Major Incidents or Breaches

  • Target Corporation: Hackers claim to have stolen and are selling internal source code from Target, with samples published online. Target’s development server has been taken offline.
  • University of Hawaii Cancer Center: Ransomware attack in August 2025 resulted in theft of participant data, including documents with Social Security numbers dating back to the 1990s.
  • Endesa (Spanish Energy Provider): Data breach disclosed, with hackers accessing customer contract-related information, including personal details.
  • BreachForums: The notorious cybercriminal forum was breached, exposing data on 324,000 administrators and members.
  • Manage My Health (New Zealand): Identified as a top breach in recent threat intelligence reporting, affecting patient portals and healthcare data.
  • Instagram: Data leak incident where user data appeared on the dark web, coinciding with a password reset vulnerability (see below).
  • Apex Legends: Live matches disrupted as threat actors hijacked player characters, disconnected users, and changed nicknames.

Newly Discovered Vulnerabilities

  • n8n Workflow Automation Platform:
    • “Ni8mare” vulnerability impacts nearly 60,000 online instances; maximum-severity flaw remains largely unpatched.
    • Supply chain attack observed, with malicious npm packages masquerading as integrations to steal OAuth credentials from developers.
  • Gogs (Git Service): High-severity remote code execution (RCE) flaw exploited in zero-day attacks. CISA has ordered US federal agencies to patch.
  • Instagram: Password reset vulnerability allowed third parties to send reset emails to users, contributing to a recent data leak.
  • Telegram: Hidden proxy links can expose user IP addresses with a single click due to how proxy links are handled. Telegram has announced plans for a fix.

Notable Threat Actor Activity

  • GoBruteforcer Botnet: New campaigns target over 50,000 Linux servers, especially those supporting cryptocurrency and blockchain projects, exploiting weak credentials and AI-generated configurations.
  • APT28 (Russia): Targeting energy research and defense collaboration entities by impersonating webmail and VPN portals (Microsoft OWA, Google, Sophos VPN).
  • Kimsuky (North Korea): FBI flagged QR-code phishing (“quishing”) campaigns targeting US and foreign government agencies, NGOs, and academia.
  • LLM/AI Service Exploitation: Multiple campaigns targeting exposed large language model (LLM) endpoints and misconfigured proxy servers to access sensitive APIs and data.
  • VoidLink Malware: Discovery of a stealthy, cloud-native Linux malware framework, attributed to a Chinese threat cluster, designed for persistence and evasion in cloud environments.
  • Facebook Credential Theft: Increased use of “browser-in-the-browser” (BitB) phishing techniques to steal Facebook login credentials over the past six months.

Trends, Tools, or Tactics of Interest

  • Supply Chain Attacks: Growing use of malicious npm packages for credential theft, specifically targeting workflow automation platforms.
  • Botnet Evolution: GoBruteforcer botnet demonstrates ongoing adaptation, now preying on servers with weak or AI-generated credentials.
  • AI and LLM Security: Surge in attacks against exposed LLM endpoints and APIs, highlighting expanding attack surfaces in organizations’ AI deployments.
  • Phishing Techniques: Rise in “quishing” (QR-code phishing) and “browser-in-the-browser” attacks, increasing the sophistication of credential theft campaigns.
  • Healthcare AI Adoption: Anthropic launched Claude AI for healthcare, introducing HIPAA-ready tools for providers and payers, reflecting broader AI integration in sensitive sectors.
  • Endpoint Security Expansion: Hexnode announced entry into endpoint security with its new XDR (Extended Detection and Response) platform.

Regulatory or Policy Developments Affecting the Security Industry

  • CISA Directive: US federal agencies ordered to patch Gogs RCE vulnerability exploited in active attacks.
  • EU Regulatory Review: The European Union set a February deadline for its verdict on Google’s $32B acquisition of Wiz, following US approval.
  • Deepfake Regulation: Global regulators are scrutinizing Grok, an AI tool, over its role in generating illegal sexual deepfake content, including child sexual abuse material.
  • Privacy and Cybersecurity Law Complexity: Ongoing analysis indicates compliance challenges will persist into 2026, with limited progress on comprehensive federal cybersecurity legislation.