Campaign threats

The SideWinder threat actor group has adopted a new attack chain leveraging Microsoft's ClickOnce deployment technology to target South Asian diplomats. This campaign uses ClickOnce to deliver malicious payloads, exploiting trust in legitimate Microsoft frameworks to bypass security controls. The attacks are highly targeted, focusing on diplomatic personnel, which suggests espionage motives. Although no known exploits are currently reported in the wild, the campaign's sophistication and targeting elevate its risk. European organizations with diplomatic ties or South Asian connections could face indirect risks, especially if involved in related geopolitical activities. Mitigation requires strict control over ClickOnce application execution, enhanced email filtering, and user awareness training focused on this attack vector. Countries with significant diplomatic engagement with South Asia or hosting South Asian diplomatic missions are more likely to be affected. Given the high impact on confidentiality and the ease of exploitation via social engineering, the suggested severity is high.

Campaign#infosecnews#redditGermany+7

A new phishing campaign named CoPhish targets users of Copilot Studio agents to steal OAuth tokens, enabling attackers to hijack user sessions and access sensitive resources. This attack leverages social engineering to trick users into authorizing malicious OAuth applications or interacting with compromised Copilot Studio agents. The stolen tokens can grant attackers unauthorized access to cloud services and enterprise applications without needing user credentials. The campaign is recent and considered high severity due to the potential for widespread token theft and session hijacking. No known exploits in the wild have been reported yet, but the threat is credible given the trusted source and recent discovery. European organizations using Copilot Studio or similar OAuth-based integrations are at risk, especially those heavily reliant on cloud services. Mitigation requires targeted user awareness, strict OAuth app permission reviews, and enhanced monitoring of token usage. Countries with significant cloud adoption and technology sectors, such as Germany, the UK, France, and the Netherlands, are likely more exposed. The attack does not require system vulnerabilities but exploits user trust and OAuth token handling, making it relatively easy to execute. The suggested severity is high due to the impact on confidentiality and integrity without requiring credential theft or complex exploits.

Campaign#infosecnews#redditGermany+5

The Russian agricultural regulatory agency Rosselkhoznadzor was targeted by a distributed denial-of-service (DDoS) attack, causing delays in food shipments across Russia. This attack disrupted the agency's online services, impacting its ability to process and manage food shipment logistics. Although no direct exploitation of software vulnerabilities was reported, the attack highlights the risk of service disruption to critical supply chain infrastructure. The attack's medium severity reflects its impact on availability rather than confidentiality or integrity. European organizations involved in agricultural trade or supply chains linked to Russia could face indirect effects such as delays or increased scrutiny. Mitigation should focus on enhancing DDoS resilience through traffic filtering, capacity scaling, and incident response planning. Countries with strong trade ties to Russia and significant agricultural sectors, such as Germany, Poland, and the Netherlands, are more likely to be affected. Given the attack's nature and impact, the suggested severity is medium due to the disruption of availability without evidence of data compromise or exploitation complexity.

Campaign#infosecnews#redditGermany+5

A large-scale smishing campaign, attributed to the China-based Smishing Triad, is targeting global users with fraudulent SMS messages impersonating toll violations and package delivery issues. The campaign has expanded internationally, targeting critical sectors such as banking, healthcare, and law enforcement by using realistic phishing pages to harvest sensitive data. It operates via a decentralized infrastructure with over 194,000 malicious domains registered since early 2024, primarily through a Hong Kong-based registrar. This phishing-as-a-service operation leverages sophisticated social engineering to maximize victim engagement. The campaign poses a significant threat to individuals and organizations worldwide, including European entities, due to the broad targeting and sector diversity. No known exploits in the wild have been reported, but the scale and complexity indicate a persistent and evolving threat. Defenders should focus on advanced SMS filtering, user awareness, and domain monitoring to mitigate risks. The threat is assessed as medium severity given its impact on confidentiality and ease of exploitation without requiring authentication but does not directly affect system availability.

Campaign#phaas#phishingGermany+10

A financially motivated Vietnamese threat actor group UNC6229 is conducting a campaign using fake job postings on legitimate platforms to target remote workers in digital advertising and marketing. They create credible fake company profiles and lure victims with attractive remote job offers. Upon victim engagement, they deliver malware attachments or phishing links, often leveraging legitimate business and CRM platforms to increase trust. The goal is to steal credentials and compromise high-value corporate and digital advertising accounts. The campaign relies heavily on social engineering and victim-initiated contact. Indicators include malware hashes and a suspicious domain (staffvirtual.website). This medium-severity threat poses risks to confidentiality and integrity of corporate accounts, especially in organizations with remote digital advertising staff.

Campaign#fake job postings#credential theftGermany+5

The Shadow Escape 0-Click attack targets AI assistants, enabling exploitation without user interaction and potentially exposing trillions of records. This novel attack vector leverages vulnerabilities in AI assistant platforms to bypass security controls silently. Although no known exploits are currently active in the wild, the threat poses a medium severity risk due to its potential scale and stealth. European organizations relying on AI assistants for sensitive data processing could face confidentiality breaches and operational disruptions. Mitigations require proactive security assessments of AI assistant integrations, strict access controls, and anomaly detection tailored to AI interaction patterns. Countries with high AI adoption in enterprise and government sectors, such as Germany, France, and the UK, are most likely to be affected. Given the attack's zero-click nature and broad impact potential, the suggested severity is high. Defenders should prioritize monitoring AI assistant platforms for unusual behavior and apply rigorous security hygiene to minimize attack surfaces.

Campaign#infosecnews#redditGermany+5

The PhantomCaptcha RAT campaign targets aid organizations supporting Ukraine by deploying a Remote Access Trojan (RAT) to infiltrate their systems. This threat is associated with an advanced persistent threat (APT) actor, aiming to gather intelligence or disrupt operations. The attack leverages social engineering or phishing to deliver the RAT payload, enabling attackers to gain unauthorized access and control over victim machines. European aid groups involved in Ukraine support are at risk due to their direct involvement and potential exposure. The campaign is currently assessed as medium severity, with no known public exploits but significant operational impact potential. Mitigation requires targeted defenses including enhanced email filtering, endpoint detection, and strict access controls. Countries with strong ties to Ukraine aid efforts, such as Poland, Germany, and the Baltic states, are most likely to be affected. The threat poses a medium risk due to the need for user interaction and targeted nature but can lead to serious confidentiality and operational impacts if successful. Defenders should prioritize awareness training and network segmentation to limit the RAT's effectiveness.

Campaign#infosecnews#redditPoland+6

The Iran-linked threat actor group MuddyWater has launched a global espionage campaign targeting over 100 organizations worldwide. This campaign focuses on intelligence gathering and is characterized by high-priority targeting of entities likely involved in sensitive sectors. Although specific technical details and exploited vulnerabilities are not disclosed, MuddyWater is known for using sophisticated tactics including spear-phishing and custom malware. The campaign poses significant risks to confidentiality and integrity of targeted organizations’ data. European organizations, especially those in critical infrastructure, government, and defense sectors, are at heightened risk due to their strategic value. Mitigation requires enhanced threat hunting, network monitoring for MuddyWater TTPs, and strict access controls. Countries with strong geopolitical ties or adversarial relations with Iran, and those with high adoption of targeted technologies, are more likely to be affected. Given the espionage nature, ease of exploitation is moderate but impact on confidentiality is high, warranting a high severity rating. Defenders should prioritize detection of MuddyWater indicators and implement proactive cyber threat intelligence sharing.

Campaign#infosecnews#redditGermany+9

The Jingle Thief campaign, conducted by financially motivated threat actors from Morocco, targets global enterprises in retail and consumer services sectors to execute gift card fraud. Using phishing and smishing tactics, the attackers gain access to Microsoft 365 environments, exploiting cloud services for reconnaissance, lateral movement, and persistence. They focus on compromising gift card issuance systems, leveraging internal documentation and communication channels. The campaign demonstrates sophisticated techniques, including tailored phishing, internal email manipulation, and device registration abuse. The attackers maintain long-term access, sometimes over a year, making detection challenging. Their activities often align with holiday periods to maximize impact.

Campaign#microsoft 365#phishingUnited Kingdom+7

Salt Typhoon is an advanced persistent threat (APT) group identified as targeting global telecommunications and energy sectors. The campaign was recently reported by Darktrace and highlighted in infosec news sources. While specific technical details and indicators of compromise are limited, the group’s focus on critical infrastructure sectors suggests a strategic intent to disrupt or gather intelligence from vital services. The threat is assessed as medium severity due to the lack of known exploits in the wild and minimal public technical details, but the potential impact on confidentiality and availability in critical sectors remains significant. European telecom and energy organizations are at risk given the continent's reliance on these sectors for economic stability and national security. Mitigation should focus on enhanced network monitoring, anomaly detection, and threat hunting tailored to APT behaviors. Countries with large telecom and energy infrastructures, such as Germany, France, the UK, Italy, and Spain, are most likely to be affected. Given the medium severity, organizations should prioritize proactive defense measures and incident response readiness to mitigate potential disruptions or espionage activities.

Campaign#infosecnews#redditGermany+6

The PolarEdge botnet campaign targets routers from Cisco, ASUS, QNAP, and Synology to expand its network of compromised devices. This campaign leverages vulnerabilities or weak configurations in these widely used routers to enlist them into a botnet, potentially enabling large-scale distributed denial-of-service (DDoS) attacks, data interception, or further lateral movement. Although no known exploits are currently reported in the wild, the campaign is considered high priority due to the critical role these devices play in network infrastructure. European organizations using these brands are at risk, especially those with less stringent router security practices. The campaign's expansion highlights the ongoing threat posed by botnets exploiting IoT and network edge devices. Defenders should focus on hardening router configurations, applying firmware updates, and monitoring network traffic for anomalies. Countries with high adoption of these router brands and significant digital infrastructure are more likely to be targeted. Immediate mitigation steps can reduce the risk of compromise and limit the botnet's growth.

Campaign#infosecnews#redditGermany+9

A new tech support scam campaign exploits Microsoft's trusted brand to deceive users. It starts with phishing emails promising payments, leading victims to fake CAPTCHA challenges. After completion, users are redirected to a browser-locked landing page mimicking ransomware, with multiple pop-ups resembling Microsoft security alerts. These pop-ups urge victims to call a fraudulent support number, enabling phone-based social engineering. The scam combines browser manipulation, phishing, and social engineering to potentially gain system access. No direct malware or exploits are involved, but the psychological manipulation can lead to financial loss or unauthorized access. The campaign underscores the risks of trusting familiar branding without verification and highlights the need for user awareness and layered defenses. Indicators include multiple malicious URLs and domains used in the campaign. The threat is medium severity due to its social engineering nature and potential impact on confidentiality and integrity.

Campaign#microsoft impersonation#browser manipulationGermany+9

The Russian Lynk group has leaked sensitive files from the UK Ministry of Defence (MoD), including detailed information on eight military bases. This data breach represents a significant compromise of confidential military information, potentially exposing critical infrastructure and operational details. The leak was reported via a Reddit InfoSec news post linking to an external article, with minimal public discussion so far. Although no specific technical exploitation details or affected software versions are provided, the leak's nature suggests a targeted campaign against UK defense assets. The breach poses a high risk to confidentiality and national security, with potential ramifications for allied European countries. Immediate mitigation involves reviewing access controls, enhancing monitoring for related threat actor activity, and conducting thorough incident response. European countries with close military cooperation with the UK or shared defense infrastructure are most likely to be affected. Given the sensitivity and potential impact, this threat is assessed as high severity despite the absence of a CVSS score.

Campaign#infosecnews#redditFrance+7

The MSS alleges that the NSA conducted a sophisticated multi-stage cyberattack on Beijing's time synchronization systems using 42 distinct cyber tools. This campaign reportedly involved complex intrusion techniques targeting critical infrastructure components responsible for timekeeping. While specific technical details and exploited vulnerabilities remain undisclosed, the scale and coordination suggest a high level of operational capability. The attack's potential impact includes disruption of time-dependent services, which could cascade into broader operational failures. European organizations relying on synchronized time for financial transactions, telecommunications, and critical infrastructure could face indirect risks if similar tactics are employed or if supply chains are affected. Mitigation requires enhanced monitoring of time synchronization systems, strict network segmentation, and collaboration with international cybersecurity entities. Countries with significant critical infrastructure and advanced cyber capabilities, such as Germany, France, and the UK, are most likely to be affected or targeted in analogous campaigns. Given the complexity, potential impact, and lack of authentication barriers, the threat severity is assessed as high. Defenders should prioritize detection of multi-stage intrusions and protect time-critical systems accordingly.

Campaign#infosecnews#redditGermany+5

American Airlines subsidiary Envoy has confirmed a data theft incident involving Oracle systems. The attack resulted in unauthorized access and exfiltration of sensitive data, although specific technical details and exploited vulnerabilities remain undisclosed. This incident highlights risks to supply chain and subsidiary infrastructures within major corporations. European organizations using Oracle products or connected to American Airlines or its subsidiaries could face indirect impacts, especially regarding data privacy and regulatory compliance. Mitigation should focus on enhanced monitoring of Oracle environments, strict access controls, and incident response readiness. Countries with significant aviation sectors and Oracle deployments, such as the UK, Germany, and France, are more likely to be affected. Given the high potential impact on confidentiality and the lack of detailed exploitation information, the threat severity is assessed as high. Defenders should prioritize verifying system integrity, reviewing Oracle account activities, and ensuring rapid containment capabilities.

Campaign#infosecnews#redditGermany+5

Europol has dismantled a SIM box operation that rented out phone numbers to facilitate various cybercrime activities. SIM boxes are devices that use multiple SIM cards to route calls over the internet, often enabling fraud, spam, and evasion of telecommunication controls. This operation's takedown disrupts a critical enabler for cybercriminals who rely on rented numbers to mask their identities and conduct illicit activities. European organizations face risks from such schemes as they can be targeted by fraud, phishing, and other attacks leveraging these rented numbers. The threat is high due to the scale and sophistication of the operation, although no direct exploits or vulnerabilities are involved. Mitigation requires enhanced telecommunication monitoring, collaboration with law enforcement, and improved detection of anomalous call patterns. Countries with significant telecom infrastructure and high cybercrime activity, such as the UK, Germany, France, Italy, and the Netherlands, are most likely affected. The severity is assessed as high given the impact on confidentiality and fraud potential, ease of exploitation by criminals, and broad scope of affected telecom services. Defenders should prioritize monitoring for SIM box activity and cooperate with authorities to reduce the availability of rented numbers for cybercrime.

Campaign#infosecnews#redditGermany+6

Hidden links are a Black Hat SEO technique where attackers inject invisible HTML blocks containing links to unrelated, often malicious or adult-themed websites into compromised websites. This manipulation harms the website's reputation, degrades search engine rankings, and can lead to legal and trust issues. Attackers typically exploit vulnerabilities in content management systems (CMS) or compromise administrator accounts to insert these hidden links. Detection involves thorough website content audits and monitoring for unauthorized changes. Mitigation requires using licensed CMS solutions, timely software updates, strong authentication, and continuous security monitoring. Although this threat does not directly compromise data confidentiality or availability, it impacts website integrity and business reputation. European organizations with public-facing websites, especially those relying heavily on organic search traffic, are at risk. Countries with high CMS adoption and significant e-commerce or digital presence are more likely to be targeted. The suggested severity is medium due to the moderate impact on integrity and reputation, ease of exploitation via common CMS vulnerabilities, and no direct data breach or service disruption involved.

Campaign#seo spam#website securityGermany+7

A phishing campaign is impersonating LastPass by sending scam emails with alarming subjects like 'We Have Been Hacked' to trick users into clicking malicious links. These links lead to fake websites hosted on domains such as lastpassdesktop.com, designed to steal credentials and secret keys, potentially compromising users' password vaults. LastPass has confirmed it has not been breached and is actively working with partners like Cloudflare to take down these fraudulent domains and warn users. Similar phishing attacks have targeted other password managers, increasing the risk to users relying on these services. The campaign leverages social engineering tactics to create urgency and exploit trust in the LastPass brand. No direct system vulnerabilities are exploited, but the threat targets user credentials through deception. European organizations using LastPass or similar password managers are at risk of credential theft if users fall for these scams. Mitigation requires user education, domain blocking, and enhanced email filtering to detect and prevent phishing attempts.

Campaign#phishing#credential theftGermany+9

The China-linked advanced persistent threat (APT) group known as Jewelbug has conducted a rare cross-nation cyberattack targeting a Russian IT provider. This campaign represents an unusual geopolitical targeting pattern, as it involves a Chinese APT focusing on a Russian entity. The attack is characterized by medium severity, with no known exploits in the wild or publicly disclosed technical details. The campaign was reported recently and is considered newsworthy due to its geopolitical implications and the involvement of a sophisticated threat actor. There are no specific affected software versions or vulnerabilities disclosed, and the attack details remain limited. European organizations should be aware of potential indirect impacts, especially those with ties to Russian IT infrastructure or supply chains. Mitigation should focus on enhanced monitoring for APT tactics, supply chain security, and cross-border intelligence sharing. Countries with significant IT service dependencies on Russian providers or geopolitical interest in Sino-Russian relations are more likely to be affected. Given the medium severity and limited technical details, the threat requires vigilance but does not currently indicate an immediate critical risk to European entities.

Campaign#infosecnews#redditGermany+6

A recently reported security concern involves the ability to bypass OpenAI’s Guardrails using simple prompt injection attacks. These attacks manipulate the input prompts to override or circumvent the safety and content filtering mechanisms embedded in OpenAI’s language models. While no known exploits are currently active in the wild, the vulnerability highlights risks in relying solely on prompt-based controls for AI safety. The attack does not require complex technical skills, making it accessible to a broad range of adversaries. The medium severity rating reflects the moderate impact potential, given that exploitation could lead to generation of harmful, misleading, or unauthorized content. European organizations using OpenAI’s services or integrating these models into their products should be aware of this threat. Mitigation requires a combination of improved prompt handling, additional layers of content validation, and monitoring for anomalous outputs. Countries with significant AI adoption and technology sectors, such as Germany, France, and the UK, are more likely to be affected. The threat underscores the need for robust AI security practices beyond current guardrails.

Campaign#infosecnews#redditGermany+7