https://blog.dansec.red/cves/cve-2024-37079/Recent content in CVE-2024-37079 on DanSec DailyHugoen-gbSun, 25 Jan 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-01-25-cybersecurity-news/Sun, 25 Jan 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-01-25-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Nike is investigating a potential security incident following claims by the WorldLeaks cybercrime group that they have stolen data from the company’s systems. The group is threatening to leak the purported information.</li> <li>A multi-stage phishing campaign has been identified targeting Russian users with ransomware and the Amnesia RAT. The campaign uses social engineering lures and delivers multiple payloads to compromise victims.</li> <li>A significant cyberattack targeting Poland’s power grid in late December 2025 has been attributed to the Russian state-sponsored group Sandworm. The attack involved the deployment of a new destructive wiper malware, DynoWiper, but was reportedly unsuccessful in causing disruption.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>CISA has added CVE-2024-37079, a critical and actively exploited vulnerability in Broadcom VMware vCenter Server, to its Known Exploited Vulnerabilities (KEV) catalog. The flaw was patched in June 2024.</li> <li>Microsoft released emergency out-of-band updates for Windows 10, Windows 11, and Windows Server to resolve an issue causing Microsoft Outlook Classic to freeze or fail to open when using PST files.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>The North Korean threat group Konni (also known as Opal Sleet or TA406) is targeting blockchain sector developers and engineers with AI-generated PowerShell malware.</li> <li>The Russian Sandworm group is linked to the attempted, but ultimately unsuccessful, destructive wiper attack (DynoWiper) on Poland’s energy systems.</li> <li>WorldLeaks, a cybercrime group, is claiming responsibility for the alleged breach at Nike and is threatening to leak stolen data.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>AI-generated malware is increasingly being used by threat actors, as demonstrated by Konni’s deployment of AI-built PowerShell malware against blockchain engineers.</li> <li>Multi-stage phishing campaigns are combining social engineering with the delivery of both ransomware and remote access trojans (RATs), as seen in the campaign targeting Russia.</li> </ul> <h2 id="regulatory-or-policy-developments-affecting-the-security-industry">Regulatory or Policy Developments Affecting the Security Industry</h2> <ul> <li>CISA’s inclusion of VMware vCenter Server CVE-2024-37079 in its KEV catalog highlights increased regulatory attention on patching actively exploited vulnerabilities in critical infrastructure.</li> <li>The U.S. Department of Justice has admitted that DOGE may have misused Social Security data.</li> <li>Microsoft has acknowledged providing BitLocker encryption keys to law enforcement agencies.</li> <li>ICE is soliciting information from companies regarding the use of commercial ad tech and big data tools for law enforcement and investigative purposes.</li> </ul>