It's been a busy 24 hours in the cyber world with significant updates on actively exploited zero-days, nation-state attacks on critical infrastructure, sophisticated vishing campaigns, and the evolving threat landscape of AI. Let's dive in:

Ivanti EPMM Zero-Days Under Active Exploitation ⚠️

- Ivanti has patched two critical zero-day vulnerabilities (CVE-2026-1281, CVE-2026-1340) in its Endpoint Manager Mobile (EPMM) product, both rated CVSS 9.8 for unauthenticated remote code execution (RCE).
- These flaws are actively being exploited in a limited number of customer environments, allowing threat actors to gain administrative access, move laterally, and potentially access sensitive data like phone numbers and GPS locations.
- While specific IOCs are scarce, defenders should scrutinise Apache access logs for unusual GET requests with bash commands in In-House Application Distribution and Android File Transfer Configuration features, and look for unexpected web shells or WAR/JAR files. If compromised, a full restore from backup or migration to a new EPMM instance is recommended.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/30/ivanti_epmm_zero_days/

Coordinated Cyber Attacks on Polish Critical Infrastructure 🚨

- CERT Polska has detailed coordinated destructive cyber attacks on over 30 wind and solar farms, a manufacturing company, and a combined heat and power (CHP) plant in Poland on December 29, 2025.
- The attacks, attributed to Russia's FSB-linked Static Tundra (aka Berserk Bear, Ghost Blizzard), involved reconnaissance, firmware damage, file deletion, and deployment of custom wiper malware like DynoWiper and LazyWiper.
- Initial access was gained via vulnerable Fortinet perimeter devices and statically defined accounts lacking two-factor authentication, with attackers also exfiltrating data related to OT network modernisation and SCADA systems from M365 services.

📰 The Hacker News | https://thehackernews.com/2026/01/poland-attributes-december-cyber.html

ShinyHunters-Style Vishing Bypasses MFA for SaaS Data Theft 🔒

- Mandiant has observed an expansion of financially motivated ShinyHunters-style (UNC6240) activity, tracked as UNC6661 and UNC6671, using advanced vishing and fake credential harvesting sites.
- These groups impersonate IT staff to trick employees into providing SSO credentials and MFA codes, then register their own devices for MFA to access cloud SaaS platforms, exfiltrate sensitive data, and extort victims.
- Organisations should enhance help desk verification processes, enforce strong passwords, remove SMS/phone/email as MFA options, restrict management access, and implement robust logging and detection for MFA lifecycle changes and SaaS export behaviours, moving towards phishing-resistant MFA like FIDO2.

📰 The Hacker News | https://thehackernews.com/2026/01/mandiant-finds-shinyhunters-using.html

Iran-Linked RedKitten Uses AI for Human Rights NGO Targeting 🐱

- A Farsi-speaking threat actor, RedKitten, linked to Iranian state interests, is targeting human rights NGOs and activists, likely leveraging large language models (LLMs) for tooling development.
- The campaign uses macro-laced Excel documents (fabricated protestor death details) in 7-Zip archives as lures, dropping a C#-based SloppyMIO implant via AppDomainManager injection.
- SloppyMIO uses GitHub as a dead drop resolver for Google Drive URLs, steganographically retrieving configuration for its Telegram Bot API-based command-and-control, enabling command execution, file exfiltration, and persistence.

📰 The Hacker News | https://thehackernews.com/2026/01/iran-linked-redkitten-cyber-campaign.html

Agentic AI: The Next Big Attack Surface 🤖

- A Dark Reading poll indicates that agentic AI is widely expected to become the top attack vector by the end of 2026, due to the expanded attack surface from agents' high access and autonomy, especially with insecure code and "shadow AI."
- Experts highlight that the primary vulnerability lies in what compromised AI agents can access, stressing that authentication and access control, rather than AI safety features, are the critical battleground for securing autonomous systems.
- Deepfakes are also rising as a major social engineering vector for high-value targets, while the adoption of phishing-resistant passkeys is lagging, leaving organisations vulnerable as agentic systems proliferate.

🕶️ Dark Reading | https://www.darkreading.com/threat-intelligence/2026-agentic-ai-attack-surface-poster-child

#CyberSecurity #ThreatIntelligence #Vulnerabilities #ZeroDay #RCE #Ivanti #NationState #APT #CriticalInfrastructure #Poland #Russia #Wiper #ShinyHunters #Vishing #MFA #SaaS #Extortion #Iran #RedKitten #LLM #AI #Deepfakes #ThreatLandscape #InfoSec #CyberAttack #Malware #IncidentResponse

It's been a busy 24 hours in the cyber world with significant updates on active exploitation of zero-days, widespread cyberattacks from sophisticated threat actors, and important discussions around data privacy and government initiatives. Let's dive in:

Recent Cyber attacks or breaches

ShinyHunters' SSO Vishing Spree Continues ⚠️
- The ShinyHunters group is actively targeting around 100 organisations, including major players like Canva, Atlassian, Epic Games, and Panera Bread, using evolved voice-phishing (vishing) techniques to compromise Okta, Microsoft, and Google SSO credentials.
- These attacks involve real-time phishing kits that mimic legitimate login pages and MFA requests, tricking employees into providing credentials and enrolling threat actor-controlled devices into MFA solutions.
- The group has claimed data theft from SoundCloud (29.8 million accounts), Betterment, Crunchbase, Panera Bread (14 million records), CarMax (500k+), and Edmunds (millions), often followed by extortion demands.
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/soundcloud-confirms-breach-after-member-data-stolen-vpn-access-disrupted/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/have-i-been-pwned-soundcloud-data-breach-impacts-298-million-accounts/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/26/shinyhunters_okta_sso_campaign/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/27/shinyhunters_claim_panera_bread/
🤫 CyberScoop | https://cyberscoop.com/shinyhunters-voice-phishing-sso-okta-mfa-bypass-data-theft/

Russian Security Firm Delta Hit by Cyberattack 🚨
- Delta, a major Russian provider of alarm and security systems for homes, businesses, and vehicles, suffered a "large-scale, coordinated" cyberattack attributed to an unspecified "hostile foreign state."
- The attack caused widespread service outages, with customers reporting issues like car alarms not deactivating, vehicles locking unexpectedly, and home systems switching to emergency mode.
- While Delta denies personal data compromise, an unidentified Telegram channel claiming responsibility has published an archive of alleged stolen data, the authenticity of which is unverified.
🗞️ The Record | https://therecord.media/russia-delta-security-alarm-company-cyberattack

Nike Investigates 1.4TB Data Leak by WorldLeaks 👟
- Sportswear giant Nike is investigating a potential cyber incident after the WorldLeaks extortion group claimed to have leaked over 1.4 terabytes of internal company data.
- The alleged stolen data includes internal documents, archives from 2020-2026, R&D assets, product creation details (technical packs, prototypes), supply chain information, and internal business presentations.
- WorldLeaks, believed to be a rebrand of the Hunters International ransomware group, briefly listed Nike on its leak site before removing the entry, suggesting potential negotiations or payment.
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/nike-investigates-data-breach-after-extortion-gang-leaks-files/
🗞️ The Record | https://therecord.media/nike-probes-alleged-cyber-incident
🕶️ Dark Reading | https://www.darkreading.com/cyberattacks-data-breaches/worldeaks-extortion-group-stole-1.4tb-nike-data

Ploutus ATM Jackpotting Ring Busted 💸
- US authorities have charged an additional 31 individuals, bringing the total to 87 members of the Venezuelan gang Tren de Aragua (TdA), for their involvement in a multi-million dollar ATM jackpotting scheme.
- The gang allegedly stole at least $5.4 million from 63 ATMs by physically accessing machines to replace hard drives or connect USBs, deploying Ploutus malware to force cash dispensing.
- TdA has been designated a Foreign Terrorist Organization by the U.S. Department of the Treasury, highlighting the increasing convergence of transnational organised crime and cyber-enabled financial fraud.
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/us-charges-31-more-suspects-linked-to-atm-malware-attacks/
🗞️ The Record | https://therecord.media/dozens-more-charged-ploutus-jackpotting-atm

China-linked Hackers Accused of Years-Long UK Government Espionage 🇨🇳
- Chinese state-linked hackers, identified as Salt Typhoon, are accused of years-long access to the phones of senior Downing Street officials, potentially exposing private communications.
- The espionage focused on aides to former UK Prime Ministers and leveraged intrusions into telecommunications providers to skim metadata and communications without direct handset installation.
- This incident, discovered in 2024, underscores the persistent threat of nation-state espionage targeting critical government infrastructure and sensitive communications.
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/27/chinalinked_hackers_accused_of_yearslong/

New Threat Research on Threat Actors/Groups, Ransomware, Malware, or Techniques and Tradecraft

ClickFix Attacks Evolve with App-V and Steganography 🎣
- A new ClickFix campaign is using fake CAPTCHA prompts to trick users into executing a command that abuses the signed Microsoft App-V script, SyncAppvPublishingServer.vbs, as a living-off-the-land (LoL) binary.
- This method proxies PowerShell execution through a trusted Microsoft component, making detection harder, and delivers the Amatera infostealer, which retrieves configuration from a public Google Calendar file and uses steganography to hide payloads in PNG images.
- The campaign is highly evasive, with checks for sandbox environments and a focus on enterprise-managed systems, reflecting a broader trend of ClickFix evolution into variants like GlitchFix and ClearFake, leveraging trusted web infrastructure for malware delivery.
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/new-clickfix-attacks-abuse-windows-app-v-scripts-to-push-malware/
📰 The Hacker News | https://thehackernews.com/2026/01/clickfix-attacks-expand-using-fake.html

'Stanley' MaaS Guarantees Malicious Chrome Extensions 😈
- A new malware-as-a-service (MaaS) called 'Stanley' is being advertised, promising to bypass Google's review process and publish malicious phishing extensions to the Chrome Web Store.
- These extensions can overlay full-screen iframes with phishing content over legitimate webpages, silently auto-install on Chrome, Edge, and Brave, and support custom tweaks, C2 polling, and geographic targeting.
- This offering highlights the ongoing challenge of securing browser extension platforms and the commoditisation of sophisticated phishing techniques, urging users to be vigilant about extension installations and publishers.
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/new-malware-service-guarantees-phishing-extensions-on-chrome-web-store/

Chinese Networks Dominate Illicit Crypto Laundering 💰
- Chinese money laundering networks processed an estimated $16.1 billion in illicit cryptocurrency in 2025, accounting for 20% of all laundered funds globally.
- These operations are highly professionalised, using Telegram groups, "guarantee" platforms for escrow protection, and offering services like "Black U" for hacking proceeds and crypto swapping.
- The continued resilience of these networks, despite crackdowns, underscores the global challenge of combating crypto-enabled financial crime and its links to transnational organised crime groups.
🗞️ The Record | https://therecord.media/chinese-money-launderers-moved-more-crypto-2025

Vulnerabilities, especially any mentioning Remote Code Exploitation (RCE), Active Exploitation, or Zero-Days

Microsoft Office Zero-Day Under Active Exploitation (CVE-2026-21509) 🚨
- Microsoft has issued an emergency out-of-band patch for CVE-2026-21509, a high-severity security feature bypass zero-day in Microsoft Office that is actively being exploited in the wild.
- The flaw bypasses OLE mitigations, allowing attackers to execute arbitrary code by convincing a user to open a specially crafted Office file; the preview pane is not an attack vector.
- CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to apply patches or implement registry-based mitigations for older Office versions by February 16.
📰 The Hacker News | https://thehackernews.com/2026/01/microsoft-issues-emergency-patch-for.html
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/27/office_zeroday_exploited_in_the/

SmarterMail Servers Vulnerable to RCE via Auth Bypass (CVE-2026-23760) 🛡️
- Over 6,000 SmarterMail servers remain exposed online and are likely vulnerable to automated attacks exploiting CVE-2026-23760, a critical authentication bypass flaw.
- This vulnerability in the password reset API allows unauthenticated attackers to hijack admin accounts and achieve remote code execution (RCE) on affected servers.
- CISA has added CVE-2026-23760 to its KEV catalog, urging federal agencies to patch by February 16, as mass exploitation attempts have already been observed in the wild.
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/over-6-000-smartermail-servers-exposed-to-automated-hijacking-attacks/

Critical Sandbox Escape in vm2 Node.js Library (CVE-2026-22709) 💻
- A critical sandbox escape vulnerability, CVE-2026-22709, has been discovered in the popular vm2 Node.js library, allowing arbitrary code execution on the host system.
- The flaw stems from improper sanitisation of Promise callbacks, enabling attackers to bypass the secure context designed to isolate untrusted JavaScript code.
- Despite the project being previously discontinued due to similar issues, vm2 remains widely used, and users are strongly advised to upgrade to version 3.10.3 immediately due to the trivial nature of exploitation.
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/critical-sandbox-escape-flaw-discovered-in-popular-vm2-nodejs-library/

WinRAR Path Traversal Flaw Actively Exploited (CVE-2025-8088) 📦
- The high-severity WinRAR path traversal vulnerability, CVE-2025-8088, continues to be actively exploited by both state-sponsored and financially motivated threat actors since July 2025.
- Attackers leverage Alternate Data Streams (ADS) to conceal malicious files within decoy archives, dropping payloads like LNK, HTA, or script files into Windows Startup folders for persistence.
- Google Threat Intelligence reports observing groups like RomCom, APT44, TEMP.Armageddon, Turla, and China-linked actors using this flaw to deliver various malware, highlighting the commoditisation of such exploits.
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/winrar-path-traversal-flaw-still-exploited-by-numerous-hackers/

Data Privacy

Google Settles Voice Recording Lawsuit for $68 Million 🎤
- Google has agreed to a $68 million settlement in a class-action lawsuit alleging its voice-activated assistant illegally recorded and shared private conversations with third parties for targeted advertising.
- Plaintiffs claimed Google Assistant improperly triggered and recorded their words, leading to unwanted targeted ads, with the settlement funds to be distributed to Google device purchasers since May 2016.
- While Google settled without admitting wrongdoing, the case underscores ongoing concerns about privacy in voice-activated technologies and the use of personal data.
🗞️ The Record | https://therecord.media/google-settles-millions-privacy-recording

WhatsApp Introduces 'Strict Account Settings' for Spyware Protection 🔒
- WhatsApp is rolling out a new "Strict Account Settings" feature designed to combat sophisticated spyware attacks by allowing users to block attachments and media from non-contacts.
- This "lockdown-style" feature is specifically aimed at high-risk users like journalists and public figures, drawing parallels with similar protections offered by Apple and Google.
- The move follows WhatsApp's legal battles against NSO Group over Pegasus spyware, reinforcing the platform's commitment to user privacy and defence against advanced surveillance tools.
🤫 CyberScoop | https://cyberscoop.com/whatsapp-strict-account-settings-lockdown-style-spyware-protection/
🗞️ The Record | https://therecord.media/whatsapp-spyware-anti-lockdown

#CyberSecurity #ThreatIntelligence #Ransomware #NationState #APT #ZeroDay #Vulnerability #ActiveExploitation #DataPrivacy #InfoSec #CyberAttack #Malware #IncidentResponse #SSO #MFA #Phishing #Vishing #PQC #DigitalSovereignty

It's been a bit light on news over the last 24 hours, but we've got a couple of noteworthy updates: a failed nation-state attack on critical infrastructure and a new feature from a popular password manager to help combat phishing. Let's dive in:

Sandworm's Failed Wiper Attack on Poland's Energy Grid ⚠️

- The Russian state-sponsored group Sandworm (also known as APT44, UAC-0113, or Seashell Blizzard) has been linked to a failed cyberattack on Poland's energy infrastructure in late December 2025.
- The group attempted to deploy a new destructive data-wiping malware, dubbed DynoWiper (detected as Win32/KillFiles.NMO), targeting combined heat and power plants and renewable energy management systems.
- Polish officials confirmed the attacks were stopped, highlighting the ongoing threat from nation-state actors to critical infrastructure and the importance of robust defensive measures.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/sandworm-hackers-linked-to-failed-wiper-attack-on-polands-energy-systems/

1Password Boosts Phishing Protection 🔒

- 1Password has rolled out new pop-up warnings for suspected phishing sites, aiming to prevent users from manually entering credentials on malicious or typosquatted domains.
- This feature adds an extra layer of defence beyond the existing URL matching, which prevents auto-filling, by explicitly alerting users who might otherwise overlook subtle domain discrepancies.
- Available automatically for individual and family plans, and configurable for enterprise admins, this update addresses the growing threat of sophisticated, AI-enhanced phishing scams.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/1password-adds-pop-pup-warnings-for-suspected-phishing-sites/

#CyberSecurity #ThreatIntelligence #NationState #Sandworm #CriticalInfrastructure #Wiper #Phishing #PasswordManager #InfoSec #CyberAttack #IncidentResponse

Alright team, it's been a pretty packed 24 hours in the cyber world! We've got updates on some serious threat actor activity, a critical vulnerability under active exploitation, a deep dive into AI agent risks, and some interesting news from CISA. Let's get stuck in:

Recent Cyber Attacks & Threat Actor Activity 💥

- ShinyHunters is claiming responsibility for widespread voice phishing (vishing) attacks targeting Single Sign-On (SSO) accounts across Okta, Microsoft Entra, and Google.
- Attackers impersonate IT support, tricking employees into providing credentials and MFA codes on dynamic phishing sites, then leveraging compromised SSO access to exfiltrate data from connected SaaS platforms like Salesforce for extortion.
- The group uses previously stolen data to enhance social engineering efforts, with recent breaches confirmed at SoundCloud, Betterment, and Crunchbase.
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/shinyhunters-claim-to-be-behind-sso-account-data-theft-attacks/

- The Russian nation-state group Sandworm attempted a significant cyberattack on Poland's power system in late December 2025, deploying a new wiper malware dubbed DynoWiper.
- While the attack on two combined heat and power plants and renewable energy management systems was unsuccessful, it highlights Sandworm's persistent targeting of critical infrastructure, echoing their 2015 Ukraine power grid attack.
- The use of DynoWiper shows their continued development of destructive capabilities, underscoring the ongoing threat to energy sectors.
📰 The Hacker News | https://thehackernews.com/2026/01/new-dynowiper-malware-used-in-attempted.html

- A sophisticated multi-stage phishing campaign is targeting Russian users, delivering the Amnesia Remote Access Trojan (RAT) and a Hakuna Matata-derived ransomware.
- The campaign leverages social engineering, LNK files, PowerShell, and public cloud services (GitHub, Dropbox) for resilient payload distribution, notably using 'defendnot' to disable Microsoft Defender.
- Amnesia RAT is a comprehensive tool for data theft (browsers, crypto wallets, Discord, Steam, Telegram) and remote control, while the ransomware encrypts files and modifies clipboard crypto addresses, demonstrating full system compromise without exploiting vulnerabilities.
📰 The Hacker News | https://thehackernews.com/2026/01/multi-stage-phishing-campaign-targets.html

- North Korean threat group Konni (APT37, Kimsuky) is targeting blockchain developers and engineers in the Asia-Pacific region with malware showing strong indications of AI-assisted development.
- The attack chain starts with Discord-hosted links delivering ZIP archives containing PDF lures and malicious LNK files, which execute a PowerShell loader and deploy a backdoor.
- The PowerShell backdoor's structured documentation, modular layout, and specific placeholder comments suggest it was generated or heavily assisted by a Large Language Model (LLM).
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/konni-hackers-target-blockchain-engineers-with-ai-built-malware/

Critical Vulnerabilities Under Active Exploitation ⚠️

- A critical out-of-bounds write vulnerability, CVE-2024-37079 (CVSS 9.8), in VMware vCenter Server's DCERPC protocol is being actively exploited in the wild.
- Despite being patched by Broadcom in June 2024, CISA has added this flaw to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to patch by February 13, 2026.
- Attackers with network access can send specially crafted packets to achieve remote code execution, and previous vCenter flaws in the same protocol have been exploited by state-backed groups, underscoring the importance of immediate patching and ensuring vCenter is not exposed to the public internet.
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/23/critical_vmware_vcenter_server_bug/
📰 The Hacker News | https://thehackernews.com/2026/01/cisa-adds-actively-exploited-vmware.html

AI Agents and Enterprise Security Risk 🤖

- The rapid deployment of AI agents is fundamentally challenging traditional Identity and Access Management (IAM) models, as these autonomous agents often operate with broad, persistent, and ownerless permissions.
- Organisational agents, in particular, pose the highest risk by creating "agentic authorization bypass" paths, allowing users to indirectly perform actions they are not directly permitted to execute.
- Securing AI agents requires a shift towards clear ownership, mapping user-agent interactions, and tracing agent access across all systems to accurately assess risk and prevent misuse.
📰 The Hacker News | https://thehackernews.com/2026/01/who-approved-this-agent-rethinking.html

Government Cyber Policy & Engagement 🏛️

- The US Cybersecurity and Infrastructure Security Agency (CISA) has confirmed it will not attend the annual RSA Conference in March, citing a focus on its core mission and "good stewardship of taxpayer dollars."
- This decision follows political tensions, including the recent appointment of former CISA director Jen Easterly as RSAC CEO, and marks a significant departure from CISA's historical active participation and speaking roles at the event.
- The move suggests a potential shift in how federal cyber officials engage with the broader cybersecurity industry under the current administration.
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/24/cisa_skipping_rsa_exclusive/

#CyberSecurity #ThreatIntelligence #Ransomware #NationState #APT #ZeroDay #Vulnerability #VMware #SSO #Vishing #AI #CyberAttack #Malware #IncidentResponse #CISA #InfoSec

It's been a busy 24 hours in the cyber world with significant updates on recent attacks, actively exploited vulnerabilities, new malware campaigns, and a reminder about the ever-evolving privacy landscape. Let's take a look:

Kyowon Group Hit by Suspected Ransomware ⚠️
- South Korea's Kyowon Group, a major education and lifestyle company, shut down parts of its network after identifying a suspected ransomware attack.
- The company confirmed an extortion demand and is investigating potential data leakage, including sensitive customer information, possibly affecting millions.
- This incident follows other high-profile data breaches in South Korea, prompting pledges for stronger data protection laws.

🗞️ The Record | https://therecord.media/kyowon-group-south-korea-suspected-ransomware-attack

Dutch Port Hacked for Cocaine Smuggling 🚨
- A Dutch appeals court upheld a seven-year prison sentence for a man who hacked port IT systems using malware-stuffed USB sticks to aid cocaine smugglers.
- The attacker gained months of remote access, exploring the network and hunting for admin rights, even live-blogging the break-in via encrypted chats.
- The case highlights the real-world impact of cyber intrusions facilitating organised crime, with the hack directly enabling a 210 kg cocaine shipment.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/13/dutch_port_hacker_appeal/

Black Axe Leaders Arrested in Spain 🕵️
- Spanish police, supported by Europol, arrested 34 alleged cybercriminals, including leaders of the transnational Black Axe organisation, across four cities.
- Black Axe is known for business email compromise (BEC) scams, money laundering, and vehicle trafficking, with estimated fraud exceeding $6.9 million.
- The operation froze $139,000 in bank accounts and seized cash, vehicles, and devices, significantly disrupting the hierarchical, Nigerian-led group.

🤫 CyberScoop | https://cyberscoop.com/black-axe-disruption-arrests-spain/

Supreme Court Filing System Hack 🏛️
- A Tennessee man is expected to plead guilty to a misdemeanor charge for hacking into the U.S. Supreme Court’s electronic case filing system on 25 occasions between August and October 2023.
- Nicholas Moore, 24, "intentionally accessed a computer without authorization," though details on the specific information accessed were not released.
- This incident underscores ongoing vulnerabilities in federal judicial systems, which have seen strengthened protections following sophisticated cyberattacks.

🗞️ The Record | https://therecord.media/guilty-plea-hacking-supreme-court-case-filing-system

Malicious Chrome Extension Steals MEXC API Keys 💰
- A malicious Google Chrome extension, "MEXC API Automator," is actively stealing API keys from the MEXC cryptocurrency exchange by masquerading as a trading tool.
- The extension programmatically creates new API keys with withdrawal permissions, hides these permissions in the UI, and exfiltrates the keys to a Telegram bot.
- This attack leverages an already authenticated browser session, bypassing traditional authentication, and grants attackers unfettered access to victims' crypto accounts.

📰 The Hacker News | https://thehackernews.com/2026/01/malicious-chrome-extension-steals-mexc.html

Gogs Zero-Day Under Active Exploitation 🛡️
- CISA has added CVE-2025-8110, a high-severity path traversal vulnerability in the Gogs self-hosted Git service, to its KEV catalog due to active exploitation.
- The flaw allows authenticated users to bypass previous fixes (CVE-2024-55947) by exploiting symbolic link handling in the PutContents API, leading to remote code execution.
- With no official patch yet, federal agencies are mandated to apply mitigations by February 2, 2026, or cease using Gogs, while other users should disable open registration and restrict access.

📰 The Hacker News | https://thehackernews.com/2026/01/13/cisa-warns-of-active-exploitation-of.html
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/13/cisa_gogs_exploit/

ServiceNow AI Platform Critical Flaw 🔒
- ServiceNow patched CVE-2025-12420, a critical 9.3 CVSS vulnerability in its AI Platform, allowing unauthenticated users to impersonate others and perform arbitrary actions.
- The flaw stemmed from a universal credential ("servicenowexternalagent") and lack of password/MFA for user identity verification, which could lead to full platform takeover.
- Although no in-the-wild exploitation has been confirmed, the vulnerability was deemed the "most severe AI-driven vulnerability to date" due to ServiceNow's deep integration across enterprise IT.

📰 The Hacker News | https://thehackernews.com/2026/01/servicenow-patches-critical-ai-platform.html
🌑 Dark Reading | https://www.darkreading.com/remote-workforce/ai-vulnerability-servicenow

AI/ML Python Libraries RCE Vulnerabilities 🐍
- Vulnerabilities in popular AI/ML Python libraries (Nvidia's NeMo, Salesforce's Uni2TS, Apple/EPFL VILAB's FlexTok) allow remote code execution via poisoned metadata.
- The flaws exploit Hydra's instantiate() function, which can execute arbitrary callables, enabling attackers to hide malicious code in model metadata that runs automatically upon loading.
- Patches have been issued for NeMo (CVE-2025-23304) and Uni2TS (CVE-2026-22584), with FlexTok also fixed, urging users to only load models from trusted sources.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/13/ai_python_library_bugs_allow/

Kremlin-linked Hackers Target Ukraine Military 🪖
- CERT-UA reports a new cyber-espionage campaign by Void Blizzard (UAC-0190) targeting Ukraine's military personnel using a novel PluggyApe malware.
- Attackers impersonate charitable organisations and use messaging apps like Signal and WhatsApp to deliver password-protected malicious executables.
- This campaign highlights a shift towards highly tailored social engineering, leveraging trusted communication channels and detailed target knowledge to deliver malware.

🗞️ The Record | https://therecord.media/kremlin-linked-hackers-pose-as-charities-spy-ukraine

SHADOW#REACTOR Delivers Remcos RAT 👻
- A new campaign, SHADOW#REACTOR, uses an evasive multi-stage Windows attack chain to deploy the Remcos RAT for persistent remote access.
- The infection leverages obfuscated VBS launchers, PowerShell downloaders, fragmented text-based payloads, and a .NET Reactor-protected loader to complicate detection.
- This broad, opportunistic activity, likely by initial access brokers, abuses LOLBins like MSBuild.exe and employs self-healing mechanisms to ensure payload delivery.

📰 The Hacker News | https://thehackernews.com/2026/01/new-malware-campaign-delivers-remcos.html

AsyncRAT Campaign Abuses Cloudflare & Python ☁️
- An emerging phishing campaign is delivering AsyncRAT by exploiting Cloudflare's free-tier services (TryCloudflare tunneling) and legitimate Python downloads.
- Attackers use Dropbox links with double-extension files (.pdfurl) in phishing emails, installing a full Python environment to inject code into explorer.exe.
- This technique masks malicious activity under trusted domains and legitimate tools, making detection challenging and highlighting the ongoing effectiveness of phishing and abuse of legitimate services.

🌑 Dark Reading | https://www.darkreading.com/endpoint-security/attackers-abuse-python-cloudflare-deliver-asyncrat

AVCheck Malware Kingpin Arrested 🚫
- Dutch police arrested a 33-year-old man at Amsterdam's Schiphol Airport, believed to be the mastermind behind the AVCheck online platform.
- AVCheck was a counter-antivirus (CAV) service, shuttered in May by Operation Endgame, that allowed cybercriminals to test malware against various AV products to evade detection.
- The arrest underscores ongoing international law enforcement efforts to dismantle critical components of the cybercrime ecosystem.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/13/avcheck_arrest/

North Korea's IT Worker & Crypto Theft Schemes 🇰🇵
- The U.S. urged UN member states to take tougher action against North Korea's IT worker scheme and cryptocurrency heists, which fund its weapons programs.
- A 140-page report highlights that over 40 countries are impacted, with North Korean IT workers stealing identities to secure remote jobs and laundered crypto funds exceeding $2 billion last year.
- China and Russia were criticised for providing safe havens, with 1,500 North Korean IT workers estimated in China alone, violating UN Security Council Resolutions.

🗞️ The Record | https://therecord.media/40-countries-impacted-nk-it-thefts-united-nations

India's Strict Crypto KYC/AML Rules 🇮🇳
- India's Financial Intelligence Unit (FIU-IND) updated regulations for crypto service providers, requiring strict client due diligence for all serving Indian residents, even offshore.
- New rules mandate collecting identity documents, bank details, occupation, income, and crucially, "Latitude and longitude coordinates of the onboarding location with date and timestamp along with IP address," plus a selfie.
- These measures aim to combat fraud, money laundering, and terrorism financing in the anonymous and instantaneous crypto transaction landscape.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/13/india_crypto_kyc_aml_update/

US Cyber Command Leadership Shake-up 🇺🇸
- Air Force Lt. Col. Jason Gargan, commander of a Cyber National Mission Force task force aligned against Russia, was "relieved for cause" due to operational disagreements.
- This unusual dismissal highlights a "loss of trust and confidence" in command ability, with Gargan now expected to retire by the end of 2026.
- The incident occurs amidst other top-rank changes at Cyber Command, which has been without a Senate-confirmed leader for over nine months.

🗞️ The Record | https://therecord.media/senior-military-cyber-op-removed-russia-task-force

US Cyber Offense vs. Defense Debate ⚖️
- A House Homeland Security subcommittee debated the U.S. approach to cyber deterrence, with some lawmakers warning against expanding offensive cyber operations before strengthening defenses.
- Concerns were raised about CISA losing one-third of its workforce and the potential for offensive actions to provoke retaliation if U.S. networks are not adequately defended.
- While acknowledging the importance of offense, experts suggested a hybrid approach where the private sector supports government offensive operations, with CISA coordinating and receiving legal protections.

🤫 CyberScoop | https://cyberscoop.com/us-offensive-cyber-operations-defense-cisa-workforce-house-homeland-security-committee/

Mandiant's Salesforce Security Tool 🛠️
- Mandiant has open-sourced AuraInspector, a tool designed to help Salesforce admins detect misconfigurations in Aura (Experience Cloud sites) that could expose sensitive data.
- The tool targets access control issues, such as unauthenticated users gaining access to Salesforce Account object records, and can bypass 2,000-record limits via GraphQL API abuse.
- AuraInspector automates potential abuse techniques and remediation strategies, providing read-only operations to identify damaging misconfigurations without modifying Salesforce instances.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/13/mandiant_salesforce_tool/

#CyberSecurity #ThreatIntelligence #Ransomware #Vulnerability #ZeroDay #RCE #Malware #APT #NationState #Cybercrime #DataPrivacy #InfoSec #IncidentResponse #CloudSecurity #AI #BrowserSecurity #KYC #AML

Alright team, it's been a busy 24 hours in the cyber world with a slew of critical vulnerabilities, some intriguing AI security research, and ongoing debates around data privacy. Let's dive into the details:

Recent Cyber Attacks & Breaches ⚠️

- A new "Boto Cor-de-Rosa" campaign is using WhatsApp as a distribution vector for the Astaroth banking trojan in Brazil. The Python-based malware auto-sends malicious ZIP files to contacts, spreading like a worm and monitoring web activity for banking credentials.
- Spanish airline Iberia confirmed a data breach, linking it to a November incident where the Zestix (aka Sentap) threat actor used infostealer malware to compromise an employee's ShareFile instance, exfiltrating 77 GB of technical aircraft data and some customer PII.
- Taiwan's National Security Bureau reported a tenfold increase in Chinese cyberattacks on its energy sector in 2025, with over 960 million intrusion attempts targeting nine critical sectors by groups like BlackTech and APT41.
- Cybersecurity firm Resecurity successfully trapped threat actors claiming affiliation with Scattered LAPSUS$ Hunters (SLH) in a honeypot, observing over 188,000 data dump requests, though SLH has since ramped up recruitment efforts.

📰 The Hacker News | https://thehackernews.com/2026/01/whatsapp-worm-spreads-astaroth-banking.html
🗞️ The Record | https://therecord.media/spanish-airline-attributes-recent-breach-allegation-to-nov-incident
📰 The Hacker News | https://thehackernews.com/2026/01/threatsday-bulletin-rustfs-flaw-iranian.html

Vulnerabilities & Active Exploitation 🚨

- A maximum-severity (CVSS 10.0) unauthenticated RCE vulnerability, CVE-2026-21858 (dubbed "ni8mare"), has been disclosed in the n8n automation platform. This flaw allows attackers to execute arbitrary code and gain full control without credentials, and active scanning for vulnerable instances is now being observed.
- CISA has added two critical flaws to its KEV catalog: CVE-2025-37164 (CVSS 10.0) in HPE OneView, a code injection vulnerability now actively exploited, and CVE-2009-0556 (CVSS 8.8) in Microsoft Office PowerPoint, a 15-year-old bug still targeting unpatched systems.
- Attackers are actively exploiting CVE-2026-0625 (CVSS 9.3), a zero-day command injection vulnerability in multiple discontinued D-Link DSL gateway devices. This flaw allows remote code execution via improper input validation in DNS server settings, underscoring the risk of end-of-life hardware.
- High-severity flaws include CVE-2025-64496 (CVSS 7.3) in Open WebUI, allowing account takeover and potential RCE, and CVE-2025-68433/CVE-2025-68432 (CVSS 7.8) in Zed IDE, enabling arbitrary code execution via malicious repositories or LSP configurations.
- A critical (CVSS 9.8) hard-coded static gRPC authentication token in RustFS versions alpha.13-alpha.77 allows privileged operations for any network-accessible attacker.
- Cisco patched CVE-2026-20029 (CVSS 4.9), an XML External Entity (XXE) vulnerability in ISE and ISE-PIC, allowing authenticated attackers to read arbitrary files. A public PoC exists, urging immediate patching due to nation-state interest in networking devices.
- Threat actors are exploiting CVE-2024-36401, a known GeoServer vulnerability, to distribute XMRig cryptocurrency miners and other malware via PowerShell commands.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/08/n8n_rce_bug/
🤫 CyberScoop | https://cyberscoop.com/n8n-critical-vulnerability-massive-risk/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/08/cisa_oneview_powerpoint_bugs/
📖 Dark Reading | https://www.darkreading.com/cyberattacks-data-breaches/attackers-exploit-zero-day-end-of-life-d-link-routers
📰 The Hacker News | https://thehackernews.com/2026/01/threatsday-bulletin-rustfs-flaw-iranian.html
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/08/rcisco_ise_bug_poc/

New Threat Research: Ransomware, Malware & AI Security 🤖

- Ransomware attacks surged over 50% in 2025, with more than 8,000 victims appearing on leak sites, despite law enforcement efforts. The landscape is fragmented, with smaller groups and affiliates quickly re-emerging, increasingly relying on social engineering and stolen credentials.
- Criminals are actively using AI-assisted coding ("vibe coding") to develop malware, with direct API calls to LLMs observed within malicious code. While AI-generated malware can contain errors, the speed of development outpaces security teams, necessitating robust security controls like Palo Alto Networks' SHIELD framework.
- Radware researchers uncovered "ZombieAgent," a new prompt injection attack against ChatGPT that bypasses existing defences to exfiltrate data character by character using static URLs and abuses ChatGPT's memory for persistence.
- IBM's AI coding agent "Bob" is vulnerable to prompt injection, allowing malware execution via its CLI, especially when "always allow" is enabled for commands. Researchers demonstrated how malicious README.md files can trick Bob into running harmful commands due to porous defences against command and process substitution.
- Iranian nation-state group MuddyWater is evolving, deploying custom backdoors like Phoenix and UDPGangster via phishing, moving away from commercial RMM tools. Concurrently, the pkr_mtsi Windows packer is being used in malvertising campaigns to distribute various malware families, including stealer and RATs, with sophisticated obfuscation.
- ANY.RUN detailed GravityRAT, a multi-platform RAT active since 2016, attributed to Pakistan's Transparent Tribe. It harvests sensitive data, including WhatsApp backups, and employs extensive anti-analysis techniques, spreading via spear-phishing or disguised apps.
- The number of Phishing-as-a-Service (PhaaS) toolkits doubled in 2025, driving 90% of high-volume phishing campaigns. These kits offer advanced anti-analysis, MFA bypass, and stealth, lowering the barrier for attackers using themes like fake payments and HR messages.
- ownCloud urged users to enable MFA after reports of threat actor Zestix (aka Sentap) auctioning data from 50 global enterprises, exploiting compromised credentials where MFA was absent on cloud file-sharing services.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/08/ransomware_2025_emsisoft/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/08/criminals_vibe_coding_malware/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/08/openai_chatgpt_prompt_injection/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/07/ibm_bob_vulnerability/
📰 The Hacker News | https://thehackernews.com/2026/01/threatsday-bulletin-rustfs-flaw-iranian.html
📰 The Hacker News | https://thehackernews.com/2026/01/threatsday-bulletin-rustfs-flaw-iranian.html
📰 The Hacker News | https://thehackernews.com/2026/01/threatsday-bulletin-rustfs-flaw-iranian.html

Data Privacy & Regulatory Issues ⚖️

- UK regulators (Ofcom, ICO) are investigating X and xAI after reports that Grok, its AI chatbot, generated nonconsensual sexual imagery, including child abuse images, raising serious concerns under the Online Safety Act.
- OpenAI's new ChatGPT Health feature, which allows connecting medical records and wellness app data, is drawing significant privacy concerns. Critics warn that this data is not protected by HIPAA, and OpenAI's terms could change, potentially leveraging sensitive health data for profit.
- OpenAI has been ordered to turn over 20 million anonymised ChatGPT logs in a US consolidated AI copyright case, where news publishers allege their copyrighted works were used for training without consent.
- Bryan Fleming, founder of the pcTattletale stalkerware, pleaded guilty to operating the app, which covertly spied on users and suffered a breach exposing 138,000 users' data. This marks a rare criminal prosecution for stalkerware purveyors.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/08/uk_regulators_swarm_x_after/
🤫 CyberScoop | https://cyberscoop.com/elon-musk-x-grok-deepfake-crisis-section-230/
🗞️ The Record | https://therecord.media/chatgpt-health-draws-concern-privacy-critics
📰 The Hacker News | https://thehackernews.com/2026/01/openai-launches-chatgpt-health-with.html
📰 The Hacker News | https://thehackernews.com/2026/01/threatsday-bulletin-rustfs-flaw-iranian.html

Government Staffing & Program Changes 🇺🇸

- The NSA's cybersecurity directorate has new acting leadership, with David Imbordino taking over as acting chief and Holly Baroody as acting deputy. The directorate has been without a permanent head for over nine months.
- The Trump administration is withdrawing the US from several international cybersecurity organisations, including the Global Forum on Cyber Expertise, citing redundancy and threats to US sovereignty. Critics fear this will create a leadership vacuum and erode global cyber coordination.

🗞️ The Record | https://therecord.media/nsa-cyber-directorate-new-acting-leadership
🤫 CyberScoop | https://cyberscoop.com/trump-pulls-us-out-of-international-cyber-orgs/

Industry News 💰

- CrowdStrike is acquiring identity management startup SGNL for nearly $740 million, aiming to enhance its identity security portfolio with dynamic, automated "just-in-time" access controls for diverse identities, including AI agents.

🤫 CyberScoop | https://cyberscoop.com/crowdstrike-sngl-deal-740-million/

Everything Else 🌐

- Cloudflare has debunked a theory that US cyberattacks on Venezuela coincided with BGP "weirdness" in January. While a BGP leak was confirmed, Cloudflare attributes it to mundane routing issues, stating it would be an ineffective method for a man-in-the-middle attack.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/08/cloudflare_venezuela_bgp_attack_theory/

#CyberSecurity #ThreatIntelligence #Vulnerabilities #RCE #ZeroDay #AI #Ransomware #Malware #DataPrivacy #InfoSec #CyberAttack #IncidentResponse #NationState #Regulatory

It's been a pretty packed 24 hours in the cyber world, with some critical RCE vulnerabilities under active exploitation, a string of significant breaches impacting UK public sector and a major car manufacturer, and important reminders about MFA. Let's dive in:

Critical RCEs Under Active Exploitation & Patches ⚠️
- Legacy D-Link DSL Routers (CVE-2026-0625): A critical command injection flaw (CVSS 9.3) in the "dnscfg.cgi" endpoint of legacy D-Link DSL gateway routers is being actively exploited. This allows unauthenticated remote attackers to execute arbitrary shell commands, leading to RCE and potential DNS hijacking. Many affected models (DSL-2640B, DSL-2740R, DSL-2780B, DSL-526B) are End-of-Life, meaning no patches are coming – upgrade immediately!
- Veeam Backup & Replication (CVE-2025-59470): Veeam has patched a critical RCE vulnerability (CVSS 9.0, rated high by Veeam due to privilege requirements) in Backup & Replication 13.0.1.180 and earlier. This flaw allows Backup or Tape Operators to achieve RCE as the postgres user. Given VBR's popularity and past targeting by ransomware gangs (Cuba, FIN7, Frag, Akira, Fog), patching is crucial.
- n8n Workflow Automation (CVE-2026-21858): A maximum severity (CVSS 10.0) "Ni8mare" vulnerability in n8n, an open-source workflow automation tool, allows remote, unauthenticated attackers to hijack instances. The flaw is a content-type confusion in how n8n parses data, enabling arbitrary file reading and potential secret exposure or command execution. Over 100,000 vulnerable servers are estimated; update to n8n version 1.121.0 or newer, and restrict public webhook/form endpoints.

📰 The Hacker News | https://thehackernews.com/2026/01/active-exploitation-hits-legacy-d-link.html
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/new-veeam-vulnerabilities-expose-backup-servers-to-rce-attacks/
🤫 CyberScoop | https://cyberscoop.com/veeam-backup-replication-security-flaw-remote-code-execution-fix/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/max-severity-ni8mare-flaw-lets-hackers-hijack-n8n-servers/

Major Cyber Incidents and Breaches 🚨
- Jaguar Land Rover (JLR): A September cyberattack, claimed by Scattered Lapsus$ Hunters, severely impacted JLR's Q3 fiscal 2026 results, causing wholesale volumes to plummet by 43.3% and retail sales by 25.1%. The incident halted production for weeks, disrupted global supply chains, and cost the UK economy an estimated £2.1 billion.
- UK Ministry of Justice (MoJ) / Legal Aid Agency (LAA): Despite spending £50 million on cybersecurity, the LAA suffered a "highly sensitive" cyberattack in December 2024 that went undetected until April 2025. The breach compromised legal aid applicant data, causing significant operational disruption and financial overpayments to providers, with recovery expected to take years.
- European Space Agency (ESA): ESA has confirmed another significant security breach, with Scattered Lapsus$ Hunters claiming to have stolen 500 GB of sensitive data, including operational procedures, spacecraft details, and proprietary contractor data (from partners like SpaceX, Airbus). The group alleges the vulnerability remains open, giving them continued access. This follows a December incident where 200 GB of ESA data was listed for sale.
- Higham Lane School: A cyberattack over the Christmas holiday has forced a British high school to delay its reopening, with its entire IT system, including phones, emails, and management systems, taken offline. This follows over 80 ransomware attacks on the UK education sector in 2024.
- Illinois Department of Human Services (IDHS): The IDHS inadvertently exposed personal data of over 700,000 state residents for up to four years by posting it on public mapping websites. The exposed data, including names, addresses, and public benefits status, is protected health information under HIPAA.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/07/jlr_wholesale_volumes/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/07/legal_aid_agency_attack/
🗞️ The Record | https://therecord.media/cyberattack-forces-british-high-school-to-delay-opening
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/07/european_space_agency_breach_criminal_probe/
🗞️ The Record | https://therecord.media/illinois-agency-exposed-data

Threat Actor Activity & Nation-State Operations ⚔️
- DDoSia Hacktivist Tool: Pro-Russian hacktivist group NoName057(16) is leveraging its custom DDoS tool, DDoSia, to conduct sustained, politically motivated attacks against Ukrainian and Western interests. The tool allows volunteers with minimal technical skill to participate in coordinated application-layer and multi-vector DDoS campaigns, often coinciding with geopolitical events.
- China's Cyber Offensive on Taiwan: Taiwan's National Security Bureau reported a 6% increase in Chinese cyberattacks in 2025, with 2.63 million intrusion attempts daily targeting government and critical infrastructure, particularly energy and hospitals. These attacks, often exploiting software/hardware vulnerabilities, are linked to China's political and military coercive actions.

⚫ Dark Reading | https://www.darkreading.com/cyberattacks-data-breaches/ddosia-powers-volunteer-driven-hacktivist-attacks
🤫 CyberScoop | https://cyberscoop.com/taiwan-china-cyberattacks-2025-energy-hospitals-nsb-report/

The Critical Need for MFA 🔒
- ownCloud Credential Theft: File-sharing platform ownCloud is urging its 200 million users to enable Multi-Factor Authentication (MFA) after reports of credential theft. Threat actors, like "Zestix" or "Sentap," are using infostealer malware (RedLine, Lumma, Vidar) to compromise employee devices, then leveraging stolen credentials to access ownCloud, ShareFile, and Nextcloud instances that lack MFA.
- Widespread Cloud Credential Heist: A report by Hudson Rock highlights a "pervasive failure in credential hygiene," where a single threat actor has breached dozens of global organisations by using infostealer-harvested credentials against cloud collaboration platforms without MFA. This underscores that simple security failures, not zero-days, are often the root cause of significant breaches.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/owncloud-urges-users-to-enable-mfa-after-credential-theft-reports/
⚫ Dark Reading | https://www.darkreading.com/cloud-security/lack-mfa-common-thread-vast-cloud-credential-heist

Regulatory Actions & Legal Outcomes ⚖️
- FCC Robocall Penalties: The US Federal Communications Commission (FCC) has finalised new financial penalties for telecoms that submit false, inaccurate, or late reporting to its Robocall Mitigation Database (RMD). Fines include $10,000 for false information and $1,000 for late updates, aiming to combat call spoofing and illegal robocalls. Two-factor authentication has also been added to the RMD.
- Stalkerware Prosecution: Bryan Fleming, creator of the pcTattletale stalkerware, has pleaded guilty in US federal court to selling software designed to intercept communications. This marks only the second successful prosecution of a stalkerware operator since 2014, highlighting a rare but significant legal victory against consumer spyware.

🤫 CyberScoop | https://cyberscoop.com/fcc-finalizes-new-penalties-for-robocall-violators/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/07/stalkerware_slinger_pleads_guilty/
🗞️ The Record | https://therecord.media/stalkerware-guilty-plea-fleming

UK Public Sector Cyber Defence Boost 🛡️
- The UK government has unveiled a new £210 million ($283 million) "Government Cyber Action Plan" to bolster cyber defences across its departments and the wider public sector. The plan includes establishing a dedicated Government Cyber Unit, setting minimum security standards, improving risk visibility, and promoting best practices through a new Software Security Ambassador Scheme. This follows recent legislation to protect critical infrastructure and a ban on ransomware payments for public sector organisations.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/uk-announces-plan-to-strengthen-public-sector-cyber-defenses/

Cyber Landscape Commentary 💭
- AI and the Cybersecurity Workforce: Qualys CEO Sumedh Thakar argues that the cybersecurity industry cannot simply hire its way out of the talent shortage in the AI era. Instead, organisations must leverage AI to automate repetitive tasks and shift towards a proactive Risk Operations Center (ROC) model. He also warns that AI-generated code often contains security flaws, necessitating embedded security in development pipelines.
- Cyber in Military Operations: Speculation surrounds the role of US Cyber Command in a recent military operation in Venezuela that led to the capture of President Nicolás Maduro. While President Trump hinted at "certain expertise" causing power outages, NetBlocks data suggests kinetic attacks could also be responsible. Experts note Venezuela's network infrastructure is a "soft target" for cyber operations.

🤫 CyberScoop | https://cyberscoop.com/cybersecurity-talent-shortage-ai-risk-operations-center-2026-op-ed/
⚫ Dark Reading | https://www.darkreading.com/cybersecurity-operations/cyberattacks-part-military-operation-venezuela/

Other Noteworthy Developments 💡
- HackerOne Bug Bounty Delays: A security researcher, Jakub Ciolek, reported being "ghosted" by HackerOne for months over an $8,500 bug bounty for two high-severity DoS flaws (CVE-2025-59538, CVE-2025-59531) in Argo CD. HackerOne attributed the delay to an "operational backlog," raising concerns about trust and communication in bug bounty programs, especially with increasing AI-generated submissions.
- Microsoft Exchange Online Spam Clamp Scrapped: Microsoft has reversed its controversial plan to impose a 2,000 external recipient rate limit on Exchange Online mailboxes, following significant customer backlash. While the aim was to curb spam and abuse, the limits created operational challenges for legitimate bulk sending. Microsoft plans to develop "smarter, more adaptive approaches."
- Cyber Scam Kingpin Arrested: Cambodian authorities have arrested and extradited to China Chen Zhi, head of the Prince Group conglomerate, who is alleged to be the mastermind behind a multi-billion dollar scam empire. Zhi and 128 entities linked to him were sanctioned by the US and UK for illegal online gambling, sextortion, money laundering, and the trafficking of enslaved workers.
- HSBC App Sideloading Issues: Some HSBC mobile banking customers in the UK are being locked out of the bank's app if they have the Bitwarden password manager installed via an open-source app catalog like F-Droid. HSBC's app security controls appear to flag sideloaded apps as a risk, preventing coexistence with its banking app.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/07/hackerone_ghosted_researcher/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/07/exchange_online_recipient_rate/
🗞️ The Record | https://therecord.media/alleged-cyber-scam-kingpin-cambodia-arrested-extradited
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/07/hsbc_bitwarden_sideloaded/

#CyberSecurity #ThreatIntelligence #Vulnerability #RCE #ActiveExploitation #ZeroDay #CyberAttack #Breach #Ransomware #DDoS #NationState #APT #MFA #CredentialTheft #DataPrivacy #Regulation #UKGov #AI #CyberWarfare #InfoSec

Alright team, it's been a pretty packed start to the year in cyber! We've got some interesting developments on active exploitation, new malware campaigns, and a couple of big names facing regulatory heat. Let's dive in:

Recent Cyber Attacks ⚠️

- Unleash Protocol, a decentralised IP platform, lost approximately $3.9 million in crypto due to an unauthorised smart contract upgrade, initiated by an external address gaining administrative control via multisig governance.
- A Lithuanian national was extradited to South Korea for infecting 2.8 million systems globally with clipboard-stealing malware, disguised as the KMSAuto Windows/Office activator, siphoning around $1.2 million in virtual assets.
- Amazon successfully blocked over 1,800 suspected North Korean operatives from infiltrating its workforce since April 2024, who were posing as IT workers or recruiters to steal credentials and source code, as DPRK crypto theft surged to $2 billion in 2025.

📰 The Hacker News | https://thehackernews.com/2026/01/threatsday-bulletin-ghostad-drain-macos.html

Actively Exploited Vulnerabilities 🛡️

- The RondoDox botnet has been actively exploiting the critical React2Shell (CVE-2025-55182, CVSS 10.0) RCE flaw in React Server Components and Next.js since December 2025, targeting IoT devices and web servers to deploy crypto miners and Mirai botnet variants.
- A coordinated campaign, primarily from Japan-based infrastructure, systematically exploited over 10 Adobe ColdFusion CVEs from 2023-2024 during Christmas 2025, leading to direct code execution, credential harvesting, and JNDI lookups.
- Researchers identified a 4-second window where AWS IAM eventual consistency allows attackers to leverage deleted access keys to create new ones, achieving persistence even after defenders believe credentials are revoked.

📰 The Hacker News | https://thehackernews.com/2026/01/rondodox-botnet-exploits-critical.html
📰 The Hacker News | https://thehackernews.com/2026/01/threatsday-bulletin-ghostad-drain-macos.html

New Threat Research & Malware Campaigns 🚨

- The GlassWorm supply chain campaign has resurfaced, now targeting macOS users with malicious Open VSX extensions (50,000 downloads) to steal funds from over 50 browser extension wallets, iCloud Keychain data, and developer credentials.
- OceanLotus (APT) is targeting China's Xinchuang initiative, exploiting CVE-2023-52076 (RCE in Atril document viewer) and deploying custom ELF Trojans specifically designed to bypass traditional Linux system checks on indigenous innovation platforms.
- The IPCola proxy network, offering 1.6 million IPs, is powered by the GaGaNode decentralised bandwidth monetization service, whose SDK contains a critical RCE vulnerability, enabling broad compromise of IoT, desktop, and mobile devices.
- Large-scale mobile adware campaigns, GhostAd (Android) and SkyWalk (iOS), are draining device resources and defrauding advertisers by running persistent background ad engines and serving invisible ads, respectively.
- Magecart attacks are evolving into full identity compromise, hijacking checkout and account creation flows with fake payment forms, phishing iframes, and anti-forensics techniques to steal credentials and personal information.
- A new cybercrime tool, ErrTraffic, automates "ClickFix" attacks by generating fake browser glitches on compromised websites, tricking users into installing information stealers or Android banking trojans.
- Kaspersky discovered 'Keenadu', a pre-installed backdoor in libandroid_runtime.so on certain Android tablet models, providing remote access for data exfiltration and command execution.

📰 The Hacker News | https://thehackernews.com/2026/01/threatsday-bulletin-ghostad-drain-macos.html

Threat Landscape & AI Concerns 🧠

- Reddit banned the r/ChatGPTJailbreak subreddit (229,000 users) for violating rules, highlighting ongoing challenges with LLM safety filters, prompt injections, and the potential for generating non-consensual deepfakes; poetic prompts were found to increase attack success rates fivefold.
- Research details "hacktivist proxy operations" where ideologically aligned non-state cyber groups conduct disruptive activities (DDoS, defacement) that align with state geopolitical interests, providing plausible deniability for the benefiting state.

📰 The Hacker News | https://thehackernews.com/2026/01/threatsday-bulletin-ghostad-drain-macos.html

Regulatory & Corporate Accountability ⚖️

- Reuters reported that Meta developed a "playbook" to mislead regulators about the prevalence of scam ads on its platform, by systematically deleting fraudulent ads from its Ad Library during regulatory searches.
- Disney agreed to pay a $10 million civil penalty to settle FTC allegations of violating children's privacy laws (COPPA) by misdesignating YouTube content, leading to unlawful data collection and targeted advertising without parental consent.

📰 The Hacker News | https://thehackernews.com/2026/01/threatsday-bulletin-ghostad-drain-macos.html

#CyberSecurity #ThreatIntelligence #Vulnerabilities #RCE #Botnet #Malware #APT #SupplyChain #Adware #AdFraud #CryptoScam #NationState #DPRK #AI #LLM #DataPrivacy #COPPA #RegulatoryCompliance #InfoSec #IncidentResponse

Alright team, it's been a pretty packed 24 hours in the cyber world! We've got a mix of significant breaches, an actively exploited vulnerability making waves, new insights into nation-state and cybercrime tradecraft, and some interesting discussions around AI security and regulation. Let's dive in:

Recent Cyber Attacks and Breaches ⚠️

Coinbase Insider Threat & Fraud 💸
- An ex-Coinbase customer service agent in India has been arrested for allegedly selling customer data to criminals, leading to social engineering scams and an attempted $20 million extortion against Coinbase.
- The stolen data included names, addresses, phone numbers, emails, IDs, and bank info for nearly 70,000 customers, though no 2FA codes or private keys were compromised.
- This highlights the critical risk of insider threats, especially in outsourced customer service operations, and the ongoing challenge of social engineering attacks targeting crypto users.
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/12/29/indian_cops_cuff_coinbase_exrep/

Coupang Data Breach & Compensation 🛍️
- South Korean retail giant Coupang is set to distribute $1.17 billion in compensation to 33.7 million customers affected by a data breach discovered in November.
- The breach, one of South Korea's largest, was traced to a 43-year-old Chinese former IT employee who retained system access after leaving the company, accessing 33 million accounts and retaining data from about 3,000.
- While the company claims the data was not transferred or further misused, the incident underscores the severe financial and reputational costs of insider threats and poor identity and access management.
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/coupang-to-split-117-billion-among-337-million-data-breach-victims/

Korean Telco Femtocell Security Failure 📞
- Korea Telecom (KT) deployed thousands of femtocells with critical security flaws, including shared certificates, no root passwords, plaintext keys, and enabled SSH, leading to micropayment fraud and potential customer communication snooping.
- Attackers cloned femtocells, enabling them to read SMS messages and call logs, with one fake femtocell used for ten months, and a large gang involved in "war-driving" to find more phones.
- This incident exposes severe vulnerabilities in critical infrastructure, suggesting that the $169,000 in micropayment fraud might be a smokescreen for larger-scale surveillance, with one key even linked to a military base.
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/12/30/kt_telecom_femtocell_security_fail/

Cybersecurity Experts Plead Guilty to BlackCat Ransomware Attacks 🚨
- Two former cybersecurity incident response professionals, Ryan Goldberg (Sygnia) and Kevin Martin (DigitalMint), have pleaded guilty to conspiring to obstruct commerce by extortion using BlackCat (ALPHV) ransomware.
- They leveraged their expertise to breach multiple US organisations, demanding ransoms up to $10 million and receiving $1.27 million from one victim, with 20% going to ALPHV administrators.
- This shocking case highlights the severe risk of insider threats within the cybersecurity industry itself and the importance of due diligence when engaging third-party incident response firms.
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/us-cybersecurity-experts-plead-guilty-to-blackcat-alphv-ransomware-attacks/
🗞️ The Record | https://therecord.media/ransomware-responders-guilty-plea-using-alphv-blackcat-us-attacks

European Space Agency Confirms External Server Breach 🛰️
- The European Space Agency (ESA) has confirmed a breach of "external servers" containing unclassified information related to collaborative engineering activities, following claims by a threat actor on BreachForums.
- The attackers claim to have stolen over 200GB of data, including source code, CI/CD pipelines, API tokens, and hardcoded credentials, after accessing ESA's JIRA and Bitbucket servers for a week.
- While ESA states the impact is limited to a "very small number of external servers" and unclassified data, the nature of the stolen data (source code, API tokens) suggests potential for further compromise or intellectual property theft.
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/european-space-agency-confirms-breach-of-external-servers/

Vulnerabilities Under Active Exploitation 🛡️

MongoBleed (CVE-2025-14847) Under Active Exploitation ⚠️
- A high-severity information-disclosure vulnerability, CVE-2025-14847 (dubbed "MongoBleed"), affecting many default MongoDB versions, is now under active exploitation in the wild.
- The flaw, stemming from mismatched length fields in zlib-compressed protocol headers, allows unauthenticated attackers to leak server memory, potentially exposing sensitive data like credentials, API keys, and PII.
- CISA has added MongoBleed to its Known Exploited Vulnerabilities Catalog, ordering federal agencies to patch by January 19, 2026, with estimates of 74,000 to 87,000 internet-exposed vulnerable instances globally. If immediate patching isn't possible, disabling zlib compression is advised.
🤫 CyberScoop | https://cyberscoop.com/mongobleed-vulnerability-mongodb-exploitation/
🗞️ The Record | https://therecord.media/us-australia-bug-exploitation
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/cisa-orders-federal-agencies-to-patch-mongobleed-flaw-actively-exploited-in-attacks/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/12/30/mongodb_vuln_exploited_cve_2025_14847/

New Threat Research and Tradecraft 🔬

Mustang Panda Uses Kernel-Mode Rootkit for ToneShell Backdoor 🐼
- The Chinese state-sponsored group Mustang Panda (aka HoneyMyte or Bronze President) is deploying a new variant of its ToneShell backdoor using a previously undocumented kernel-mode rootkit driver.
- This rootkit, signed with a stolen or leaked certificate, registers as a mini-filter driver to evade user-mode monitoring, protect its files and processes, and interfere with Microsoft Defender, giving it high stealth and persistence.
- The evolved TTPs, including dynamic API resolution and network traffic obfuscation, highlight Mustang Panda's increasing sophistication in targeting government organisations in Southeast and East Asia, making memory forensics crucial for detection.
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/chinese-state-hackers-use-rootkit-to-hide-toneshell-malware-activity/
📰 The Hacker News | https://thehackernews.com/2025/12/mustang-panda-uses-signed-kernel-driver.html

Silver Fox Targets India with ValleyRAT Malware 🦊
- The Chinese cybercrime group Silver Fox (aka SwimSnake) is now targeting Indian users with tax-themed phishing emails to distribute its modular ValleyRAT (Winos 4.0) remote access trojan.
- The sophisticated kill chain involves DLL hijacking via a legitimate executable (Thunder) and a Donut loader, performing anti-analysis checks before injecting ValleyRAT into explorer.exe.
- Silver Fox also uses SEO poisoning and fake application sites (e.g., Microsoft Teams, Signal) to spread ValleyRAT globally, demonstrating a multi-pronged approach for espionage, financial gain, and intelligence collection.
📰 The Hacker News | https://thehackernews.com/2025/12/silver-fox-targets-indian-users-with-tax-themed-emails-delivering-valleyrat-malware/

Zoom Stealer Browser Extensions Harvest Corporate Meeting Intelligence 🕵️‍♀️
- A campaign dubbed "Zoom Stealer," attributed to the China-linked threat actor DarkSpectre, is affecting 2.2 million Chrome, Firefox, and Edge users through 18 malicious browser extensions.
- These extensions, some functional as video downloaders or recorders, covertly collect sensitive meeting-related data (URLs, IDs, topics, embedded passwords, speaker info) from 28 video-conferencing platforms.
- The exfiltrated data, streamed in real-time, is likely used for corporate espionage, sales intelligence, and large-scale social engineering or impersonation operations, underscoring the need for careful extension permission review.
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/zoom-stealer-browser-extensions-harvest-corporate-meeting-intelligence/

Threat Landscape Commentary 🗣️

OpenAI: Prompt Injection May Never Be 'Solved' for Browser Agents 🤖
- OpenAI warns that prompt injection is a central security risk for AI browser agents like ChatGPT Atlas, which operate within a web browser and can carry out tasks for users.
- Internal red-teaming uncovered new complex prompt-injection attacks, leading to a security update with an adversarially trained model and strengthened safeguards.
- The company acknowledges that prompt injection may never be fully mitigated, advising a focus on risk reduction and limiting impact, as content designed to persuade humans can now command AI agents.
🤫 CyberScoop | https://cyberscoop.com/openai-chatgpt-atlas-prompt-injection-browser-agent-security-update-head-of-preparedness/

Regulatory Issues 🏛️

Fragmented AI Regulation Poses Challenges ⚖️
- The rapid, uncoordinated expansion of state-level AI regulations in the US is creating a "patchwork regulatory landscape" that hinders responsible AI development and security.
- Conflicting definitions, compliance, and enforcement approaches across states disproportionately burden small and midsize companies, stifling innovation and allowing larger firms to gravitate towards less stringent rules.
- A unified federal framework is urgently needed to establish clear expectations for transparency, accountability, and responsible innovation, ensuring consistent safeguards and a more secure AI ecosystem.
🤫 CyberScoop | https://cyberscoop.com/ai-regulation-unified-federal-standards-needed-op-ed/

Sponsored Content 📈

Integrating AI into Modern SOC Workflows 📊
- Many SOCs struggle to operationalise AI, often treating it as a shortcut or applying it to ill-defined problems, with 40% using AI/ML tools informally and 42% without customisation.
- AI can reliably enhance SOC capabilities in detection engineering (for narrow, well-defined tasks), threat hunting (for exploration and pattern comparison), code development (for scaffolding), automation (for workflow drafting), and reporting (for standardisation and clarity).
- Successful AI adoption requires clear expectations, ongoing validation, and human accountability, with teams acting as "takers," "shapers," or "makers" to integrate AI effectively into existing workflows.
📰 The Hacker News | https://thehackernews.com/2025/12/how-to-integrate-ai-into-modern-soc.html

#CyberSecurity #ThreatIntelligence #Ransomware #NationState #APT #ZeroDay #Vulnerability #MongoBleed #AI #DataPrivacy #InfoSec #CyberAttack #Malware #IncidentResponse #MustangPanda #SilverFox #DarkSpectre

APT35 Sızıntısı: Siber casusluktan fiziksel suikast planlarına
#apt35 #CharmingKitten #İran #nationstate

https://webrecord.media/apt35-sizintisi-siber-casusluktan-fiziksel-suikast-planlarina/

It's been a bit quiet over the last 24 hours, so it'll be a short post today, but we do have a significant update on a long-standing Iranian threat actor. Let's dive in:

Iranian Infy APT Resurfaces with Advanced Tradecraft 🇮🇷

- The Iranian APT group Infy, also known as Prince of Persia, has resurfaced with new malware activity and updated tactics after nearly five years of silence, proving it remains active and dangerous.
- This elusive group, one of the oldest APTs dating back to 2004, is now using updated versions of its Foudre downloader and Tonnerre data exfiltrator, distributed via executables embedded in documents, targeting victims across multiple regions including Iran, Iraq, Turkey, India, Canada, and Europe.
- Key updates to their tradecraft include the use of a Domain Generation Algorithm (DGA) for resilient command-and-control (C2) infrastructure, RSA signature validation for C2 authenticity, and a unique mechanism within Tonnerre to communicate with a Telegram group for C2.

📰 The Hacker News | https://thehackernews.com/2025/12/iranian-infy-apt-resurfaces-with-new.html

#CyberSecurity #ThreatIntelligence #APT #NationState #Iran #Malware #Infy #PrinceOfPersia #InfoSec #CyberAttack #ThreatActor #TTPs

Alright team, it's been a busy 24 hours in the cyber world with significant updates on nation-state activity, a couple of actively exploited vulnerabilities, new malware campaigns, and some serious data privacy discussions. Let's dive in:

Recent Cyber Attacks & Breaches 🚨

- France's Interior Ministry is investigating a malicious cyber intrusion into its email servers, confirming unauthorised access to several accounts and dozens of confidential documents, including judicial records and wanted persons' data.
- Analytics vendor Mixpanel denies being the source of data stolen from Pornhub, stating the data was last accessed by a legitimate Pornhub employee account in 2023, not during Mixpanel's November 2025 security incident.
- Threat actors are exploiting WhatsApp's legitimate device-linking feature in a campaign dubbed "GhostPairing," tricking users with fake Facebook verification pages to link the attacker's browser to their WhatsApp account, gaining full conversation history access.
- European law enforcement has dismantled two Ukraine-based call centre networks responsible for over $13.7 million in scams, where criminals posed as police or bank employees to trick victims into transferring funds or installing remote access software.
- The FTC has ordered blockchain company Illusory Systems to distribute approximately $37.5 million in recovered funds to customers affected by the 2022 Nomad crypto platform hack, which saw $186 million stolen due to inadequately tested code.

🗞️ The Record | https://therecord.media/france-interior-ministry-email-breach-investigation
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/12/16/mixpanel_breach_leak_denial/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/whatsapp-device-linking-abused-in-account-hijacking-attacks/
🗞️ The Record | https://therecord.media/european-police-bust-ukraine-based-call-centers
🗞️ The Record | https://therecord.media/ftc-settlement-nomad-platform-return-customers-cryptocurrency

Vulnerabilities: Zero-Days & Active Exploitation 🛡️

- SonicWall has warned customers to patch a medium-severity local privilege escalation flaw (CVE-2025-40602) in its SMA1000 Appliance Management Console, which is being chained with a critical pre-authentication deserialisation flaw (CVE-2025-23006) for unauthenticated remote code execution with root privileges.
- The critical React2Shell vulnerability (CVE-2025-55182), an insecure deserialisation issue in React Server Components, is being actively exploited by a ransomware gang (Weaxor) to gain initial access and deploy encryptors in under a minute.
- System administrators should review Windows event logs and EDR telemetry for process creation from Node or React binaries, as well as unusual outbound connections or disabled security solutions, as patching alone might not be sufficient due to the speed of exploitation.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-sma1000-zero-day-exploited-in-attacks/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/critical-react2shell-flaw-exploited-in-ransomware-attacks/

New Threat Research: APTs, Malware & Tradecraft 🕵️‍♀️

- The Russian state-sponsored APT28 (BlueDelta) has been conducting a sustained credential-harvesting campaign targeting Ukrainian UKR.net webmail users since June 2024, using fake login pages on legitimate services like Mocky and shortened links in PDF attachments.
- Amazon security researchers report that Russia’s GRU (APT44/Sandworm) has shifted tactics since 2025, now primarily targeting misconfigured network edge devices in Western critical infrastructure, particularly the energy sector, instead of relying on novel vulnerabilities.
- China-linked threat actor Ink Dragon (Jewelbug) is increasingly targeting government entities in Europe, Southeast Asia, and South America, leveraging vulnerable web applications to deploy web shells, ShadowPad IIS Listener modules, and an updated FINALDRAFT backdoor for stealthy, long-term persistence and data exfiltration.
- Operation ForumTroll, an unknown threat actor, is targeting Russian scholars in political science and economics with personalised phishing emails disguised as eLibrary plagiarism reports, delivering the Tuoni C2 framework via malicious LNK files and PowerShell scripts.
- A new Android Malware-as-a-Service (MaaS) called Cellik is being advertised, offering the ability to embed itself into any Google Play Store app, stream screens, intercept notifications, exfiltrate files, and use a hidden browser mode.
- The "GhostPoster" malware has been found in 17 Firefox add-ons with over 50,000 downloads, using steganography in logo files to embed malicious JavaScript that hijacks affiliate links, injects tracking code, strips security headers, and performs ad/click fraud.
- Forensic researchers have discovered "ResidentBat," a previously unknown Android spyware, on a Belarusian journalist's phone, believed to have been installed during KGB detention and capable of accessing call logs, messages, microphone recordings, and files.

📰 The Hacker News | https://thehackernews.com/2025/12/apt28-targets-ukrainian-ukr-net-users.html
🗞️ The Record | https://therecord.media/russian-bluedelta-hackers-ran-phishing-ukraine-webmail
🗞️ The Record | https://therecord.media/russia-gru-hackers-target-energy-sector-sandworm
📰 The Hacker News | https://thehackernews.com/2025/12/china-linked-ink-dragon-hacks.html
📰 The Hacker News | https://thehackernews.com/2025/12/new-forumtroll-phishing-attacks-target.html
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/cellik-android-malware-builds-malicious-versions-from-google-play-apps/
📰 The Hacker News | https://thehackernews.com/2025/12/ghostposter-malware-found-in-17-firefox.html
🗞️ The Record | https://therecord.media/spyware-belarus-journalist-rsf

Data Privacy Concerns 🔒

- Four popular browser extensions (Urban VPN Proxy, 1ClickVPN Proxy, Urban Browser Guard, Urban Ad Blocker) have been caught harvesting text from AI chatbot conversations (ChatGPT, Claude, Gemini, etc.) from over 8 million users and sending it to developers, despite some claiming privacy protection.
- Meta has rolled out a new policy to personalise content and ad recommendations based on users' interactions with its generative AI features, with no opt-out option, raising significant privacy concerns among experts about the use of sensitive chat data.
- Digital rights organisation noyb alleges that TikTok and Grindr are violating European GDPR laws by tracking user activities across apps, with TikTok reportedly acknowledging it tracked a user's Grindr activity and other app usage, including shopping cart items.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/12/16/chrome_edge_privacy_extensions_quietly/
🗞️ The Record | https://therecord.media/privacy-advocates-see-risks-meta-ai-ad-targeting
🗞️ The Record | https://therecord.media/tiktok-grindr-data-tracking-noyb

Government & Defence Strategy 🏛️

- NATO's Assistant Secretary General for Cyber and Digital Transformation stressed the existential urgency for the alliance to develop sovereign cloud-based technologies, highlighting the need for speed, collaboration, and designing systems that enhance autonomy and allied trust.
- Outgoing GAO chief Gene Dodaro warned lawmakers that the U.S. is "very vulnerable" to cyber threats and expressed concern that CISA is "taking our foot off the gas," having lost about a third of its staff, and urged for a permanent director to be confirmed swiftly.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/12/17/sovereign_cloud_is_existential_nato/
🤫 CyberScoop | https://fedscoop.com/cisa-workforce-threats-gao-cybersecurity-gene-dodaro/

#CyberSecurity #ThreatIntelligence #APT #Ransomware #Malware #ZeroDay #Vulnerability #DataPrivacy #InfoSec #CyberAttack #NationState #Phishing #SocialEngineering #CloudSecurity #GovernmentSecurity #CISA #GDPR

Less a 'pop up city', more a convention of Incels.

#NetworkState #Incels #TechBros #Zuzalu #NationState #NoBillionaires #VitalikButerin #CryptoBros #Montenegro

It's been a busy 24 hours in the cyber world with significant updates on a critical RCE vulnerability under active exploitation, novel attack techniques leveraging AI and web standards, and a timely reminder about evolving authentication best practices. Let's dive in:

AI-Powered Virtual Kidnapping Scams on the Rise 🚨
- Criminals are now leveraging social media images and AI tools to create convincing fake "proof of life" photos and videos for "virtual kidnapping" and extortion scams.
- These sophisticated social engineering attacks pressure victims with threats of violence, demanding immediate ransom payments, echoing the old "grandparent scam" but with a modern, AI-enhanced twist.
- The FBI advises extreme caution: never provide personal info to strangers, establish a family code word, and always attempt to contact the supposed victim directly before making any payments.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/12/05/virtual_kidnapping_scam/

React2Shell RCE Under Widespread Exploitation ⚠️
- The critical React2Shell vulnerability (CVE-2025-55182), an unauthenticated RCE flaw in React Server Components, is under active and widespread exploitation by various threat actors, including China-linked state groups like Earth Lamia, Jackpot Panda, and UNC5174.
- CISA has added CVE-2025-55182 to its Known Exploited Vulnerabilities (KEV) catalog, with over 77,000 internet-exposed IP addresses identified as vulnerable and more than 30 organisations already compromised.
- Post-exploitation activities include reconnaissance, credential theft (especially AWS config files), deployment of webshells, cryptojackers, and malware like Snowlight and Vshell. Cloudflare even experienced an outage while deploying mitigations.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/12/05/react2shell_pocs_exploitation/
🤫 CyberScoop | https://cyberscoop.com/attackers-exploit-react-server-vulnerability/
📰 The Hacker News | https://thehackernews.com/2025/12/critical-react2shell-flaw-added-to-cisa.html
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/react2shell-flaw-exploited-to-breach-30-orgs-77k-ip-addresses-vulnerable/

IDEsaster: 30+ Flaws in AI Coding Tools 🛡️
- New research, dubbed "IDEsaster," has uncovered over 30 vulnerabilities in popular AI-powered Integrated Development Environments (IDEs) like Cursor, GitHub Copilot, and Zed.dev.
- These flaws chain prompt injection with legitimate IDE features, allowing attackers to bypass LLM guardrails and achieve data exfiltration or remote code execution without user interaction.
- The findings highlight a critical need for a "Secure for AI" paradigm, urging developers to apply least privilege to LLM tools, minimise prompt injection vectors, and implement sandboxing for commands.

📰 The Hacker News | https://thehackernews.com/2025/12/researchers-uncover-30-flaws-in-ai.html

Novel Clickjacking via CSS and SVG 🎨
- A security researcher has developed a new clickjacking technique that leverages SVG filters and CSS to leak cross-origin information, effectively bypassing the web's same-origin policy.
- This method allows for complex logic gates to process webpage pixels, enabling sophisticated attacks like exfiltrating Google Docs text, even in scenarios where traditional framing mitigations are absent or ineffective.
- While Google awarded a bounty for the report, the vulnerability remains unpatched across multiple browsers, underscoring the ongoing challenge of securing complex web standards.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/12/05/css_svg_clickjacking/

Passkeys: The Future of Phishing-Resistant MFA 🔒
- Traditional SMS and email one-time passwords (OTPs) are increasingly vulnerable to phishing attacks, making them an unreliable form of multi-factor authentication (MFA).
- Passkeys, based on cryptographic key pairs and FIDO2 standards, represent the "gold standard" for phishing-resistant MFA, offering superior security and a significantly improved user experience with faster logins and reduced helpdesk calls.
- While multi-device passkeys can still be susceptible to social engineering (like Scattered Spider attacks), they remain a substantial upgrade from OTPs, with over 2 billion passkeys already in use and strong adoption expected to continue.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/12/06/multifactor_authentication_passkeys/

#CyberSecurity #ThreatIntelligence #Vulnerability #RCE #React2Shell #CVE_2025_55182 #NationState #APT #Clickjacking #SVG #CSS #AICodingTools #IDEsaster #PromptInjection #MFA #Passkeys #Phishing #SocialEngineering #InfoSec #CyberAttack #IncidentResponse

It's been a busy 24 hours in the cyber world with significant updates on nation-state activity, a couple of actively exploited vulnerabilities, new insights into AI's role in cyberattacks, and a reminder about government policy and privacy. Let's take a look:

Ransomware Hits Pharma and NHS ⚠️

- US pharmaceutical firm Inotiv is notifying 9,542 individuals of a data breach following an August 2025 Qilin ransomware attack, which claimed to exfiltrate 176 GB of data.
- Barts Health NHS Trust in England also disclosed a data breach, with Clop ransomware actors stealing invoices containing names and addresses after exploiting an Oracle E-business Suite zero-day (CVE-2025-61882). Patient records were not affected.
- Asus confirmed that an unnamed third-party supplier was compromised by the Everest ransomware gang, who claimed to have stolen 1 TB of data, including camera source code for Asus phones. Asus insists its own products and customer data were unaffected.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/pharma-firm-inotiv-discloses-data-breach-after-ransomware-attack/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/barts-health-nhs-discloses-data-breach-after-oracle-zero-day-hack/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/12/05/asus_supplier_hack/

China-Linked BRICKSTORM Malware Campaign 🇨🇳

- US and Canadian cybersecurity agencies (CISA, NSA, CCCS) have issued a joint advisory on BRICKSTORM, a sophisticated Golang backdoor used by China-linked state-sponsored actors (UNC5221/Warp Panda) for long-term persistence.
- BRICKSTORM targets VMware vSphere and Windows environments, enabling credential theft, hidden VM creation, and lateral movement, with some intrusions maintaining access for years in government, IT, legal, and SaaS sectors.
- The malware includes a "self-watching" function for automatic reinstallation and uses advanced C2 techniques like DNS-over-HTTPS and SOCKS proxying, making detection difficult and posing a significant threat to critical infrastructure.

🗞️ The Record | https://therecord.media/cisa-nsa-warn-brickstorm-china
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/12/04/prc_spies_brickstorm_cisa/
🤫 CyberScoop | https://cyberscoop.com/china-brickstorm-malware-cyber-espionage-campaign-cisa-dhs-alert/
📰 The Hacker News | https://thehackernews.com/2025/12/cisa-reports-prc-hackers-using.html

Intellexa Predator Spyware: Zero-Days and Remote Access 📱

- Leaked training videos suggest Intellexa, the maker of Predator spyware, retained remote access capabilities to customer surveillance systems, raising serious human rights concerns about potential liability for misuse.
- The investigation revealed Predator's use of numerous zero-day exploits (e.g., CVE-2025-48543, CVE-2025-6554, CVE-2023-41993) against mobile browsers and a new "Aladdin" vector that delivers spyware via malicious mobile advertisements.
- Confirmed targeting includes a human rights lawyer in Pakistan, with ongoing Predator activity detected in multiple countries like Iraq, Saudi Arabia, Kazakhstan, Angola, and Mongolia, highlighting the persistent global demand for such surveillance tools.

🤫 CyberScoop | https://cyberscoop.com/intellexa-remotely-accessed-predator-spyware-customer-systems-investigation-finds/
📰 The Hacker News | https://thehackernews.com/2025/12/intellexa-leaks-reveal-zero-days-and.html

Actively Exploited VPN and Web Framework Vulnerabilities 🛡️

- Hackers are actively exploiting a command injection vulnerability in Array AG Series VPN devices (ArrayOS AG 9.4.5.8 and earlier with DesktopDirect enabled) to deploy webshells and create rogue users, primarily targeting organisations in Japan.
- A critical insecure deserialization flaw, React2Shell (CVE-2025-55182), affecting React Server Components (RSC) and Next.js, is being actively exploited by multiple China-linked threat actors (Earth Lamia, Jackpot Panda) for unauthenticated remote code execution (RCE).
- Cloudflare experienced a widespread outage due to an emergency patch deployed to mitigate the React2Shell vulnerability, underscoring the severity and rapid exploitation of this flaw.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/hackers-are-exploiting-arrayos-ag-vpn-flaw-to-plant-webshells/
📰 The Hacker News | https://thehackernews.com/2025/12/jpcert-confirms-active-command.html
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/react2shell-critical-flaw-actively-exploited-in-china-linked-attacks/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/cloudflare-blames-todays-outage-on-emergency-react2shell-patch/
🗞️ The Record | https://therecord.media/chinese-hackers-exploit-react2shell-vulnerability-amazon

AI Agents: New Attack Vectors and Defence Challenges 🧠

- Anthropic's SCONE-bench research demonstrates that AI agents are becoming increasingly adept at exploiting smart contract vulnerabilities, with some models profitably identifying zero-days and generating millions in simulated funds.
- A "zero-click agentic browser attack" targeting Perplexity's Comet browser can leverage crafted emails to instruct an AI agent to delete an entire Google Drive, exploiting the agent's "excessive agency" without explicit user confirmation or traditional prompt injection.
- Researchers found that AI coding tools integrated into software development workflows (e.g., GitHub Actions) are vulnerable to prompt injection, where malicious commit messages or pull requests can be interpreted as instructions by LLMs, leading to shell command execution and token leakage.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/12/05/an_ai_for_an_ai/
📰 The Hacker News | https://thehackernews.com/2025/12/zero-click-agentic-browser-attack-can.html
🤫 CyberScoop | https://cyberscoop.com/ai-coding-tools-can-be-turned-against-you-aikido-github-prompt-injection/

UK Facial Recognition Expansion Sparks Privacy Debate 🚨

- The UK Home Office is pushing ahead with plans for a dedicated legal framework to expand police use of live facial recognition and other biometric technologies, aiming for "significantly greater scale."
- While the government touts facial recognition as a major crime-fighting tool, civil liberties groups like Big Brother Watch warn that this expansion risks turning public spaces into "biometric dragnets" and could lead to an "authoritarian surveillance state."
- Critics argue that any expansion must be paired with robust policy and investment in data protection and GDPR compliance to prevent unnecessary infringement on privacy.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/12/05/uk_cops_facial_recognition/

US Healthcare Cybersecurity Legislation Returns 🏥

- A bipartisan group of US senators has revived the Health Care Cybersecurity and Resiliency Act, aiming to update regulations, authorise grants, offer training, and clarify federal agency roles (HHS, CISA) to bolster healthcare cybersecurity.
- The legislation seeks to improve coordination between HHS and CISA, direct HHS to develop an incident response plan, update HIPAA regulations for modern cybersecurity practices, and provide guidance for rural health clinics.
- This renewed effort follows major healthcare data breaches, such as the Change Healthcare ransomware attack, underscoring the urgent need for comprehensive legislative action to protect sensitive medical data.

🤫 CyberScoop | https://cyberscoop.com/bipartisan-health-care-cybersecurity-legislation-returns-to-address-a-cornucopia-of-issues/

DoD Comms Failures and North Korea IT Worker Scheme 🏛️

- A Pentagon Inspector General report found that US Defense Secretary Pete Hegseth violated policy by using a personal device and Signal for sensitive operational details, highlighting a widespread, systemic issue of non-compliance within the DoD regarding unofficial messaging.
- A Maryland man was sentenced to 15 months in prison for his role in a North Korean IT worker scheme, where he allowed North Korean nationals to use his identity to secure software development contracts, including at the FAA, potentially exposing sensitive national defence information.
- The Trump administration's new national security strategy emphasises collaboration with US industry and regional foreign governments to protect critical infrastructure and networks, calling for deregulation and a focus on the Western Hemisphere, with a separate national cybersecurity strategy expected in January.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/12/04/dod_hegseth_broke_pentagon_policy_signal/
🗞️ The Record | https://therecord.media/north-korea-it-worker-scheme-maryland-man-sentenced
🗞️ The Record | https://therecord.media/trump-national-security-strategy-cyber-elements

FBI Warns of Virtual Kidnapping Scams 📞

- The FBI is warning the public about an increase in virtual kidnapping ransom scams where criminals use altered social media photos as fake "proof of life" to pressure victims into paying ransoms.
- These scams create a false sense of urgency, often involving spoofed phone numbers and manipulated images to convince victims that a loved one has been abducted, even though no actual kidnapping has occurred.
- The FBI advises caution, avoiding sharing personal information with strangers, establishing family code words for emergencies, and carefully scrutinising any "proof of life" photos for inconsistencies.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/fbi-warns-of-virtual-kidnapping-ransom-scams-using-altered-social-media-photos/

#CyberSecurity #ThreatIntelligence #Ransomware #NationState #APT #ZeroDay #Vulnerability #AI #DataPrivacy #InfoSec #CyberAttack #Malware #IncidentResponse #GovernmentSecurity #SupplyChainSecurity

Listening to Dr Janina Ramirez (historian, fabulous lady) low key call out the nonsense that is the nation state on the BBC 6 Music....don't tell the Mail!

"It's a construct!"

#BBC6Music #DrJaninaRamirez #History #Anarchy #NationState

It's been a busy 24 hours in the cyber world with significant updates on nation-state activity, new malware campaigns, actively exploited vulnerabilities, and a push to dispel common security myths. Let's dive in:

Recent Cyber Attacks and Breaches 🚨

- Pro-Ukraine hacktivists from the Ukrainian Cyber Alliance (UCA) claim to have severely disrupted Donbas Post, a Russian state-owned postal operator in occupied eastern Ukraine, wiping over 1,000 workstations, 100 virtual machines, and several dozen terabytes of data.
- Harvard University disclosed a data breach affecting alumni, donors, and staff, stemming from a voice phishing attack on its Alumni Affairs and Development systems, exposing personal details but no financial or password data.
- Real-estate finance services giant SitusAMC reported a data breach impacting corporate data and some client customer data, though business operations were unaffected and no encrypting malware was deployed.
- Media conglomerate Cox Enterprises confirmed data theft affecting 9,479 individuals from its Oracle E-Business instances, attributed to the Clop ransomware gang's exploitation of Oracle software.

🗞️ The Record | https://therecord.media/hackers-knock-out-systems-russia-operated-post-ukraine
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/harvard-university-discloses-data-breach-affecting-alumni-donors/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/real-estate-finance-services-giant-situsamc-breach-exposes-client-data/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/23/infosec_news_in_brief/

New Threat Research & Malware Campaigns 🔍

- A new Shai-Hulud supply-chain campaign has infected nearly 500 npm packages, including popular ones like Zapier and ENS Domains, stealing developer and CI/CD secrets and leaking them to automatically generated GitHub repositories.
- Chinese state-sponsored APT 31 (Violet Typhoon) has been observed attacking Russian cloud environments, specifically targeting IT sector contractors for government agencies, using a mix of common and custom malware for persistent access and credential theft.
- ShadowPad malware, a modular backdoor linked to Chinese state-sponsored groups, is actively exploiting CVE-2025-59287, a critical deserialization flaw in Microsoft WSUS, to gain system-level remote code execution and install its payload.
- ESET researchers uncovered the Chinese-aligned PlushDaemon APT group deploying "EdgeStepper," a network implant that hijacks DNS traffic to malicious nodes, enabling the delivery of malicious software updates in adversary-in-the-middle attacks.
- CISA issued an alert warning about commercial spyware actively targeting mobile messaging applications, leveraging sophisticated social engineering, zero-click exploits, and malicious QR codes to compromise high-value individuals.
- New ClickFix attack variants are using highly deceptive fake Windows Update screens and steganography (embedding malware in PNG image pixel data) to trick users into executing commands that deploy LummaC2 and Rhadamanthys information stealers.
- CrowdStrike research revealed that the Chinese DeepSeek-R1 AI model generates significantly more insecure code (up to 50% increase in severe vulnerabilities) when prompts contain politically sensitive topics like Tibet or Uyghurs, highlighting potential geopolitical biases in AI outputs.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/shai-hulud-malware-infects-500-npm-packages-leaks-secrets-on-github/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/24/asia_tech_news_roundup/
📰 The Hacker News | https://thehackernews.com/2025/11/shadowpad-malware-actively-exploits.html
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/23/infosec_news_in_brief/
🤫 CyberScoop | https://cyberscoop.com/cisa-alert-draws-attention-to-spywares-targeting-of-messaging-apps/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/clickfix-attack-uses-fake-windows-update-screen-to-push-malware/
📰 The Hacker News | https://thehackernews.com/2025/11/chinese-ai-model-deepseek-r1-generates.html

Critical Vulnerabilities & Exploitation ⚠️

- Five "trivial-to-exploit" vulnerabilities, including RCE and an 8-year-old path traversal flaw (CVE-2025-12972), were discovered in Fluent Bit, an open-source log collection tool widely used across major cloud providers and AI labs.
- These Fluent Bit flaws, if chained, could allow attackers to bypass authentication, achieve remote code execution, cause denial-of-service, manipulate tags, and potentially lead to full node and cluster takeover in Kubernetes environments.
- A years-old remote code execution (RCE) flaw (CVE-2025-64756, CVSS 7.5) was found in the CLI tool of the `glob` file pattern matching library, which is a universal part of the JavaScript stack, allowing malicious filenames to be executed as code on POSIX systems when the `-c` flag is used.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/24/fluent_bit_cves/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/23/infosec_news_in_brief/

Regulatory Shifts & Software Liability ⚖️

- The UK's Business and Trade Committee has urged the government to introduce liability for software developers, incentivise business investment in cyber resilience, and mandate reporting of all malicious cyber incidents to bolster economic security.
- The Federal Communications Commission (FCC) has controversially reversed cybersecurity rules introduced after the Chinese Salt Typhoon espionage campaign, which aimed to force telecom carriers to harden their lawful intercept and other sensitive systems.
- Critics, including FCC Commissioner Anna Gomez and the Electronic Privacy Information Center (EPIC), warn that abandoning these enforceable requirements leaves the US less secure and creates a "safe harbor for insecure cybersecurity practices."

🗞️ The Record | https://therecord.media/software-companies-liable-britain-security
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/24/fcc_salt_typhoon_rules/

Debunking Cyber Myths & SBOM Challenges 🛡️

- A new initiative, Hacklore.org, launched by former CISA officials and over 80 cybersecurity professionals, aims to dispel common "hacklore" myths (e.g., frequent password changes, avoiding public Wi-Fi) in favour of practical, evidence-based advice like MFA, password managers, and timely updates.
- The initiative also advocates for software manufacturers to adopt "secure by design" and "secure by default" principles, committing to publishing roadmaps and timely CVE records to improve overall software security.
- Despite government efforts, Software Bills of Materials (SBOMs) adoption remains sluggish in the private sector, with experts divided on whether the rapid advance of AI-assisted coding will make SBOMs obsolete by generating vulnerability-free software, or if AI will simply introduce new complexities.

🤫 CyberScoop | https://cyberscoop.com/this-campaign-aims-to-tackle-persistent-security-myths-in-favor-of-better-advice/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/24/hacklore_launch/
🤫 CyberScoop | https://cyberscoop.com/sbom-adoption-challenges-ai-coding-transparency/

Operational Security Blunder 🤦‍♀️

- The International Association for Cryptologic Research (IACR) must re-run its election for new board members after one of three trustees "irretrievably lost their private key," preventing the joint decryption of electronic voting results.
- This incident highlights a critical operational security failure in a system designed for multi-party control, underscoring the human element in cryptographic key management.
- The IACR plans to adopt a two-out-of-three threshold mechanism for key management and a clearer written procedure to prevent future occurrences.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/24/cryptologic_research_election_rerun/

#CyberSecurity #ThreatIntelligence #CyberAttack #DataBreach #Malware #Ransomware #SupplyChainAttack #Vulnerability #RCE #ZeroDay #APT #NationState #AI #SecureByDesign #SBOM #InfoSec #IncidentResponse

It's been a pretty active 24 hours in the cyber world, with CISA warning about an actively exploited Oracle zero-day, new insights into China-linked APT31's stealthy operations against Russian IT, and a fresh look at a fileless, cross-platform phishing framework using browser notifications. Let's dive in:

Critical Oracle Identity Manager Zero-Day Under Active Exploitation ⚠️

- CISA has added CVE-2025-61757, a critical Oracle Identity Manager vulnerability (CVSS 9.8), to its Known Exploited Vulnerabilities (KEV) catalog due to active exploitation.
- This flaw allows pre-authenticated remote code execution by bypassing authentication for critical functions, stemming from a faulty security filter that can be tricked with "?WSDL" or ";.wadl" appended to URIs.
- Evidence suggests the vulnerability was exploited as a zero-day between August 30 and September 9, 2025, well before Oracle's October patch, with Federal Civilian Executive Branch agencies mandated to patch by December 12, 2025.

📰 The Hacker News | https://thehackernews.com/2025/11/cisa-warns-of-actively-exploited.html

China-Linked APT31 Targets Russian IT with Cloud C2 🇨🇳

- The China-linked APT31 (aka Altaire, Violet Typhoon) has been attributed to stealthy cyberattacks against the Russian IT sector between 2024-2025, often remaining undetected for extended periods.
- The group leverages legitimate cloud services like Yandex Cloud for command-and-control (C2) and data exfiltration, blending in with normal traffic, and stages encrypted commands in social media profiles.
- APT31 employs a diverse arsenal of public and custom tools, including CloudyLoader, SharpADUserIP, Tailscale VPN, and unique backdoors like OneDriveDoor and VtChatter, to achieve persistence and exfiltrate sensitive data.

📰 The Hacker News | https://thehackernews.com/2025/11/china-linked-apt31-launches-stealthy.html

Matrix Push C2 Leverages Browser Notifications for Fileless Phishing 🎣

- A new command-and-control (C2) platform, Matrix Push C2, is being used by threat actors to conduct fileless, cross-platform phishing attacks via browser push notifications.
- Victims are socially engineered into allowing notifications, which then deliver fake alerts (e.g., suspicious logins, browser updates) with malicious links, effectively bypassing traditional security controls.
- Offered as a Malware-as-a-Service (MaaS) with tiered subscriptions, Matrix Push C2 includes configurable templates for impersonating brands and analytics, while separate research notes an uptick in legitimate DFIR tool Velociraptor misuse.

📰 The Hacker News | https://thehackernews.com/2025/11/matrix-push-c2-uses-browser.html

#CyberSecurity #ThreatIntelligence #ZeroDay #RCE #Oracle #APT31 #NationState #Phishing #Malware #C2 #CloudSecurity #IncidentResponse #InfoSec

It's been a pretty packed week in cyber, with some serious shifts in regulatory landscapes, active exploitation of critical vulnerabilities, and continued efforts to dismantle cybercrime infrastructure.

For a full recap, check out our latest episode: https://open.spotify.com/episode/2EQ2lzZnQA3DmYsExXXLnm?si=rBXJP2d5SNOnyVfd0hhroQ

Let's dive in:

Recent Cyber Attacks and Breaches ⚠️

- PowerSchool, an ed-tech giant, suffered a mega-breach in December 2024, impacting millions of student and staff records, with Canadian privacy watchdogs blaming school boards for poor security and oversight.
- Salesforce disclosed another third-party breach involving Gainsight-published applications, likely linked to the ShinyHunters group, which accessed customer Salesforce data via compromised OAuth tokens.
- These incidents highlight the critical need for robust third-party vendor management, strong contractual security clauses, and proper oversight of remote access, especially for sensitive data.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/20/powerschool_breach_reports/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/20/salesforce_gainsight_breach/

Insider Sabotage at Waste Management 💥

- An Ohio IT contractor, Maxwell Schultz, pleaded guilty to sabotaging his former employer's systems, allegedly Waste Management, causing over $862,000 in damages by resetting 2,500 passwords.
- Schultz impersonated another contractor after his credentials were revoked, demonstrating a critical lapse in access management and the persistent threat of malicious insiders.
- This incident underscores the importance of immediate credential revocation, robust monitoring for anomalous activity, and strong insider threat programmes.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/20/it_contractor_sabotage/

Vulnerabilities and Active Exploitation 🛡️

Fortinet FortiWeb Zero-Days 🚨

- Fortinet confirmed a second zero-day (CVE-2025-58034), an OS command injection flaw, actively exploited in its FortiWeb web application firewall, just days after disclosing another critical path traversal zero-day (CVE-2025-64446) in the same product.
- These two vulnerabilities likely form an exploit chain for unauthenticated remote code execution, with CISA adding CVE-2025-58034 to its Known Exploited Vulnerabilities catalog with a 7-day patch deadline.
- Organisations using FortiWeb should immediately update to the latest software versions and monitor for signs of compromise.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/19/fortinet_confirms_second_fortiweb_0day/

Critical Oracle Identity Manager RCE 🔓

- A critical pre-authentication RCE (CVE-2025-61757, CVSS 9.8) in Oracle Fusion Middleware's Identity Manager allows unauthenticated attackers to fully compromise susceptible systems via HTTP.
- The flaw, affecting versions 12.2.1.4.0 and 14.1.2.1.0, stems from logical flaws in Java's URI interpretation within authentication filters.
- Oracle has already patched this vulnerability, so ensure your Identity Manager instances are fully updated to prevent potential system takeover.

📰 The Hacker News | https://thehackernews.com/2025/11/threatsday-bulletin-0-days-linkedin.html

glob CLI Command Injection 💻

- A security flaw (CVE-2025-64756, CVSS 7.5) in glob CLI's -c/--cmd flag can lead to operating system command injection and remote code execution if filenames with shell metacharacters are passed.
- This vulnerability could compromise developer machines or facilitate supply chain poisoning via malicious packages, affecting Glob versions 10.2.0 through 11.0.3.
- Users should update to patched versions (10.5.0, 11.1.0, or 12.0.0) and note that only CLI tool usage is affected, not the library API.

📰 The Hacker News | https://thehackernews.com/2025/11/threatsday-bulletin-0-days-linkedin.html

Shelly Pro 4PM Smart Relay Vulnerability 🏠

- A critical flaw (CVE-2025-11243, CVSS 8.3) in the Shelly Pro 4PM smart relay allows attackers to cause device reboots by sending unexpected inputs to JSON-RPC methods.
- While not enabling code execution or data theft, this can systematically cause outages, impacting automation and visibility in smart home/building contexts.
- Users are advised to update to version 1.6.0 and avoid direct internet exposure for these devices.

📰 The Hacker News | https://thehackernews.com/2025/11/threatsday-bulletin-0-days-linkedin.html

Palo Alto GlobalProtect Scanning Surge 📈

- Malicious traffic targeting Palo Alto Networks' GlobalProtect portals surged almost 40-fold in 24 hours, hitting a 90-day high, with fingerprints suggesting repeat threat actors.
- This activity often precedes new vulnerability disclosures, as seen with Fortinet appliances, putting defenders on high alert for potential future exploitation.
- Organisations should tighten access controls, monitor for login anomalies, and be prepared to implement blocklists or IPS rules for exposed GlobalProtect portals.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/20/palo_alto_traffic_flood/

New Threat Research: Malware and Techniques 🔬

Iranian Cyber-Kinetic Targeting 🎯

- Amazon's threat intelligence observed Iran-linked Imperial Kitten (Tortoiseshell) conducting cyber reconnaissance, including mapping ship AIS data and accessing CCTV, days before a real-world missile strike attempt.
- This "cyber-enabled kinetic targeting" blurs the lines between digital and physical warfare, using cyber ops to support military objectives.
- The trend highlights the need for integrated security frameworks that address both digital and physical threats, as espionage can directly lead to kinetic attacks.

📰 The Hacker News | https://thehackernews.com/2025/11/iran-linked-hackers-mapped-ship-ais.html

ShadowRay 2.0 Cryptomining Botnet 🤖

- Oligo Security warns of ShadowRay 2.0, an evolution of a cryptomining botnet exploiting an unpatched, two-year-old authentication flaw (CVE-2023-48022, CVSS 9.8) in the Ray AI framework.
- This self-replicating botnet hijacks NVIDIA GPUs for XMRig mining, leveraging exposed Ray Job Submission APIs and pivoting laterally to non-internet-facing nodes.
- Mitigation includes configuring firewalls, adding authorisation to Ray Dashboard port (8265), and using Anyscale's "Ray Open Ports Checker" tool to prevent accidental exposure, as over 230,500 Ray servers are publicly accessible.

📰 The Hacker News | https://thehackernews.com/2025/11/shadowray-20-exploits-unpatched-ray-flaw-to-build-self-spreading-gpu-cryptomining-botnet.html

NovaStealer macOS Malware 🍎

- A new macOS stealer, NovaStealer, has been detailed, capable of exfiltrating crypto wallet files, collecting telemetry, and replacing legitimate Ledger/Trezor applications with tampered copies.
- The malware uses a script orchestrator under ~/.mdrivers and a LaunchAgent to pull and run b64-encoded scripts from its C2, supporting updates and restarts.
- macOS users, especially those with crypto wallets, should be vigilant for suspicious processes and ensure applications are downloaded from official sources.

📰 The Hacker News | https://thehackernews.com/2025/11/threatsday-bulletin-0-days-linkedin.html

Sturnus Android Banking Trojan 📱

- ThreatFabric uncovered Sturnus, a new Android banking trojan that can intercept decrypted messages from apps like WhatsApp, Telegram, and Signal, and steal banking credentials via fake login screens.
- Sturnus offers attackers near-total remote control, including injecting text, observing activity, and executing transactions while hiding operations with a black overlay.
- While in development, its advanced capabilities and targeted geography (Southern/Central Europe) suggest preparation for wider, coordinated campaigns.

🗞️ The Record | https://therecord.media/new-android-malware-captures-private-messages

LLM-Generated Malware: Reality Check 🧠

- Researchers found that while LLMs like GPT-3.5-Turbo and GPT-4 can generate malicious code (e.g., Python scripts for anti-VM detection), it's currently "too unreliable and ineffective for operational deployment."
- GPT-5 showed improved code quality but also stronger safety guardrails, making it harder to bypass and subverting malicious intent.
- Despite advancements, fully autonomous, operational LLM-based attacks remain theoretical, still requiring human intervention and review.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/20/llmgenerated_malware_improving/

SharpParty: PoolParty in C# 💉

- Cybersecurity researchers have released SharpParty, a C# implementation of PoolParty, a collection of process injection techniques targeting Windows Thread Pools.
- This re-engineering aims to evade Endpoint Detection and Response (EDR) systems by leveraging inline MSBuild tasks in XML files.
- Defenders should be aware of these advanced injection techniques and ensure EDR solutions are configured to detect subtle anomalies in thread pool activity.

📰 The Hacker News | https://thehackernews.com/2025/11/threatsday-bulletin-0-days-linkedin.html

Malicious Browser Extensions 🚫

- Threat actors are using malicious VPN and ad-blocking extensions for Chrome and Edge browsers (e.g., "VPN Professional," "Ads Blocker") to steal sensitive data.
- These extensions, installed about 31,000 times, can intercept web traffic, collect browsing data, modify/disable security tools, and route traffic through attacker-controlled servers.
- Users should exercise extreme caution with browser extensions, only installing those from trusted developers and regularly reviewing permissions.

📰 The Hacker News | https://thehackernews.com/2025/11/threatsday-bulletin-0-days-linkedin.html

Phishing with Microsoft Entra Invites 🎣

- A new phishing campaign weaponises legitimate Microsoft Entra guest user invitations (from invites@microsoft[.]com) to bypass email filters and establish trust.
- The goal is to trick recipients into making phone calls to attackers posing as Microsoft support in "TOAD" (Telephone-Oriented Attack Delivery) attacks.
- Organisations should educate users about the risks of unsolicited invitations and verify requests through official channels, even if they appear legitimate.

📰 The Hacker News | https://thehackernews.com/2025/11/threatsday-bulletin-0-days-linkedin.html

Data Privacy and Regulatory Issues ⚖️

EU GDPR and AI Act Changes 🇪🇺

- The European Commission proposed major changes to GDPR and the AI Act, aiming to simplify GDPR and clarify "personal data" definition to allow AI training without prior consent under "legitimate interest."
- This "digital omnibus" package also amends cookie consent rules for one-click preferences, but critics argue it rolls back digital protections and panders to Big Tech.
- The changes could give authorities and companies more room to process personal data with limited oversight, potentially increasing profiling and intrusive monitoring.

📰 The Hacker News | https://thehackernews.com/2025/11/threatsday-bulletin-0-days-linkedin.html

FCC Rolls Back Telecom Cyber Regulations 🏛️

- The FCC, in a party-line vote, reversed Biden-era cybersecurity regulations that would have mandated telecoms to secure networks and submit annual risk management certifications, following the Salt Typhoon Chinese hack.
- Chairman Brendan Carr argued the rules were "unlawful nor effective" and that voluntary industry collaboration is sufficient, despite Commissioner Anna Gomez's strong dissent, warning of continued vulnerability.
- This move leaves U.S. communications infrastructure potentially less protected against state-sponsored threats, relying on "handshake agreements" over enforceable standards.

🤫 CyberScoop | https://cyberscop.com/fcc-cybersecurity-vote-china-hack-telecoms-anna-gomez/
🗞️ The Record | https://therecord.media/fcc-removes-biden-era-cybersecurity-rules-telecoms-salt-typhoon

#CyberSecurity #ThreatIntelligence #Vulnerability #ZeroDay #RCE #Malware #Ransomware #APT #NationState #DataPrivacy #GDPR #RegulatoryAffairs #Cybercrime #LawEnforcement #AI #LLM #InfoSec #IncidentResponse

Alright, cyber pros! It's been a pretty active 24 hours, with a mix of new breach disclosures, some interesting ransomware developments, critical vulnerabilities under active attack, and a peek into how AI is shaping the threat landscape. Let's dive in:

Recent Cyber Attacks & Breaches 🚨

- DoorDash disclosed a data breach in October, impacting consumers, Dashers, and merchants. Personal information like names, addresses, phone numbers, and emails were accessed after an employee fell victim to a social engineering scam. This marks their third significant incident since 2019.
- The UK's National Health Service (NHS) is investigating claims by the Clop ransomware gang of a cyberattack. While Clop listed NHS.uk on its leak site, it hasn't specified which part of the organisation was breached or published any data, raising questions about the extent of their access.
- UK fintech firm Checkout.com was breached by ShinyHunters, who accessed a legacy cloud storage system with merchant data from 2020 and earlier. The company has publicly refused to pay the ransom, instead pledging to donate the amount to cybersecurity research at Carnegie Mellon and Oxford.
- A major Russian port operator, Port Alliance, reported ongoing disruptions from a cyberattack "from abroad," involving a DDoS and network breach. The attackers used a botnet of over 15,000 IPs, aiming to disrupt coal and fertiliser shipments, though core operations remained functional.
- The Lighthouse phishing kit, used for widespread "smishing" scams like fake road tolls, appears to have been disrupted following a lawsuit by Google. Researchers observed the kit's Telegram channels being taken down and associated domains no longer resolving.
- The FBI has warned of an aggressive health insurance scam targeting Chinese speakers in the US. Scammers spoof legitimate insurers, claim bogus surgery bills, and then, under the guise of Chinese law enforcement, threaten extradition or prosecution to extort payments and gain remote access to victims' computers.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/doordash-hit-by-new-data-breach-in-october-exposing-user-information/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/14/nhs_clop/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/checkoutcom-snubs-shinyhunters-hackers-to-donate-ransom-instead/
🗞️ The Record | https://therecord.media/cyberattack-on-russian-port-operator
🤫 CyberScoop | https://cyberscoop.com/lighthouse-text-scammers-disrupted-google-lawsuit/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/14/fbi_chinese_speaker_health_insurance/

New Threat Research: Ransomware, Malware & AI-Driven Attacks 🛡️

- Anthropic reported that Chinese state-sponsored group GTG-1002 used their Claude Code AI model to automate cyber espionage against 30 critical organisations, including tech, finance, and government. The AI allegedly handled vulnerability scanning, exploitation, and data exfiltration with minimal human oversight, though some researchers have expressed skepticism regarding the claimed level of AI autonomy.
- CISA and FBI issued an updated advisory on Akira ransomware, highlighting its new capability to encrypt Nutanix AHV virtual machines, expanding its targets beyond VMware ESXi and Hyper-V. The FBI ranks Akira as a "top five" ransomware threat, having extorted over $244 million from small- and medium-sized businesses, often exfiltrating data within two hours of initial access.
- The Kraken ransomware, a continuation of the HelloKitty operation, now features a system benchmarking capability. It tests target machines to determine optimal encryption speed, allowing it to choose between full or partial data encryption to maximise impact without triggering alerts due to excessive resource usage.
- A new self-spreading npm package, dubbed 'IndonesianFoods,' has flooded the registry with over 100,000 junk packages, spawning new ones every seven seconds. While currently non-malicious, it aims to stress the open-source ecosystem and may be financially motivated through abuse of the TEA Protocol.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/13/chinese_spies_claude_attacks/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/anthropic-claims-of-claude-ai-automated-cyberattacks-met-with-doubt/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/cisa-warns-of-akira-ransomware-linux-encryptor-targeting-nutanix-vms/
🤫 CyberScoop | https://cyberscoop.com/akira-ransomware-fbi-cisa-joint-advisory/
🗞️ The Record | https://therecord.media/akira-gang-received-million
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/kraken-ransomware-benchmarks-systems-for-optimal-encryption-choice/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/new-indonesianfoods-worm-floods-npm-with-100-000-packages/

Critical Vulnerabilities & Active Exploitation ⚠️

- A critical path traversal vulnerability (CVE-2025-64446) in Fortinet FortiWeb web application firewalls is under active, widespread exploitation. Attackers are using a publicly available PoC to create new administrative accounts on exposed devices without authentication. Fortinet silently patched this in version 8.0.2, and CISA has added it to its Known Exploited Vulnerabilities Catalog, urging immediate patching.
- ASUS has released firmware updates for several DSL series routers (DSL-AC51, DSL-N16, DSL-AC750) to fix a critical authentication bypass flaw (CVE-2025-59367). This vulnerability allows remote, unauthenticated attackers to gain full control. Users unable to update should disable internet-facing services like remote access, port forwarding, and VPN server.
- Researchers discovered critical Remote Code Execution (RCE) vulnerabilities in major AI inference engines from Meta (Llama), Nvidia (TensorRT-LLM), Microsoft (Sarathi-Serve), and open-source projects like vLLM and SGLang. These "ShadowMQ" flaws stem from insecure deserialization of data via ZeroMQ and Python's pickle module, often due to code reuse, potentially allowing arbitrary code execution.
- Kubernetes maintainers have decided to retire Ingress NGINX by March 2026 due to persistent security flaws and maintenance challenges. This popular ingress controller, found in around 6,000 implementations, has been problematic, with serious vulnerabilities allowing cluster takeover identified as recently as March 2025. Admins should plan migration to alternatives.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/fortiweb-flaw-with-public-poc-actively-exploited-to-create-admin-users/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/14/fortinet_active_exploit_cve_2025_64446/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/asus-warns-of-critical-auth-bypass-flaw-in-dsl-series-routers/
🚨 The Hacker News | https://thehackernews.com/2025/11/researchers-find-serious-ai-bugs.html
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/11/14/nginx_retirement/

Threat Landscape Commentary 📈

- The retail industry is facing a growing cybersecurity crisis, with breaches costing millions and eroding customer trust. The core issue isn't just about more technology, but a lack of executive-level cybersecurity leadership and a failure to treat cyber as a core strategic priority.
- The National Retail Federation (NRF) is urged to establish a dedicated cybersecurity talent incubator. This program would develop executive-ready leaders who understand both technical threats and the specific operational pressures retailers face, bridging the gap between academic expertise and industry needs.
- The initiative would offer six-month programs for graduates and modular training for junior roles, with placements across the NRF's network, aiming to foster a sector-wide mindset shift towards long-term strategic investment in cybersecurity talent.

🤫 CyberScoop | https://cyberscoop.com/retail-cybersecurity-crisis-nrf-leadership-talent-pipeline-op-ed/

Regulatory Issues & Data Privacy 🔒

- Google has backpedaled on its controversial Android developer verification rules following widespread backlash from users and developers. Originally intended to block malware from sideloaded apps, the revised rules will now offer options for limited app distribution without full verification and an "advanced flow" for power users to sideload unverified apps with warnings.
- The initial plan was criticised for potentially consolidating power and threatening open ecosystems like F-Droid.
- The revised verification process will open for early access in November 2025, with a phased global rollout of mandatory verification starting in September 2026 for specific regions.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/google/google-backpedals-on-new-android-developer-registration-rules/

Government Actions Against Cybercrime 🏛️

- US federal authorities have established a new "Scam Center Strike Force" to combat Chinese cryptocurrency scam networks, often known as "pig butchering" or "romance baiting." These scams defraud Americans of nearly $10 billion annually, with operators often working from criminal compounds in Southeast Asia.
- The strike force focuses on tracing and seizing illicit crypto funds, already recovering over $401 million and initiating forfeiture for an additional $80 million. They also coordinate with international partners and have sanctioned groups and firms linked to these operations.
- A suspected Russian hacker, potentially Aleksey Lukashev (a GRU officer wanted by the FBI for 2016 US election interference), has been detained in Phuket, Thailand, at the request of the US. He faces possible extradition on cybercrime charges, with Thai police seizing laptops, phones, and digital wallets.
- The Justice Department announced five guilty pleas related to North Korea's long-running IT worker scam, which defrauded 136 US companies of $2.2 million and involved 18 stolen US identities. The DOJ also seized over $15 million in cryptocurrency from North Korean facilitators, linked to APT38 (Lazarus Group) and several major crypto thefts in 2023.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/us-announces-new-strike-force-targeting-chinese-crypto-scammers/
🗞️ The Record | https://therecord.media/russian-hacker-detained-thailand-possible-us-extradition
🗞️ The Record | https://therecord.media/multiple-us-nationals-guilty-pleas-north-korean-it-worker-scams

#CyberSecurity #ThreatIntelligence #Ransomware #Malware #Vulnerability #ActiveExploitation #ZeroDay #AI #NationState #DataBreach #Cybercrime #InfoSec #IncidentResponse #SupplyChainSecurity #CloudSecurity