Major Incidents or Breaches

  • Nissan confirmed that thousands of customer records were compromised due to the Red Hat data breach in September.
  • The University of Phoenix disclosed a data breach impacting nearly 3.5 million students, staff, and suppliers, attributed to the Clop ransomware group.
  • Coupang, a major e-commerce company, reported a data breach affecting 33.7 million users, with unauthorized access to personal data persisting for almost five months.
  • The Romanian National Water Authority (Administrația Națională Apele Române) suffered a ransomware attack over the weekend.
  • France’s national postal service and associated banking operations experienced significant disruption from a cyberattack, impacting package deliveries and online payments during the Christmas period.
  • Pornhub warned users of potential sextortion emails following a data exposure incident.
  • The UK government acknowledged an ongoing investigation into a cyber incident after reports that hackers linked to China accessed thousands of confidential documents.

Newly Discovered Vulnerabilities

  • Over 115,000 WatchGuard Firebox firewall devices remain unpatched and exposed to a critical remote code execution (RCE) vulnerability in the Fireware OS’s iked process, which is being actively exploited in the wild. WatchGuard has released a patch.
  • A new phishing kit, “BlackForce,” was identified leveraging Man-in-the-Browser (MitB) techniques to steal credentials and bypass multi-factor authentication (MFA).
  • A malicious npm package masquerading as a WhatsApp API was discovered, capable of intercepting messages, collecting contacts, and stealing login tokens.
  • The latest variant of the MacSync information stealer for macOS is being distributed via a digitally signed, notarized Swift application, allowing it to evade Gatekeeper checks and eliminating the need for user terminal interaction.

Notable Threat Actor Activity

  • The Clop ransomware group was responsible for the University of Phoenix breach, continuing its campaign against large organizations.
  • A Ukrainian national pleaded guilty in the US to conspiracy to commit computer fraud as an affiliate of the Nefilim ransomware gang, targeting high-revenue businesses internationally.
  • An Interpol-led operation (Operation Sentinel) resulted in 574 arrests and the recovery of $3 million related to business email compromise, extortion, and ransomware, and enabled the decryption of six ransomware strains.
  • ATM attacks using Ploutus malware led to charges against 54 individuals, including members of the Tren de Aragua crime syndicate.
  • Android SMS stealer malware is actively targeting Telegram users in Uzbekistan, with attackers refining their methods.

Trends, Tools, or Tactics of Interest

  • Attackers are increasingly targeting trusted edge devices, including firewalls and browser add-ons, to achieve significant impact without large-scale attacks.
  • The use of notarized, signed applications to bypass macOS security controls is on the rise, as demonstrated by the MacSync malware.
  • Phishing kits, such as BlackForce, are adopting advanced MitB tactics to defeat MFA protections.
  • Malicious npm packages continue to pose supply chain risks, as seen with the fake WhatsApp API library.

Regulatory or Policy Developments

  • The US Federal Communications Commission (FCC) announced a ban on all drones and critical components manufactured in foreign countries, citing national security concerns.