HarfangLab France

37min Identifier: TRR260501. Summary Investigating Gamaredon’s abuse of CVE-2025-8088, we identified a dozen waves of spearphishing emails against Ukrainian state institutions in a campaign that is still active, dating back to September 2025. These emails – spoofed or sent from compromised government accounts – deliver persistent, multi-stage VBScript downloaders that profile the infected system.

To deal with the threat effectively and remedy the situation, the first step is to confirm and identify the incident, then contain it. The reflex sheets from InterCERT France (in French) offer practical advice for following these steps one by one. Here is a summary. Prerequisites for classifying a data leak Effective coordination of people and resources is essential for classifying a data leak.

Here are 10 tips from the French National Cybersecurity Agency (ANSSI) in a simple-to-follow checklist to protect mobile devices against malicious attacks. Feel free to share with every information system user you know! 1. Updates Keep the operating system and applications on your mobile devices up to date. These updates from software providers improve the security of operating systems and apps. Restart your mobile device regularly. Restarting helps limit the impact of non-persistent compromises. 2.

IBM’s 2025 “Cost of a Data Breach” report indicates that the average cost per data breach is $4.4 million. Whether sensitive or not, if data is compromised, stolen, or deleted, business operations may be interrupted, resulting in operating and financial losses. And that’s not counting the risk of penalties that may be added to the bill as a result of legal proceedings, loss of customer and user confidence, or even loss of market share.

First, thecompromise must be assessed, then the severity of the incident, its scope, its impact, and its criticality. Let’s see how. System compromise assessment To assess a system compromise, those involved must have access to the administration, informationsystem, and security equipment monitoring tools. They must also be aware of the organization’s business priorities and the list of emergency contacts. External assistance may be required to assess the incident.

Zero Trustmodel: The Zero Trust model involves reducing the trust granted to users to access an information system. This model responds to security needs that have increased with the practice of BYOD (Bring Your Own Device), and is likewise due to heterogeneous access to services that may be hosted On-Premises or in the Cloud. Without the Zero Trust model, trust is granted by default to all users and devices within the company.

Let’s look at this initiative with three questions posed to Pierre-Louis Mauratille, Director of Operations at HarfangLab. What does the Cloud Sovereignty Framework contain? Pierre-Louis Mauratille: The Cloud Sovereignty Framework is a concise 6-page document that establishes a set of criteria enabling bidders for European public tenders to assess the level of sovereignty of a cloud service.

In a webinar held in December 2025, Anouck Teiller, Deputy CEO at HarfangLab, and Allie Mellen, Principal Security & Risk Analyst at Forrester, provided actionable advice to: Identify and close endpoint visibility gaps across your attack surface Align EDR and Attack Surface Management to reduce risk Build a unified detection and response approach that scales This session was designed to deliver strategic takeaways you can apply immediately and use to answer the real-world challenges CISOs...

The first step is to confirm the nature of the incident and the email accounts that have been compromised, then assess the severity of the incident, its scope and impact on your organization, and its criticality. Assessing the compromise of an email account An organization must call on internal and possibly external resources to assess the security incident.

An increase in vulnerabilities that exceeds protection capabilities As of the first half of 2025, the number of CVEs was already 16 to 18% higher than in 2024 for the same period. Forrester’s data reveal that in 2022, 25% of external attacks were carried out in part or entirely via software vulnerability exploits. Paired with an expanding workspace attack surface that includes cloud, identities, and networks, attackers are outpacing organizations’ defenses.