Geek-Guy.com

Category: Europe

Stay informed on the evolving cybersecurity landscape in Europe. Explore expert analysis on regional threat actors, data privacy regulations, and sovereign AI initiatives, specifically curated for security researchers and analysts monitoring European digital security trends.

China-Linked TA416 Targets European Governments with PlugX and OAuth-Based Phishing

A China-aligned threat actor has set its sights on European government and diplomatic organizations since mid-2025, following a two-year period of minimal targeting in the region. The campaign has been attributed to TA416, a cluster of activity that overlaps with DarkPeony, RedDelta, Red Lich, SmugX, UNC6384, and Vertigo Panda. “This TA416 activity included multiple

CERT-EU blames Trivy supply chain attack for Europa.eu data breach

The European Union’s Computer Emergency Response Team, CERT-EU, has traced last week’s theft of data from the Europa.eu platform to the recent supply chain attack on Aqua Security’s Trivy open-source vulnerability scanner. The attack on the AWS cloud infrastructure hosting the Europa.eu web hub on March 24 resulted in the theft of 350 GB of…

TeamPCP Supply Chain Campaign: Update 006 – CERT-EU Confirms European Commission Cloud Breach, Sportradar Details Emerge, and Mandiant Quantifies Campaign at 1,000+ SaaS Environments, (Fri, Apr 3rd)

This is the sixth update to the TeamPCP supply chain campaign threat intelligence report, “When the Security Scanner Became the Weapon” (v3.0, March 25, 2026). Update 005 covered developments through April 1, including the first confirmed victim disclosure (Mercor AI), Wiz’s post-compromise cloud enumeration findings, DPRK attribution of the axios compromise, and LiteLLM’s release resumption after Mandiant’s forensic audit.…

March 2026 Leadership Moves: Google Cloud Partner Chief Departs & More

As the first quarter of 2026 comes to a close, organizations around the channel have made significant moves to their leadership teams. Key figures have been appointed, promoted, or departed from their positions to make way for new faces. Take a look around at some of the signature moves that enterprises have made as they…

Trivy supply chain attack enabled European Commission cloud breach

CERT-EU confirmed that ShinyHunters are behind the recent breach of the cloud infrastructure underpinning websites of the European Commission, and that they stole and subsequently leaked approximately 340 GB of data. “Analysis of the published dataset has so far confirmed the presence of personal data, including lists of names, last names, usernames, and email addresses,…

Apple — 50 years in fifteen minutes

It felt churlish to let Apple’s 50th birthday pass without adding to the hagiographic choir, so what follows is an unapologetically selective tour through some of the moments that shaped one of the most influential companies of the modern era. These were the inflection points where Apple didn’t just ship products, it distorted reality in its direction. For…

European-Chinese geopolitical issues drive renewed cyberespionage campaign

A Chinese cyberespionage group has shifted its gaze back to Europe after years of focusing on other parts of the world, Proofpoint research published Wednesday found. The surge began in mid-2025, with a bevy of issues bubbling up between China and Europe, the company said. Proofpoint labels the government-linked group TA416, but other companies track…

Casbaneiro Phishing Targets Latin America and Europe Using Dynamic PDF Lures

A multi-pronged phishing campaign is targeting Spanish-speaking users in organizations across Latin America and Europe to deliver Windows banking trojans like Casbaneiro (aka Metamorfo) via another malware called Horabot. The activity has been attributed to a Brazilian cybercrime threat actor tracked as Augmented Marauder and Water Saci. The e-crime group was first documented by Trend…

Microsoft facing CMA probe of its business software portfolio

The regulatory body which last year accused Microsoft of inflating its office software’s license prices when it was run on rival cloud platforms to make those platforms less appealing, said Tuesday it will conduct a further investigation into the company’s entire business software ecosystem. The probe by the UK’s Competition and Markets Authority (CMA), scheduled…

Euro-Office billed as Europe’s sovereign alternative to Microsoft Office

A group of European technology firms has launched a new open-source office suite aimed at offering a sovereign alternative to Microsoft Office. Euro-Office consists of four core applications — a document editor, spreadsheet program, presentation tool, and PDF editor — and is built on the open-source OnlyOffice suite. It supports Microsoft Office file formats DOCX,…

AWS Security Agent on-demand penetration testing now generally available

AWS Security Agent on-demand penetration testing is now generally available, enabling you to run comprehensive security tests across all your applications, not only your most critical ones. This milestone transforms penetration testing from a periodic bottleneck into an on-demand capability that scales with your development velocity across AWS, Azure, GCP, other cloud-providers, and on-premises. With…

California to bar AI vendors that can’t prove bias safeguards

AI vendors selling to the California state government must prove they have safeguards against algorithmic bias, civil rights violations, and illegal content, or risk being barred from state contracts, under an executive order signed by Governor Gavin Newsom. The order directs the Department of General Services and the California Department of Technology to develop new…

GNM has published its 2025 Annual Infrastructure Report

GNM has published its 2025 Annual Infrastructure Report, outlining a year of coordinated backbone expansion, IX ecosystem growth and high-capacity platform scaling across Europe and Singapore. In 2025, the focus was not on isolated upgrades, but on strengthening the platform as one interconnection environment – where transport, peering and IP services develop on a unified…

Fortinet hit by another exploited cybersecurity flaw

Yet another critical flaw in a Fortinet product has come to light as attackers continue to target the company, this time by actively exploiting a critical SQL injection vulnerability in the cybersecurity company’s management server. The vulnerability, (CVE-2026-21643), allows unauthenticated threat actors to execute arbitrary code on unpatched systems via specifically-crafted HTTP requests. These low-complexity…

China-Linked groups target Southeast Asian government with advanced malware in 2025

China-linked groups hit a Southeast Asian government in 2025, deploying multiple malware families in a sophisticated cyber campaign. In 2025, three China-linked threat clusters targeted a Southeast Asian government in a complex, well-funded cyber operation. Threat actors deployed numerous malware types, including HIUPAN, PUBLOAD, EggStremeFuel/Loader, MASOL RAT, PoshRAT, TrackBak Stealer, Hypnosis Loader, and FluffyGh0st, showing…

Second data breach at European Commission this year leaves questions over resilience

The European Commission confirmed that a cyberattack impacted cloud infrastructure hosting its web presence on the Europa.eu platform. Authorities said the cyberattack was discovered on 24 March, and early findings from the ongoing investigation suggest data were taken from the affected websites. There is no indication that the Commission’s internal systems were affected by the…

Critical Fortinet FortiClient EMS flaw exploited for Remote Code Execution

Attackers are exploiting a critical Fortinet FortiClient EMS flaw (CVE-2026-21643) that allows remote code execution via SQL injection. A critical Fortinet FortiClient EMS vulnerability, tracked as CVE-2026-21643 (CVSS score of 9.1), is now being actively exploited. Defused researchers warn that threat actors are exploiting the vulnerability in Fortinet’s FortiClient EMS platform. “Fortinet Forticlient EMS CVE-2026-21643…

Russia-linked APT TA446 uses DarkSword exploit to target iPhone users in phishing wave

Russia-linked TA446 is using the DarkSword iOS exploit kit in targeted phishing campaigns to compromise iPhone users. Russia-linked APT group TA446 (aka SEABORGIUM, ColdRiver, Callisto, and Star Blizzard) is using the DarkSword exploit kit in targeted spear-phishing campaigns against iOS devices. The attacks rely on malicious emails to compromise iPhones, highlighting a growing threat from…

Security Affairs newsletter Round 569 by Pierluigi Paganini – INTERNATIONAL EDITION

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. ShinyHunters claims the hack of the European Commission Iran-linked group Handala hacked FBI Director Kash Patel’s…

ShinyHunters claims the hack of the European Commission

The European Commission has allegedly been breached by ShinyHunters, with reported data dumps including content from mail servers. The European Commission has allegedly been breached by ShinyHunters, with reported data dumps including content from mail servers and internal communications systems. The cybercrime group added the Commission to its Tor data leak site, claiming the theft…

Iran-linked group Handala hacked FBI Director Kash Patel’s personal email account

Iran-linked group Handala claims it hacked FBI Director Kash Patel’s personal email, leaking files. The FBI says no government data was exposed. Iran-linked hacking group Handala claims it breached FBI Director Kash Patel’s personal Gmail account and shared alleged data, including photos and files. The FBI confirmed it is aware of the incident and has…

The European Commission confirmed a cyberattack affecting part of its cloud systems

The European Commission confirmed a cyberattack affecting part of its cloud systems, now contained, with no impact on internal networks. On March 24, the European Commission detected a cyberattack affecting the cloud infrastructure hosting its Europa.eu websites. The incident was quickly contained, with mitigation measures applied and no disruption to website availability. Early findings suggest…

European Commission data stolen in a cyberattack on the infrastructure hosting its web sites

The European Commission is continuing to investigate the theft of data from its cloud infrastructure earlier this week. On Thursday, the Commission revealed there had been an attack on its Europa.eu platform, offering few details, then, on Friday, security news site Bleeping Computer reported that the attack had involved the compromise of an account or…

European Parliament delays implementation of parts of the EU AI Act

The European Parliament’s Thursday vote to delay parts of the EU AI Act adds more uncertainty to the already chaotic AI compliance universe. But analysts say that CIOs must proceed as though the compliance rules are in effect.  In a statement, Parliament said that its members decided to “delay the application of certain rules on…

Researchers release tool to detect stealthy BPFDoor implants in critical infrastructure networks

Telecommunications providers around the world have been dealing with the burrowing efforts of the China-linked Salt Typhoon APT for many years now. To help them identify hard-to-detect implants used by the group, researchers have released a scanning script. Salt Typhoon goes deep Salt Typhoon has hit US, Canadian, European and Asian telcos. “By compromising telecom…

New critical Citrix NetScaler hole of similar severity to CitrixBleed2, says expert

A new critical vulnerability that is similar to the widely-exploited CitrixBleed and CitrixBleed2 holes should be patched in NetScaler devices immediately, say experts. The hole, CVE-2026-3055, is an out-of-bounds read vulnerability in customer-managed NetScaler ADC and NetScaler Gateway devices configured as SAML IDP for approving identity and authentication. It’s rated at 9.3 in severity on…

MY YAKE: A decade of cyber collaboration, built under Obama, is now hostage to a political grudge

SAN FRANCISCO — I was in the room at Stanford in February 2015 when President Obama used the bully pulpit to launch what became a decade of hard-won public-private collaboration in cybersecurity. It didn’t take much to tear it asunder. At RSAC 2026 this week, that decade of work is suddenly on the line —…

Njordium AI blocks fake invoices and fraudulent payments

Njordium Cyber Group has launched its new AI Fraud Detection Module, a self-learning AI engine integrated into the recently released Vendor Management System (VMS). The module instantly detects and neutralises fake invoices, phantom services or products, and inflated pricing. Fully transparent and compliant with the EU AI Act, it delivers a regulator-aligned solution to Europe’s…

Kamasers Analysis: A Multi-Vector DDoS Botnet Targeting Organizations Worldwide 

DDoS attacks are no longer only an infrastructure problem. They can quickly turn into a business issue, affecting uptime, customer experience, and operational stability. Kamasers is a strong example of this new reality, with broad attack capabilities and resilient command-and-control mechanisms that allow it to remain active under pressure. Let’s explore the Kamasers botnet through…

Kamasers Analysis: A Multi-Vector DDoS Botnet Targeting Organizations Worldwide 

DDoS attacks are no longer only an infrastructure problem. They can quickly turn into a business issue, affecting uptime, customer experience, and operational stability. Kamasers is a strong example of this new reality, with broad attack capabilities and resilient command-and-control mechanisms that allow it to remain active under pressure. Let’s explore the Kamasers botnet through…

6 key trends reshaping the IAM market

The identity and access management (IAM) market has shifted its focus from traditional “login and MFA” mechanisms toward treating identity as a security control plane. Buyers are prioritizing phishing-resistant authentication, including passkeys, and the management of non-human identities, according to an array of experts quizzed on developments in the market by CSO. “Workforce access is…

Exclusive Networks Launches Ignition in North America

Exclusive Networks is expanding its incubation model for emerging cybersecurity vendors into North America, aiming to give MSPs and solution providers earlier access to next-generation, AI-driven technologies while accelerating vendor go-to-market timelines. Exclusive Networks launches Ignition in North America at RSA Conference Exclusive Networks this week announced the North American debut of its “Ignition” program,…

China’s use of open‑source AI threatens the US lead in AI development, US Commission warns

China’s open-source AI strategy is building a self-reinforcing competitive advantage that US export controls were not designed to counter, the US-China Economic and Security Review Commission has warned. “US export controls primarily target the digital loop, restricting access to advanced chips used for frontier model training — but are not well suited to addressing the…

Broadcom Launches CBX Platform as CISPE Files Complaint

Broadcom has launched a new cloud-based security platform while facing a fresh antitrust complaint in Europe tied to its VMware partner strategy. The company introduced Symantec CBX, an XDR platform combining Symantec and Carbon Black technologies, as the Cloud Infrastructure Services Providers in Europe (CISPE) filed a competition complaint over Broadcom’s planned changes to its…

U.S. CISA adds Apple, Laravel Livewire and Craft CMS flaws to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apple, Laravel Livewire and Craft CMS flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Apple, Laravel Livewire and Craft CMS flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the flaws added to the catalog: CVE-2025-31277 (CVSS score of 8.8)…

Water utilities strengthen cybersecurity through cooperation

Water utilities are finding that letting information flow can flush out cybersecurity problems. The water industry has a security issue: Many utilities operate with ageing systems and minimal IT or cybersecurity personnel. But by coordinating responses to cyber-attacks, participants in a pilot program run by the Cyber Readiness Institute (CRI) and the Center on Cyber…

Microsoft won’t force Copilot in everywhere after all

Microsoft has temporarily halted automatic installation of the Microsoft 365 Copilot app on Windows devices with Microsoft 365 desktop apps. The company announced the change via an update in Microsoft 365 Message Centre, but offered no indication when the measure would be reactivated.  However, existing installations of the app will not be affected. “Automatic installation…

Data Centers Are Military Targets Now

In retaliation for the ongoing U.S.–Israeli war, Iran responded with a novel form of counterattack. For the first time in military history, private sector data centers came under deliberate attack. In an era when companies known for e-commerce, social networks, and search engines have also become close collaborators with militaries, is bombing their servers fair…

Russian APT targets Ukraine via Zimbra XSS flaw CVE-2025-66376

Russian APT exploits a critical XSS flaw in Zimbra, tracked as CVE-2025-66376, running scripts via HTML emails to target users in Ukraine. Russia-linked threat actor exploits a high-severity XSS vulnerability, tracked as CVE-2025-66376 (CVSS score of 7.2), in Zimbra Collaboration. Attackers exploited insufficiently sanitized HTML emails to run scripts when opened, targeting users in Ukraine.…

Russia establishes Vienna as key western spy hub targeting NATO

Russia uses Vienna as its largest Western spy hub, monitoring NATO and other sensitive communications via diplomatic sites and satellite dishes. Western intelligence reports that Russia has transformed Vienna into its largest Western spy hub, steadily expanding surveillance over the past two years. Using diplomatic compounds and rooftop satellite clusters, Russia monitors sensitive communications across…

Keysight SBOM Manager simplifies global cybersecurity compliance and software transparency

Keysight Technologies has launched Keysight SBOM Manager, a new solution designed to help organizations meet growing global cybersecurity and software transparency requirements, led by the European Union’s Cyber Resilience Act (CRA). The solution provides a unified approach to generating, managing, and using Software Bill of Materials (SBOMs) for digital products, enabling organizations to meet regulatory…

The True Cost of Cyber Downtime: A UK Board-Level Briefing

Written by Sean Tilley, Senior Sales Director EMEA at 11:11 Systems   Cyber downtime carries measurable financial consequences, and those consequences are becoming clearer with each major incident. Research from 11:11 Systems shows that 78% of European organisations report losses of up to $500,000 per hour following a cyber-related outage, while 6% face costs exceeding £1 million per…

Elite members of North Korean society fake their way into Western paychecks

Increased federal activity, including indictments over the past year, has drawn attention to a pattern that has been unfolding inside corporate hiring pipelines. North Korean nationals are securing roles as remote IT contractors and full-time staff within organizations across North America and Western Europe, using standard hiring channels to get in. Research by IBM X-Force…

Mistral launches Forge to help enterprises build their own AI models

Mistral has introduced Forge, a new platform aimed at helping enterprises move beyond generic AI systems by enabling them to train and adapt models on proprietary data. Today’s AI systems are largely developed using open internet data and are built to handle a wide variety of general tasks. However, enterprises depend on deeply embedded internal knowledge, including…

Tracking the Iran War: A Month of Escalation and Regional Impact

Iran war likely prolonged, increasing cyber threats, energy disruption, and instability, with companies in the Middle East facing higher risk. Resecurity (USA) released a strategic intelligence update on the war in Iran, covering nearly a month of military conflict. The conflict has shifted global attention and resources, placing other ongoing conflicts like Russia-Ukraine, Israel-Gaza, and…

EU sanctions Chinese and Iranian actors over cyberattacks on critical infrastructure

EU sanctions Chinese and Iranian firms and individuals for cyberattacks targeting critical infrastructure and over 65,000 devices across member states. The Council of the European Union has imposed sanctions on three companies and two individuals linked to cyberattacks against EU countries and partners. “The Council adopted today restrictive measures against three entities and two individuals responsible for cyber-attacks carried…

AWS completes the second GDV community audit with participant insurers in Germany

We’re excited to announce that Amazon Web Services (AWS) has completed its second GDV (German Insurance Association) community audit with 36 members from the Germany insurance industry participating, corresponding to over 63% coverage of the German market in terms of insurance premiums. Community audits are an efficient method to provide additional assurance to a group…

Indigo Appoints Ilex Content Strategies as its Marketing and Communications Agency of Record

Indigo Telecom Group, a strategic partner for critical digital infrastructure, has appointed  Ilex Content Strategies, a global B2B marketing and communications agency, as its marketing and communications agency of record. Ilex will support brand and messaging development, account-based marketing, content creation, internal communications, and Borderless PR as Indigo drives global growth.      Indigo serves critical digital infrastructure providers, from…

Sherweb Expands to the UK to Support MSP Growth

Sherweb is expanding into the United Kingdom as the Canadian cloud marketplace and MSP enablement provider looks to grow beyond North America. The move targets one of Europe’s largest managed services markets and builds on Sherweb’s recent acquisition of Ireland-based IT distributor MicroWarehouse. The company says the expansion will focus on helping MSPs navigate rapid…

ANY.RUN at RootedCON 2026: Meeting Security Teams and Showcasing New Capabilities 

From March 5 to March 7, the ANY.RUN team attended RootedCON 2026 in Madrid and showcase some of our latest capabilities developed for modern SOC environments at the conference expo.  The event provided a great opportunity to meet our existing clients and connect with security teams exploring advanced threat detection solutions.  Meeting the Community and Partners  RootedCON is one of the largest cybersecurity conferences in Europe, bringing together thousands of security researchers, SOC…

Security Affairs newsletter Round 567 by Pierluigi Paganini – INTERNATIONAL EDITION

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Starbucks data breach impacts 889 employees Storm-2561 lures victims to spoofed VPN sites to harvest corporate…

Hackers targeted Poland’s National Centre for Nuclear Research

Hackers targeted Poland’s National Centre for Nuclear Research, but security systems detected and blocked the attack before any damage. The National Centre for Nuclear Research in Poland reported a cyberattack on its IT infrastructure. The intrusion attempt was quickly detected by security systems, allowing staff to secure the targeted systems and prevent any operational impact.…

European companies warn EU leaders: reduced reliance on US tech could hurt profitability

Several European companies are warning that the EU’s increased focus on technological sovereignty could hurt both profitability and competitiveness and argue it will be difficult to quickly reduce dependence on US tech firms, the Financial Times reports. The European Commission is currently working on a new package for technological sovereignty aimed at reducing Europe’s dependence…

US and European authorities disrupt socksEscort proxy service tied to AVrecon botnet

Authorities in the US and Europe disrupted the SocksEscort proxy service, which used the AVrecon botnet and infected about 360,000 devices since 2020. Law enforcement agencies in the US and Europe have disrupted SocksEscort, a malicious proxy service powered by the AVrecon botnet. Active since 2020, the service hijacked roughly 360,000 devices and allowed cybercriminals…

Building Trust in AI SOC Analyst Solutions: A UK and EU CISO Perspective

By Brett Candon, VP International at Dropzone AI Trust has always been critical in security operations, but in the UK and Europe it carries significant regulatory weight. GDPR, NIS2 and similar related data‑protection frameworks shape far more than legal risk, they directly influence architectural decisions, supplier selection, and how security data can be accessed, processed…

Report: AI Accelerates Attacks on Trusted Identities

A recent report from ConnectWise found that attackers are increasingly exploiting trusted identities, along with remote access infrastructure and software supply chains, while AI continues to accelerate in speed and scale. 2026 MSP Threat Report shows trusted identities and legitimate tools are top targets The research, ConnectWise’s 2026 MSP Threat Report, provides global threat intelligence…

AWS European Sovereign Cloud achieves first compliance milestone: SOC 2 and C5 reports plus seven ISO certifications

In January 2026, we announced the general availability of the AWS European Sovereign Cloud, a new, independent cloud for Europe entirely located within the European Union (EU), and physically and logically separate from all other AWS Regions. The unique approach of the AWS European Sovereign Cloud provides the only fully featured, independently operated sovereign cloud…

DroneShield Establishes European Manufacturing Footprint to Advance Sovereign Counter-UAS Capability

DroneShield (ASX:DRO) today announced the establishment of counter-UAS manufacturing in the EU, marking a major expansion of the Company’s European industrial footprint and manufacturing capacity. The announcement follows increased momentum across the continent, with national military investments growing under the ReArm Europe Plan / Readiness 2030 initiative, accelerating the need for mature, scalable, and sovereign…

No, it’s not ‘unnecessarily burdensome’ to control your own data

According to a recent report, the State Department sent a cable urging U.S. diplomats to oppose international data sovereignty regulations like GDPR, characterizing these guardrails as “unnecessarily burdensome.”  In the cable, the State Department claims that data sovereignty regulations “disrupt global data flows, increase costs and cybersecurity risks, limit Artificial Intelligence (AI) and cloud services, and…

Slide Announces $70M Series B Round & EMEA Expansion

Slide, a business continuity and disaster recovery (BCDR) platform designed exclusively for managed services providers (MSPs), announced Tuesday it has raised $70 million in Series B funding as the company accelerates product development and expands internationally. The round was led by venture capital firm General Catalyst, with participation from Base10, Outsiders Fund, futurepresent, Vine Ventures,…

Anthropic’s US gov’t lawsuit says federal action “unprecedented and unlawful”

Anthropic on Monday fought back against the US federal government’s determination that it is a supply chain risk, suing the feds and arguing to a California federal judge that the government is being inconsistent and contradictory. “The Constitution confers on Anthropic the right to express its views—both publicly and to the government—about the limitations of…

CVE program funding secured, easing fears of repeat crisis

The Cybersecurity and Infrastructure Security Agency and the MITRE Corporation have renegotiated the contract supporting the 26-year-old Common Vulnerabilities and Exposures Program in a way that eliminates the looming expiration that triggered panic across the security community in 2025. According to sources, the program appears to have moved from a discretionary funding item to a…

Augur lands $15 million funding to strengthen critical infrastructure security

Augur has announced a $15 million seed round led by Plural, with participation from First Kind, SNR, Flix, and Tiny VC. The funding will support the deployment of Augur’s technology as governments, operators, and venue owners across Europe face rising security threats to vulnerable public spaces and critical national infrastructure. The changing threat landscape The…

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 87

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Malware Reverse Engineering is no longer a human problem!   StegaBin: 26 Malicious npm Packages Use Pastebin Steganography to Deploy Multi-Stage Credential Stealer   Inside a fake Google security check that becomes a browser RAT   SloppyLemming…

Security Affairs newsletter Round 566 by Pierluigi Paganini – INTERNATIONAL EDITION

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. FBI probing intrusion into a system managing sensitive surveillance information Reading White House President Trump’s Cyber…

Iran-linked MuddyWater deploys Dindoor malware against U.S. organizations

Iran-linked APT MuddyWater targeted U.S. organizations, deploying the new Dindoor backdoor across sectors including banks, airports, and nonprofits. Broadcom’s Symantec Threat Hunter Team uncovered a campaign by the Iran-linked MuddyWater  (aka SeedWorm, TEMP.Zagros, Mango Sandstorm, TA450, and Static Kitten) APT group targeting several U.S. organizations. “Activity associated with Iranian APT group Seedworm has been spotted on the networks of multiple…

Gov’t IT spending seen as key to building Europe’s tech ecosystem

As more European organizations reconsider their reliance on US technology suppliers amid rising geopolitical and trade tensions, public sector organizations are leading the way in a potential shift to local tech providers.  The German state of Schleswig-Holstein is moving tens of thousands of employees from Microsoft apps Office, Windows and Exchange to open-source alternatives, for…

The Coruna exploit: Why iPhone users should be concerned

A new iPhone-hacking exploit has exposed the uncomfortable truth that when governments build offensive attacks, they eventually come for all of us. Revealed by Google’s Threat Intelligence Group (GTIG) and iVerify, the Coruna exploit can compromise iPhones running iOS 13 through to iOS 17.2.1, though Apple has secured its systems against this threat in iOS 26. What Coruna does Coruna…

Anthropic seeks to renegotiate its AI deal with US DoD, says report

Anthropic is attempting to renegotiate the terms of its AI contract with the US Department of Defense (DoD). CEO Dario Amodei has been in meetings with Emil Michael, the US under-secretary of defense for research and engineering, to iron out contractual disagreements that led the DoD to mark Anthropic as a supply-chain risk, the Financial…

Lack of regulatory action on hyperscaler dominance prompts inquiry chair to quit

Delays in regulatory action to deal with imbalances in the market for cloud services has prompted the resignation of the chair of an inquiry into the market. Companies deploying cloud services are being hampered by the dominance of Microsoft Azure and Amazon Web Services, a situation exacerbated by the glacial pace in which the UK’s…

Operation Leak: FBI and Europol dismantle LeakBase Cybercrime forum

The Federal Bureau of Investigation seized the LeakBase cybercrime forum in an international crackdown led by Europol. The Federal Bureau of Investigation seized the LeakBase cybercrime forum (leakbase[.]la), a platform used to trade hacking tools and stolen data. The action formed part of “Operation Leak,” an international effort coordinated by Europol involving authorities from 14…

State-affiliated hackers set up for critical OT attacks that operators may not detect

Several state-linked threat groups known for breaking into operational technology (OT) networks have shifted their focus over the past year from gaining and maintaining access to actively mapping out ways to disrupt physical industrial processes. The shift poses a significant threat because fewer than one in 10 OT networks have monitoring in place to detect…

February 2026 Recap: Channel Sees New Hires in a Variety of Roles

January saw a flurry of organizations hiring for the new year, including many CEOs. So many, in fact, that it required a Part 1 and Part 2. February’s leadership changes include several impactful hires from organizations such as QuSecure, Syncro, ConnectWise, and KnowBe4. Channel Insider takes a look around the channel each month to round…

Google Workspace vs. Microsoft 365: What’s the best office suite for business?

Once upon a time, Microsoft Office ruled the business world. By the late ’90s and early 2000s, Microsoft’s office suite had brushed aside rivals such as WordPerfect Office and Lotus SmartSuite, and there was no competition on the horizon. Then in 2006 Google came along with Google Docs & Spreadsheets, a collaborative online word processing and…

From phishing to Google Drive C2: Silver Dragon expands APT41 playbook

APT group Silver Dragon, linked to APT41, targets governments via server exploits and phishing, using Cobalt Strike and Google Drive for C2. Check Point researchers have identified Silver Dragon, an APT group tied to the China-linked group APT41, targeting government entities in Europe and Southeast Asia since mid-2024. The group gains initial access by exploiting…