Major Incidents or Breaches

  • Notepad++ Supply Chain Attack:

    • Chinese state-sponsored group “Lotus Blossom” compromised the Notepad++ hosting provider for approximately six months.
    • Attackers hijacked the official update mechanism, redirecting select users to malicious servers and distributing trojanised updates.
    • The campaign was highly targeted and attributed to Chinese state interests with medium confidence.

  • NationStates Data Breach:

    • The multiplayer browser-based game NationStates confirmed a data breach and temporarily shut down its website to investigate the incident.

  • Panera Bread Data Breach:

    • The data breach at Panera Bread impacted 5.1 million accounts, as confirmed by Have I Been Pwned.

  • MongoDB Database Compromise:

    • Over 1,400 out of 3,100 unprotected MongoDB instances were compromised, with most attributed to a single threat actor.

  • Polish Energy Sector ICS Attack:

    • Attackers exploited default credentials to gain access to industrial control systems (ICS) at Polish energy facilities, resulting in destructive impacts.

Newly Discovered Vulnerabilities

  • OpenClaw (MoltBot/Clawdbot) Remote Code Execution:

    • A high-severity bug in OpenClaw allows one-click remote code execution via malicious links.
    • Hundreds of malicious skills/packages exploiting this and related issues have been published on the official OpenClaw registry and GitHub.

  • Microsoft Office CVE-2026-21509:

    • Russian threat actors are actively exploiting a recently patched Microsoft Office vulnerability (CVE-2026-21509) in ongoing attacks, particularly targeting Ukraine.

  • Windows Shutdown Bug:

    • Microsoft confirmed a shutdown bug affecting Windows 10 and 11 systems with Virtual Secure Mode (VSM) enabled, expanding the known impact of the issue.

Notable Threat Actor Activity

  • GlassWorm Malware Campaign:

    • GlassWorm is distributing malware via compromised OpenVSX publisher accounts, including malicious versions of established Visual Studio Code extensions.
    • The campaign is targeting macOS systems to steal passwords, cryptocurrency wallets, and developer credentials.

  • ShinyHunters SaaS Extortion:

    • The ShinyHunters cybercrime group has expanded its SaaS extortion operations, targeting a broader range of cloud platforms and increasing the aggressiveness of its tactics.
    • Techniques include vishing, login harvesting, and compromising SSO credentials for unauthorised MFA enrollment.

  • Phishing Campaigns:

    • Attackers are using fake PDF lures to harvest Dropbox credentials from corporate users in a malware-free phishing campaign.
    • Fake party invitations are being used to distribute remote access tools.

  • Winter Olympics Scams:

    • Ongoing scams and cyberthreats are targeting individuals and organisations related to the Winter Olympics, leveraging the event for phishing and fraud.

Trends, Tools, or Tactics of Interest

  • Malicious AI Assistant Skills:

    • Researchers identified 341 malicious ClawHub/OpenClaw skills in supply chain attacks, exposing users to credential theft and malware.

  • Supply Chain Attacks via Software Update Mechanisms:

    • The Notepad++ incident highlights continued targeting of supply chains, particularly software update channels, by state-sponsored actors.

  • Ransom and Extortion Tactics:

    • Increased use of aggressive extortion tactics by groups like ShinyHunters, including targeting SaaS platforms and leveraging SSO/MFA weaknesses.

  • Unprotected Database Exploitation:

    • Mass exploitation of exposed MongoDB instances continues to be a significant risk, with attackers automating discovery and compromise of unsecured databases.

  • Increased Use of Social Engineering:

    • Social media and fake investment platforms are being used at scale to propagate high-yield investment scams (HYIP), often using recycled templates and aggressive outreach.

  • Manifest v3 Impact on Security Tools:

    • Security vendors are adapting browser extensions (e.g., Browser Guard) to comply with Chrome’s Manifest v3, requiring significant architectural changes.

Regulatory or Policy Developments

  • Microsoft NTLM Phase-Out:

    • Microsoft announced a three-stage plan to phase out NTLM authentication in favour of Kerberos, with future Windows Server and Windows releases disabling NTLM by default.

  • Japan-UK Cybersecurity Cooperation:

    • Japan and Britain have agreed to accelerate cooperation on cybersecurity and critical mineral supply chains amid concerns over China’s regional influence.

  • Mozilla Firefox AI Controls:

    • Mozilla introduced new settings in Firefox to allow users to disable all generative AI features with a single click, responding to privacy and security concerns.

  • Penetration Testing Legal Risks:

    • An Iowa county paid $600,000 in damages to penetration testers who were wrongfully jailed during a red teaming exercise, highlighting legal risks for security professionals.