1. State-Sponsored Attacks and Hybrid Warfare

France has officially accused the Russian group APT28 (also known as Fancy Bear) of cyberattacks against government organizations and the 2024 Paris Olympics. These attacks are part of a broader hybrid warfare strategy, aimed at gathering intelligence and destabilizing Europe. (WSJ)

2. Government Collaboration with Cybercriminals

According to a Microsoft report, authoritarian regimes such as Russia, China and Iran are collaborating with cybercriminal groups to carry out attacks against the United States and its allies. This collaboration enhances the scale and effectiveness of the attacks. (AP News)

3. Threats to Aviation Security

The aviation industry is facing increasing threats, such as attacks on GPS systems and coordinate spoofing, which can cause serious accidents. These attacks are attributed to state actors and highlight the need to strengthen cybersecurity in the aviation sector.

4. Growing Attacks on Critical Infrastructure

Cooperation between government agencies and cybercriminals has led to increased attacks on critical infrastructure, such as utility networks and transportation. These attacks jeopardize the security and operation of essential services. (Axios)

The evolution of artificial intelligence (AI) presents both opportunities and challenges for cybersecurity. While AI can enhance threat detection and response, it can also be used by attackers to develop more sophisticated attacks. Adopting responsible AI practices and continuously monitoring developments are essential to addressing these challenges.

Studies and surveys from 2023 and 2024 highlight the need for constant vigilance and adaptation to new cybersecurity threats. Adopting best practices, investing in cutting-edge technologies, and training staff are key elements to protecting organizations from ever-evolving threats.

CVE-2024-49112 is a critical remote code execution (RCE) vulnerability in Microsoft Windows' Lightweight Directory Access Protocol (LDAP). It was discovered by security researcher Yuki Chen and publicly disclosed by Microsoft in December 2024. The vulnerability is rated 9.8/10 on the CVSS scale, indicating the highest possible risk.

The vulnerability concerns an integer overflow error in LDAP, which could allow a remote, unauthenticated attacker to execute arbitrary code within the LDAP service. This can lead to complete compromise of a Domain Controller or other critical systems.

The vulnerability affects multiple versions of Windows, including:

• Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
• Windows 11 (versions 22H2, 22H3, 23H2, 24H2)
• Windows Server 2008 SP2, 2008 R2 SP1, 2012, 2016, 2019, 2022, and 2025

The full list of affected versions is available in Microsoft's official guide at msrc.microsoft.com.

Exploitation can be done in two main ways:

1. Against Domain Controllers:

The attacker sends specially crafted Remote Procedure Calls (RPCs) to cause the target to lookup its own domain.

2. Against LDAP clients:

The attacker tricks the user into connecting to a malicious LDAP server or performing a domain controller lookup for the attacker's domain.Trend Micro
SafeBreach Labs has published a proof-of-concept (PoC) tool, known as "LDAPNightmare", which can crash unpatched Windows Servers without the need for authentication.

Some administrators have reported issues with features such as Self-Service Password Reset (SSPR) and Entra Connect after the updates were applied. These issues appear to be related to changes in how the updates handle legacy LDAP commands.

• Microsoft Security Update Guide for CVE-2024-49112
• Proof-of-Concept tool "LDAPNightmare" by SafeBreach Labs
• Vulnerability Analysis by Trend Micro

• Zerologon (CVE-2020-1472)
  This vulnerability allows unauthenticated attackers to gain administrative access to Domain Controllers via the Netlogon protocol, making it one of the most severe vulnerabilities in Active Directory.
• SIGRed (CVE-2020-1350)This vulnerability affects the Windows DNS Server and allows remote code execution via specially crafted DNS queries, with the potential for "wormable" propagation.

• Apply Updates: Ensure all systems are up to date with the latest Microsoft security patches.
• Restrict Access: Restrict access to critical services such as LDAP, DNS, and RDP to authorized users and networks only.
• Monitor and Detect: Use monitoring and detection tools to identify suspicious activity and potential exploits.
• Review Security Policies: Review security policies and Active Directory settings to ensure the minimum necessary access.

1. ELTA (2022)
   They were attacked by ransomware, resulting in the leakage of corporate documents and personal data on the dark web. (Business Daily)
2. DESFA (2022)
   The Ragnar Locker group carried out a ransomware attack, with the Administrator stating that it will not negotiate with cybercriminals. (Business Daily)
3. ETAD (Late 2023)
   They were attacked by ransomware, with limited impact on official functions due to immediate response. (Business Daily)
4. Aegean University (2023)
   The Lockbit group attacked the university, with files being published on the dark web, although they were of little value. (Business Daily)
5. Byte and Papaki.gr (2023)
   Byte was attacked by ransomware, while Papaki.gr detected unauthorized third-party access to its systems. (Business Daily)

Despite cyberattacks, Greece attracts significant investments in data centers:

• Microsoft: Construction of three data centers in Attica, with an investment of 976 million euros. (InfoCom)
• Google: Plans three data centers in Attica, with an investment of 2.2 billion euros, creating 19,400 jobs by 2030. (Kathimerini)
• Digital Realty (via Lamda Hellix): Already operates three data centers in Athens and is building Heraklion-1 in Crete, with planned operation in the first quarter of 2025. (Revelations)
• Lancom: Has three privately owned data centers in Athens and Thessaloniki and is investing in a new center in Heraklion, Crete. (Economic Post)
  These investments strengthen Greece's position as a data hub in Southeast Europe. (Liberal)

Marks & Spencer (M&S) – United Kingdom
In April 2025, M&S suffered a major cyberattack that lasted over a week. The attack, attributed to the "Scattered Spider" group, caused contactless card payments to be disrupted, online orders to be suspended and product shortages to occur in stores. The company reported sales losses of around £3.8 million per day and a drop in its stock market value of almost £700 million. (Financial Times)

Co-op – United Kingdom
A few days after the attack on M&S, the Co-op chain was hit by an attempted cyberattack. As a precautionary measure, it disabled parts of its IT network, affecting functions such as virtual offices and customer service centres. However, stores and deliveries continued to operate as normal. (Reuters)

Ahold Delhaize – US
Dutch company Ahold Delhaize reported a cyberattack that affected its US chains, including Giant Food and Hannaford. The attack caused network outages and a temporary suspension of operations, although physical stores continued to serve customers. (eucif.org)

Targus – USA
In April 2024, Targus, a company known for its computer accessories, was attacked by a ransomware attack by the Red Ransomware group. The attack caused disruptions to its business operations and a data leak. (ics-cert.kaspersky.com)

Lemken – Germany
German agricultural machinery company Lemken suffered a cyberattack in May 2024 that affected its global operations, causing disruptions to production and parts orders. The company temporarily suspended all of its IT systems to contain the attack. (ics-cert.kaspersky.com)

Crown Equipment – ​​USA
Crown Equipment, a forklift manufacturer, was attacked by a cyberattack that disrupted its production operations in the US and Germany. The attack resulted in the leakage of sensitive employee personal data. (ics-cert.kaspersky.com)

The agri-food sector has been the target of increasing cyberattacks:

• In 2021, JBS S.A., the world’s largest meat producer, suffered a ransomware attack that disrupted its operations in the US, Canada and Australia. The company paid a ransom of $11 million to restore its systems. (Wikipedia)
• In 2022, HP Hood Dairy, owner of Lactaid, suffered a ransomware attack that shut down all of its factories. (Forbes)
• In 2023, companies such as Dole, Sysco and Mondelez suffered significant cyberattacks that disrupted their operations. (Forbes)
• In the first quarter of 2024, 40 incidents of cyberattacks were reported in the US agri-food sector. (Forbes)

• In the first quarter of 2024, 1,104 cyberattacks were recorded, marking a 43% increase compared to the same period in 2023. (902.gr)
• These attacks include financial fraud, malware attacks, phishing, as well as attacks on critical infrastructure and government services. (902.gr)

While there are no published details of specific attacks on Greek businesses, the general increase in cyberattacks suggests that the private sector has also been affected. These attacks can include data breaches, ransomware attacks and other forms of digital threats.

To address the growing threats, the following measures are recommended:

1. Software Update:

Keep all systems and applications up to date with the latest security patches.

2. Staff Training:

Train employees to recognize and avoid phishing attacks and other social mechanisms.

3. Secure Access Practices:

Implement strong password policies and, where possible, multi-factor authentication (MFA).

4. Backups:

Keep regular backups of critical data and test the recovery process.

5. Risk Assessment:

Conduct regular risk assessments to identify and address potential vulnerabilities.

1. System Update: Apply all available security updates from Microsoft immediately to fix known vulnerabilities.
2. Disable Vulnerable Features: If you are not using specific features such as HTTP Trailer Support, consider disabling them via the registry.
3. Restrict Access: Restrict access to services that use HTTP.sys to only trusted networks and users.
4. Network Monitoring: Use monitoring tools to identify unusual activity that may indicate exploitation attempts.
5. Staff Training: Educate IT staff on the latest threats and best practices (Sangfor Technologies)

The eShop – ERP interface can become a development tool, but also a vulnerable point for cyberattacks. With the right technical and organizational practices, you can ensure data integrity and protect your business from threats.

In the era of digital transformation, B2B businesses that operate through an online store and interface with ERP software (such as SoftOne, Epsilon Net, Megasort) are an ideal target for cyberattacks. Behind every automated order or inventory synchronization, lies a huge volume of valuable data that cybercriminals want to acquire.

1. High value data
   Complete B2B customer data (name, address, VAT number, price lists).
   Order information, discounts, agreements.
   Access to financial data and banking transactions via ERP.
2. Automatic data flow = potential security “holes”
   Many of these businesses interconnect ERP and eShop without strong encryption or firewall.
   Use of APIs without authentication or rate limiting.
3. Usually without adequate IT infrastructure
   Many small and medium-sized B2B businesses do not have specialized IT or Cybersecurity staff.

• Man-in-the-middle attacks on poorly secured ERP – eShop connections.
• Stealing credentials via phishing or malware on employee devices.
• Exploiting vulnerabilities in Windows server platforms, such as http.sys, for remote access.
• Malicious orders that exploit backend weaknesses.
• Posting fake API requests to extract data from the ERP.

• The entire customer and supplier database.
• Sensitive commercial data such as wholesale prices, credit limits.
• Invoicing documents and financial transactions.
• Administrator and ERP account passwords.

1. Security check on the “bridge” eShop – ERP
   Use of Token-based APIs or VPN protection.
   Logging and monitoring of each interface.
2. Employee training
   Identification of phishing emails.
   Secure use of ERP and web applications.
3. Proactive check for CVEs
   Regular scanning for known vulnerabilities such as the recent CVE-2024-49112 or previous ones in Windows http.sys.
4. Security strategy with firewall and WAF
   Restriction of access to ERP via whitelist IPs.
   Web Application Firewall for eShop.

Cybercriminals are increasingly targeting businesses that “run” valuable data in the background, such as B2B eShops with ERP. If action is not taken today, a breach is only a matter of time. Don’t let them in through the back door. Shield your data before you lose it.

1. Sensitive personal data
   Medical history, diagnoses, medications, tests.
   Social security number, contact details and financial information.
2. ERP – HIS – LIS systems with insufficient security
   Many medical systems are not updated frequently or operate on old versions of Windows.
   Internal networks without firewall or separation.
3. Human error – phishing
   Medical staff focus on the patient, not on email or password security.

• Ransomware (encryption of files with ransom demand).
• Theft of medical files and leakage on the dark web.
• Attacks through vulnerabilities in Windows servers or http.sys (such as CVE-2024-49112).
• Fake emails from "EOPYY" or "Ministry of Health" to install malware.

• Violation of GDPR → fines up to 2-4% of turnover.
• Loss of trust from patients & partners.
• Operation outage for days.
• Used as a "bridge" for attack on public organizations.

1. Secure access to medical information systems (HIS/LIS/ERP)
   VPN for remote users.
   Access rights only for authorized personnel.
   Communication encryption.
2. Modern Firewall & Antivirus on all workstations
   Especially at reception, secretariat and accounting points.
3. Backups & off-network storage
   Daily, with read control.
4. Staff training
   Phishing email recognition, use of strong passwords, non-disclosure policy.
5. Regular updates (patches) on Windows Server, http.sys, Office
   Vulnerabilities in Windows and IIS services are a common entry point (e.g. CVE-2024-21410, CVE-2024-49112).

• A medical record is worth €50-100 on the dark web, compared to €1 for a credit card.
• In 2023, a Greek private hospital was attacked by Ransomware, encrypting examination files and financial data.
• In 2024, attacks were carried out on small private clinics and laboratories in Attica and Thessaloniki, targeting ERP-Accounting connections.

Your medical center may have modern equipment, but if it doesn't have a modern digital shield, then it's exposed. Hackers don't care about the size of the clinic - they care about the lifeblood of your data.

1. Sensitive customer and cargo data
   Booking details, personal data of passengers and organizations.
   Invoices, conditions of carriage, shipping contracts, cargo data.
2. Interconnected systems and networks
   Booking, payment and fleet management systems with connection to third-party providers.
   Booking websites, online payments, mobile apps.
3. Supply chain security
   Use of IoT and SCADA systems to monitor ships, cargo, and goods, which makes shipping companies vulnerable.

• Ransomware on shipping companies, encrypting critical data such as ship plans, itinerary information, customer data.
• Phishing attacks via emails pretending to be from shipping organizations or travel agencies, aiming to obtain money or passwords.
• Leakage of trade secrets and shipping information on the Dark Web.
• Attacks on IoT devices used for fleet monitoring, allowing hackers to gain access to critical data on ships and cargo.

1. Loss of trust from customers and partners
   Customer data is the A and Z for shipping and travel companies. Its leakage can mean the loss of important customers and partnerships.
2. Fines for violating GDPR regulations and other international regulations.
   Personal passenger data, such as AMKA or passports, require strong protection.
3. Slowdown or shutdown
   Disruption of reservations, fleet management, collections and payments due to the attack.
4. Risk of sending malicious cargo due to the insecurity of management systems.

1. Strengthen IT and network security

Use VPN and strong firewalls to protect internal systems and communication networks. Ensure the security of ERP, reservation systems and applications that communicate with third parties.

2. Secure data storage and encryption

All customer and merchandise data must be encrypted and stored securely in data centers with ISO/IEC 27001 certifications. Backup of critical data with encryption and restore off-site.

3. Staff training

Continuous training on phishing and social engineering techniques used by hackers. Policy on the use of strong passwords and multi-factor authentication.

4. System Upgrade and Maintenance

Regularly upgrade Windows servers, applications, and ERP systems to protect against known vulnerabilities. Implement the latest version of software and security codes.

5. Secure ship and cargo data management via IoT

Use encrypted systems for fleet monitoring and cargo management. Ensure that SCADA systems and IoT devices are properly protected.

• In 2023, a shipping company in South Korea was hit by a ransomware attack, resulting in the encryption of 30% of its data and the suspension of shipping for 48 hours.
• Travel agencies worldwide have been hit by attacks targeting customers' reservations and credit card information.

Shipping and travel companies are extremely vulnerable to cyberattacks, mainly due to their continued reliance on technology to process customer and cargo data. By using the right security measures and enhancing staff training, the industry can drastically reduce risks and protect both customer data and its reputation.

The risk of falling victim to customer account theft is not only about protecting your customer data, but also about the reputation and legitimate operation of your business. E-commerce attacks that focus on customer account theft put your business and its continued operation at immediate risk. Protecting your customer account is essential for the security of your business, your customers, and your revenue. For this reason, developing a strong cybersecurity strategy is crucial to growing and protecting your business in the digital world.