Major Incidents or Breaches

  • Spanish authorities arrested a 19-year-old in Barcelona for allegedly stealing and attempting to sell 64 million personal data records obtained from breaches at nine companies.
  • Canadian organizations have been the primary target in a campaign by threat cluster STAC6565, with almost 40 incidents investigated. The Gold Blade group has been observed deploying QWCrypt ransomware in these attacks.
  • Japanese manufacturers, retailers, and government entities continue to experience prolonged recovery periods following ransomware attacks, highlighting the long-term operational impact of such incidents.
  • Microsoft Copilot experienced an outage affecting users in Europe, with investigation and mitigation ongoing.

Newly Discovered Vulnerabilities

  • Microsoft’s December 2025 Patch Tuesday addressed 57 vulnerabilities, including three zero-days (one actively exploited, two publicly disclosed) affecting Windows and supported software.
  • Adobe released patches for nearly 140 vulnerabilities, including 117 in Experience Manager (116 XSS bugs).
  • SAP issued patches for 14 vulnerabilities across multiple products, including three critical-severity flaws.
  • Fortinet released updates for two critical authentication bypass vulnerabilities affecting FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager, and warned of critical SSO login flaws in FortiCloud that could allow authentication bypass.
  • Ivanti disclosed and patched a critical remote code execution vulnerability in Endpoint Manager.
  • Google patched a critical “no-click” vulnerability in Gemini Enterprise that allowed attackers to exfiltrate sensitive data via malicious document instructions.
  • Microsoft added PowerShell warnings for scripts using Invoke-WebRequest to help prevent risky code execution.
  • Google introduced new layered defenses in Chrome to block indirect prompt injection threats following the addition of agentic AI capabilities.
  • Researchers identified malicious extensions in Microsoft Visual Studio Code Marketplace and malicious packages in Go, npm, and Rust ecosystems, designed to steal developer data.

Notable Threat Actor Activity

  • North Korea-linked actors exploited the React2Shell (CVE-2025-55182) vulnerability in React Server Components to deploy new EtherRAT malware, which implements multiple Linux persistence mechanisms and uses Ethereum smart contracts for command and control.
  • Four distinct threat clusters are leveraging the CastleLoader malware loader, indicating it is being offered as a service for broader cybercriminal use.
  • Storm-0249, previously known as an initial access broker, has escalated to direct ransomware operations using advanced techniques such as domain spoofing, DLL side-loading, fileless PowerShell, and abusing endpoint detection and response (EDR) solutions for stealthy malware execution.
  • A phishing campaign leveraging the Evilginx open-source phishing framework is targeting at least 18 U.S. universities, aiming to bypass MFA and steal credentials.
  • Multi-stage phishing attacks have been observed evading Microsoft 365 security controls.
  • Kaspersky researchers report that Telegram’s crackdown on illicit channels is pushing cybercriminal activity to other platforms.
  • Shanya, a “packer-as-a-service,” is being used to obfuscate ransomware payloads and disable EDR, supporting ransomware operators in evading detection.

Trends, Tools, or Tactics of Interest

  • Increased abuse of EDR and trusted Windows utilities by threat actors for stealthy malware deployment and persistence.
  • Growing adoption of malware loaders and packer-as-a-service offerings (e.g., CastleLoader, Shanya) to facilitate ransomware and malware campaigns.
  • Surge in malicious packages and extensions targeting developer environments (VS Code, Go, npm, Rust) to steal sensitive data and credentials.
  • Attackers are leveraging deepfakes, AI-generated resumes, and social engineering to impersonate job applicants and infiltrate organizations.
  • Prompt injection vulnerabilities in AI-powered tools remain a persistent and difficult-to-mitigate risk, as highlighted by the UK’s NCSC.
  • Zero Trust adoption is hindered by lack of interoperability among security tools, with 88% of organizations experiencing challenges in sharing security signals.
  • Ongoing migration of cybercriminal communities away from Telegram due to increased enforcement and platform blocks.

Regulatory or Policy Developments Affecting the Security Industry

  • The UK government imposed sanctions on Russian and Chinese firms suspected of conducting malign information warfare and hybrid threats targeting critical infrastructure and democratic processes.
  • The EU fined X (formerly Twitter) $140 million for verification rules that facilitate impostor scams by allowing anyone to purchase a verified checkmark.
  • CISA, FBI, and international partners issued a joint advisory urging immediate action to defend critical infrastructure from pro-Russia hacktivist threats.
  • The US announced a $10 million bounty for information on Iranian hackers associated with Emennet Pasargad.
  • Microsoft announced new operating CISOs as part of a strategic shift toward AI-driven cyber defense and enhanced operational oversight.