A new wave of cyberattacks has been identified involving Chinese threat actors weaponizing the open-source Nezha tool. This campaign reportedly leverages Nezha, a remote administration tool (RAT), to achieve remote code execution (RCE) capabilities, enabling attackers to infiltrate and control targeted systems. While no specific affected software versions or known exploits in the wild have been documented yet, the campaign is assessed as high severity due to the potential impact of RCE and the strategic use of an open-source tool to evade detection. European organizations, especially those in critical infrastructure and technology sectors, face elevated risks due to the tool's capabilities and the geopolitical context. Mitigation requires focused detection of Nezha-related activity, network segmentation, and enhanced monitoring for unusual remote access behaviors. Countries with significant technology industries and geopolitical interest from China, such as Germany, France, the UK, and the Netherlands, are most likely to be targeted. Given the ease of exploitation through RCE and the broad scope of potential targets, the suggested severity is high. Defenders should prioritize threat hunting for Nezha indicators and strengthen endpoint security controls accordingly.
A new ransomware triad comprising DragonForce, LockBit, and Qilin is emerging with ambitions to dominate the ransomware landscape. These ransomware groups are known for leveraging remote code execution (RCE) vulnerabilities to infiltrate networks and deploy ransomware payloads. Although no specific exploits or affected software versions have been identified yet, the collaboration or concurrent activity of these groups signals a potential increase in ransomware attacks. The threat is currently assessed as medium severity due to the lack of confirmed exploits in the wild and limited technical details. European organizations, especially those in critical infrastructure and high-value sectors, could face increased ransomware risks if these groups target them. Mitigation requires proactive network monitoring, patch management, and incident response readiness tailored to ransomware attack vectors. Countries with significant digital infrastructure and history of ransomware targeting, such as Germany, France, and the UK, are likely to be most affected. Given the ransomware nature and potential for significant operational disruption, the suggested severity is high. Defenders should prioritize detection of ransomware behaviors, restrict lateral movement, and ensure robust backups to mitigate impact.
A phishing campaign leverages Zoom's document sharing feature to establish initial trust with victims. The attack directs users through a fake bot protection page before presenting a Gmail-like login interface to harvest credentials. Entered credentials are transmitted to the attacker via WebSocket and validated on the backend. This technique exploits user trust in Zoom and mimics legitimate Gmail login to increase success rates. The campaign is currently observed with minimal discussion and no known widespread exploitation. It poses a medium risk due to credential compromise potential without requiring advanced exploitation or vulnerabilities. European organizations using Gmail and Zoom are at risk, especially those with remote workforces relying on these platforms. Attackers can gain unauthorized access to email accounts, leading to data breaches and further attacks. Mitigation requires user awareness, multi-factor authentication enforcement, and monitoring for suspicious login attempts. Countries with high Zoom and Gmail usage and significant remote work adoption are most likely affected.
Salesforce has been targeted by widespread data theft attacks involving remote code execution (RCE) attempts. Despite the severity and scale of these breaches, Salesforce has publicly refused to pay ransom demands. The attacks indicate a significant compromise risk to customer data and internal systems, highlighting vulnerabilities in cloud service security. No specific affected versions or patches have been disclosed, and there are no known exploits in the wild yet. The threat is considered high severity due to the potential impact on confidentiality and integrity of sensitive data. European organizations relying on Salesforce services could face indirect impacts through data exposure or service disruption. Mitigation requires enhanced monitoring, strict access controls, and incident response readiness. Countries with high Salesforce adoption and critical cloud infrastructure are most at risk. The threat underscores the importance of robust cloud security practices and ransomware resilience strategies.
FreePBX is a popular PBX system built around the open source VoIP system Asterisk. To manage Asterisk more easily, it provides a capable web-based admin interface. Sadly, like so many web applications, it has had its share of vulnerabilities in the past. Most recently, a SQL injection vulnerability was found that allows attackers to modify the database.
Salesforce says the extortion attempts are related to past or unsubstantiated incidents, and not to fresh intrusions. The post Hackers Extorting Salesforce After Stealing Data From Dozens of Customers appeared first on SecurityWeek .
A critical unauthenticated remote code execution (RCE) vulnerability (CVE-2025-10547) was discovered and patched in DrayTek Vigor routers. The flaw can be exploited remotely via crafted HTTP/S requests to the device's web user interface, potentially causing memory corruption, system crashes, and arbitrary code execution without authentication. While remote WAN attacks can be mitigated by disabling remote WebUI and SSL VPN access or configuring ACLs, local network attackers may still exploit the vulnerability. DrayTek has released patches for 35 router models and urges immediate updates. The routers are widely used by prosumers and SMBs, making this a significant risk, especially given past ransomware campaigns targeting DrayTek devices. No exploitation in the wild has been reported yet, but the ease of exploitation and impact potential warrant urgent attention from European organizations using these routers.
FullHunt 💜 Open-Source: 39,408 Exploits from 0day.today is Back Online
Source: https://fullhunt.io/blog/2025/09/28/fullhunt-releases-0day-today-archive.html
Critical ForcedLeak Vulnerability in Salesforce Agentforce AI Agent Exposed CRM Data
Source: https://hackread.com/forcedleak-salesforce-agentforce-ai-agent-crm-data/
I wrote a hands on guide that shows how leaked webhooks surface as an attack vector; how to find them in the wild; how to craft safe non destructive PoCs; how to harden receivers. Includes curl examples for Slack and Discord; Node.js and Go HMAC verification samples; a disclosure template.
Why this matters
* webhooks are often treated as bearer secrets; leaks are common
* small mistakes in verification or ordering can become business logic bugs
* many real world impacts are serviceable without flashy RCE
What you get in the post
* threat model and scope guidance
* detection rules and SIEM ideas
Read it here: [https://blog.himanshuanand.com/posts/2025-09-17-how-to-hack-webhooks/](https://blog.himanshuanand.com/posts/2025-09-17-how-to-hack-webhooks/)
Notes: do not test endpoints you do not own.follow program scope and responsible disclosure rules.
Happy hunting
Google confirms fraudulent account created in law enforcement portal
Source: https://www.bleepingcomputer.com/news/security/google-confirms-hackers-gained-access-to-law-enforcement-portal/
FBI Warns of Salesforce attacks by UNC6040 and UNC6395
Source: https://securityaffairs.com/182159/cyber-crime/fbi-warns-of-salesforce-attacks-by-unc6040-and-unc6395-groups.html
FBI Warns of UNC6040 and UNC6395 Targeting Salesforce Platforms in Data Theft Attacks
Source: https://thehackernews.com/2025/09/fbi-warns-of-unc6040-and-unc6395.html
