Major Incidents or Breaches

  • Kyowon Group, a major South Korean conglomerate, confirmed a ransomware attack resulting in operational disruption and potential exposure of customer data.
  • Cloud marketplace Pax8 inadvertently exposed internal business information, including MSP customer data, to fewer than 40 UK-based partners via email.
  • Robo-advisor Betterment disclosed a breach where a threat actor accessed customer information and sent scam crypto-related messages.
  • Free Mobile and its parent company, Free, were fined €42 million by the French CNIL for inadequate protection of customer data related to a 2024 breach.

Newly Discovered Vulnerabilities

  • Fortinet patched a critical unauthenticated remote code execution vulnerability in FortiSIEM. Public exploit code and technical details for this flaw have been released.
  • Additional critical vulnerabilities in Fortinet products, including FortiFone, were disclosed and patched, with risks of configuration leaks and code execution.
  • Chrome 144 and Firefox 147 released patches for high-severity vulnerabilities, addressing 26 security defects including code execution risks.
  • Microsoft’s January 2026 Patch Tuesday addressed 114 Windows vulnerabilities, including one actively exploited in the wild.
  • A DLL side-loading vulnerability in the open-source c-ares library is being actively exploited to bypass security controls and deploy malware.

Notable Threat Actor Activity

  • Microsoft and law enforcement disrupted the RedVDS cybercrime-as-a-service platform, which facilitated phishing, BEC, account takeover, and fraud, and was linked to over $40 million in losses.
  • Researchers null-routed over 550 command-and-control servers associated with the AISURU/Kimwolf botnet, which had infected over two million devices since October 2025.
  • A major phishing campaign abused Google’s infrastructure, targeting over 3,000 organizations (primarily in manufacturing) to bypass email security defenses.
  • Magecart skimming attacks are targeting online checkouts using major payment networks such as AmEx, Diners Club, and Mastercard.
  • The newly emerged Sicarii Ransomware-as-a-Service operation began advertising across underground forums in December 2025.
  • Predator spyware has been found to use failed attacks for intelligence gathering to improve future exploit attempts.
  • Fake “account restricted” comments are being posted on LinkedIn as part of phishing campaigns to steal user credentials.

Trends, Tools, or Tactics of Interest

  • Microsoft was the most impersonated brand in phishing attacks during Q4 2025, followed by Facebook, Roblox, McAfee, and Steam.
  • OAuth phishing attacks using the ConsentFix technique are evolving, with attackers hijacking Microsoft accounts via browser-based authorization flows.
  • The “Reprompt” attack technique allowed hijacking of Microsoft Copilot sessions for sensitive data exfiltration.
  • AI agents are increasingly being integrated into core workflows, raising concerns about privilege escalation pathways.
  • 64% of third-party applications on leading websites now access sensitive data without business justification, up from 51% in 2024.
  • Attackers are leveraging legitimate open-source software downloads to conceal remote backdoors.
  • The “VoidLink” modular malware framework is targeting Linux systems, designed for stealthy, long-term access in cloud-first environments.
  • Infection campaigns are repeatedly adding scheduled tasks and increasing communication with persistent C2 domains.

Regulatory or Policy Developments

  • The French CNIL imposed a €42 million fine on Free Mobile and Free for failing to adequately protect customer data in a 2024 breach incident.
  • An investor lawsuit related to the CrowdStrike outage was dismissed due to lack of evidence of investor fraud.