Major Incidents or Breaches

  • Nike is investigating a potential security incident following claims by the WorldLeaks cybercrime group that they have stolen data from the company’s systems. The group is threatening to leak the purported information.
  • A multi-stage phishing campaign has been identified targeting Russian users with ransomware and the Amnesia RAT. The campaign uses social engineering lures and delivers multiple payloads to compromise victims.
  • A significant cyberattack targeting Poland’s power grid in late December 2025 has been attributed to the Russian state-sponsored group Sandworm. The attack involved the deployment of a new destructive wiper malware, DynoWiper, but was reportedly unsuccessful in causing disruption.

Newly Discovered Vulnerabilities

  • CISA has added CVE-2024-37079, a critical and actively exploited vulnerability in Broadcom VMware vCenter Server, to its Known Exploited Vulnerabilities (KEV) catalog. The flaw was patched in June 2024.
  • Microsoft released emergency out-of-band updates for Windows 10, Windows 11, and Windows Server to resolve an issue causing Microsoft Outlook Classic to freeze or fail to open when using PST files.

Notable Threat Actor Activity

  • The North Korean threat group Konni (also known as Opal Sleet or TA406) is targeting blockchain sector developers and engineers with AI-generated PowerShell malware.
  • The Russian Sandworm group is linked to the attempted, but ultimately unsuccessful, destructive wiper attack (DynoWiper) on Poland’s energy systems.
  • WorldLeaks, a cybercrime group, is claiming responsibility for the alleged breach at Nike and is threatening to leak stolen data.

Trends, Tools, or Tactics of Interest

  • AI-generated malware is increasingly being used by threat actors, as demonstrated by Konni’s deployment of AI-built PowerShell malware against blockchain engineers.
  • Multi-stage phishing campaigns are combining social engineering with the delivery of both ransomware and remote access trojans (RATs), as seen in the campaign targeting Russia.

Regulatory or Policy Developments Affecting the Security Industry

  • CISA’s inclusion of VMware vCenter Server CVE-2024-37079 in its KEV catalog highlights increased regulatory attention on patching actively exploited vulnerabilities in critical infrastructure.
  • The U.S. Department of Justice has admitted that DOGE may have misused Social Security data.
  • Microsoft has acknowledged providing BitLocker encryption keys to law enforcement agencies.
  • ICE is soliciting information from companies regarding the use of commercial ad tech and big data tools for law enforcement and investigative purposes.