Major Incidents or Breaches

• A hacktivist group claims to have breached the Mexican government, allegedly leaking 2.3 terabytes of data affecting 36 million citizens. The government disputes the sensitivity of the leaked data.
• Notepad++ update infrastructure was compromised by suspected Chinese state-backed hackers, resulting in the distribution of a backdoored version of the application.
• Ongoing web traffic hijacking campaigns are targeting NGINX servers and management panels such as Baota (BT), redirecting user traffic through attacker-controlled infrastructure.
• The DEAD#VAX malware campaign is deploying AsyncRAT via IPFS-hosted VHD phishing files, using advanced evasion techniques to bypass traditional security controls.
• Iranian threat actors continue credential theft operations targeting expatriates, Syrians, and Israelis using spear-phishing and social engineering.
• Attackers are leveraging Windows .scr screensaver files to deliver malware and remote management tools, exploiting the fact that these executables often evade standard controls.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Notepad++ Supply Chain Attack: Kaspersky GReAT identified previously undocumented infection chains in the Notepad++ supply chain attack, with new indicators of compromise (IoCs) and use of DLL sideloading.
• Panera Bread Data Leak: ShinyHunters leaked 5.1 million Panera Bread account records, claiming theft of 14 million records from the company’s systems.
• AT&T Breach Data Resurfacing: Previously leaked AT&T customer data has resurfaced, now merged and enriched with other datasets, increasing risks for affected customers.
• AI Plush Toy Data Exposure: Approximately 50,000 chat transcripts between children and Bondu’s AI dinosaur plush toy were exposed and accessible to anyone with a Google account.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Notepad++ Supply Chain Attack:

  • Chinese state-sponsored group “Lotus Blossom” compromised the Notepad++ hosting provider for approximately six months.
  • Attackers hijacked the official update mechanism, redirecting select users to malicious servers and distributing trojanised updates.
  • The campaign was highly targeted and attributed to Chinese state interests with medium confidence.

• NationStates Data Breach:

  • The multiplayer browser-based game NationStates confirmed a data breach and temporarily shut down its website to investigate the incident.

• Panera Bread Data Breach:

  • The data breach at Panera Bread impacted 5.1 million accounts, as confirmed by Have I Been Pwned.

• MongoDB Database Compromise:

  • Over 1,400 out of 3,100 unprotected MongoDB instances were compromised, with most attributed to a single threat actor.

• Polish Energy Sector ICS Attack:

  • Attackers exploited default credentials to gain access to industrial control systems (ICS) at Polish energy facilities, resulting in destructive impacts.

Major Incidents or Breaches

• eScan Antivirus update servers were compromised by unknown attackers, resulting in the delivery of multi-stage malware through the official update channel. The attack leveraged the trusted update infrastructure of MicroWorld Technologies, impacting users who downloaded updates during the compromise period.

• The Open VSX Registry, a popular extension registry for Visual Studio Code, was targeted in a supply chain attack. Threat actors compromised a legitimate developer’s account to distribute malicious extensions containing the GlassWorm malware to end users.

• Exposed MongoDB instances continue to be targeted in automated data extortion attacks. Threat actors are accessing unsecured databases, exfiltrating data, and demanding low-value ransoms from database owners to restore access.

Major Incidents or Breaches

• Hackers compromised a MicroWorld Technologies update server, delivering a malicious file to eScan Antivirus customers via a supply chain attack.
• A researcher disclosed that private Instagram profiles were leaking photo links to unauthenticated visitors. The issue was subsequently fixed, but Meta closed the report as not applicable.

Newly Discovered Vulnerabilities

• Evidence indicated a flaw in Instagram’s handling of private profile photos, allowing unauthorized access to photo links. This has since been remediated.

Notable Threat Actor Activity

Major Incidents or Breaches

• CERT Polska reported coordinated cyber attacks on over 30 wind and solar farms, as well as a private manufacturing company, in Poland. Related reporting attributes a Russia-linked threat actor (Sandworm/Electrum) as responsible for these intrusions, which resulted in bricked ICS devices at 30 sites affecting communication and control systems in the Polish power grid.
• ShinyHunters ransomware group claimed breaches of Match Group dating platforms (Match, Hinge, OkCupid) and Panera Bread, allegedly stealing millions of user records.
• Illegal cryptocurrency flows reached $158 billion in 2025, marking a record high after several years of decline.
• Researchers identified malicious Google Chrome extensions capable of hijacking affiliate links, stealing data, and collecting OpenAI ChatGPT authentication tokens.
• Android users were targeted with a remote access trojan (RAT) delivered via malicious applications hosted on Hugging Face repositories.
• Over 175,000 exposed Ollama AI model hosts were identified, with 23,000 persistently active, posing risks of LLM abuse.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Match Group, the parent company of Tinder, OkCupid, Hinge, and Match.com, confirmed a cybersecurity incident resulting in the compromise of user data across multiple platforms.
• Marquis Software Solutions reported that a ransomware attack in August 2025 affecting dozens of U.S. banks and credit unions was due to a breach of SonicWall cloud backups.
• An AI chat toy company, Bondu, exposed over 50,000 logs of conversations between children and its AI-enabled toys due to an unsecured web console.
• The French national unemployment agency was fined €5 million for a breach that resulted in the theft of job seekers’ personal information.
• eScan antivirus suffered a supply chain attack, with malicious updates detected and distributed through its update mechanism.
• Google, in collaboration with industry partners, disrupted the IPIDEA residential proxy network, which had been leveraged by threat actors via malware-infected devices.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• The Polish energy grid suffered a coordinated cyberattack in December 2025, impacting around 30 distributed energy resource sites, including combined heat and power facilities and wind farms. The incident has been attributed to the Russian state-sponsored group ELECTRUM.
• eScan antivirus vendor MicroWorld Technologies confirmed its update server was breached and used to distribute a malicious update.
• The FBI seized the RAMP cybercrime forum, a major platform for ransomware gangs and malware advertisements.
• Google, in collaboration with partners, disrupted IPIDEA, one of the world’s largest residential proxy networks.
• A malicious campaign, dubbed “Bizarre Bazaar,” is actively targeting exposed Large Language Model (LLM) service endpoints to commercialise unauthorised access to AI infrastructure.
• Researchers found 16 malicious Chrome extensions capable of hijacking ChatGPT sessions and exfiltrating user data.
• Two malicious Python packages masquerading as spellcheckers were discovered on PyPI, delivering remote access trojans.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Nike is investigating a potential data breach after the World Leaks ransomware/extortion group published 1.4 TB of allegedly stolen corporate files, including 188,347 highly sensitive documents.
• SoundCloud has suffered a data breach impacting 29.8 million accounts, with hackers stealing personal and contact information.
• Over 100 organizations have been targeted in a phishing campaign attributed to ShinyHunters, with domains set up to impersonate brands such as Atlassian, Canva, Epic Games, HubSpot, Moderna, ZoomInfo, and WeWork.
• Over 6,000 SmarterMail servers are exposed online and likely vulnerable to automated hijacking attacks exploiting a critical authentication bypass vulnerability.
• Multiple threat actors, including state-sponsored and financially motivated groups, continue to exploit the CVE-2025-8088 WinRAR path traversal vulnerability for initial access and malware delivery.
• Chrome and Edge browser extensions marketed as ChatGPT enhancement tools have been found stealing ChatGPT session data, granting threat actors access to user information.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Crunchbase has confirmed a data breach following hacking claims. The incident is linked to the ShinyHunters group, which also targeted SoundCloud and Betterment.
• A failed cyberattack on the Polish power grid has been attributed to the Russian APT group Sandworm. The attack involved the deployment of data-wiping malware but did not result in significant disruption.
• Nearly 800,000 Telnet servers have been found exposed to remote attacks due to a critical authentication bypass vulnerability in GNU InetUtils, with ongoing exploitation attempts observed.
• Cloudflare experienced a 25-minute BGP route leak affecting IPv6 traffic due to internal misconfiguration, causing congestion, packet loss, and approximately 12 Gbps of traffic disruption.

Newly Discovered Vulnerabilities