The Dutch National Cyber Security Centre (NCSC-NL) has confirmed active exploitation of the critical Citrix NetScaler CVE-2025-6543 vulnerability in several critical organizations within the Netherlands. The flaw, which allows unintended control flow and denial-of-service (DoS), has been exploited since May 2025. A recent coordinated reconnaissance campaign targeting Citrix NetScaler infrastructure used tens of thousands of residential proxies to discover login panels between January 28 and February 2, 2026. The activity involved 63,000 distinct IPs launching 111,834 sessions, with 79% of the traffic aimed at Citrix Gateway honeypots. Investigations are ongoing to determine the full extent of the impact. The exploitation involved the use of web shells for remote access, and attackers attempted to erase traces of their activities. Organizations are advised to apply the latest updates, terminate active sessions, and run a provided shell script to hunt for indicators of compromise.

SolarWinds has released security updates to address multiple critical vulnerabilities in SolarWinds Web Help Desk, including four new critical flaws (CVE-2025-40536, CVE-2025-40537, CVE-2025-40551, CVE-2025-40552, CVE-2025-40553, and CVE-2025-40554) that could result in authentication bypass and remote code execution (RCE). These vulnerabilities were discovered by Jimi Sebree from Horizon3.ai and Piotr Bazydlo from watchTowr. The flaws have been addressed in WHD 2026.1. CISA has flagged CVE-2025-40551 as actively exploited in attacks and ordered federal agencies to patch their systems within three days. The vulnerability stems from an untrusted data deserialization weakness that can allow unauthenticated attackers to gain remote command execution on unpatched devices. SolarWinds Web Help Desk is used by more than 300,000 customers worldwide, including government agencies, large corporations, healthcare organizations, and educational institutions. SolarWinds has previously released a third patch to address a critical deserialization vulnerability (CVE-2025-26399) in Web Help Desk 12.8.7 and earlier versions. This flaw allows unauthenticated remote code execution (RCE) on affected systems. The vulnerability was discovered by an anonymous researcher and reported through Trend Micro's Zero Day Initiative (ZDI). The flaw is a patch bypass for CVE-2024-28988, which itself was a bypass for CVE-2024-28986. The original vulnerability was exploited in the wild and added to the Known Exploited Vulnerabilities (KEV) catalog by CISA. SolarWinds advises users to update to version 12.8.7 HF1 to mitigate the risk. SolarWinds Web Help Desk is a help desk and ticketing suite used by medium-to-large organizations for IT support request tracking, workflow automation, asset management, and compliance assurance. The vulnerability affects the AjaxProxy component, and the hotfix requires replacing specific JAR files.

Under Armour is investigating a data breach after 72 million customer records were allegedly exposed online by the Everest ransomware group. The breach reportedly occurred in November 2025, with data including email addresses, personal information, and purchase details being published on a hacking forum in January 2026. Under Armour has confirmed the investigation and stated that there is no evidence the breach affected payment systems or customer passwords. Additionally, Iron Mountain, a data storage and recovery services company, reported a breach by the Everest group, which was limited to marketing materials and did not involve customer confidential or sensitive information.

A critical security flaw, dubbed DockerDash, has been disclosed in Docker's Ask Gordon AI assistant. The vulnerability allows attackers to execute arbitrary commands or exfiltrate data by manipulating metadata in Docker images. The flaw stems from the lack of validation in the Model Context Protocol (MCP) gateway, enabling attackers to bypass security boundaries without traditional software bugs. The issue affects both cloud CLI environments and Docker Desktop, with different impacts depending on the deployment. Docker has released patches and mitigation strategies to address the vulnerability. The vulnerability involves a three-stage attack where malicious metadata in Docker images is interpreted and executed by the MCP Gateway without validation. The attack chain involves publishing a malicious Docker image, querying Ask Gordon AI, forwarding instructions to the MCP Gateway, and executing commands with the victim's Docker privileges. The data exfiltration vulnerability in Docker Desktop allows capturing sensitive internal data about the victim's environment using MCP tools. Ask Gordon version 4.50.0 also resolves a prompt injection vulnerability discovered by Pillar Security.

A security audit by Koi Security identified 341 malicious skills on ClawHub, a marketplace for OpenClaw users, which distribute Atomic Stealer malware to steal sensitive data from macOS and Windows systems. The campaign, codenamed ClawHavoc, uses social engineering tactics to trick users into installing malicious prerequisites. The skills masquerade as legitimate tools, including cryptocurrency utilities, YouTube tools, and finance applications. OpenClaw has added a reporting feature to mitigate the issue. The malware targets API keys, credentials, and other sensitive data, exploiting the open-source ecosystem's vulnerabilities. The campaign coincides with a report from OpenSourceMalware, highlighting the same threat. The intersection of AI agent capabilities and persistent memory amplifies the risks, enabling stateful, delayed-execution attacks. New findings reveal almost 400 fake crypto trading add-ons in the project behind the viral Moltbot/OpenClaw AI assistant tool can lead users to install information-stealing malware. These addons, called skills, masquerade as cryptocurrency trading automation tools and target ByBit, Polymarket, Axiom, Reddit, and LinkedIn. The malicious skills share the same command-and-control (C2) infrastructure, 91.92.242.30, and use sophisticated social engineering to convince users to execute malicious commands which then steals crypto assets like exchange API keys, wallet private keys, SSH credentials, and browser passwords.

A SQL injection vulnerability in the Quiz and Survey Master (QSM) plugin for WordPress, affecting versions 10.3.1 and earlier, has been discovered. The flaw allowed authenticated users with Subscriber-level privileges or higher to interfere with database queries, potentially leading to unauthorized data access. The vulnerability was patched in version 10.3.2, released on December 4, 2025. The issue highlights the risks of improper input validation and the importance of using prepared statements in database queries.

Enterprises face growing security risks due to unmanaged AI agent identities. Traditional identity management systems are inadequate for autonomous, decentralized AI agents, leading to identity sprawl and potential breaches. AI agents operate at machine speed and scale, inheriting human-like intent while retaining machine-like persistence, creating unique security challenges. Effective AI agent identity lifecycle management is crucial to mitigate these risks.

The European Commission has launched a formal investigation into X (formerly Twitter) under the Digital Services Act (DSA) to assess risks associated with its Grok AI tool, which has been used to generate sexually explicit images, including child sexual abuse material (CSAM). French prosecutors have raided X's offices in Paris as part of a criminal investigation into Grok AI, which has been used to generate illegal content. The investigation, opened in January 2025, has expanded to include sexual deepfakes, Holocaust-denial content, and a significant drop in CSAM reports. UK authorities, including the Information Commissioner's Office (ICO), have also launched a formal investigation into X and its Irish subsidiary over reports that Grok AI was used to generate nonconsensual sexual images. The ICO will examine whether X processed personal data lawfully and whether adequate safeguards were in place to prevent Grok from creating harmful, manipulated images. UK and California authorities are also investigating X's compliance with data protection and online safety laws. X has restricted Grok's image generation capabilities to paid subscribers, a move criticized by UK officials.

A webinar titled 'Breaking Down the Modern SOC: What to Build vs Buy vs Automate' is scheduled to address the challenges faced by security operations centers (SOCs). The session will provide practical insights into optimizing SOC operations by determining what to build, buy, and automate. It will feature a real customer case study and a practical checklist for immediate use.

A critical security flaw in the React Native CLI package, tracked as CVE-2025-11953, allowed remote, unauthenticated attackers to execute arbitrary OS commands on development servers. The vulnerability affected versions 4.8.0 through 20.0.0-alpha.2 of the @react-native-community/cli-server-api package, impacting millions of developers using the React Native framework. The flaw was patched in version 20.0.0. The vulnerability is being actively exploited in the wild, with attacks observed on December 21, 2025, January 4, 2026, and January 21, 2026. The attacks involve delivering base-64 encoded PowerShell payloads hidden in the HTTP POST body of malicious requests. The payloads disable endpoint protections, establish a raw TCP connection to attacker-controlled infrastructure, write data to disk, and execute the downloaded binary. Approximately 3,500 exposed React Native Metro servers are still online, according to scans using the ZoomEye search engine. Despite active exploitation being observed for over a month, the vulnerability still carries a low score in the Exploit Prediction Scoring System (EPSS). The vulnerability affects Windows, Linux, and macOS systems, with varying levels of control over executed commands. The flaw was discovered by researchers at JFrog and disclosed in early November 2025. The vulnerability is dubbed Metro4Shell by VulnCheck. The Windows payload is a Rust-based UPX-packed binary with basic anti-analysis logic, and the same attacker infrastructure hosts corresponding Linux binaries, indicating cross-platform targeting.

A new ransomware-as-a-service (RaaS) group named Vect has emerged, targeting organizations in Brazil and South Africa. The group, which began recruiting affiliates in December 2025, uses custom-built C++ malware with ChaCha20-Poly1305 AEAD encryption and intermittent encryption techniques. Vect operates with a high level of maturity, offering cross-platform ransomware targeting Windows, Linux, and VMware ESXi, and employs strong operational security measures. The group has already claimed two victims and operates a double extortion model. Vect's malware is notable for its speed and disruption capabilities, and the group's infrastructure is exclusively hosted on TOR hidden services. Initial access is likely achieved through exposed RDP/VPN, stolen credentials, phishing, or vulnerability exploitation.

Threat actors are actively exploiting a critical remote code execution (RCE) flaw (CVE-2025-11953, CVSS 9.8) in the Metro Development Server within the @react-native-community/cli npm package. First observed on December 21, 2025, the vulnerability allows unauthenticated attackers to execute arbitrary OS commands. Exploits deliver a PowerShell script that disables Microsoft Defender exclusions and downloads a Rust-based binary with anti-analysis features from an attacker-controlled host. The attacks originate from multiple IP addresses and indicate operational use rather than experimental probing.

Recent cloud service outages affecting AWS, Azure, and Cloudflare have caused widespread disruptions, impacting authentication and authorization systems critical to business operations. These incidents highlight the dependency of identity systems on cloud infrastructure, creating hidden single points of failure that can halt access to services and APIs. The ripple effects of such outages underscore the need for robust, multi-cloud identity architectures that can fail gracefully under degraded conditions.

A sophisticated phishing campaign uses multi-stage techniques to evade detection and steal Dropbox credentials from corporate users. The attack begins with phishing emails claiming urgent business matters, containing PDF attachments with hidden malicious links. These links lead to a spoofed Dropbox login page, where entered credentials are exfiltrated to attacker-controlled Telegram channels. The campaign leverages legitimate cloud infrastructure to bypass security checks and manipulate users into providing their credentials.

A malicious Microsoft Visual Studio Code (VS Code) extension named "ClawdBot Agent - AI Coding Assistant" was discovered on the official Extension Marketplace. The extension, which posed as a free AI coding assistant, stealthily dropped a malicious payload on compromised hosts. The extension was taken down by Microsoft after being reported by cybersecurity researchers. The malicious extension executed a binary named "Code.exe" that deployed a legitimate remote desktop program, granting attackers persistent remote access to compromised hosts. The extension also incorporated multiple fallback mechanisms to ensure payload delivery, including retrieving a DLL from Dropbox and using hard-coded URLs to obtain the payloads. Additionally, security researchers found hundreds of unauthenticated Moltbot instances online, exposing sensitive data and credentials. Moltbot, an open-source personal AI assistant, can run 24/7 locally, maintaining a persistent memory and executing scheduled tasks. However, insecure deployments can lead to sensitive data leaks, corporate data exposure, credential theft, and command execution. Hundreds of Clawdbot Control admin interfaces are exposed online due to reverse proxy misconfiguration, allowing unauthenticated access and root-level system access. More than 230 malicious packages for OpenClaw (formerly Moltbot and ClawdBot) have been published in less than a week on the tool's official registry and on GitHub. These malicious skills impersonate legitimate utilities and inject information-stealing malware payloads onto users' systems, targeting sensitive data like API keys, wallet private keys, SSH credentials, and browser passwords. Users are advised to audit their configurations, revoke connected service integrations, and implement network controls to mitigate potential risks. A self-styled social networking platform built for AI agents, Moltbook, contained a misconfigured database that allowed full read and write access to all data. The exposure was due to a Supabase API key exposed in client-side JavaScript, granting unauthenticated access to the entire production database. Researchers accessed 1.5 million API authentication tokens, 30,000 email addresses, and thousands of private messages between agents. The API key exposure allowed attackers to impersonate any agent on the platform, post content, send messages, and interact as that agent. Unauthenticated users could edit existing posts, inject malicious content or prompt injection payloads, and deface the site.

Amazon has disrupted a years-long Russian state-sponsored campaign targeting Western critical infrastructure, including energy sector organizations and cloud-hosted network infrastructure. The campaign, attributed to the GRU-affiliated APT44 group, initially leveraged vulnerabilities in WatchGuard Firebox and XTM, Atlassian Confluence, and Veeam to gain initial access. However, starting in 2025, APT44 shifted its tactics to target misconfigured network edge devices, reducing their exposure and resource expenditure. The group targeted enterprise routers, VPN concentrators, network management appliances, and cloud-based project management systems to harvest credentials and establish persistent access. Amazon's intervention led to the disruption of the campaign, highlighting the ongoing threat posed by state-sponsored cyber actors. APT44, also known as FROZENBARENTS, Sandworm, Seashell Blizzard, and Voodoo Bear, has been active since at least 2021. The group exploited vulnerabilities in WatchGuard Firebox and XTM (CVE-2022-26318), Atlassian Confluence (CVE-2021-26084, CVE-2023-22518), and Veeam (CVE-2023-27532) to compromise network edge devices. The campaign involved credential replay attacks and targeted energy, technology/cloud services, and telecom service providers across North America, Western and Eastern Europe, and the Middle East. Amazon's threat intelligence team identified and notified affected customers, disrupting active threat actor operations. Additionally, APT28, another GRU-affiliated group, has been conducting a sustained credential-harvesting campaign targeting users of UKR[.]net, a webmail and news service popular in Ukraine. The campaign, observed between June 2024 and April 2025, involves deploying UKR[.]net-themed login pages on legitimate services like Mocky to entice recipients into entering their credentials and 2FA codes. Links to these pages are embedded within PDF documents distributed via phishing emails, often shortened using services like tiny[.]cc or tinyurl[.]com. In some cases, APT28 uses subdomains created on platforms like Blogger (*.blogspot[.]com) to launch a two-tier redirection chain leading to the credential harvesting page. The campaign is part of a broader set of phishing and credential theft operations targeting various institutions in pursuit of Russia's strategic objectives. APT28's recent campaign targeted Turkish renewable energy scientists with a climate change policy document from a real Middle Eastern think tank. The group used phishing emails themed to match their intended targets and written in the targets' native tongues. Victims were redirected to a login page mimicking a legitimate online service after following a link in a phishing email. APT28 used regular hosted services rather than custom tools and infrastructure for their attacks. The targets included an IT integrator based in Uzbekistan, a European think tank, a military organization in North Macedonia, and scientists and researchers associated with a Turkish energy and nuclear research organization. The campaign was highly selective and consistent with GRU collection priorities, aligning with geopolitical, military, or strategic intelligence objectives. APT28 has been targeting organizations associated with energy research, defense collaboration, and government communication in a new credential-harvesting campaign. The group used phishing pages impersonating Microsoft Outlook Web Access (OWA), Google, and Sophos VPN portals. Victims were redirected to legitimate domains after entering their credentials. APT28 relied heavily on free hosting and tunneling services such as Webhook.site, InfinityFree, Byet Internet Services, and Ngrok to host phishing content, capture user data, and manage redirections. In February 2025, APT28 deployed a Microsoft OWA phishing page and used the ShortURL link-shortening service for the first-stage redirection. The group employed a webhook relying on HTML to load a PDF lure document in the browser for two seconds before redirecting the victim to a second webhook hosting the spoofed OWA login page. In July, APT28 deployed a spoofed OWA login portal containing Turkish-language text and targeting Turkish scientists and researchers. In June, APT28 deployed a spoofed Sophos VPN password reset page hosted on InfinityFree infrastructure. In September, APT28 hosted two spoofed OWA expired password pages on an InfinityFree domain. In April, Recorded Future discovered a spoofed Google password reset page in Portuguese, hosted on a free apex domain from Byet Internet Services. APT28 abused Ngrok's free service to connect servers behind a firewall to a proxy server and expose that server to the internet without changing firewall rules. APT28's ability to adapt its infrastructure and rebrand credential-harvesting pages suggests it will continue to abuse free hosting, tunneling, and link-shortening services to reduce operational costs and obscure attribution. Recently, APT28 exploited CVE-2026-21509, a recently patched vulnerability in multiple versions of Microsoft Office. The attacks involved malicious DOC files themed around EU COREPER consultations in Ukraine and impersonated the Ukrainian Hydrometeorological Center. The malicious document triggers a WebDAV-based download chain that installs malware via COM hijacking, a malicious DLL (EhStoreShell.dll), shellcode hidden in an image file (SplashScreen.png), and a scheduled task (OneDriveHealth). The scheduled task execution leads to the termination and restart of the explorer.exe process, ensuring the loading of the EhStoreShell.dll file. This DLL executes shellcode from the image file, which launches the COVENANT software (framework) on the computer. COVENANT uses the Filen (filen.io) cloud storage service for command-and-control (C2) operations. APT28 used three more documents in attacks against various EU-based organizations, indicating that the campaign extends beyond Ukraine.

Mozilla will introduce a new 'Block AI enhancements' toggle in Firefox 148, allowing users to disable all AI features or manage them individually. The update responds to user feedback and emphasizes user choice and control over AI integration in the browser. The feature will roll out on February 24, first to Nightly users and then to all desktop users. Mozilla's CEO emphasized the importance of user agency, privacy, and clear controls over AI features.

The China-linked Lotus Blossom hacking group exploited a hosting provider breach to deliver a previously undocumented backdoor, Chrysalis, to Notepad++ users. The attack, which occurred between June and December 2025, involved hijacking update traffic and exploiting insufficient update verification controls in older versions of the software. The group used a multi-layered shellcode loader and integrated undocumented system calls to enhance stealth and resilience. The breach was discovered and mitigated in December 2025, with Notepad++ migrating to a new hosting provider and rotating all credentials. The Chrysalis backdoor is a feature-rich implant capable of gathering system information, executing commands, and maintaining persistence. It communicates with a command-and-control (C2) server to receive additional instructions. The C2 server is currently offline, but the malware's capabilities suggest ongoing development and adaptation by the threat actor.

The GlassWorm malware campaign has resurfaced with a third wave, adding 24 new packages to OpenVSX and Microsoft Visual Studio Marketplace. The malware uses invisible Unicode characters to hide malicious code and targets GitHub, NPM, and OpenVSX account credentials, as well as cryptocurrency wallet data. The campaign initially impacted 49 extensions, with an estimated 35,800 downloads, though this figure includes inflated numbers due to bots and visibility-boosting tactics. The Eclipse Foundation has revoked leaked tokens and introduced security measures, but the threat actors have pivoted to GitHub and now returned to OpenVSX with updated command-and-control endpoints. The malware's global reach includes systems in the United States, South America, Europe, Asia, and a government entity in the Middle East. Koi Security has accessed the attackers' server and shared victim data with law enforcement. The threat actors have posted a fresh transaction to the Solana blockchain, providing an updated C2 endpoint for downloading the next-stage payload. The attacker's server was inadvertently exposed, revealing a partial list of victims spanning the U.S., South America, Europe, and Asia, including a major government entity from the Middle East. The threat actor is assessed to be Russian-speaking and uses the open-source browser extension C2 framework named RedExt as part of their infrastructure. The third wave of Glassworm uses Rust-based implants packaged inside the extensions and targets popular tools and developer frameworks like Flutter, Vim, Yaml, Tailwind, Svelte, React Native, and Vue. Additionally, a malicious Rust package named "evm-units" was discovered, targeting Windows, macOS, and Linux systems. This package, uploaded to crates.io in mid-April 2025, attracted over 7,000 downloads and was designed to stealthily execute on developer machines by masquerading as an Ethereum Virtual Machine (EVM) unit helper tool. The package checks for the presence of Qihoo 360 antivirus and alters its execution flow accordingly. The references to EVM and Uniswap indicate that the supply chain incident is designed to target developers in the Web3 space. The latest development involves the compromise of a legitimate developer's resources to push malicious updates to downstream users, with the malicious extensions having previously been presented as legitimate developer utilities and collectively accumulated over 22,000 Open VSX downloads prior to the malicious releases. A new GlassWorm malware attack through compromised OpenVSX extensions focuses on stealing passwords, crypto-wallet data, and developer credentials and configurations from macOS systems. The threat actor gained access to the account of a legitimate developer (oorzc) and pushed malicious updates with the GlassWorm payload to four extensions that had been downloaded 22,000 times. GlassWorm attacks first appeared in late October, hiding the malicious code using "invisible" Unicode characters to steal cryptocurrency wallet and developer account details. The malware also supports VNC-based remote access and SOCKS proxying. Over time and across multiple attack waves, GlassWorm impacted both Microsoft's official Visual Studio Code marketplace and its open-source alternative for unsupported IDEs, OpenVSX. In a previous campaign, GlassWorm showed signs of evolution, targeting macOS systems, and its developers were working to add a replacement mechanism for the Trezor and Ledger apps. A new report from Socket's security team describes a new campaign that relied on trojanizing the following extensions: oorzc.ssh-tools v0.5.1, oorzc.i18n-tools-plus v1.6.8, oorzc.mind-map v1.0.61, oorzc.scss-to-css-compile v1.3.4. The malicious updates were pushed on January 30, and Socket reports that the extensions had been innocuous for two years. This suggests that the oorzc account was most likely compromised by GlassWorm operators. According to the researchers, the campaign targets macOS systems exclusively, pulling instructions from Solana transaction memos. Notably, Russian-locale systems are excluded, which may hint at the origin of the attacker. GlassWorm loads a macOS information stealer that establishes persistence on infected systems via a LaunchAgent, enabling execution at login. It harvests browser data across Firefox and Chromium, wallet extensions and wallet apps, macOS keychain data, Apple Notes databases, Safari cookies, developer secrets, and documents from the local filesystem, and exfiltrates everything to the attacker's infrastructure at 45.32.150[.]251. Socket reported the packages to the Eclipse Foundation, the operator of the Open VSX platform, and the security team confirmed unauthorized publishing access, revoked tokens, and removed the malicious releases. The only exception is oorzc.ssh-tools, which was removed completely from Open VSX due to discovering multiple malicious releases. Currently, versions of the affected extensions on the market are clean, but developers who downloaded the malicious releases should perform a full system clean-up and rotate all their secrets and passwords.

Two penetration testers, Gary De Mercurio and Justin Wynn, have received a $600,000 settlement from Dallas County, Iowa, seven years after being wrongfully arrested while conducting a security evaluation. The incident occurred in 2019 when they were hired by the state of Iowa's Judicial Branch to test the courthouse's security systems. Despite having legal clearance, they were arrested for burglary and faced protracted legal battles. The settlement was finalized recently, providing some vindication but not full restitution for the career impacts they suffered.

Windows 11 23H2 devices with System Guard Secure Launch enabled fail to shut down properly after installing the January 13, 2026, cumulative update (KB5073455). Affected systems restart instead of shutting down or entering hibernation. This issue impacts Enterprise and IoT editions of Windows 11, version 23H2, as well as Windows 10 22H2, Windows 10 Enterprise LTSC 2021, and Windows 10 Enterprise LTSC 2019 with Virtual Secure Mode (VSM) enabled. Microsoft has provided a temporary workaround for shutdown but no solution for hibernation. The company is also addressing a separate bug in the January 2026 KB5074109 update causing Remote Desktop connection failures. Microsoft has released an out-of-band update (KB5077797) to fix the shutdown issue in Windows 11 23H2.

A high-severity vulnerability (CVE-2026-25253, CVSS 8.8) in OpenClaw, an open-source AI assistant, allows remote code execution via a malicious link. The flaw enables token exfiltration and full gateway compromise. The issue was patched in version 2026.1.29 released on January 30, 2026. The vulnerability arises because the Control UI trusts the gatewayUrl parameter without validation, auto-connecting and sending the stored gateway token in the WebSocket connect payload. This allows an attacker to connect to the victim's local gateway, modify configurations, and execute privileged actions. OpenClaw integrates with various messaging platforms and has gained rapid popularity, with its GitHub repository crossing 149,000 stars. The vulnerability can be exploited to achieve one-click RCE by visiting a malicious web page, leveraging cross-site WebSocket hijacking due to the lack of origin header validation.

The **ShinyHunters and Scattered Spider collaboration**, operating under the **Scattered Lapsus$ Shiny Hunters (SLSH) alliance**, has escalated its extortion tactics in **early 2026**, combining **technical intrusions** with **psychological harassment, swatting, and media manipulation** to coerce payments. A February 2026 analysis by **Allison Nixon (Unit 221B)** reveals the group’s **unreliable and fractious nature**, rooted in its origins within *The Com*—a decentralized cybercriminal network prone to internal betrayals and operational instability. Unlike traditional ransomware groups, SLSH **does not guarantee data deletion** post-payment, instead using **extortion as a pretext for future fraud** while deploying **DDoS attacks, email floods, and threats of physical violence** against executives, their families, and even security researchers. This follows a year of high-impact breaches, including the **$107 million loss at the Co-operative Group (U.K.)**, **Jaguar Land Rover’s operational shutdown**, and attacks on **Allianz Life, Farmers Insurance, and PornHub Premium members** via the **Mixpanel analytics breach**. The groups leverage **vishing, OAuth token abuse, and AI-enhanced tooling** to exploit **SaaS platforms (Okta, SharePoint, Salesforce)**, while **law enforcement arrests** (e.g., **Owen Flowers, Thalha Jubair**) and **shutdown claims** have failed to halt operations. The **FBI, U.K. NCA, and Google Threat Intelligence** continue tracking their **adaptive tactics**, now compounded by **SLSH’s use of harassment as a core extortion lever**, rendering traditional negotiation strategies ineffective. Victims are advised to **refuse engagement** beyond a firm "no payment" stance, as compliance only fuels further escalation. The alliance’s latest developments—including the **ShinySp1d3r RaaS platform**, **Zendesk phishing campaigns**, and **targeted intrusions against financial sectors**—demonstrate a **multi-pronged expansion** in both **technical sophistication** and **psychological warfare**, solidifying their status as a **high-risk, low-trust threat actor** in the cybercrime landscape.

The US National Security Agency (NSA) has published new Zero Trust Implementation Guidelines (ZIGs) to help organizations advance to target-level zero trust maturity. The guidelines introduce Phase One and Phase Two, designed to support the US Department of War's (DoW) zero trust framework and broader US government cybersecurity strategy. These phases outline activities, dependencies, and outcomes, allowing organizations to tailor adoption based on operational needs. The phased approach emphasizes continuous evaluation and integration of core zero trust solutions across environments, reinforcing a shift from perimeter-based security to continuous authentication and authorization.

Microsoft plans to disable the 30-year-old NTLM authentication protocol by default in upcoming Windows releases due to its security vulnerabilities. NTLM, introduced in 1993, has been widely exploited in attacks such as NTLM relay and pass-the-hash attacks. Microsoft is transitioning to Kerberos-based authentication, which is more secure. The company has outlined a three-phase transition plan to mitigate risks and minimize disruption. NTLM has been a fallback authentication method when Kerberos is unavailable, but its weak cryptography and vulnerabilities make it a target for attackers. Microsoft's move aims to enhance security by default in future Windows Server and client versions. NTLM was formally deprecated in June 2024 and no longer receives updates. The transition is part of Microsoft's efforts to move toward a passwordless, phishing-resistant future.

Fraudulent High-Yield Investment Programs (HYIPs) are experiencing a global surge, promising unrealistic returns to lure victims. These scams operate like Ponzi schemes, with early investors receiving payouts to create an illusion of profit, while subsequent investors face delayed or withheld withdrawals. The scams eventually collapse, with operators disappearing with the funds. CTM360 identified over 4,200 scam websites and hundreds of monthly incidents, highlighting the widespread nature of these schemes. HYIPs primarily use social media for distribution, with professional-looking interfaces and fabricated performance claims to extract deposits. They often display forged licenses and testimonials to appear credible. Referral programs turn victims into distributors, accelerating the scams' growth. Payment methods include cryptocurrency, credit/debit cards, and local payment gateways, with KYC delays used to withhold funds.

Notepad++ version 8.8.9 was released to address a security flaw in its WinGUp update tool that allowed attackers to push malicious executables instead of legitimate updates. Users reported incidents where the updater spawned a malicious AutoUpdater.exe that collected device information and exfiltrated it to a remote site. The flaw was mitigated by enforcing updates only from GitHub and later by requiring signature verification for all updates. Security researchers noted targeted attacks against organizations with interests in East Asia, where Notepad++ processes were used to gain initial access. The attack involved an infrastructure-level compromise at the hosting provider level, allowing malicious actors to intercept and redirect update traffic. The incident commenced in June 2025 and continued until December 2025, with the Notepad++ website later migrated to a new hosting provider. The attackers were likely Chinese state-sponsored threat actors, selectively redirecting update requests from certain users to malicious servers. The hosting provider for the update feature was compromised, enabling targeted traffic redirections. The attackers regained access using previously obtained internal service credentials. Notepad++ has since migrated all clients to a new hosting provider with stronger security and plans to enforce mandatory certificate signature verification in version 8.9.2. The compromise involved shared hosting infrastructure rather than a flaw in the software's code, with attackers gaining access at the hosting provider level to intercept and manipulate traffic bound for the Notepad++ update endpoint. Direct server access by the attackers ended on September 2, 2025, but credentials associated with internal services remained exposed until December 2, 2025, allowing continued traffic redirection. The hosting provider confirmed no additional customers were affected.

The ShinyHunters extortion gang breached Panera Bread's systems via a Microsoft Entra single sign-on (SSO) compromise, exposing 5.1 million unique user accounts. The breach included personally identifiable information (PII) such as names, phone numbers, and physical addresses. The initial claim of 14 million affected customers was clarified to refer to stolen records, not unique accounts. The breach was part of a broader vishing campaign targeting SSO accounts at Okta, Microsoft, and Google across over 100 organizations. Panera Bread has confirmed the breach but has not yet issued a public statement.

A cybercrime operation named 'Bizarre Bazaar' is actively targeting exposed or poorly authenticated LLM (Large Language Model) service endpoints. Over 35,000 attack sessions were recorded in 40 days, involving unauthorized access to steal computing resources, resell API access, exfiltrate data, and pivot into internal systems. The campaign highlights the emerging threat of 'LLMjacking' attacks, where attackers exploit misconfigurations in LLM infrastructure to monetize access through cryptocurrency mining and darknet markets. The SilverInc service, marketed on Telegram and Discord, resells access to more than 50 AI models in exchange for cryptocurrency or PayPal payments. A recent investigation by SentinelOne SentinelLABS and Censys revealed 175,000 unique Ollama hosts across 130 countries, many of which are configured with tool-calling capabilities, increasing the risk of LLMjacking attacks.

Mid-market organizations face significant cybersecurity challenges due to limited budgets and lean IT teams. They often rely on a small set of foundational tools, but these are frequently underutilized due to lack of resources. A more sustainable approach involves integrating prevention, protection, detection, and response across the complete threat lifecycle. Security platforms and Managed Detection and Response (MDR) services can help extend coverage and reduce operational burden.