Major Incidents or Breaches

  • Under Armour suffered a ransomware breach resulting in the alleged exposure of data belonging to 72 million customers. The stolen data is reported to be circulating on the dark web.
  • Fortinet FortiGate devices are being actively targeted and compromised in automated attacks. Threat actors are creating rogue accounts and stealing firewall configuration data, with reports of malicious configuration changes even on fully patched devices.
  • A major food service franchisee operator in Southeast Asia was targeted by the new Osiris ransomware family in November 2025, leveraging a Bring Your Own Vulnerable Driver (BYOVD) attack using the POORTRY driver.
  • SmarterTools SmarterMail email servers are being actively exploited via an authentication bypass vulnerability. Attackers are hijacking admin accounts and resetting passwords, with exploitation observed within two days of patch release.
  • Researchers were able to recover stolen data from 12 U.S. organizations impacted by INC ransomware due to an operational security failure by the threat actors.
  • Okta SSO accounts are being targeted in active vishing-based data theft attacks, with attackers employing custom phishing kits tailored for voice-based social engineering.

Newly Discovered Vulnerabilities

  • A critical vulnerability (CVE-2026-24061, CVSS 9.8) was disclosed in GNU InetUtils telnetd, allowing attackers to bypass login and gain root access. The flaw was present for nearly 11 years.
  • Atlassian, GitLab, and Zoom released security patches addressing over two dozen vulnerabilities, including several critical- and high-severity issues.
  • Cisco released patches for a critical zero-day vulnerability (CVE-2026-20045) in Cisco Unified CM, which could allow unauthenticated remote code execution and is under active exploitation.
  • A new authentication bypass flaw in SmarterMail is being exploited in the wild to hijack administrator accounts.
  • At Pwn2Own Automotive 2026, researchers exploited 29 zero-day vulnerabilities across automotive technologies in a single day.

Notable Threat Actor Activity

  • North Korean-linked threat actor KONNI is conducting a phishing campaign targeting developers, using AI-generated PowerShell backdoors.
  • DPRK actors are deploying spear-phishing campaigns that utilise VS Code Tunnels and trusted Microsoft infrastructure to facilitate remote hacking while evading detection.
  • A widespread phishing campaign is targeting LinkedIn users via automated comments posted by bots impersonating LinkedIn personnel.
  • A malicious PyPI package impersonating the SymPy library was discovered deploying XMRig cryptominer on Linux hosts.
  • Fake LastPass maintenance phishing emails are targeting users, urging them to back up their vaults within 24 hours.
  • Threat actors are using trusted Remote Monitoring and Management (RMM) tools as backdoors, as observed in a dual-vector campaign exploiting legitimate RMM software for persistent access.

Trends, Tools, or Tactics of Interest

  • Attackers are increasingly exploiting trusted and familiar systems, such as RMM tools, VS Code Tunnels, and routine services, to gain and maintain access.
  • Social engineering tactics are evolving, with a rise in vishing attacks targeting Okta SSO and phishing campaigns leveraging LinkedIn comments.
  • The use of AI is expanding in both attack and defence: threat actors are using AI to generate malware, while defenders are integrating AI-driven detection into security products.
  • Old attack techniques, such as Linux page cache exploits, are being optimised for greater speed and efficiency by researchers.
  • The abuse of software supply chains continues, with malicious packages on PyPI and impersonation of popular libraries.
  • Microsoft Teams will introduce brand impersonation warnings to help detect social engineering attempts during calls.

Regulatory or Policy Developments Affecting the Security Industry

  • The EU AI Act introduces a legal requirement for AI literacy training, shifting best practice into a compliance mandate for organisations operating in or with the EU.
  • The developer of the curl project is ending its bug bounty programme on HackerOne due to a high volume of low-quality, AI-generated vulnerability reports.
  • Increased scrutiny in Europe regarding overreliance on US cybersecurity technology providers, with ongoing policy discussions about technology sovereignty and supply chain risks.
  • The Australian government is reviewing the cybersecurity risks of Chinese-made electric buses, which have been found to contain vulnerabilities and a potential remote “kill switch.”