Blind enumeration of gRPC services exploits subtle differences in error messages returned by gRPC servers when invalid requests are made. Attackers can map available services and methods even when server reflection is disabled, by sending crafted requests and analyzing error codes such as UNIMPLEMENTED, NOT_FOUND, and INVALID_ARGUMENT. This technique reveals service sprawl, method proliferation, and inconsistent authentication controls, often arising from partial migrations and fragmented development teams. Although crafting valid protobuf messages still requires additional effort, enumerating service existence significantly aids attackers in reconnaissance. The threat is particularly relevant for organizations using gRPC-based microservices architectures without strict security controls or proper network segmentation. European organizations with complex service deployments and legacy microservices are at risk of information disclosure and potential unauthorized access. Mitigation involves strict authentication enforcement on all methods, network segmentation of internal services, disabling or tightly controlling reflection endpoints, and regular audits for service sprawl and auth drift. Countries with strong technology sectors and widespread gRPC adoption, such as Germany, France, the UK, and the Netherlands, are most likely to be affected. The severity is assessed as medium due to the information disclosure nature, the need for some attacker effort, and the lack of direct remote code execution or data manipulation without further exploitation.
Over the past few weeks, Rapid7 has observed increased activity of a new threat group attacking AWS cloud environments with the goal of data exfiltration and subsequent extortion of the victim. This threat group refers to itself as ‘Crimson Collective’ and has recently announced that it is behind an attack on Red Hat, wherein it claims to have stolen private repositories from Red Hat’s GitLab.
There is a reported surge in AI-powered cyberattacks targeting Ukraine, attributed to Russia-linked threat actors. These attacks represent a campaign leveraging artificial intelligence techniques to enhance the sophistication and effectiveness of cyber operations. While specific technical details and exploited vulnerabilities are not disclosed, the use of AI suggests automation, improved evasion, and potentially novel attack vectors. The threat is assessed as medium severity due to limited public technical data and no known exploits in the wild. European organizations, especially those with geopolitical or strategic ties to Ukraine, may face indirect risks such as spillover or targeted attacks. Mitigation requires enhanced monitoring for AI-driven attack patterns, threat intelligence sharing, and tailored defenses beyond generic cybersecurity measures. Countries with close political, economic, or military connections to Ukraine, such as Poland, Germany, and the Baltic states, are more likely to be affected. Given the medium severity, defenders should prioritize awareness and preparedness for evolving AI-enabled threats in the regional cyber landscape.
GreyNoise has discovered that attacks exploiting Cisco, Fortinet, and Palo Alto Networks vulnerabilities are launched from the same infrastructure. The post Cisco, Fortinet, Palo Alto Networks Devices Targeted in Coordinated Campaign appeared first on SecurityWeek .
Supply chain attacks have surged by 250% from 2021 to 2024, with third-party vendor compromise accounting for 45% of incidents. These attacks have a longer average dwell time (287 days) compared to direct attacks (207 days), indicating significant detection challenges. The financial impact is substantial, with supply chain attacks costing an average of $5.12 million per incident. CISA has issued an emergency directive emphasizing zero-trust architecture, Software Bill of Materials (SBOM) requirements, and continuous vendor risk assessments to mitigate these threats. European organizations face heightened risks due to their reliance on complex vendor ecosystems and critical infrastructure. Countries with dense technology sectors and critical infrastructure, such as Germany, France, and the UK, are particularly vulnerable. Mitigation requires tailored vendor risk management, adoption of SBOM tools, and enhanced monitoring of supply chain interactions. Given the critical impact on confidentiality, integrity, and availability, ease of exploitation through trusted vendors, and broad scope, this threat is assessed as critical severity.
On June 8th, 2025, we received a submission through our Bug Bounty Program for an Authentication Bypass vulnerability in Service Finder Bookings, a WordPress plugin bundled with the Service Finder theme. This theme has been sold to approximately 6,000 customers. This vulnerability makes it possible for an unauthenticated attacker to gain access to any account on a site including accounts with the ‘administrator’ role. The vendor released the patched version on July 17, 2025, and we publicly disclosed this vulnerability on July 31, 2025.
The FileFix attack is a newly identified campaign that leverages cache smuggling techniques to bypass security software detection. By exploiting caching mechanisms, attackers can deliver malicious payloads that evade traditional scanning and filtering tools. This method complicates detection as the malicious content is hidden within cached data, making it less visible to security controls. Although no known exploits are currently active in the wild, the attack's high severity rating indicates significant potential risk. European organizations, especially those relying on caching proxies or web security gateways, could be targeted due to the attack's evasion capabilities. Mitigation requires advanced monitoring of cache behavior, strict validation of cached content, and deployment of security solutions capable of inspecting cached data. Countries with high adoption of web caching infrastructure and critical industries such as finance and manufacturing are more likely to be impacted. Given the attack's ability to compromise confidentiality and integrity without requiring user interaction, and its ease of exploitation through common caching mechanisms, the suggested severity is high. Defenders should prioritize understanding cache smuggling vectors and updating their security policies accordingly.
DraftKings recently detected and successfully thwarted a credential stuffing attack targeting its user accounts. Although the attack was blocked, the company has urged all users to reset their passwords and enable multi-factor authentication (MFA) to enhance account security. Credential stuffing involves attackers using large volumes of stolen username-password pairs from other breaches to gain unauthorized access. This type of attack exploits password reuse and weak authentication practices. While no known exploits are currently active in the wild, the incident highlights the ongoing risk posed by credential stuffing campaigns. European organizations with similar user-facing platforms should be vigilant against such attacks, especially given the widespread use of reused credentials. Implementing strong authentication controls and monitoring for unusual login patterns are critical. Countries with high online betting and gaming activity, such as the UK and Germany, may be more exposed. The threat is assessed as medium severity due to the potential for account compromise but mitigated by the lack of active exploitation and the availability of effective countermeasures.
A new wave of cyberattacks has been identified involving Chinese threat actors weaponizing the open-source Nezha tool. This campaign reportedly leverages Nezha, a remote administration tool (RAT), to achieve remote code execution (RCE) capabilities, enabling attackers to infiltrate and control targeted systems. While no specific affected software versions or known exploits in the wild have been documented yet, the campaign is assessed as high severity due to the potential impact of RCE and the strategic use of an open-source tool to evade detection. European organizations, especially those in critical infrastructure and technology sectors, face elevated risks due to the tool's capabilities and the geopolitical context. Mitigation requires focused detection of Nezha-related activity, network segmentation, and enhanced monitoring for unusual remote access behaviors. Countries with significant technology industries and geopolitical interest from China, such as Germany, France, the UK, and the Netherlands, are most likely to be targeted. Given the ease of exploitation through RCE and the broad scope of potential targets, the suggested severity is high. Defenders should prioritize threat hunting for Nezha indicators and strengthen endpoint security controls accordingly.
A new ASCII smuggling attack has been identified targeting Google's Gemini platform, with Google reportedly choosing not to address the vulnerability. ASCII smuggling involves encoding malicious payloads using ASCII characters to bypass security filters and input validation mechanisms. Although no known exploits are currently active in the wild, the attack vector poses a high risk due to its potential to evade detection and compromise system integrity. The lack of an official fix increases the threat's persistence and potential impact. European organizations using Gemini or related Google services could face risks including data breaches, unauthorized access, or service disruption. Mitigation requires enhanced input validation, monitoring for anomalous traffic patterns, and deploying advanced filtering techniques that detect obfuscated payloads. Countries with significant cloud adoption and reliance on Google services, such as Germany, France, and the UK, are more likely to be affected. Given the attack's ability to bypass defenses without user interaction and the high impact on confidentiality and integrity, the threat severity is assessed as high. Defenders should prioritize detection and containment strategies while advocating for vendor remediation.
The Mic-E-Mouse attack is a newly reported threat where compromised computer mice are exploited to capture audio conversations. This attack leverages the microphone capabilities embedded or accessible via certain computer mice to eavesdrop on users without their knowledge. Although no specific affected versions or exploits in the wild have been confirmed, the campaign is linked to advanced persistent threat (APT) actors, indicating a targeted and sophisticated approach. The attack does not require user interaction beyond normal mouse use, making it stealthy and potentially widespread. The severity is assessed as medium due to the targeted nature and complexity of exploitation. European organizations, especially those in sensitive sectors, could face confidentiality breaches if such devices are used within their environments. Mitigation requires strict hardware procurement policies, network segmentation, and monitoring for unusual device behavior. Countries with high adoption of advanced peripherals and significant strategic or governmental targets are more likely to be affected. Given the lack of patches or CVSS scoring, the threat is rated medium severity based on impact and exploitation factors.
A Chinese cybercrime group is operating a global SEO fraud campaign by compromising Microsoft IIS web servers. The attackers leverage these compromised servers to manipulate search engine rankings, likely redirecting traffic or injecting fraudulent content to benefit their SEO schemes. This campaign is high priority due to its global scale and the widespread use of IIS servers. Although no specific exploited vulnerabilities or CVEs are identified, the threat involves unauthorized access and control over web infrastructure, impacting confidentiality and integrity. European organizations running IIS servers are at risk of having their web assets abused for fraudulent purposes, potentially damaging reputation and causing indirect financial losses. Mitigation requires proactive server hardening, continuous monitoring for unauthorized changes, and rapid incident response. Countries with significant IIS deployment and high-value web infrastructure, such as Germany, the UK, France, and the Netherlands, are most likely to be affected. Given the ease of exploitation implied by compromised servers and the broad impact on availability and integrity, the suggested severity is high. Defenders should prioritize detection of unusual web server activity and ensure robust patching and access controls to prevent compromise.
A financially motivated cybercrime operation has been identified, targeting users with over 80 spoofed domain names and lure websites. The campaign, which began in September 2024, focuses on government tax sites, consumer banking, age 18+ social media content, and Windows assistant applications. The actors use these domains to deliver Android and Windows trojans, likely for credential theft. The operation employs common techniques such as spoofed domains and lure websites, prioritizing scale and conversion rates over technical sophistication. The most common lures exploit curiosity and desire, making victims less likely to report infections. Users are advised to be cautious when encountering unfamiliar links or download prompts.
New "Cavalry Werewolf" Attack Hits Russian Agencies with FoalShell and StallionRAT
Source: https://thehackernews.com/2025/10/new-cavalry-werewolf-attack-hits.html
A Chinese-speaking cybercrime group, UAT-8099, is targeting high-value Internet Information Services (IIS) servers for search engine optimization fraud and data theft. The group focuses on reputable servers in India, Thailand, Vietnam, Canada, and Brazil, affecting universities, tech firms, and telecom providers. UAT-8099 uses web shells, hacking tools, Cobalt Strike, and BadIIS malware to manipulate search rankings and maintain persistence. They exploit weak file upload settings, enable guest accounts, and use RDP for access. The group also steals valuable credentials, configuration files, and certificates. New BadIIS variants with low detection rates and Chinese debug strings have been identified. The attackers employ SEO techniques like backlinking and inject malicious JavaScript to redirect users to fraudulent websites.
Rhadamanthys, a complex multi-modular stealer, has released version 0.9.2 with significant updates. The malware now uses PNG files to deliver payloads, implements new evasion techniques, and introduces changes to its custom executable formats. Key modifications include a new message box mimicking Lumma stealer, updates to string encryption, and enhanced configurability. The malware continues to evolve, focusing on refinements and customization options while maintaining its core design. These changes aim to disrupt analysis tools and detection methods. The authors are professionalizing their operation, treating Rhadamanthys as a long-term business venture with tiered pricing and expanded product offerings.
An analysis of robots.txt files revealed over 60 cryptocurrency phishing pages impersonating hardware wallet brands Trezor and Ledger. The actor behind these pages attempted to block phishing reporting sites by including their endpoints in the robots.txt file, demonstrating a misunderstanding of its function. Most sites were hosted on Cloudflare Pages, with a few on custom domains. The campaign's unusual robots.txt pattern was also found in GitHub repositories containing crypto-themed spoof pages. Merge conflicts in README files suggest the actor may lack web development expertise. Various free web hosting providers were used for similar spoofed pages. The campaign highlights the ongoing targeting of cryptocurrency users and the potential effectiveness of even poorly executed phishing attempts.
