Advisory · Threat Intelligence

Cyber-Angriff BRIEF

TLP:AMBER

StegoAd · bösartige Browser-Erweiterungen mit Steganografie

StegoAd-Kampagne: Die seit mindestens 2021 aktive Gruppe hat 119 bösartige Erweiterungen verbreitet und rund 2,6 Millionen Nutzer erreicht, vorwiegend über Microsoft Edge und andere Chromium-Browser. Seit 2024 wurde der Angriffscode über 25 Monate hinweg mittels Steganografie in Bildern und Schriftarten versteckt und umging so klassische Kontrollen. Auf betroffenen Systemen ermöglicht die Erweiterung Remote-Befehlsausführung, den Diebstahl von Google-Zugangsdaten und Sitzungstoken (Kontozugriff auch bei aktiver Multi-Faktor-Authentifizierung, da der Diebstahl nach der legitimen Anmeldung erfolgt), den Zugriff auf WordPress-Administratorkonten sowie die Exfiltration von Sitzungscookies; der ausgehende Datenverkehr wird über Google Analytics maskiert. Fortgale prüft die gesamte überwachte Infrastruktur.

Cyber-Angriff BRIEF

TLP:AMBER

FortiBleed · offengelegte Fortinet-Zugangsdaten

FortiBleed-Kampagne: konkretes Risiko für Organisationen mit im Internet exponierten Fortinet/FortiGate-Geräten, insbesondere SSL-VPN-Diensten oder Verwaltungsoberflächen. Der Bedrohungsakteur führte groß angelegte Reconnaissance durch, um exponierte Fortinet-Instanzen zu identifizieren; die Analyse veröffentlichter Dateien ergab auch Hinweise auf italienische Assets und Organisationen, vermutlich aus Konfigurationsexporten mit Zugangsdaten, SSL-VPN-Konfigurationen, Firewall-Regeln und interner Adressierung. Gültige SSL-VPN-Zugangsdaten könnten Erstzugriff auf das interne Netzwerk sowie feindliche Aktivitäten wie Lateral Movement, Datenexfiltration oder Malware-Verteilung ermöglichen. Überprüfung der überwachten Infrastruktur läuft.

Cyber-Angriff ADVISORY

TLP:AMBER

Kali365 · Phishing-Kit auf Basis des OAuth Device Code Flow

Kali365: eine Phishing-as-a-Service-Plattform, die den OAuth Device Code Flow von Microsoft missbraucht, kein Reverse-Proxy-Angriff, um dauerhaften Zugriff auf Microsoft 365 zu erlangen. Für 250 USD versendet der Betreiber E-Mails, die vertrauenswürdige Dienste (Adobe, DocuSign, SharePoint) imitieren, mit einem Code und der Aufforderung, microsoft.com/devicelogin zu besuchen: Das Opfer schließt die Authentifizierung inklusive MFA ab und autorisiert damit faktisch ein vom Angreifer kontrolliertes Gerät. Access- und Refresh-Token werden nach der legitimen Anmeldung abgegriffen und ermöglichen wochen- bis monatelangen Zugriff ohne Auffälligkeiten im Audit-Log. Fortgale-Analyse von 800 Kampagnendomains: 85,8 % auf Cloudflare Workers gehostet, TLDs .de/.dev/.com machen über 94 % der Stichprobe aus. Klassische MFA-Verfahren (SMS, OTP, Push) sind gegen diese Angriffsklasse wirkungslos: empfohlen wird die vorrangige Migration zu FIDO2/WebAuthn oder Windows Hello for Business für Risikonutzer (C-Level, Finance, HR, IT) sowie der Einsatz von ITDR zur Erkennung von Token- und Lateral-Movement-Anomalien nach der Kompromittierung. IoCs bereits im Fortgale Intelligence Feed hinterlegt. Vollständige technische Analyse im Fortgale-Blog.

Cyber-Angriff ADVISORY

TLP:AMBER

GitHub · Kompromittierung über VS-Code-Erweiterungen

Kompromittierung mit bösartigen VS-Code-Erweiterungen. GitHub hat bisher weder IoCs veröffentlicht noch die betroffenen Erweiterungen öffentlich identifiziert. Empfohlen: vollständiges Inventar aller VS-Code-Erweiterungen auf Unternehmensgeräten und Einsatz der nativen Enterprise-Kontrolle extensions.allowed (VS Code 1.96+), um nur freigegebene Publisher und Erweiterungen zuzulassen. Fortgale-Telemetrie wird analysiert.

Cyber-Angriff BRIEF

TLP:AMBER

npm · Supply-Chain-Angriff auf @antv-Ökosystem

Als Mini Shai-Hulud bezeichneter Angriff auf das @antv-npm-Ökosystem und verwandte Bibliotheken (z. B. echarts-for-react). Ein Maintainer-Konto wurde kompromittiert und bösartige Versionen mit Credential-Theft-Payload veröffentlicht: GitHub-Token, AWS-Zugangsdaten, SSH-Schlüssel, kubeconfig-Dateien und SaaS-Token, exfiltriert nach t.m-kosche[.]com. 639 Versionen über 323 Pakete betroffen. IoCs im Fortgale Intelligence Feed hinterlegt.

Cyber-Angriff ADVISORY

TLP:GREEN

AI-SEO-Poisoning-Kampagne

SEO-Poisoning-Kampagne, die mit KI erstellte Websites missbraucht, auf denen angebliche KI-basierte Utility-Tools beworben werden. Die heruntergeladenen Programme infizieren das Gerät mit Malware. Beispiel für eine bösartige Domain: kitchen-canvas[.]com. Empfohlen: Vorsicht bei Downloads aus nicht verifizierten Quellen und Sperrung der gemeldeten Domains.

Hardening ADVISORY

TLP:AMBER

PAN-OS · Zero-Day-RCE von staatlich gesteuerten Akteuren ausgenutzt

Zero-Day (CVE-2026-0300), aktiv ausgenutzt im Dienst User-ID Authentication Portal (Captive Portal) von PAN-OS. Ermöglicht einem nicht authentifizierten Angreifer die Codeausführung (RCE) mit Root-Rechten durch speziell gestaltete Netzwerkpakete. Betroffen sind ausschließlich PA-Series- und VM-Series-Firewalls mit konfiguriertem und zum Internet/nicht vertrauenswürdigen Netzen exponiertem Captive Portal; Prisma Access, Cloud NGFW und Panorama sind nicht betroffen. Sofortiges Einspielen der gepatchten Versionen und ACL-Beschränkung der Management-Schnittstellen. IoCs in den Fortgale-Feeds.

Cyber-Angriff ADVISORY

TLP:AMBER

New phishing campaign · NTLMv2 hash capture

Active campaign across europäische Organisationen exploiting forced authentication via legacy protocols. Emails relay the Net-NTLMv2 hash to threat actor infrastructure with no user interaction required, automatic email client preview is enough.

Hardening BRIEF

TLP:GREEN

Linux · unauthorised root escalation

PackageKit (versions 1.0.2-1.3.4) contains a vulnerability that lets an unprivileged local user install or remove packages without authorisation, gaining full root access. Update to 1.3.5 or apply distro patches.

Hardening ADVISORY

TLP:AMBER

GitHub repository compromise · Trivy

Open-source vulnerability scanning tool for cloud, containers and CI/CD compromised via GitHub Actions. Guidance on SHA pinning, credential rotation, outbound connection monitoring. IoCs included.

Hardening ADVISORY

TLP:AMBER

Fortinet management interfaces exposed to the public internet

Failed access attempts identified against Fortinet management interfaces directly exposed on the internet. No unauthorised access detected, but the attack surface is high. Recommended isolation via VPN/private network.

Cyber-Angriff ADVISORY

TLP:AMBER

Notepad++ · Lotus Blossom (CN) compromise

Chinese threat actors exploited Notepad++ infrastructure for targeted attacks between May-Dec 2025. Update to 8.9.1+, monitor %AppData%\Bluetooth, review WinGUp.exe logs. Fortgale telemetry: no customers compromised.

Hardening BRIEF

TLP:GREEN

Microsoft Office · security feature bypass

CVSS 7.8, already in active exploitation. Insufficient input validation in security decisions lets an unauthenticated attacker bypass local features. Office 2016/2019/LTSC 2021/2024 and 365 Apps for Enterprise.

Cyber-Angriff BRIEF

TLP:AMBER

PyPI · sympy-dev typosquats SymPy

Malicious package via typosquatting (~85M downloads/month for the legitimate one). 4 versions published Jan 2026 contain code inside polynomial routines that drops in-memory XMRig payload via memfd_create. >1000 downloads in 1 day.

Hardening BRIEF

TLP:GREEN

Net-NTLMv1 · rainbow tables released

Tables published that drastically lower the bar for attacking the protocol. Credential recovery from hash with consumer hardware around 600 USD. Disable everywhere, set 'NTLMv2 only' via Group Policy, monitor Event ID 4624.

Hardening ADVISORY

TLP:AMBER

Azure AD · ROPC flow for MFA bypass

Resource Owner Password Credential flow lets username+password be exchanged directly for an access token, bypassing MFA and Conditional Access. Dangerous for Microsoft Graph/EWS/SharePoint API. Disable via CA policy.

Cyber-Angriff BRIEF

TLP:AMBER

NTLM exploited in active attacks

Authentication coercion techniques exploited in enterprise environments where legacy protocols remain active. Active Directory hardening recommendations and authentication telemetry.

Hardening ADVISORY

TLP:GREEN

NTLMv1 · protocol disabling guide

Operational Cyber Security and IT guide for disabling Net-NTLMv1 in Active Directory. Lower technical barrier following Mandiant rainbow tables release. Enforcement measures + Event ID 4624 monitoring.

Cyber-Angriff ADVISORY

TLP:AMBER

Malicious browser extensions · access to systems and data

Several campaigns exploit Chrome/Edge/Firefox/Opera extensions to access victim systems and data. Audit installed extensions, centralised allow-lists via GPO/MDM, separate business and personal browsers.

Cyber-Angriff ADVISORY

TLP:AMBER

Microsoft 365 · password spraying reconnaissance in ganz Europaan tenants

Active reconnaissance campaigns against European M365 tenants using password spraying techniques. Tenant hardening, legacy authentication blocking, Conditional Access bypass monitoring.

Hardening ADVISORY

TLP:GREEN

React/Next.js · RCE in Server Components

CVE-2025-55182, CVSS 10.0, named 'React2Shell'. Allows arbitrary remote code execution on the server. Affects React apps with RSC/Next.js Server Functions ('use server' directive). Immediate patching required.

Cyber-Angriff ADVISORY

TLP:AMBER

Online code formatters · credential exposure

Threat actors mine data inadvertently shared on jsonformatter.org, codebeautify.org, etc., credentials, AWS keys, source code. Compromises observed within hours of publication. Recommend corporate proxy block.

Breach ADVISORY

TLP:AMBER

F5 BREACH · business and supply chain impacts

F5 Networks announced (15 Oct 2025) unauthorised access by a nation-state actor with exfiltration of portions of BIG-IP source code, documentation on vulnerabilities under remediation, and customer configuration data.

Hardening ADVISORY

TLP:RED

Microsoft Entra ID · undetected access (CVSS 10)

CVE-2025-55241 allowed access to any M365 enterprise tenant by impersonating any user, including Global Admin. Migrate from Azure AD Graph (deprecated) to Microsoft Graph, review service principals/OAuth, deploy PIM/JIT.

Cyber-Angriff ADVISORY

TLP:AMBER

Salesforce · targeted data theft campaigns

Aktive Kampagnen against Salesforce tenants targeting strategic data. Measures: vishing/social engineering training, phishing-resistant MFA, least-privilege principle, monitoring of API and third-party connected apps.

Cyber-Angriff ADVISORY

TLP:AMBER

Compromised NPM packages · developer alert

18 popular NPM packages compromised (chalk, debug, ansi-styles, color-convert, supports-color, etc.). Verify internal dependencies, build/deployment logs, block suspicious releases. Update to safe versions.

Cyber-Angriff ADVISORY

TLP:RED

europäischer Einzelhandel bank branch · hybrid KVM-over-IP attack

Fraud attempt against a europäischer Einzelhandel bank branch over a weekend in August 2025: physical component (sealed doors to delay staff entry) + KVM-over-IP installation for remote control of a branch workstation. All fraudulent transfers blocked.

Cyber-Angriff ADVISORY

TLP:AMBER

Backdoor malware distributed via fake PDF editors

Malicious campaign distributing a backdoor via fake PDF editor download sites. C2 domains (5b7crp[.]com, 9mdp5f[.]com) added to the Fortgale Intelligence Feed. Verifications on monitored systems in progress.

Cyber-Angriff ADVISORY

TLP:AMBER

ClickFix · campaigns dropping Rhadamanthys Infostealer

Active ClickFix campaigns trick users into running malicious PowerShell commands disguised as anti-bot verification. IoCs: 45.221.64[.]224, pub-dce4815fde8f4b84a55fe31ab7cf28c3[.]r2[.]dev. Already in the Fortgale Intelligence Feed.

Hardening ADVISORY

TLP:GREEN

Scattered Spider · how the risk shifts post-arrests

After the partial dismantling of the group, other threat actors are adopting similar TTPs. Hardening: separate hypervisor admin (vCenter/ESXi) from AD, multi-channel MFA for password reset, monitor AnyDesk/Teleport, centralise vSphere logs to SIEM.

Cyber-Angriff ADVISORY

TLP:AMBER

Phishing · fake OneDrive against European executives

Emails simulating Microsoft communications themed 'salary amendment' or 'pending payments' targeting top-level executives. Redirect to fake Microsoft login pages built with the RaccoonO365 kit, steals credentials and session cookies, bypasses MFA.

Cyber-Angriff ADVISORY

TLP:AMBER

Targeted attacks on European CFOs and executives

Spear phishing aimed at CFOs and finance executives at europäische Unternehmen (banking/insurance/energy). Threat actors use advanced social engineering, impersonating prestigious consulting firms with exclusive executive job offers.

Cyber-Angriff ADVISORY

TLP:AMBER

SEO Poisoning · Lumma Stealer via fraudulent domains

Campaign distributing Lumma Stealer through fraudulent domains that mimic legitimate software download pages. Variations in names (e.g. 'v2-' prefixes). Block list of SEO Poisoning domains + C2 in the Fortgale report.

Hardening ADVISORY

TLP:GREEN

Coordinated scanning · Palo Alto GlobalProtect

Increased mass scanning activity against PAN-OS GlobalProtect. Restrict access via external VPN/IP whitelisting, consider ZTNA so as not to expose critical portals to the internet, periodic audit of the exposed surface.

Cyber-Angriff ADVISORY

TLP:AMBER

China Chopper · Weaver Ant (CN) and advanced tunnelling

Sophisticated campaign attributed to the Chinese 'Weaver Ant' group using the China Chopper web shell. Restrict service-account privileges, ACL web→internal traffic, deploy EDR/XDR for web shell detection, harden WAF rules for anomalous HTTP requests.

Hardening BRIEF

TLP:GREEN

Apache Tomcat · CVE-2025-24813 actively exploited

Vulnerability in Apache Tomcat actively exploited during March 2025. Immediate patching required on all internet-facing Tomcat installations, monitor anomalous requests via WAF.

Cyber-Angriff ADVISORY

TLP:AMBER

Medusa Ransomware · criminal group on the rise

RaaS active since 2021, over 300 organisations hit (healthcare, education, legal, manufacturing). Double extortion, phishing + vulnerability exploitation, lateral movement with legitimate tools. European cases observed: maritime, manufacturing, consulting.

Cyber-Angriff ADVISORY

TLP:AMBER

Password spraying against Microsoft 365 accounts

Brute-force-style password spraying campaign against European Office 365 tenants. Conditional Access hardening, legacy authentication blocking, account lockout pattern monitoring.

Cyber-Angriff ADVISORY

TLP:AMBER

Device Code Phishing · Storm-2372, APT29 and UTA0304/0307

Sophisticated attacks by Russian groups (Storm-2372, CozyLarch/APT29) against governments, NGOs and enterprises. The 'Device Code Authentication phishing' technique deceives victims by abusing legitimate authentication flows, hard to detect.

Hardening ADVISORY

TLP:GREEN

Annual security and intelligence outlook · 2025

Geopolitical landscape and overlapping tensions have significantly shaped cyberspace. Threat actors leverage cyber operations for strategic objectives thanks to territorial neutrality, attribution ambiguity and concealment capabilities.

Breach ADVISORY

TLP:RED

15,000 FortiGate · credentials published online

Data on more than 15,000 FortiGate devices (configurations, IPs, VPN credentials, private keys, firewall rules) from October 2022 published on the dark web, exploiting CVE-2022-40684. Many European infrastructures affected. Attribution: 'Belsen' group.

Cyber-Angriff ADVISORY

TLP:AMBER

35 Chrome extensions compromised via OAuth phishing

Phishing against Chrome Web Store developers compromised at least 35 extensions (~2.6M users). Malicious OAuth chain via fake 'Privacy Policy Extension', MFA bypass. Malicious code (worker.js, content.js) for theft of Facebook Business accounts.

Cyber-Angriff ADVISORY

TLP:AMBER

Tycoon 2FA · Phishing-as-a-Service against 2FA

Sophisticated PhaaS platform designed to bypass 2FA. Customisable Outlook templates, automation, modular infrastructure with redirect/obfuscation. Dynamic subdomains, AES + Base64 to hide payload. Fortgale published a threat hunting signature.

Cyber-Angriff BRIEF

TLP:AMBER

LummApp · OBS abused for advanced infostealing

LummApp variant abusing OBS Studio for infostealing activity. Masking techniques to evade detection. IoCs in the Fortgale feeds.

Cyber-Angriff ADVISORY

TLP:AMBER

Fake CAPTCHA · malvertising campaign for Lumma

Massive malvertising campaign via fake CAPTCHA pages: 1M ad impressions/day from 3,000+ publisher sites. Abuses Monetag (PropellerAds) and BeMob for cloaking. Tricks users into running PowerShell under the pretext of anti-bot verification.

Cyber-Angriff ADVISORY

TLP:AMBER

Chinese APT · 'Operation Digital Eye' via VS Code Remote Tunnel

Chinese cyberespionage against europäische Unternehmen (June-July 2024) exploiting SQL injection for initial access, PHPsert webshell for persistence, abuse of Visual Studio Code Remote Tunnel + Microsoft-signed binaries + Azure for C2.

Hardening ADVISORY

TLP:AMBER

BootExecute · observed EDR bypass technique

Windows logic flaw: native applications run before full OS initialisation, allowing removal of any EDR/Antivirus and bypassing anti-tampering (T1562.001). Fortgale published specific Threat Hunting rules.

Cyber-Angriff ADVISORY

TLP:AMBER

WARMCOOKIE Backdoor · emerging threat

WARMCOOKIE backdoor expanding, IoCs monitored via Shodan (specific header hash, html hash). Active Fortgale tracking, indicators added to feeds.

Breach ADVISORY

TLP:RED

Compromised FortiGate · COATHANGER (CN) November 2024

FortiGate compromise campaign reported by European national CERTs. COATHANGER malware establishes persistence via BusyBox reverse shell, surviving reboot and firmware update. Exploits CVE-2022-42475. Attribution: Chinese threat actors.

Cyber-Angriff BRIEF

TLP:AMBER

Agent Tesla · new campaign in ganz Europaan inboxes

Resurgence of AgentTesla with functional loader, advanced AES encryption and memory-only execution. Email subject pattern: 'Vietnam Da Nang Buy Order &C248SH12'. IoCs in the Fortgale Intelligence Feed.

Cyber-Angriff BRIEF

TLP:AMBER

Lumma Stealer · C2 infrastructure expansion

Lumma Stealer expands its infrastructure with new domains (.shop TLD) for exfiltration. Domain pattern: 'lum' prefix + random string. All sharing the same Russian title (Esenin poem). Fortgale tracks dozens of these domains.

Breach ADVISORY

TLP:AMBER

Argonauts ransomware · Zacros Corporation (JP)

On 28 Nov 2024 the 'Argonauts' ransomware group announced the compromise of ZACROS (formerly Fujimori Kogyo, JP). 140GB+ of sensitive data exfiltrated (users, passwords, business records, production data, financial). Active sale of the data.

Cyber-Angriff ADVISORY

TLP:AMBER

Financial phishing · Google Docs + Weebly

Campaign identified late October 2024 against telco and finance. Google Docs for phishing-link delivery → fake login pages on Weebly. Sentry.io and Datadog for metrics. AT&T-themed lures, US/CA banking. Fake MFA prompt.

Cyber-Angriff ADVISORY

TLP:AMBER

APT-K-47 · Asyncshell-v4 in multi-country attacks

Mysterious Elephant (APT-K-47) uses CHM files to run Asyncshell payload (v4). Base64 variant for string hiding, disguised C2, reduced logging. Targeting: Pakistan, Bangladesh, Turkey with gov/religious decoys.

Cyber-Angriff ADVISORY

TLP:AMBER

JinxLoader → Astolfo Loader · malware evolution

JinxLoader (Go-based, distributed via phishing) evolved into Astolfo Loader (C++, improved performance, smaller file size). MaaS, anti-analysis and geolocation check before C2. Distributed on Hack Forums.

Cyber-Angriff ADVISORY

TLP:AMBER

TAG-110 · Russian threat expanding in ganz Europa

Russian threat actor TAG-110 extends its cyber activity against European targets. Active Fortgale tracking.

Breach ADVISORY

TLP:AMBER

IncRansom · PBS Aerospace (US)

On 20 Nov 2024 IncRansom announced the compromise of PBS Aerospace (Atlanta, USA, UAV/drone turbines, EASA-certified). 2TB exfiltration declared, including CAD files and internal documents. The INC Ransom group has been active since Aug 2023, ~200 victims.

Cyber-Angriff ADVISORY

TLP:AMBER

Phishing on GitHub Pages · credentials exfiltrated via Telegram

Campaign identified by European CERTs leveraging GitHub Pages to host fake login pages (WeTransfer, cPanel). Stolen credentials sent via Telegram API to attacker-controlled bot. Visual spoofing + abuse of legitimate domain.

Cyber-Angriff ADVISORY

TLP:RED

BrazenBamboo (CN) · FortiClient zero-day via DEEPDATA

Chinese threat actor BrazenBamboo exploits a zero-day in FortiClient Windows VPN via DEEPDATA to extract VPN credentials from process memory. Multi-platform: WeChat/Skype/Telegram/Signal, browser data, Outlook contacts.

Cyber-Angriff ADVISORY

TLP:AMBER

Glove Stealer · bypass Chrome App-Bound Encryption

.NET infostealer that bypasses Chrome App-Bound Encryption via IElevator. Targets: browsers, crypto wallets, 2FA authenticators, password managers, email clients. Distribution: phishing with HTML 'ClickFix'. C2: master.hdsjfkgsadoghdsiougds[.]space, master.volt-texs[.]online.

Cyber-Angriff ADVISORY

TLP:AMBER

Fake Google Meet · ClickFix infostealer delivery

Threat actors use fake Google Meet pages in the ClickFix campaign. Win → StealC + Rhadamanthys. Mac → Atomic stealer. Expansion to impersonate Facebook, Chrome, reCAPTCHA. Groups: Slavic Nation Empire, Scamquerteo. Thousands of domains tracked by Fortgale.

Hardening ADVISORY

TLP:RED

Palo Alto · firewall management interface RCE

PAN-SA-2024-0015: unauthenticated RCE vulnerability in management interfaces of Palo Alto NGFWs exposed to the internet (CVSS 4.0: 9.3). Already exploited in real-world attacks. Does not affect Prisma Access/Cloud NGFW. Isolate the interface from the internet.

Cyber-Angriff ADVISORY

TLP:AMBER

SilkSpecter (CN) · Black Friday e-commerce phishing

Chinese SilkSpecter phishing against Black Friday 2024 e-commerce shoppers (US/EU). Stripe API abuse for real transactions with CHD/SAD exfiltration. Dynamic localisation via Google Translate. 4,000+ domains, 89 IPs. Chinese oemapps SaaS.

Cyber-Angriff ADVISORY

TLP:RED

CVE-2024-43451 · NTLM 0day for Spark RAT (UAC-0194)

Russian threat actor UAC-0194 exploits an NTLM zero-day (CVSS 6.5) for Net-NTLMv2 hash theft with minimal interaction (right-click, drag). Phishing emails from compromised Ukrainian gov → ZIP with malicious .url → Spark RAT (open source, persistence). Microsoft patch available.

Cyber-Angriff ADVISORY

TLP:AMBER

Charming Kitten (IR) · 'Dream Job' against aerospace

TA455/Charming Kitten (APT35) launches 'Dream Job' against aerospace and defence sectors with SnailResin malware via LinkedIn message + spear-phishing email. Lure: fake job offers to gain access, exfiltrate data and remote control.

Cyber-Angriff ADVISORY

TLP:AMBER

DocuSign · phishing in ganz Europaan inboxes with HTML attachment

Phishing against European DocuSign users: emails with HTML attachment that opens a fake login page. JavaScript intercepts credentials and forwards them via Telegram bot API. Pattern is simple but effective and bypasses many email filters.

Cyber-Angriff ADVISORY

TLP:AMBER

VEILDrive · Microsoft services abused for C2

Operation (Russian origin, Aug 2024+) using Teams, SharePoint, Quick Assist and OneDrive as C2. Non-obfuscated Java .jar bypasses EDR and VirusTotal. Microsoft Graph API to manage ODC2 via files on OneDrive named after device UUIDs. US kritische Infrastruktur.

Cyber-Angriff ADVISORY

TLP:RED

ToxicPanda · Android banking trojan in Southern Europe

New Android banking trojan (Oct 2024) targeting Southern Europe heavily (>50% Italy, plus Portugal, Spain) and LATAM. RAT abusing Android Accessibility for ODF, intercepts OTPs, bypasses PSD2 2FA. C2: dksu.top, mixcom.one, freebasic.cn. Chinese threat actors.

Cyber-Angriff ADVISORY

TLP:AMBER

BlackBasta · Cobalt Strike infrastructure analysis

Fortgale analysis on 12,000 tracked Cobalt Strike configurations, 52,000+ indicators. 126 unique IPs associated with BlackBasta. Resurgence late September/early October. europäische Organisationen affected (manufacturing, finance). Eastern European nexus.

Breach ADVISORY

TLP:AMBER

Snowflake · alleged 'Judische' hacker arrested

Alexander 'Connor' Moucka arrested in Canada (30 Oct 2024) for the Snowflake breach. UNC5537 hit 165+ orgs via credential reuse from infostealers (credentials dating back to 2020). Victims: AT&T, Santander, Ticketmaster. Extortion + sale on forums.

Hardening BRIEF

TLP:RED

FortiManager · CVE-2024-47575 actively exploited

Critical vulnerability in Fortinet's FortiManager product actively exploited. Immediate patching required on all FortiManager installations.

Breach ADVISORY

TLP:AMBER

BlackSuit · ransomware against Aerotecnic (ES)

On 23 Oct 2024 BlackSuit announced the compromise of Aerotecnic (Seville, ES, aerospace, supplier to Airbus/Boeing/Aciturri/Aernnova/Embraer). 800GB+ exfiltration declared (users, business records, employees, production data, financial).

Hardening BRIEF

TLP:RED

Veeam Backup & Replication · CVE-2024-40711

Critical unauthenticated RCE in Veeam VBR (build ≤12.1.2.172). Exploited via /trigger on port 8000 to create a rogue admin and deploy Fog/Akira ransomware. Allows full access to the backup environment. Patched September 2024.

Hardening BRIEF

TLP:RED

Fortinet · CVE-2024-23113 now exploited (CVSS 9.8)

CISA adds it to KEV. Vulnerability in Fortinet (FortiOS, FortiPAM, FortiProxy, FortiWeb) allows unauthenticated RCE via specially crafted requests. Immediate patching required.

Breach ADVISORY

TLP:AMBER

European bank database with 450k clients on sale

On 10 Oct 2024 a threat actor put on sale on a darkweb forum a database with 450,000 records of clients of an unnamed European bank: names, emails, phone numbers, addresses, investment amounts. Risk of targeted phishing, fraud, identity theft.

Cyber-Angriff ADVISORY

TLP:AMBER

Seeverkehr · targeted malware campaigns

September 2024: targeted campaign against shipping/maritime logistics. Threat actors use compromised email accounts of legitimate shipping companies to inject malicious content into ongoing email threads. Hard to detect.

Cyber-Angriff ADVISORY

TLP:AMBER

Aerospace · cyberespionage via WhatsApp + email

Iranian cyberespionage campaign (Charming Kitten) against the European aerospace sector via WhatsApp + targeted emails with fake job offers (Dream Job pattern).

Cyber-Angriff ADVISORY

TLP:AMBER

Versicherung/Finance · 'Supercar' Phishing Kit for M365

New phishing infrastructure targeting europäischer Finanzsektor and insurance organisations via the Supercar Phishing Kit for Microsoft 365. Original Fortgale report: blog.fortgale.com.

Cyber-Angriff ADVISORY

TLP:AMBER

European aerospace/satellite · new targeted threat

Intelligence advisory for European aerospace and satellite companies on the mitigation of new targeted cyber threats.

Cyber-Angriff ADVISORY

TLP:GREEN

CrowdStrike BSOD · suspicious post-incident domains

Following the CrowdStrike BSOD incident, a significant rise in newly registered domains containing the term 'CrowdStrike'. Phishing/impersonation risks. Recommended block list to prevent brand abuse.

Hardening ADVISORY

TLP:RED

Microsoft Outlook · zero-click RCE CVE-2024-38021

New zero-click RCE vulnerability in Microsoft Outlook. Exploitable without user interaction. Severe risk: data breach, unauthorised access, particularly critical for emails from trusted senders.

Unsere Threat Intelligence Advisories.

StegoAd · bösartige Browser-Erweiterungen mit Steganografie

FortiBleed · offengelegte Fortinet-Zugangsdaten

Kali365 · Phishing-Kit auf Basis des OAuth Device Code Flow

GitHub · Kompromittierung über VS-Code-Erweiterungen

npm · Supply-Chain-Angriff auf @antv-Ökosystem

AI-SEO-Poisoning-Kampagne

PAN-OS · Zero-Day-RCE von staatlich gesteuerten Akteuren ausgenutzt

New phishing campaign · NTLMv2 hash capture

Linux · unauthorised root escalation

GitHub repository compromise · Trivy

Fortinet management interfaces exposed to the public internet

Notepad++ · Lotus Blossom (CN) compromise

Microsoft Office · security feature bypass

PyPI · sympy-dev typosquats SymPy

Net-NTLMv1 · rainbow tables released

Azure AD · ROPC flow for MFA bypass

NTLM exploited in active attacks

NTLMv1 · protocol disabling guide

Malicious browser extensions · access to systems and data

Microsoft 365 · password spraying reconnaissance in ganz Europaan tenants

React/Next.js · RCE in Server Components

Online code formatters · credential exposure

F5 BREACH · business and supply chain impacts

Microsoft Entra ID · undetected access (CVSS 10)

Salesforce · targeted data theft campaigns

Compromised NPM packages · developer alert

europäischer Einzelhandel bank branch · hybrid KVM-over-IP attack

Backdoor malware distributed via fake PDF editors

ClickFix · campaigns dropping Rhadamanthys Infostealer

Scattered Spider · how the risk shifts post-arrests

Phishing · fake OneDrive against European executives

Targeted attacks on European CFOs and executives

SEO Poisoning · Lumma Stealer via fraudulent domains

Coordinated scanning · Palo Alto GlobalProtect

China Chopper · Weaver Ant (CN) and advanced tunnelling

Apache Tomcat · CVE-2025-24813 actively exploited

Medusa Ransomware · criminal group on the rise

Password spraying against Microsoft 365 accounts

Device Code Phishing · Storm-2372, APT29 and UTA0304/0307

Annual security and intelligence outlook · 2025

15,000 FortiGate · credentials published online

35 Chrome extensions compromised via OAuth phishing

Tycoon 2FA · Phishing-as-a-Service against 2FA

LummApp · OBS abused for advanced infostealing

Fake CAPTCHA · malvertising campaign for Lumma

Chinese APT · 'Operation Digital Eye' via VS Code Remote Tunnel

BootExecute · observed EDR bypass technique

WARMCOOKIE Backdoor · emerging threat

Compromised FortiGate · COATHANGER (CN) November 2024

Agent Tesla · new campaign in ganz Europaan inboxes

Lumma Stealer · C2 infrastructure expansion

Argonauts ransomware · Zacros Corporation (JP)

Financial phishing · Google Docs + Weebly

APT-K-47 · Asyncshell-v4 in multi-country attacks

JinxLoader → Astolfo Loader · malware evolution

TAG-110 · Russian threat expanding in ganz Europa

IncRansom · PBS Aerospace (US)

Phishing on GitHub Pages · credentials exfiltrated via Telegram

BrazenBamboo (CN) · FortiClient zero-day via DEEPDATA

Glove Stealer · bypass Chrome App-Bound Encryption

Fake Google Meet · ClickFix infostealer delivery

Palo Alto · firewall management interface RCE

SilkSpecter (CN) · Black Friday e-commerce phishing

CVE-2024-43451 · NTLM 0day for Spark RAT (UAC-0194)

Charming Kitten (IR) · 'Dream Job' against aerospace

DocuSign · phishing in ganz Europaan inboxes with HTML attachment

VEILDrive · Microsoft services abused for C2

ToxicPanda · Android banking trojan in Southern Europe

BlackBasta · Cobalt Strike infrastructure analysis

Snowflake · alleged 'Judische' hacker arrested

FortiManager · CVE-2024-47575 actively exploited

BlackSuit · ransomware against Aerotecnic (ES)

Veeam Backup & Replication · CVE-2024-40711

Fortinet · CVE-2024-23113 now exploited (CVSS 9.8)

European bank database with 450k clients on sale

Seeverkehr · targeted malware campaigns

Aerospace · cyberespionage via WhatsApp + email

Versicherung/Finance · 'Supercar' Phishing Kit for M365

European aerospace/satellite · new targeted threat