overlaying fake login screens to capture credentials. The malware operates silently in the background, connects to a remote command center for updates and cleanup, and has been observed mainly in Southeast Asia. Although no CVE or known exploits in the wild are reported, the malware's capabilities pose significant risks to user confidentiality and financial security. This threat highlights the importance of enhanced mobile security and user vigilance against fake apps and overlay attacks.

Campaign#cryptocurrency#androidGermany+6

A China-linked hacking group is conducting a global campaign targeting Cisco AKA firewalls. The campaign appears to be recent and is reported via a Reddit InfoSec news post referencing an external source. While specific technical details, affected versions, or exploits in the wild are not provided, the targeting of Cisco AKA firewalls suggests an attempt to compromise network perimeter defenses. The campaign is assessed as medium severity due to limited public technical details and no confirmed exploits. European organizations using Cisco AKA firewalls could be at risk, especially those with critical infrastructure or government networks. Mitigation should focus on enhanced monitoring, network segmentation, and applying Cisco security advisories promptly. Countries with high Cisco market penetration and strategic geopolitical interest in China-related cyber activities are more likely to be affected. Given the lack of detailed exploit information, the threat severity is assessed as medium, balancing potential impact and limited exploitation evidence.

Campaign#infosecnews#redditGermany+6

A sophisticated campaign targeting Russian and Belarusian military personnel has been identified, using multi-stage infection chains and decoy documents. The attackers deploy OpenSSH and Tor bridges to establish covert remote access and lateral movement capabilities. The infection process involves PowerShell scripts, scheduled tasks for persistence, and the use of Tor hidden services to expose multiple local services. The campaign employs anti-analysis techniques and leverages obfuscated configurations for SSH and Tor. While attribution remains uncertain, the targeting and tactics are consistent with Eastern European-linked espionage activities focusing on defense and government sectors.

Campaign#ssh#torPoland+7

Open VSX fully contained the GlassWorm attacks and says it was not a self-replicating worm in the traditional sense. The post Open VSX Downplays Impact From GlassWorm Campaign appeared first on SecurityWeek .

CampaignGermanyFrance+4

A security research campaign uncovered over 2,000 medium vulnerabilities, including 98 highly critical issues, across publicly exposed applications built on vibe-coded platforms integrating Lovable front-ends with Supabase backends. The research revealed 400+ exposed secrets and 175 instances of personally identifiable information (PII), including sensitive data such as bank details and medical information. Notable vulnerabilities include Broken Object Level Authorization (BOLA), Server-Side Request Forgery (SSRF), and zero-click account takeover exploits. The threat arises from the architectural integration where sensitive tokens and API keys are exposed in frontend bundles, increasing the attack surface. Although no known exploits are currently in the wild, the critical severity and volume of findings indicate a significant risk. European organizations using these platforms or similar architectures face risks of data breaches, unauthorized access, and service disruption. Mitigation requires targeted scanning for exposed secrets in frontend code, strict API authorization enforcement, and comprehensive secrets management. Countries with high adoption of Supabase and vibe-coded platforms, such as the UK, Germany, France, and the Netherlands, are most likely affected. Given the ease of exploitation and sensitive data exposure without authentication, the suggested severity is critical.

Campaign#netsec#redditGermany+5

A major US telecom backbone provider, Ribbon Communications, was reportedly compromised by nation-state actors. Ribbon Communications supplies critical communications technology to the US government and major telecom operators. Although specific technical details of the breach are not disclosed, the attack likely targets sensitive infrastructure supporting telecom networks. The incident highlights risks to telecom supply chains and potential impacts on network confidentiality, integrity, and availability. No known exploits or patches have been reported yet. European organizations relying on interconnected telecom infrastructure or using Ribbon products may face indirect risks. Mitigation requires enhanced monitoring, supply chain risk assessments, and collaboration with vendors. Countries with significant telecom infrastructure linked to US networks or strategic geopolitical interest in US-China/Russia relations are more likely to be affected. Given the medium severity and lack of detailed exploit information, the threat is assessed as high due to the critical nature of telecom backbone systems and potential for disruption or espionage.

CampaignGermanyFrance+6

Tangerine Turkey is a cryptomining campaign that propagates via VBScript worms spread through USB drives, leveraging legitimate system binaries for execution and persistence. The malware employs advanced defense evasion techniques such as registry modification and masquerading malicious files as legitimate system components. It establishes persistence through malicious services and scheduled tasks while attempting to disable Windows Defender. Although its primary objective is unauthorized cryptocurrency mining, its capabilities for persistence and lateral movement pose broader security risks. The campaign uses living-off-the-land binaries and creates mock directories to conceal its activities. No known CVEs or exploits are currently associated with this threat. The medium severity rating reflects the financial motivation and potential for system compromise without immediate destructive impact. European organizations using Windows systems with USB access are at risk, especially those with lax endpoint security controls and high-value targets. Mitigation requires targeted controls beyond generic advice, including USB device management, monitoring for living-off-the-land abuse, and registry integrity checks.

Campaign#vbscript#living-off-the-landGermany+6

In October 2025, a wave of sophisticated cyber attacks targeted corporate environments, leveraging phishing campaigns exploiting trusted platforms like Google Careers and ClickUp, abusing Figma for credential theft, and deploying the LockBit 5.0 ransomware variant against ESXi and Linux systems. Attackers used legitimate cloud services and multi-stage redirection to evade detection, while a new phishing kit named TyKit emerged. These campaigns threaten corporate credentials, infrastructure integrity, and data confidentiality across multiple sectors. The attacks do not require known exploits in the wild but rely heavily on social engineering and abuse of trusted platforms. Security operations centers (SOCs) must enhance detection capabilities, harden access controls, and employ advanced threat intelligence to mitigate these evolving threats. The overall severity is medium, reflecting the complexity and multi-vector nature of the attacks but without widespread exploitation of zero-day vulnerabilities. European organizations, especially those using affected platforms and cloud services, face significant risks from credential theft and ransomware infection.

Campaign#clickup#lockbit 5.0Germany+7

The TEE. Fail side-channel attack targets secure enclaves implemented on Intel and AMD processors using DDR5 memory, enabling attackers to extract sensitive secrets. This attack exploits vulnerabilities in the Trusted Execution Environment (TEE) design, leveraging side-channel techniques to bypass hardware protections. Although no known exploits are currently observed in the wild, the attack poses a high risk due to the critical nature of enclave security. European organizations relying on Intel and AMD CPUs with DDR5 memory for confidential computing or secure data processing are at risk of data leakage and compromise of cryptographic keys. Mitigation requires microcode and firmware updates from CPU vendors, enhanced enclave design, and strict memory access controls. Countries with significant technology sectors and extensive use of Intel/AMD hardware, such as Germany, France, and the UK, are most likely to be affected. Given the high impact on confidentiality and the complexity of exploitation, the threat severity is assessed as high. Defenders should prioritize patching, monitoring enclave behavior, and restricting access to sensitive enclave workloads.

Campaign#infosecnews#redditGermany+5

A recent campaign has been identified targeting the Visual Studio Code (VSCode) extension marketplace, where attackers have uploaded a dozen malicious extensions aimed at developers. These extensions pose a supply chain attack risk by potentially compromising developer environments and injecting malicious code into software development workflows. Although no known exploits are currently active in the wild, the presence of malicious plugins in a widely used IDE marketplace elevates the risk profile. The threat is assessed as medium severity due to the potential impact on confidentiality and integrity, combined with the ease of exploitation through trusted extension installation. European organizations relying heavily on VSCode for software development could face risks of intellectual property theft, code integrity compromise, and downstream supply chain contamination. Mitigation requires proactive extension vetting, restricting extension installation policies, and monitoring for unusual IDE behaviors. Countries with strong software development sectors and high VSCode adoption, such as Germany, the UK, France, and the Netherlands, are more likely to be affected. Given the medium severity and the supply chain nature of the attack, defenders should prioritize awareness and controls around IDE plugin management.

Campaign#netsec#redditGermany+5

Herodotus is a newly discovered Android malware designed to perform device takeover by mimicking human behavior to evade biometric and automated detection. It is distributed via side-loading and targets financial organizations and cryptocurrency wallets, with active campaigns observed in Italy and Brazil and potential for global spread. The malware is offered as Malware-as-a-Service and is linked to the Brokewell malware family. It steals credentials and remotely controls infected devices, using randomized delays between inputs to simulate human interaction. This behavior mimicry complicates detection by security solutions relying on behavioral analysis. The malware’s focus on financial targets and crypto wallets poses significant risks to confidentiality and financial integrity. European organizations, especially in Italy and Poland, are currently targeted and should prepare for potential expansion. Mitigation requires advanced layered security, including strict app installation policies, behavioral anomaly detection tuned for such mimicry, and user education on side-loading risks.

Campaign#banking trojan#mqttItaly+1

The Everest group has claimed responsibility for a cyberattack targeting Svenska kraftnät, Sweden's national power grid operator. While details remain sparse and unverified, the incident raises concerns about the security of critical infrastructure in Sweden. No technical specifics or evidence of exploitation have been publicly disclosed, and there are no known exploits in the wild linked to this claim. The attack, if confirmed, could impact the confidentiality, integrity, and availability of power grid operations, potentially disrupting energy supply. European organizations, especially those involved in critical infrastructure, should remain vigilant. Mitigation should focus on enhanced monitoring, incident response readiness, and securing operational technology environments. Sweden is the primary affected country, with potential indirect effects on neighboring European countries due to interconnected energy networks. Given the lack of detailed information and confirmed impact, the threat severity is assessed as medium. Defenders should prioritize verifying the claim, assessing system integrity, and reinforcing cybersecurity controls in critical infrastructure sectors.

Campaign#infosecnews#redditSweden+4

GhostCall and GhostHire are two distinct but related cyber-espionage campaigns conducted by the BlueNoroff APT group, a Lazarus subgroup, targeting executives and developers in the cryptocurrency industry. GhostCall focuses on social engineering attacks against executives, primarily on macOS, using fake investor personas and spoofed video calls to lure victims to malicious sites that prompt malware installation. GhostHire targets blockchain developers by offering fake job opportunities and delivering malware through test tasks distributed via Telegram and GitHub. Both campaigns aim to infect victims' computers to steal cryptocurrency, credentials, and sensitive corporate secrets. The attacks leverage sophisticated social engineering and custom malware, with a shared command-and-control infrastructure. There are no known public exploits, but the campaigns demonstrate targeted, well-prepared operations. European organizations in the crypto and blockchain sectors, especially those with macOS-using executives and developers, face significant risk. Mitigation requires tailored security awareness training, advanced endpoint protection, and strict controls on software installation and external communications. Given the targeted nature, potential financial theft, and infection vectors, the threat severity is assessed as high.

CampaignGermanyFrance+5

A mass attack campaign is targeting WordPress websites using vulnerabilities or malicious functionalities in the GutenKit and Hunk Companion plugins. These plugins, if installed and active, could be exploited to compromise site integrity, potentially allowing attackers to execute unauthorized actions. Although no specific affected versions or known exploits in the wild have been identified yet, the campaign's scale and focus on popular WordPress plugins raise concerns. European organizations running WordPress sites with these plugins are at risk, especially those in countries with high WordPress adoption. Mitigation requires immediate auditing of installed plugins, removal or update of GutenKit and Hunk Companion plugins, and enhanced monitoring for suspicious activity. Given the medium severity and lack of detailed technical exploit data, the threat should be taken seriously but is not currently critical. Countries with large WordPress user bases and significant web infrastructure, such as Germany, the UK, France, Italy, and Spain, are most likely to be affected. Defenders should prioritize plugin hygiene and proactive threat detection to prevent compromise.

Campaign#infosecnews#redditGermany+7

Memento Labs is reportedly resurfacing as a cyber threat actor linked to the legacy of Hacking Team, a notorious surveillance software vendor known for supplying governments with offensive cyber tools. While concrete technical details and active exploits are currently minimal, the campaign's reemergence signals potential renewed activity in targeted cyber espionage or surveillance operations. There is no evidence of widespread exploitation or public exploits at this time, and the threat appears to be in early stages of observation. European organizations, especially those in government, defense, and critical infrastructure sectors, should be vigilant given Hacking Team's historical targeting patterns. Mitigation should focus on enhanced monitoring for advanced persistent threat (APT) behaviors, network segmentation, and strict access controls. Countries with significant government and defense industries, such as Germany, France, Italy, and the UK, are likely to be primary targets. Given the medium severity and lack of active exploitation, the threat should be considered medium risk but monitored closely for escalation. Defenders should prioritize threat intelligence sharing and proactive detection capabilities to identify any emerging indicators of compromise related to Memento Labs.

Campaign#infosecnews#redditGermany+7