Threats & incidents
-
FTAPI confirms ransomware on internal server
German secure file-transfer provider FTAPI says ransomware was deployed on an internal server, while its customer platform and transferred customer data were not affected.
-
Citrix exploitation reaches broad European sectors
Mandiant says exploitation of a NetScaler zero-day began weeks before disclosure and likely affected European organisations across government, finance, energy, education, technology, and legal services.
-
Microsoft details NeedyMantis post-compromise malware
Microsoft has exposed a modular malware family used after attackers gain initial access, with observed victims spanning telecoms, universities, medical nonprofits, intergovernmental organisations, and government contractors.
-
Apple patches targeted CoreGraphics zero-day
Apple has patched a CoreGraphics flaw that can enable arbitrary code execution and says it may have been exploited in an extremely sophisticated attack against specific individuals.
-
Dutch institutions restrict Citrix after NetScaler warning
Dutch hospitals and government services restricted remote access after warnings over actively exploited NetScaler vulnerabilities, showing how precautionary containment can itself disrupt critical services.
-
Star Blizzard scales phishing with RedFlick
Microsoft says Russia-linked Star Blizzard has expanded from tightly targeted spear phishing into larger campaigns while adopting a lower-friction malware delivery technique known as RedFlick.
-
L&Q attack exposes resident correspondence
London housing association L&Q says unauthorised access exposed emails and webform messages from around 12,000 residents while its website and online services remain unavailable.
-
Dutch police confirm ShinyHunters arrest
Dutch police have confirmed that a 24-year-old Amsterdam man was arrested as part of an investigation into ShinyHunters, with further information expected at a Rotterdam court appearance.
-
Flink breach followed by customer extortion
Delivery company Flink says attackers obtained customer and employee contact information from an internal system and are now approaching people directly with demands for payment.
-
LMU breach expands to 600,000 records
LMU Munich says forensic work has established that its entire admissions-system dataset was affected by September’s cyberattack, covering around 600,000 records dating back roughly 50 years.