Threats Tagged 'europe'

Kratos is a mature Phishing-as-a-Service operation targeting Microsoft 365 users across the United States, Europe, and other regions. The platform enables attackers to steal credentials through trusted platforms, anti-bot verification, and convincing login pages. Researchers traced three generations of the kit and uncovered 1,484 previously unattributed detonations. The operation targets organizations across more than 20 countries with particularly strong concentration in the US, Spain, and Southern Europe. Kratos includes an operator panel allowing deployment of phishing domains, configurable Telegram or email delivery, geographic restrictions, and multiple anti-bot systems. The kit has evolved through three page generations (V0, V1, V2) with different exfiltration code. Activity has been visible since January 2026, with the operator panel active since September 2025.

MediumCampaignUnited StatesAustriaBelgium+8#microsoft 365#kratos#united states

Sturnus is a newly identified Android banking trojan targeting financial institutions in Southern and Central Europe. It features advanced capabilities such as full device takeover, harvesting banking credentials, keylogging, and remote control via VNC. Notably, it can bypass encryption on popular messaging apps like WhatsApp, Telegram, and Signal to monitor communications. The malware uses sophisticated communication protocols including WebSocket and HTTP to interact with its command-and-control servers. Although still in development and not yet exploited in the wild, Sturnus poses a significant threat to financial security and user privacy. It employs HTML overlays for data exfiltration and extensive environment monitoring to evade detection. The malware’s complexity and targeting of Android devices make it a serious concern for European financial sectors. Defenders should prioritize detection and containment measures to mitigate potential impacts.

MediumCampaignItalySpainFrance+4#banking trojan#remote control#europe

The Interlock ransomware group has been actively targeting businesses and critical infrastructures in North America and Europe since September 2024. Their ransomware employs AES-256-GCM encryption with RSA-4096 key protection, leveraging the OpenSSL library for efficient file encryption. The malware includes code obfuscation techniques and specific arguments for various behaviors. It excludes certain folders, file extensions, and files from encryption to avoid system damage. The ransomware changes file extensions to '.!NT3RLOCK' and may terminate processes during encryption. Interlock's operations involve data theft and public disclosure threats for ransom leverage. The group utilizes a Tor-based negotiation site and references legal regulations to pressure victims. To counter this threat, offsite data backups and regular recovery drills are recommended.

MediumMalwareGermanyFranceUnited Kingdom+7#aes-256-gcm#code obfuscation#file encryption

A newly emerged ransomware group called BERT has been targeting organizations across Asia and Europe since April. The group employs simple code with effective execution, impacting sectors such as healthcare, technology, and event services. BERT's ransomware operates on both Windows and Linux platforms, using PowerShell-based loaders, privilege escalation, and concurrent file encryption. On Linux systems, it can support up to 50 threads for fast encryption and forcibly shut down ESXi virtual machines. The group's tactics include disabling security features, terminating specific processes, and using standard encryption algorithms. BERT's variants have evolved, streamlining their encryption process and expanding their targeting activities. The Linux variant shows similarities to the REvil ransomware, suggesting possible code reuse.

MediumMalwareGermanyFranceUnited Kingdom+4#asia#esxi#powershell