Major Incidents or Breaches

  • The Canadian Investment Regulatory Organization (CIRO) suffered a data breach impacting 750,000 individuals, exposing personal information of member firms and their registered employees.
  • Five malicious Chrome browser extensions impersonating HR and ERP platforms such as Workday and NetSuite were discovered hijacking user accounts.
  • Verizon experienced a nationwide wireless outage last week and is now issuing $20 credits to affected customers.
  • Researchers hijacked StealC malware control panels via an XSS flaw, gaining intelligence on the info-stealing operation and active attacker sessions.

Newly Discovered Vulnerabilities

  • A critical command injection vulnerability (CVE-2025-64155) in Fortinet FortiSIEM is actively exploited in the wild. Public proof-of-concept code is available, and attacks from multiple IP addresses have been observed.
  • Cisco fixed a maximum-severity AsyncOS zero-day in Secure Email Gateway appliances that had been exploited since November 2025.
  • A critical vulnerability in Bluetooth audio accessories, dubbed “WhisperPair,” allows attackers to hijack, track, and eavesdrop on millions of devices using improper Google Fast Pair implementations.
  • Microsoft confirmed that the January Windows 11 update (KB5074109) causes Outlook to freeze for POP users and prevents some Windows 11 23H2 devices with System Guard Secure Launch enabled from shutting down.

Notable Threat Actor Activity

  • China-linked threat actor UAT-8837 exploited a Sitecore zero-day and other known vulnerabilities to target critical infrastructure in North America.
  • Chinese group UAT-9686 exploited a Cisco vulnerability to deploy the AquaShell backdoor on internet-exposed Cisco appliances.
  • The Black Basta ransomware gang leader’s identity has been confirmed by law enforcement in Ukraine and Germany, and the individual has been added to Europol and Interpol’s wanted lists.
  • A new campaign targeting U.S. government and policy entities used Venezuela-themed spear phishing to deliver the LOTUSLITE backdoor.
  • Russian threat actors reportedly targeted the Polish power grid, as noted in industry roundups.

Trends, Tools, or Tactics of Interest

  • GootLoader malware now uses malformed ZIP archives concatenating 500–1,000 ZIP files to evade detection.
  • Social engineering attacks are increasingly leveraging AI to enhance effectiveness.
  • The BodySnatcher agentic AI hijacking technique, Telegram IP exposure, and researcher-led attacks on shipping systems were noted as emerging security concerns.
  • Pacific Northwest National Labs introduced ALOHA, an AI system that reduces attack reconstruction time from weeks to hours.
  • Dutch police conducted an operation selling fake event tickets to demonstrate the prevalence and effectiveness of online scams.

Regulatory or Policy Developments Affecting the Security Industry

  • CISOs are increasingly joining executive suites, driven by heightened regulatory and compliance standards.
  • Reports indicate China is instituting a software ban, with all top 20 domestic cybersecurity firms working with the government.
  • Former CISA Director Jen Easterly has been appointed CEO of the RSA Conference (RSAC).
  • Project Eleven raised $20 million to develop post-quantum security infrastructure, and Monnai secured $12 million for identity and risk data solutions.