The Bitter APT group is leveraging an old WinRAR vulnerability combined with malicious Office files to deploy new backdoor attacks. This threat involves exploitation of legacy software flaws to gain initial access and then use weaponized Office documents to establish persistence and control. Although no known exploits in the wild have been confirmed, the attack vector is notable due to the use of widely deployed software and common attack techniques. The medium severity rating reflects moderate impact potential, considering the age of the vulnerability and the complexity of the attack chain. European organizations using outdated WinRAR versions and handling Office documents are at risk, especially those in sectors targeted by APT groups. Mitigation requires patching or removing vulnerable WinRAR versions, enhancing email filtering, and applying strict macro and attachment policies. Countries with high usage of WinRAR and significant exposure to APT activity, such as Germany, France, and the UK, are more likely to be affected. The threat's exploitation complexity and lack of authentication requirements suggest a medium severity level. Defenders should prioritize detection of suspicious Office files and monitor for unusual backdoor activity linked to this campaign.
Salt Typhoon is an advanced persistent threat (APT) group identified as targeting global telecommunications and energy sectors. The campaign was recently reported by Darktrace and highlighted in infosec news sources. While specific technical details and indicators of compromise are limited, the group’s focus on critical infrastructure sectors suggests a strategic intent to disrupt or gather intelligence from vital services. The threat is assessed as medium severity due to the lack of known exploits in the wild and minimal public technical details, but the potential impact on confidentiality and availability in critical sectors remains significant. European telecom and energy organizations are at risk given the continent's reliance on these sectors for economic stability and national security. Mitigation should focus on enhanced network monitoring, anomaly detection, and threat hunting tailored to APT behaviors. Countries with large telecom and energy infrastructures, such as Germany, France, the UK, Italy, and Spain, are most likely to be affected. Given the medium severity, organizations should prioritize proactive defense measures and incident response readiness to mitigate potential disruptions or espionage activities.
Russian threat actors have evolved a malware campaign that leverages fake "I am not a robot" CAPTCHA prompts to deliver malicious payloads. This technique abuses user trust in CAPTCHA interfaces to trick victims into executing malware, potentially leading to system compromise. The malware is associated with advanced persistent threat (APT) groups and represents a high-severity risk due to its social engineering vector and stealthy delivery. Although no known exploits are currently active in the wild, the campaign's sophistication and targeting suggest a significant threat to organizations, especially those with high user interaction and web-facing services. European organizations are at risk given the widespread use of CAPTCHA mechanisms and the geopolitical focus on this region. Mitigation requires enhanced user awareness, web filtering, and endpoint detection tuned to identify unusual CAPTCHA-related behaviors. Countries with large digital economies and critical infrastructure in Europe are most likely targets. The threat is assessed as high severity due to the potential for confidentiality breaches, ease of exploitation via social engineering, and the broad scope of affected systems without requiring prior authentication or complex user interaction beyond clicking a fake CAPTCHA.
The China-linked advanced persistent threat (APT) group known as Jewelbug has conducted a rare cross-nation cyberattack targeting a Russian IT provider. This campaign represents an unusual geopolitical targeting pattern, as it involves a Chinese APT focusing on a Russian entity. The attack is characterized by medium severity, with no known exploits in the wild or publicly disclosed technical details. The campaign was reported recently and is considered newsworthy due to its geopolitical implications and the involvement of a sophisticated threat actor. There are no specific affected software versions or vulnerabilities disclosed, and the attack details remain limited. European organizations should be aware of potential indirect impacts, especially those with ties to Russian IT infrastructure or supply chains. Mitigation should focus on enhanced monitoring for APT tactics, supply chain security, and cross-border intelligence sharing. Countries with significant IT service dependencies on Russian providers or geopolitical interest in Sino-Russian relations are more likely to be affected. Given the medium severity and limited technical details, the threat requires vigilance but does not currently indicate an immediate critical risk to European entities.
A Secure Boot bypass vulnerability has been identified affecting nearly 200,000 Linux Framework laptops. This flaw allows attackers to circumvent Secure Boot protections, potentially enabling unauthorized code execution during system startup. Although no known exploits are currently active in the wild, the risk is rated high due to the critical role of Secure Boot in maintaining system integrity. The vulnerability primarily impacts Linux Framework laptops, a niche but growing hardware platform popular among security-conscious users. European organizations using these devices could face increased risk of firmware-level compromise, threatening confidentiality and system trustworthiness. Mitigation is complicated by the lack of available patches and requires careful firmware validation and monitoring. Countries with higher adoption of Linux Framework laptops and strategic technology sectors are more likely to be affected. Given the ease of exploitation at the boot level and the broad impact on system integrity, the threat severity is assessed as high. Defenders should prioritize firmware integrity checks and restrict physical access to vulnerable devices to reduce risk.
Threat actors have begun leveraging the Velociraptor digital forensics and incident response (DFIR) tool as part of ransomware attack campaigns. Velociraptor, originally designed for legitimate forensic investigations and incident response, is being repurposed by attackers to facilitate lateral movement, reconnaissance, and data collection within compromised networks. This misuse enhances attackers' ability to identify valuable targets and escalate privileges before deploying ransomware payloads. The threat is considered high severity due to the tool's powerful capabilities, ease of use, and the significant impact ransomware attacks can have on confidentiality, integrity, and availability of systems. European organizations, especially those with critical infrastructure and large enterprise environments, face increased risk given the tool’s effectiveness in complex networks. Mitigation requires tailored detection of Velociraptor usage patterns, strict endpoint monitoring, and network segmentation to limit attacker movement. Countries with high adoption of enterprise IT infrastructure and critical sectors such as finance, manufacturing, and government are most likely to be targeted. Given the lack of a CVSS score, the threat is assessed as high severity due to the potential for widespread disruption, ease of exploitation by skilled attackers, and the critical nature of impacted assets.
The Mic-E-Mouse attack is a newly reported threat where compromised computer mice are exploited to capture audio conversations. This attack leverages the microphone capabilities embedded or accessible via certain computer mice to eavesdrop on users without their knowledge. Although no specific affected versions or exploits in the wild have been confirmed, the campaign is linked to advanced persistent threat (APT) actors, indicating a targeted and sophisticated approach. The attack does not require user interaction beyond normal mouse use, making it stealthy and potentially widespread. The severity is assessed as medium due to the targeted nature and complexity of exploitation. European organizations, especially those in sensitive sectors, could face confidentiality breaches if such devices are used within their environments. Mitigation requires strict hardware procurement policies, network segmentation, and monitoring for unusual device behavior. Countries with high adoption of advanced peripherals and significant strategic or governmental targets are more likely to be affected. Given the lack of patches or CVSS scoring, the threat is rated medium severity based on impact and exploitation factors.
APT SideWinder has launched a new targeted operation dubbed Operation SouthNet, focusing on the maritime sector in South Asia, particularly Pakistan and Sri Lanka. The group leverages free hosting platforms to deploy credential-harvesting portals and weaponized lure documents, while staging malware in open directories. Over 50 malicious domains were uncovered across various platforms, with Pakistan accounting for 40% of the identified domains. The campaign utilizes maritime and port-themed lures to target government and military entities. SideWinder's infrastructure overlaps with legacy C2 assets, indicating recycling across multiple years. The group maintains a high operational tempo, with new phishing domains emerging every 3-5 days.
A new campaign targeting telecommunications and manufacturing sectors in Central and South Asian countries has been discovered, delivering a new variant of PlugX. The campaign, active since 2022, shows overlaps between RainyDay and Turian backdoors, including the abuse of legitimate applications for DLL sideloading and shared encryption methods. The new PlugX variant's configuration format resembles that of RainyDay, suggesting attribution to Naikon. Analysis of victimology and technical implementation indicates a potential connection between Naikon and BackdoorDiplomacy, possibly sourcing tools from the same vendor. The malware families use similar infection chains, loaders, and shellcode structures, with shared RC4 keys for payload decryption. This campaign highlights the evolving tactics of Chinese-speaking threat actors and the potential collaboration between previously distinct groups.
This analysis examines the Bookworm malware family and its connection to the Chinese APT group Stately Taurus. Using a structured attribution framework, the study evaluates tactics, tooling, operational security, infrastructure, victimology and timelines to establish a high-confidence link between Bookworm and Stately Taurus. Key evidence includes shared program database paths, overlapping command and control infrastructure, and consistent targeting of Southeast Asian governments. The framework assigns scores to each piece of evidence, resulting in an overall attribution confidence score of 58.4 out of 100, indicating strong confidence in the connection. This systematic approach aims to improve analytical rigor and collaboration in threat intelligence.
A new multi-stage ClickFix campaign, attributed to the Russia-linked APT group COLDRIVER, has been discovered targeting Russian civil society members. The campaign employs social engineering techniques to trick users into executing malicious commands, leading to the deployment of two new malware families: BAITSWITCH (a downloader) and SIMPLEFIX (a PowerShell-based backdoor). The attack chain involves a fake Cloudflare Turnstile checkbox, persistence establishment, and data exfiltration. COLDRIVER's tactics include using server-side checks, obfuscation techniques, and targeting specific file types for intelligence collection. The group's focus on NGOs, human rights defenders, and Russian exiles aligns with their known victimology.
Moonlock Lab researchers have spotted a new macOS malware campaign that leverages **malvertising + fake social media profiles** to distribute malicious apps. Once installed, the malware exfiltrates sensitive data and can be updated remotely with new modules. This trend shows that macOS is no longer “low priority” for attackers – they’re actively adapting Windows-style tactics for Apple’s ecosystem.
In late July 2025, an organized APT attack using shortcut files was discovered, attributed to the North Korean Kimsuky group. The attackers distribute decoy zip files containing password-protected documents and a disguised shortcut file. When executed, it connects to a C2 server, downloads encrypted payloads, and performs various malicious activities. These include collecting sensitive information from browsers, cryptocurrency wallets, messaging apps, and system files. The collected data is encrypted and sent to the C2 server, which can issue additional commands for remote execution. The attack employs anti-VM techniques and establishes persistence through registry modifications. It also includes a separate malicious DLL for browser process injection.
A campaign targeting telecommunications and manufacturing sectors in Central and South Asian countries has been discovered, delivering a new PlugX variant. The campaign, active since 2022, shows overlaps with RainyDay and Turian backdoors, including the abuse of legitimate applications for DLL sideloading and shared encryption methods. The new PlugX variant's configuration format resembles that of RainyDay, suggesting attribution to Naikon. Analysis of victimology and technical implementation indicates a potential connection between Naikon and BackdoorDiplomacy, possibly sourcing tools from the same vendor. The malware families use similar infection chains, loaders, and shellcode structures, with shared RC4 keys for payload decryption. This campaign highlights the evolving tactics of Chinese-speaking threat actors and the potential convergence of previously distinct groups.
The Iranian threat actor Nimbus Manticore has expanded its operations, targeting defense, telecommunications, and aviation sectors in Western Europe. The group uses sophisticated spear-phishing techniques, impersonating HR recruiters to lure victims to fake career portals. Their toolset includes the MiniJunk backdoor and MiniBrowse stealer, which have evolved to employ advanced evasion techniques like multi-stage DLL sideloading, heavy obfuscation, and code signing. The malware infrastructure leverages Azure App Services for resilient command and control. Nimbus Manticore's recent activities demonstrate increased focus on stealth, operational security, and expanding their targeting to align with Iranian strategic priorities.
A recent analysis of a suspicious trojan loader reveals similarities to the APT-C-00 (Ocean Lotus) group, a government-backed hacker organization targeting East Asian companies and government agencies. The sample, a DLL file with excellent evasion capabilities, uses hash algorithms to dynamically obtain API functions. It creates a mutex for single-instance execution, validates command-line parameters, adds itself to the registry for persistence, and sets up a VEH exception handler. The loader employs module hollowing to replace code in certmgr.dll with shellcode that reflectively loads the Havoc RAT. The tactics and development environment align with Ocean Lotus' known techniques, including the use of Mingw-w64 and similar initialization processes.
ESET researchers uncovered collaboration between two notorious APT groups, Gamaredon and Turla, both associated with Russia's FSB. The groups were observed working together to compromise high-profile targets in Ukraine. Evidence shows Gamaredon tools being used to restart and deploy Turla's Kazuar backdoor on specific machines. This cooperation indicates a strategic alignment between different FSB units, with Gamaredon likely providing initial access for Turla's more sophisticated operations. The collaboration was detected through multiple attack chains involving various malware tools from both groups. This discovery highlights the evolving tactics of Russian cyber espionage efforts, particularly in the context of the ongoing conflict in Ukraine.
