Major Incidents or Breaches

• Trust Wallet Chrome Extension Breach: Trust Wallet confirmed a security incident involving its Chrome extension, resulting in the theft of approximately $7 million in cryptocurrency. The breach was linked to a compromised extension update released on December 24. Users are being urged to update to the latest version immediately.

• Grubhub-Themed Cryptocurrency Scam: Grubhub users received fraudulent emails purporting to be from the company, promising a tenfold return on sent cryptocurrency. The emails directed recipients to transfer funds to a specified wallet, indicating a targeted phishing campaign.

Major Incidents or Breaches

• Encrypted vault backups stolen during the 2022 LastPass breach have enabled threat actors to compromise weak master passwords and steal cryptocurrency assets, with thefts continuing through 2025.

Newly Discovered Vulnerabilities

• Fortinet has reported active exploitation of CVE-2020-12812, a five-year-old FortiOS SSL VPN vulnerability that allows two-factor authentication bypass under certain configurations.
• CISA has added a vulnerability affecting Digiever DS-2105 Pro network video recorders to its Known Exploited Vulnerabilities (KEV) catalogue. This flaw allows remote code execution and is being actively exploited.

Notable Threat Actor Activity

Major Incidents or Breaches

• The U.S. FBI seized the ‘web3adspanels.org’ domain and its database, which were used by cybercriminals to host and distribute stolen bank login credentials obtained in account takeover attacks targeting U.S. victims.
• The French national postal service, La Poste, experienced a Distributed Denial-of-Service (DDoS) attack that knocked central computer systems offline. Pro-Russian hacker groups have claimed responsibility.
• The U.S. Securities and Exchange Commission (SEC) filed charges against multiple companies involved in a cryptocurrency scam that used fake AI-themed investment tips to defraud victims of over $14 million.
• ESET reported a 62% surge in the Nomani investment scam, which now leverages AI-generated deepfake advertisements and has expanded distribution beyond Facebook to other social media platforms.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• The French national postal service experienced a cyberattack that disrupted online services, including digital banking and postal operations, affecting millions of users.
• Baker University disclosed a data breach affecting over 53,000 individuals, with attackers accessing personal, health, and financial information after compromising the network a year prior.
• Nissan confirmed exposure of personal information for 21,000 customers due to a compromise of Red Hat’s GitLab instances.
• The U.S. Department of Justice seized a domain and database used in a $14.6 million bank account takeover scheme, which involved phishing and credential theft.
• Hacktivists claimed to have scraped nearly all content from Spotify, raising concerns about data exposure.
• INTERPOL coordinated an operation across 19 African countries, resulting in 574 arrests and the recovery of $3 million, dismantling business email compromise (BEC), ransomware, and cyber-fraud networks.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Nissan confirmed that thousands of customer records were compromised due to the Red Hat data breach in September.
• The University of Phoenix disclosed a data breach impacting nearly 3.5 million students, staff, and suppliers, attributed to the Clop ransomware group.
• Coupang, a major e-commerce company, reported a data breach affecting 33.7 million users, with unauthorized access to personal data persisting for almost five months.
• The Romanian National Water Authority (Administrația Națională Apele Române) suffered a ransomware attack over the weekend.
• France’s national postal service and associated banking operations experienced significant disruption from a cyberattack, impacting package deliveries and online payments during the Christmas period.
• Pornhub warned users of potential sextortion emails following a data exposure incident.
• The UK government acknowledged an ongoing investigation into a cyber incident after reports that hackers linked to China accessed thousands of confidential documents.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Hackers stole millions of PornHub users’ data for extortion purposes.
• The U.S. Department of Justice indicted 54 individuals for a multi-million dollar ATM jackpotting scheme involving the use of Ploutus malware.

Newly Discovered Vulnerabilities

• Cisco disclosed a zero-day vulnerability for which no patch is currently available.

Notable Threat Actor Activity

• The Iranian Infy (aka Prince of Persia) APT group has resurfaced after nearly five years of inactivity, exhibiting new malware activity.

Trends, Tools, or Tactics of Interest

Major Incidents or Breaches

• PornHub has suffered a data breach in which hackers stole data belonging to millions of users. The attackers are reportedly using the stolen information for extortion purposes.

Notable Threat Actor Activity

• The Iranian APT group Infy (also known as Prince of Persia) has resurfaced after nearly five years of inactivity. New malware activity attributed to Infy has been observed targeting victims in Sweden.
• RansomHouse ransomware-as-a-service operators have upgraded their encryption techniques, moving from a single-phase linear approach to a more complex, multi-layered data processing method.
• The U.S. Department of Justice has indicted 54 individuals involved in a large-scale ATM jackpotting scheme. The conspiracy utilised Ploutus malware to compromise ATMs and steal millions of dollars.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• University of Sydney Data Breach: A data breach at the University of Sydney has affected 27,000 individuals, including current and former staff, affiliates, alumni, and students. The breach was linked to information downloaded from a code library.
• Microsoft Teams Outage: Microsoft Teams experienced significant service disruptions, with widespread issues and delays in message delivery.
• Denmark Water Utility Attack: Danish intelligence has attributed destructive cyberattacks on the country’s water utility and other critical infrastructure to Russian state actors, in what is described as part of a broader campaign of hybrid warfare against Western nations.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• The University of Sydney suffered a data breach after attackers accessed an online coding repository, resulting in the theft of files containing personal information of staff and students.
• The Richmond Behavioral Health Authority (Virginia, US) experienced a ransomware attack, with threat actors stealing names, Social Security numbers, and financial and health information of 113,000 individuals.
• French authorities arrested two crew members from an Italian passenger ferry for allegedly installing malware enabling remote control of the vessel. France’s counterespionage agency is investigating the incident as suspected foreign interference.
• The US Department of Justice seized the E-Note cryptocurrency exchange, which was allegedly used to launder over $70 million in ransomware payments.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• LKQ, a major auto parts supplier, confirmed a breach involving its Oracle E-Business Suite (EBS), resulting in the compromise of personal information for thousands of individuals.
• France arrested a 22-year-old suspect linked to the recent cyberattack on the country’s Ministry of the Interior.
• Amazon AWS GuardDuty reported an ongoing cryptomining campaign abusing compromised AWS credentials to hijack EC2 and ECS resources across multiple customer environments.
• WhatsApp accounts are being hijacked via abuse of the device-linking feature in attacks dubbed “GhostPairing,” allowing threat actors to take over user accounts.
• The NMFTA (National Motor Freight Traffic Association) warned of a surge in sophisticated cyber-enabled cargo theft targeting the transportation sector.

Newly Discovered Vulnerabilities