Major Incidents or Breaches

  • The Polish energy grid suffered a coordinated cyberattack in December 2025, impacting around 30 distributed energy resource sites, including combined heat and power facilities and wind farms. The incident has been attributed to the Russian state-sponsored group ELECTRUM.
  • eScan antivirus vendor MicroWorld Technologies confirmed its update server was breached and used to distribute a malicious update.
  • The FBI seized the RAMP cybercrime forum, a major platform for ransomware gangs and malware advertisements.
  • Google, in collaboration with partners, disrupted IPIDEA, one of the world’s largest residential proxy networks.
  • A malicious campaign, dubbed “Bizarre Bazaar,” is actively targeting exposed Large Language Model (LLM) service endpoints to commercialise unauthorised access to AI infrastructure.
  • Researchers found 16 malicious Chrome extensions capable of hijacking ChatGPT sessions and exfiltrating user data.
  • Two malicious Python packages masquerading as spellcheckers were discovered on PyPI, delivering remote access trojans.

Newly Discovered Vulnerabilities

  • Two high-severity vulnerabilities were disclosed in the n8n workflow automation platform, allowing authenticated remote code execution and potential compromise of affected instances.
  • A critical sandbox escape vulnerability was identified in the vm2 Node.js library, enabling arbitrary code execution on the host system.
  • SolarWinds released patches for critical vulnerabilities in its Web Help Desk software, addressing authentication bypass and remote command execution issues.
  • Fortinet patched a zero-day (CVE-2026-24858) in FortiCloud SSO authentication, which allowed attackers to log into devices registered to other accounts; the company temporarily disabled SSO authentication to mitigate ongoing attacks.
  • Oracle WebLogic vulnerability CVE-2026-21962 has been recently patched, with evidence of exploit attempts being observed.

Notable Threat Actor Activity

  • Russian state-sponsored group ELECTRUM was attributed with medium confidence to the December 2025 cyberattack on Poland’s power grid.
  • Chinese-linked Mustang Panda deployed an updated COOLCLIENT backdoor in cyber espionage attacks against government entities, facilitating extensive data theft.
  • China-backed threat actor “PeckBirdy” used the JScript C2 framework in cross-platform campaigns targeting Chinese gambling websites and Asian government entities with new backdoors.
  • Multiple threat actors, including Russian and Chinese state-sponsored groups, are actively exploiting the WinRAR vulnerability CVE-2025-8088 for initial access and data theft, despite the availability of a patch since July 2025.
  • Initial access broker TA584 is now leveraging the Tsundere Bot and XWorm RAT to gain network access, leading to ransomware attacks.
  • Fake dating apps are being used as lures in Android spyware campaigns in Pakistan, linked to broader espionage operations.

Trends, Tools, or Tactics of Interest

  • A surge in attacks targeting Latin America, including data-leak extortion, credential theft, edge-device exploitation, and attacker adoption of AI-driven tactics, has made it the riskiest region for cyberattacks.
  • Threat actors are increasingly exploiting exposed AI/LLM endpoints and insecure deployments, leading to unauthorised access and data leakage in enterprise environments.
  • Malicious VS Code extensions (e.g., fake Moltbot) are being distributed via the official marketplace, dropping malware and exposing sensitive data such as API keys and OAuth tokens.
  • Password reuse and risky credential workarounds remain prevalent attack vectors, often overlooked by security teams.
  • AI-driven security operations (AI SOC agents) are accelerating triage and threat hunting, but concerns remain about over-reliance on automation.
  • Malicious browser extensions continue to target high-profile services like ChatGPT to exfiltrate user data.

Regulatory or Policy Developments Affecting the Security Industry

  • WhatsApp has rolled out new lockdown-style security features, including Strict Account Settings, to protect high-risk users (journalists, public figures) from advanced exploits and spyware. These features block risky attachments, media, and calls from unknown sources.
  • AI is increasingly being used for compliance controls and regulated actions, prompting CISOs to reconsider identity, access, and auditability frameworks.
  • ICE in the US is using Palantir’s AI tools to process and summarise tips, highlighting increased adoption of AI in law enforcement and government operations.