Threats tagged 'thehackernews.com'

A Python-based worm propagates through WhatsApp, spreading the Eternidade stealer malware primarily targeting Brazilian devices. This malware harvests sensitive information from infected systems, leveraging social engineering via WhatsApp to self-replicate and infect new victims. Although currently focused on Brazil, the worm's propagation method and malware payload pose risks to any WhatsApp users, including European organizations with employees or contacts linked to Brazil. The worm does not require complex exploits but relies on user interaction to propagate. There is no known CVSS score, but the threat is assessed as high severity due to its potential impact on confidentiality and ease of spread. Defenders should focus on user awareness, endpoint detection, and network monitoring to mitigate infection risks. Countries with strong economic or cultural ties to Brazil and high WhatsApp usage are more likely to be affected in Europe.

Malware#infosecnews#redditPortugal+6

A high-severity remote code execution (RCE) vulnerability identified as CVE-2025-11001 affects 7-Zip, leveraging symbolic link (symlink) handling flaws. Attackers can exploit this vulnerability to execute arbitrary code on affected systems by crafting malicious archives that abuse symlink processing during extraction. Although no known exploits are currently observed in the wild, active exploitation attempts have been reported, indicating an urgent threat. The vulnerability impacts users of 7-Zip, a widely used open-source file archiver, particularly on Windows platforms. European organizations relying on 7-Zip for file compression and decompression are at risk of compromise, potentially leading to data breaches, system takeover, and lateral movement within networks. Mitigation requires immediate patching once updates are available, restricting archive extraction privileges, and monitoring for suspicious archive handling activities. Countries with high adoption of 7-Zip in enterprise environments and critical infrastructure sectors, such as Germany, France, and the UK, are most likely to be targeted. Given the ease of exploitation without authentication and the potential for full system compromise, this vulnerability is assessed as critical. Defenders must prioritize awareness, implement compensating controls, and prepare for incident response related to this threat.

EPSS 27%Vulnerability#infosecnews#redditGermany+2

EdgeStepper is a sophisticated malware implant that manipulates DNS queries to hijack software update mechanisms, enabling the deployment of malicious payloads. By rerouting DNS requests, it intercepts and redirects legitimate update traffic to attacker-controlled servers, facilitating stealthy malware distribution. This technique undermines software supply chain integrity and can lead to widespread compromise of affected systems. The threat is classified as high severity due to its potential to impact confidentiality, integrity, and availability without requiring user interaction or authentication. European organizations relying on vulnerable software update infrastructures are at risk, especially those in critical sectors. Mitigation requires enhanced DNS monitoring, validation of update sources, and network segmentation to detect and block anomalous DNS behavior. Countries with significant technology sectors and critical infrastructure, such as Germany, France, and the UK, are likely to be most affected. Given the complexity and stealth of the attack vector, this threat demands urgent attention and tailored defensive measures.

Malware#infosecnews#redditGermany+6

The Tuoni Command and Control (C2) infrastructure was involved in a high-priority attempted cyber intrusion targeting the real-estate sector in 2025. While detailed technical indicators and affected software versions are not disclosed, the threat is characterized as a botnet operation with a high severity rating. The attack appears to be focused on leveraging Tuoni C2 to orchestrate malicious activities within real-estate organizations, potentially aiming at data exfiltration, disruption, or espionage. No known exploits in the wild have been reported yet, and the discussion around this threat remains minimal. European real-estate firms, especially in countries with significant property markets and digital infrastructure, could be at risk. Mitigation requires enhanced network monitoring for botnet-related traffic, strict segmentation of critical systems, and proactive threat hunting for Tuoni C2 indicators. Countries like the UK, Germany, France, and the Netherlands are likely to be most affected due to their large real-estate markets and historical targeting patterns. Given the high potential impact on confidentiality and availability, ease of botnet deployment, and lack of authentication barriers, the threat severity is assessed as high.

Botnet#infosecnews#redditGermany+5

A critical zero-day vulnerability has been discovered and actively exploited in the V8 JavaScript engine used by Google Chrome. Google has issued a security fix to address this flaw, which could allow attackers to execute arbitrary code or escalate privileges via crafted web content. Although no detailed technical specifics or CVE identifier are currently available, the vulnerability's active exploitation status and critical severity highlight the urgent need for patching. European organizations relying on Chrome browsers are at risk of compromise, especially those in sectors with high exposure to web-based threats. Mitigation requires immediate deployment of the latest Chrome updates and enhanced monitoring for suspicious browser activity. Countries with high Chrome usage and significant digital infrastructure, such as Germany, France, and the UK, are likely to be most affected. Given the ease of exploitation through web content and the potential for full system compromise, this vulnerability is assessed as critical. Defenders should prioritize patch management and user awareness to reduce exposure.

Vulnerability#infosecnews#redditGermany+2

The Dragon Breath threat actor uses the RONINGLOADER malware to disable security tools on compromised systems and subsequently deploys the Gh0st RAT remote access trojan. This multi-stage attack allows adversaries to gain persistent, stealthy access to victim networks, enabling espionage, data theft, and further lateral movement. The threat is considered high severity due to its capability to bypass defenses and deploy a powerful RAT without requiring user interaction once initial compromise occurs. European organizations with exposed endpoints or insufficient endpoint detection and response (EDR) solutions are at risk. Mitigation requires proactive detection of RONINGLOADER activity, hardening endpoint security, and network segmentation to limit RAT deployment impact. Countries with significant use of Windows-based enterprise environments and critical infrastructure are most likely affected, including Germany, France, the UK, Italy, and the Netherlands. Given the stealth and persistence of Gh0st RAT and the disabling of security tools, the suggested severity is high. Defenders should prioritize monitoring for loader activity and RAT communications to prevent data exfiltration and maintain operational integrity.

News#infosecnews#redditGermany+4

The adoption of the Rust programming language in Android development has driven memory safety bugs below 20% for the first time, marking a significant improvement in Android security. This reduction in memory-related vulnerabilities is attributed to Rust's inherent memory safety features, which prevent common issues like buffer overflows and use-after-free errors. While this news highlights positive progress rather than a direct threat, it reflects evolving security practices that impact vulnerability landscapes. European organizations relying on Android devices may benefit from improved platform security, reducing risks from memory corruption exploits. However, this is not a new vulnerability or active threat but rather an informative update on security trends. No known exploits are currently in the wild related to this topic. The severity is assessed as low since this is a security improvement rather than a threat. Defenders should continue to monitor Android updates and encourage adoption of safer coding practices. Countries with significant Android user bases and development ecosystems, such as Germany, France, and the UK, are most relevant to this trend. Overall, this is positive news indicating a reduction in memory safety vulnerabilities due to Rust adoption in Android codebases.

News#infosecnews#redditGermany+6

RondoDox is a botnet malware campaign actively exploiting unpatched XWiki servers to recruit additional devices into its network. The threat leverages known vulnerabilities in XWiki instances that remain unpatched, enabling remote compromise without authentication or user interaction. Once infected, these servers become part of the botnet, potentially used for distributed denial-of-service (DDoS) attacks, data exfiltration, or further propagation. European organizations running XWiki without timely patching are at heightened risk, especially those in sectors relying heavily on collaborative platforms. The threat is considered high severity due to ease of exploitation and potential widespread impact. Mitigation requires immediate patching of XWiki servers, network segmentation, and monitoring for unusual outbound traffic. Countries with significant XWiki adoption and strategic digital infrastructure, such as Germany, France, and the UK, are most likely to be targeted. Given the lack of CVSS scoring, the threat is assessed as high severity based on its impact and exploitation characteristics. Defenders should prioritize vulnerability management and incident detection to prevent botnet expansion.

Botnet#infosecnews#redditGermany+5

Five individuals in the U. S.have pleaded guilty to assisting North Korean IT workers in infiltrating 136 companies. This operation involved facilitating cyber intrusions attributed to North Korean threat actors targeting a wide range of organizations. The attacks likely aimed at espionage, intellectual property theft, and potential disruption. Although specific technical details of the intrusions are not provided, the scale and coordination indicate a sophisticated threat actor leveraging insider assistance. European organizations could be at risk due to interconnected global supply chains and shared technologies. The threat underscores the importance of monitoring insider threats and nation-state cyber activities. Mitigation requires enhanced vetting, network segmentation, and threat intelligence sharing. Countries with significant technology sectors and geopolitical interest in North Korea are more likely to be targeted.

News#infosecnews#redditGermany+7

The 'SpearSpecter' campaign is a high-severity espionage operation attributed to Iranian threat actors targeting defense and government entities. It involves sophisticated spear-phishing and possibly custom malware to infiltrate sensitive networks. While no specific vulnerabilities or exploits have been publicly disclosed, the campaign's focus on high-value targets indicates a strategic intent to gather intelligence. European defense and government organizations are at risk due to their geopolitical relevance and collaboration with global security partners. The threat actors likely employ stealthy tactics to maintain persistence and evade detection. Mitigation requires enhanced email filtering, network monitoring for anomalous activity, and strict access controls. Countries with significant defense industries and government institutions, such as the UK, Germany, France, and Italy, are most likely to be targeted. Given the campaign's espionage nature, ease of exploitation is moderate but impact on confidentiality is critical. Defenders should prioritize threat intelligence sharing and incident response readiness to counter this evolving threat.

Campaign#infosecnews#redditGermany+9

A high-priority cyber espionage campaign has been reported involving Chinese threat actors leveraging Anthropic's AI technology to automate their operations. This campaign represents an evolution in threat actor capabilities by integrating advanced AI to enhance attack automation and sophistication. Although no specific vulnerabilities or exploits are detailed, the use of AI suggests increased speed, scale, and adaptability in targeting. European organizations, especially those in critical infrastructure, government, and technology sectors, face heightened risks due to potential espionage and data exfiltration. Mitigation requires tailored defenses including AI threat detection, enhanced monitoring for automated attack patterns, and strict access controls. Countries with significant technological and industrial assets, such as Germany, France, and the UK, are likely primary targets. Given the campaign nature, lack of authentication requirements, and potential broad impact, the threat severity is assessed as high. Defenders should prioritize intelligence sharing and proactive AI-driven security measures to counter this emerging threat.

Campaign#infosecnews#redditGermany+6

The ransomware landscape is experiencing significant fragmentation, complicating defense efforts, while the notorious LockBit ransomware group has reemerged as a prominent threat. This resurgence signals a potential increase in targeted ransomware attacks leveraging LockBit's established infrastructure and tactics. European organizations, especially those in critical infrastructure and high-value sectors, face heightened risks due to LockBit's return and the broader ransomware ecosystem's instability. The fragmentation among ransomware groups may lead to more unpredictable attack vectors and increased competition, potentially escalating ransom demands and attack frequency. Defenders should prioritize monitoring for LockBit indicators, enhance incident response readiness, and implement targeted controls to mitigate ransomware risks. Countries with high digital infrastructure reliance and previous ransomware incidents, such as Germany, France, and the UK, are particularly vulnerable. Given the high impact on confidentiality, integrity, and availability, combined with ease of exploitation and no need for user interaction in some cases, this threat is assessed as high severity. Immediate, specific mitigation steps beyond generic advice are critical to reduce exposure and potential damage.

Malware#infosecnews#redditGermany+7

A recently patched vulnerability in Fortinet FortiWeb web application firewall products has been actively exploited to create unauthorized administrative accounts. This flaw allows attackers to escalate privileges by injecting admin-level credentials, potentially leading to full control over the affected devices. Although the vulnerability has been patched, exploitation attempts have been observed in the wild, highlighting the urgency for organizations to apply updates. The attack does not require user interaction but may require network access to the FortiWeb management interface. European organizations using FortiWeb appliances are at risk of unauthorized access, data compromise, and disruption of web application security controls. Immediate patching and monitoring for suspicious admin account creation are critical to mitigate this threat. Countries with significant Fortinet market presence and critical infrastructure relying on FortiWeb are particularly vulnerable. Given the ease of exploitation and high impact on confidentiality and integrity, this vulnerability is assessed as high severity. Defenders should prioritize deploying patches, auditing admin accounts, and restricting management interface access to trusted networks.

News#infosecnews#redditGermany+9

Russian threat actors have created approximately 4,300 fake travel websites designed to impersonate legitimate hotel booking platforms. These fraudulent sites aim to steal payment card data from unsuspecting hotel guests by capturing their payment information during the booking process. The campaign leverages phishing tactics and domain spoofing to deceive users into trusting these fake portals. There is no indication that these sites exploit software vulnerabilities; rather, they rely on social engineering and fraudulent web infrastructure. The threat poses a high risk to travelers and hospitality businesses, particularly in Europe where travel and tourism are significant economic sectors. Organizations should be vigilant about monitoring for fraudulent domains and educating customers about verifying legitimate booking sites. Mitigation involves enhanced domain monitoring, customer awareness campaigns, and deployment of anti-phishing technologies. Countries with large tourism industries and high volumes of international travelers, such as Spain, Italy, France, Germany, and the UK, are most likely to be targeted. Given the ease of exploitation and potential for significant financial theft, the severity of this threat is assessed as high.

Phishing#infosecnews#redditSpain+9

A large-scale spam attack has flooded the npm registry with over 67,000 fake packages, mimicking a worm-like propagation pattern. These counterfeit packages may contain malicious code or be used to distribute malware, posing significant risks to developers and organizations relying on npm for software dependencies. Although no known exploits in the wild have been reported yet, the sheer volume and automated nature of the attack increase the likelihood of accidental inclusion of malicious packages in projects. European organizations using npm extensively for development and production environments face risks including supply chain compromise, data breaches, and service disruptions. Mitigation requires enhanced package vetting, use of trusted package sources, dependency auditing, and implementation of strict CI/CD pipeline controls. Countries with strong software development sectors and high npm usage, such as Germany, the UK, France, and the Netherlands, are particularly vulnerable. Given the potential for widespread impact on confidentiality, integrity, and availability, and the ease of exploitation via automated package installation, this threat is assessed as high severity. Defenders must prioritize monitoring npm package sources and applying automated security tools to detect and block fake or malicious packages.

Malware#infosecnews#redditGermany+6

A critical vulnerability in WatchGuard Fireware has been flagged by CISA, exposing approximately 54,000 Firebox devices to no-login attacks. This flaw allows attackers to bypass authentication entirely, potentially gaining unauthorized access to affected devices. The vulnerability impacts network security appliances widely used for perimeter defense, increasing risks of network compromise, data breaches, and lateral movement within corporate networks. Although no known exploits are currently reported in the wild, the critical nature and scale of affected devices necessitate immediate attention. European organizations using WatchGuard Firebox devices are at heightened risk, especially those in sectors with stringent security requirements. Mitigation requires prompt patching once updates are available, network segmentation, and enhanced monitoring for anomalous access attempts. Countries with significant deployments of WatchGuard products and critical infrastructure reliance on these devices are more vulnerable. Given the ease of exploitation without authentication and the broad impact on confidentiality, integrity, and availability, this vulnerability is assessed as critical. Defenders should prioritize identification of affected devices and implement compensating controls while awaiting patches.

News#infosecnews#redditGermany+9

Google has filed a lawsuit against China-based hackers responsible for operating the Lighthouse phishing platform, which is estimated to have caused over $1 billion in damages. The Lighthouse platform is a large-scale phishing operation targeting various victims to steal credentials and sensitive information. Although no specific affected software versions or exploits are detailed, the threat is categorized as high severity due to its scale and financial impact. The phishing campaigns likely employ sophisticated social engineering techniques to deceive users into divulging confidential data. European organizations, especially those with significant digital presence and valuable intellectual property, could be targeted due to their strategic importance. Mitigation requires enhanced email security, user awareness training, and deployment of advanced threat detection systems tailored to phishing. Countries with high technology adoption and geopolitical relevance to China are more likely to be affected. Given the ease of phishing exploitation and the broad scope of potential victims, the threat severity is assessed as high. Defenders should prioritize phishing detection, incident response readiness, and cross-border intelligence sharing to mitigate risks.

Phishing#infosecnews#redditGermany+9

Amazon has uncovered active attacks exploiting previously unknown zero-day vulnerabilities in Cisco Identity Services Engine (ISE) and Citrix NetScaler products. These zero-day flaws allow attackers to potentially compromise critical network infrastructure components used for authentication, access control, and application delivery. Although no public exploits or patches are currently available, the critical severity indicates a high risk of unauthorized access and disruption. European organizations relying on Cisco ISE and Citrix NetScaler for secure network access and application delivery are at significant risk, especially in sectors like finance, government, and telecommunications. Immediate mitigation steps include enhanced monitoring, network segmentation, and applying vendor advisories once available. Countries with high adoption of these products and strategic infrastructure are most likely to be targeted. Given the critical impact on confidentiality, integrity, and availability, ease of exploitation, and lack of authentication requirement, this threat is assessed as critical severity. Defenders should prioritize detection of suspicious activity related to these platforms and prepare incident response plans accordingly.

GlassWorm malware has been discovered embedded within three Visual Studio Code extensions that have collectively been installed thousands of times. This malware targets developers by leveraging the popularity of VS Code extensions to infiltrate systems. Once installed, GlassWorm can execute malicious activities potentially compromising confidentiality and integrity of affected systems. Although no known exploits are currently active in the wild, the high severity rating indicates significant risk if exploited. European organizations using these extensions are at risk, especially those in software development and IT sectors. Mitigation requires immediate auditing of installed VS Code extensions, removal of suspicious ones, and monitoring for unusual activity. Countries with high adoption of VS Code and strong software development industries, such as Germany, France, and the UK, are most likely to be affected. The threat is considered high severity due to the potential impact on sensitive development environments and ease of distribution via trusted extension marketplaces. Defenders should prioritize verifying extension authenticity and applying strict controls on extension installation policies.

Malware#infosecnews#redditGermany+6

A large-scale phishing campaign named ClickFix is targeting hotel systems by delivering PureRAT malware. The attack uses phishing emails to trick hotel employees into executing malicious payloads, compromising system confidentiality and integrity. PureRAT is a remote access trojan capable of data exfiltration, credential theft, and persistent access. European hotel organizations face risks of operational disruption, data breaches, and reputational damage. The threat is high severity due to the malware's capabilities and the scale of the phishing campaign. Mitigation requires targeted employee training, enhanced email filtering, network segmentation, and endpoint detection tuned for RAT behaviors. Countries with significant tourism industries and large hospitality sectors, such as Spain, Italy, France, Germany, and the UK, are most likely affected. Given the ease of phishing exploitation and the critical nature of hospitality systems, this threat demands immediate attention from European cybersecurity teams.

Malware#infosecnews#redditSpain+7