Threats tagged 'data-theft'

ACRStealer, a sophisticated Malware as a Service, has evolved with enhanced evasion techniques and C2 communication strategies. It employs low-level syscalls and AFD for stealthy operations, bypassing user-mode hooks. The malware uses layered communication, establishing raw TCP connections followed by SSL/TLS over SSPI. ACRStealer's data-stealing capabilities are extensive, targeting browsers, Steam accounts, and performing victim fingerprinting. It can execute secondary payloads and capture screenshots. The malware shows an active infection pattern in countries like the USA, Mongolia, and Germany, communicating with specific IP addresses and domains. Recent developments indicate a shift to LummaStealer, suggesting ongoing threat actor activities targeting gaming platforms and social media.

Malware#hijackloader#data-theftUnited States+2

The Clop ransomware group has been observed targeting Gladinet CentreStack servers to conduct data theft and extortion attacks. By compromising these file-sharing and cloud storage platforms, attackers exfiltrate sensitive data before deploying ransomware, increasing pressure on victims to pay. This threat is significant due to the critical role CentreStack plays in enterprise file synchronization and sharing, potentially exposing large volumes of corporate data. The attacks do not yet have known public exploits, but the high severity rating reflects the impact of combined data theft and ransomware. European organizations using CentreStack should be vigilant, as the threat could disrupt business operations and lead to data breaches. Mitigation requires specific hardening of CentreStack deployments, network segmentation, and enhanced monitoring for unusual activity. Countries with high adoption of cloud collaboration tools and significant enterprise sectors, such as Germany, France, and the UK, are likely to be most affected. Given the ease of exploitation and the severe consequences of data loss and operational disruption, this threat is assessed as high severity. Defenders must prioritize detection and response capabilities tailored to CentreStack environments to reduce risk.

Malware#infosecnews#redditGermany+6

The Space Bears ransomware group claims to have stolen data from Comcast via a breach involving the Quasar remote access trojan. This incident involves ransomware coupled with data theft, indicating a potential double-extortion attack. Although technical details are limited and no confirmed exploits are reported, the threat is considered high severity due to the nature of the targeted organization and the potential impact of leaked sensitive data. European organizations, especially those in telecommunications and critical infrastructure sectors, could face indirect risks from similar tactics or supply chain impacts. Mitigation requires enhanced endpoint detection, network segmentation, and proactive threat hunting for RAT activity like Quasar. Countries with significant telecom infrastructure and Comcast business ties, such as the UK, Germany, and France, are more likely to be affected. The threat is assessed as high severity given the potential confidentiality breach, ease of exploitation via RATs, and the high-profile nature of the victim. Defenders should prioritize monitoring for ransomware indicators, securing remote access tools, and preparing incident response plans for data breach scenarios.

Malware#infosecnews#redditGermany+4

The Qilin ransomware group has claimed responsibility for a data theft incident targeting the Church of Scientology. This ransomware variant is associated with encrypting victim data and exfiltrating sensitive information to extort victims. Although the technical details and exploitation methods remain sparse, the attack highlights ongoing risks of ransomware combined with data theft. No confirmed exploits or vulnerabilities have been publicly disclosed yet. The threat is assessed as medium severity due to the potential confidentiality impact and extortion risk, but limited public technical details and minimal discussion reduce immediate exploitation concerns. European organizations with similar profiles or using related infrastructure should remain vigilant. Mitigation should focus on robust backup strategies, network segmentation, and monitoring for ransomware indicators. Countries with higher exposure to ransomware attacks and significant presence of targeted organizations, such as the UK, Germany, and France, are more likely to be affected. Overall, defenders must prioritize detection and response capabilities to mitigate potential ransomware and data theft incidents.

Malware#infosecnews#redditGermany+4

The Everest ransomware group claims to have breached ASUS, stealing approximately 1TB of data including camera source code. This incident involves data theft and ransomware activities, potentially exposing sensitive intellectual property and customer information. The breach reportedly includes remote code execution (RCE) capabilities exploited by the attackers. Although no CVSS score is assigned, the threat is assessed as high severity due to the scale of data theft, potential impact on confidentiality and integrity, and the ransomware nature of the attack. European organizations using ASUS products or related camera technologies could face indirect risks from this breach, including supply chain vulnerabilities and exposure to ransomware campaigns. Mitigation requires enhanced monitoring of ASUS-related infrastructure, strict access controls, and incident response readiness. Countries with significant ASUS market penetration and technology sectors, such as Germany, France, and the UK, are likely to be most affected. Defenders should prioritize detection of ransomware indicators, secure firmware and software updates, and prepare for potential secondary attacks leveraging stolen data.

Malware#infosecnews#redditGermany+5

The Everest ransomware group has claimed a significant breach of Spain’s national airline, Iberia, reportedly stealing 596 GB of data. This incident involves ransomware activity combined with data exfiltration, indicating a double-extortion tactic where attackers encrypt systems and threaten to leak stolen data. The breach highlights vulnerabilities in critical infrastructure sectors such as aviation, which are highly sensitive and impactful. Although no specific exploited vulnerabilities or affected software versions are disclosed, the attack's scale and target underscore a high-risk scenario. European organizations, especially in Spain and neighboring countries, face increased risks from similar ransomware operations targeting critical transport and infrastructure sectors. Mitigation requires tailored incident response plans, enhanced network segmentation, and proactive threat hunting focused on ransomware behaviors. Spain is the most directly affected country, but given Iberia's international operations, other European countries with strong aviation ties may also be at risk. The threat is assessed as high severity due to the large data theft, potential operational disruption, and the critical nature of the airline sector. Defenders must prioritize monitoring for ransomware indicators, securing remote access, and ensuring robust data backup and recovery capabilities.

Malware#infosecnews#redditSpain+5

Salesforce is investigating a data breach involving Gainsight, a customer success platform, which has resulted in the theft of customer data. The breach reportedly allowed unauthorized access potentially through a remote code execution (RCE) vulnerability, leading to exposure of sensitive information. Although no confirmed exploits are currently known in the wild, the incident is considered high severity due to the nature of the data involved and the trust placed in these platforms. European organizations using Salesforce and Gainsight services may face risks related to confidentiality breaches and regulatory compliance violations. Mitigation requires immediate review of third-party integrations, enhanced monitoring of access logs, and strict validation of vendor security postures. Countries with high adoption of Salesforce and cloud-based CRM solutions, such as the UK, Germany, France, and the Netherlands, are likely to be most affected. Given the breach involves data theft and potential RCE, the suggested severity is high. Defenders should prioritize incident response readiness, vendor communication, and data access audits to limit impact.

Breach#infosecnews#redditGermany+6

The Cline Bot AI Agent, a coding assistant tool, has been identified with vulnerabilities that could lead to unauthorized data theft and remote code execution. These flaws potentially allow attackers to access sensitive information processed by the bot and execute arbitrary code within the environment where the bot operates. Although no known exploits are currently active in the wild, the medium severity rating indicates a tangible risk that requires attention. The threat primarily concerns organizations using this AI coding assistant, especially those handling confidential or proprietary code. Mitigation involves restricting the bot's access to sensitive data, applying strict input validation, and monitoring for unusual activity. European organizations relying on AI coding tools should prioritize evaluating their exposure to this vulnerability. Countries with significant tech sectors and AI adoption, such as Germany, France, and the UK, are more likely to be impacted. Given the potential for data compromise and code execution without requiring user interaction, the threat severity is assessed as high. Immediate security reviews and hardening of AI agent deployments are recommended to prevent exploitation.

Vulnerability#infosecnews#redditGermany+2

Eurofiber, a European telecommunications infrastructure provider, confirmed a cyberattack on November 13 involving unauthorized access, data theft, and an extortion attempt. The breach was publicly disclosed via a security news source and Reddit InfoSec community, highlighting the incident's recent and newsworthy nature. Although specific technical details about the attack vector or exploited vulnerabilities are not provided, the incident involves data exfiltration and extortion, indicating a ransomware or data leak scenario. No known exploits or patches are currently reported. The attack poses significant risks to confidentiality and potentially availability of Eurofiber's services. European organizations relying on Eurofiber's infrastructure could face service disruptions or data exposure. Mitigation requires enhanced monitoring, incident response readiness, and verification of supply chain security. Countries with high Eurofiber market presence and critical infrastructure dependency, such as the Netherlands, Belgium, and Germany, are most at risk. Given the high impact on confidentiality and extortion elements, the threat severity is assessed as high. Defenders should prioritize containment, forensic analysis, and communication strategies to mitigate reputational and operational damage.

Breach#infosecnews#redditNetherlands+4

GlobalLogic has disclosed a data breach resulting from a security incident involving Oracle, leading to the theft of personal data affecting approximately 10,000 GlobalLogic employees. The breach stems from an Oracle-related compromise, though specific technical details about the vulnerability or attack vector have not been publicly disclosed. This incident highlights risks associated with third-party software supply chain security and the potential exposure of sensitive employee information. European organizations with ties to GlobalLogic or using Oracle products should be alert to similar risks. The breach could lead to identity theft, phishing attacks, and reputational damage. Mitigation requires enhanced monitoring of Oracle environments, employee awareness training, and verification of third-party security postures. Countries with significant Oracle and GlobalLogic presence, such as the UK, Germany, France, and the Netherlands, are likely to be most impacted. Given the scale and sensitivity of the data theft, the severity is assessed as high. Defenders should prioritize incident response, data protection, and supply chain risk management to mitigate further exposure.

Breach#infosecnews#redditGermany+5

Vidar Stealer 2.0 is a malware variant that enhances its data theft capabilities by implementing multi-threaded operations and improved evasion techniques. It targets sensitive user information by stealing data more efficiently and stealthily than previous versions. Although no known exploits in the wild have been reported yet, its high-priority classification and recent emergence warrant immediate attention. The malware’s multi-threaded design allows it to exfiltrate data faster, increasing the risk of significant data loss. European organizations, especially those handling large volumes of personal or financial data, are at risk due to the potential for rapid and covert data compromise. Mitigation requires advanced endpoint detection, behavioral analysis, and network monitoring tailored to detect multi-threaded suspicious activities. Countries with high adoption of Windows-based systems and significant financial or industrial sectors are more likely to be targeted. Given the high impact on confidentiality and ease of exploitation without user interaction, the threat severity is assessed as high.

Malware#infosecnews#redditGermany+9

American Airlines subsidiary Envoy has confirmed a data theft incident involving Oracle systems. The attack resulted in unauthorized access and exfiltration of sensitive data, although specific technical details and exploited vulnerabilities remain undisclosed. This incident highlights risks to supply chain and subsidiary infrastructures within major corporations. European organizations using Oracle products or connected to American Airlines or its subsidiaries could face indirect impacts, especially regarding data privacy and regulatory compliance. Mitigation should focus on enhanced monitoring of Oracle environments, strict access controls, and incident response readiness. Countries with significant aviation sectors and Oracle deployments, such as the UK, Germany, and France, are more likely to be affected. Given the high potential impact on confidentiality and the lack of detailed exploitation information, the threat severity is assessed as high. Defenders should prioritize verifying system integrity, reviewing Oracle account activities, and ensuring rapid containment capabilities.

Campaign#infosecnews#redditGermany+5

The Crimson Collective hacker group has been reported targeting AWS cloud instances with the intent of stealing data. This threat involves unauthorized access to cloud environments, specifically those hosted on Amazon Web Services, aiming to exfiltrate sensitive information. Although detailed technical specifics and exploited vulnerabilities are not disclosed, the high severity rating indicates significant risk. European organizations using AWS cloud infrastructure are at risk of data breaches, potentially impacting confidentiality and operational integrity. The threat does not currently have known exploits in the wild, and minimal public discussion limits detailed understanding. Mitigation requires enhanced cloud security posture, including strict access controls, continuous monitoring, and incident response readiness. Countries with high AWS adoption and critical cloud-dependent sectors, such as the UK, Germany, France, and the Netherlands, are more likely to be affected. Given the potential for data theft without requiring user interaction, the threat severity is assessed as high. Defenders should prioritize securing AWS environments against unauthorized access and data exfiltration attempts.

Breach#infosecnews#redditGermany+7

Salesforce has been targeted by widespread data theft attacks involving remote code execution (RCE) attempts. Despite the severity and scale of these breaches, Salesforce has publicly refused to pay ransom demands. The attacks indicate a significant compromise risk to customer data and internal systems, highlighting vulnerabilities in cloud service security. No specific affected versions or patches have been disclosed, and there are no known exploits in the wild yet. The threat is considered high severity due to the potential impact on confidentiality and integrity of sensitive data. European organizations relying on Salesforce services could face indirect impacts through data exposure or service disruption. Mitigation requires enhanced monitoring, strict access controls, and incident response readiness. Countries with high Salesforce adoption and critical cloud infrastructure are most at risk. The threat underscores the importance of robust cloud security practices and ransomware resilience strategies.

Breach#infosecnews#redditGermany+6

The Clop ransomware group has been exploiting a zero-day vulnerability in Oracle software since early August to conduct data theft operations. This critical vulnerability allows attackers to gain unauthorized access to sensitive data without requiring prior authentication. The exploitation is ongoing and targets organizations using vulnerable Oracle products, enabling attackers to exfiltrate valuable information. European organizations relying on Oracle infrastructure are at significant risk, especially those in sectors with high-value data. The threat is severe due to the zero-day nature, lack of available patches, and the involvement of a sophisticated threat actor known for ransomware and data extortion. Immediate mitigation efforts are necessary to reduce exposure, including enhanced monitoring and network segmentation. Countries with large Oracle deployments and critical infrastructure are more likely to be targeted. The threat severity is assessed as critical given the potential impact on confidentiality and integrity, ease of exploitation, and the scope of affected systems. Defenders should prioritize detection and containment strategies while awaiting official patches from Oracle.

XWorm 6.0 is a newly resurfaced malware strain featuring over 35 plugins that significantly enhance its data theft capabilities. This modular malware enables attackers to customize their operations, targeting a wide range of data types and systems. Although no known exploits are currently reported in the wild, its high severity rating and advanced features pose a substantial risk. European organizations, especially those handling sensitive or financial data, could face serious confidentiality breaches and operational disruptions. The malware's extensibility allows it to adapt to various environments, increasing the likelihood of successful infiltration and prolonged persistence. Mitigation requires proactive detection strategies, including monitoring for unusual network activity and employing advanced endpoint protection tailored to detect modular malware behaviors. Countries with high adoption of Windows-based enterprise systems and significant financial or industrial sectors, such as Germany, France, and the UK, are particularly at risk. Given the malware's potential impact on confidentiality and ease of plugin-based expansion, the suggested severity is high. Defenders should prioritize threat intelligence sharing and implement strict access controls to reduce exposure.

Breach#infosecnews#redditGermany+5

A self-propagating malware called Shai-Hulud has infected over 500 npm packages, including one with over two million weekly downloads. The worm steals sensitive data, exposes private repositories, and hijacks victim credentials to spread further. It executes when an infected package is installed, collecting system information and GitHub tokens. The malware exfiltrates secrets from repositories, migrates private repositories to public, and self-replicates by infecting the victim's most downloaded packages. Notable infected libraries include those from CrowdStrike. The infection started with ngx-bootstrap version 18.1.4. Prevention measures include using specialized solutions for monitoring open-source components and implementing comprehensive security systems.

Campaign#supply-chain-attack#self-propagatingGermany+6

Inc Ransomware Claims 5.7 TB of Data Theft at Pennsylvania Attorney General Source: https://hackread.com/inc-ransomware-data-pennsylvania-attorney-general/

Malware#infosecnews#redditGermany+9

FBI Warns of UNC6040 and UNC6395 Targeting Salesforce Platforms in Data Theft Attacks Source: https://thehackernews.com/2025/09/fbi-warns-of-unc6040-and-unc6395.html

Breach#infosecnews#redditGermany+7

Jaguar Land Rover confirms data theft after recent cyberattack Source: https://www.bleepingcomputer.com/news/security/jaguar-land-rover-jlr-confirms-data-theft-after-recent-cyberattack/

Breach#infosecnews#redditGermany+7