Major Incidents or Breaches

  • Petróleos de Venezuela (PDVSA), Venezuela’s state-owned oil company, suffered a cyberattack that disrupted export operations over the weekend.
  • SoundCloud disclosed a data breach affecting approximately 20% of its users, with attackers accessing user data.
  • Askul, an e-commerce and logistics company, was targeted by the RansomHouse ransomware group in October, resulting in the compromise of 700,000 records.
  • A new report highlights that most “parked” domains-largely expired or unused domains-now serve malicious content, increasing risks from direct navigation.
  • Urban VPN Proxy, a popular Chrome extension with 8 million users, was found to be harvesting data from AI chatbot conversations, including ChatGPT, Claude, Gemini, and Copilot.
  • A security flaw at a photo booth operator’s website exposed hundreds of private customer photos online.

Newly Discovered Vulnerabilities

  • Two critical authentication bypass vulnerabilities in Fortinet FortiGate devices are under active exploitation, enabling unauthorised access to admin accounts and theft of configuration files.
  • The React2Shell vulnerability is being actively exploited to deploy Linux backdoors such as KSwapDoor and ZnDoor.
  • A vulnerability in JumpCloud Remote Assist allows attackers to write arbitrary data or delete files to gain System privileges.
  • Kaspersky researchers detailed a vulnerability in a vehicle’s head unit modem, which allowed full system access.
  • A malicious NuGet package, typosquatting the legitimate Tracer.Fody .NET library, was discovered stealing cryptocurrency wallet data.

Notable Threat Actor Activity

  • Amazon’s threat intelligence team reported a years-long Russian GRU campaign targeting Western critical infrastructure, particularly in the energy and cloud sectors, from 2021 to 2025. The campaign has shifted from exploiting vulnerabilities to leveraging misconfigured edge devices.
  • The Ink Dragon espionage group (also known as CL-STA-0049, Earth Alux) was profiled for its sustained and sophisticated offensive operations, including the use of relay networks.
  • An ongoing campaign is targeting AWS customers with compromised IAM credentials to conduct large-scale cryptocurrency mining.
  • The ‘GhostPoster’ campaign is distributing malicious Firefox extensions that hide JavaScript in addon logos to monitor activity and deploy backdoors, with over 50,000 downloads.
  • Cellik, a new Android malware-as-a-service (MaaS), is being marketed on underground forums with capabilities to embed in any app and build malicious versions from Google Play apps.
  • A phishing campaign targeting executives is using phony award offers to harvest credentials.
  • European law enforcement dismantled a Ukrainian call center fraud ring responsible for over €10 million in losses across Europe.

Trends, Tools, or Tactics of Interest

  • Ransomware groups are increasingly targeting hypervisors to encrypt multiple virtual machines simultaneously.
  • There is a surge in Android mobile adware and malware, particularly Triada and MobiDash, in late 2025.
  • Threat actors are increasingly exploiting third-party risks introduced by rapid adoption of open source and AI-powered coding assistants.
  • The majority of parked domains now serve malicious content, making direct navigation to such domains riskier.
  • Fortinet FortiGate vulnerabilities are being exploited within a week of public disclosure, indicating rapid weaponisation of new flaws.
  • AI-assisted coding platforms are accelerating software development, increasing the attack surface and third-party risks.
  • KnowBe4 released deepfake training modules to help organisations combat AI-driven threats.
  • Microsoft announced it will block Exchange Online access for mobile devices running outdated email software.
  • Amazon observed Russian state actors shifting tactics from exploiting vulnerabilities to abusing misconfigured infrastructure in critical sectors.

Regulatory or Policy Developments Affecting the Security Industry

  • The Texas Attorney General filed lawsuits against five major TV manufacturers, alleging illegal collection and sale of user viewing data without consent via Automated Content Recognition.
  • Afripol is intensifying regional cooperation to address cybercrime challenges amid rapid digitisation and increased cybercriminal activity in Africa.
  • Google announced it will discontinue its dark web monitoring report in early 2026.