Major Incidents or Breaches

  • Spain’s Ministry of Science has partially shut down IT systems following breach claims, disrupting several citizen- and company-facing services.
  • Rome’s La Sapienza University suffered a cyberattack causing widespread operational disruptions.
  • Romanian oil pipeline operator Conpet disclosed a cyberattack that disrupted business systems and took down its website; the Qilin ransomware group is reportedly involved.
  • Newsletter platform Substack notified users of a data breach after attackers stole email addresses and phone numbers (approx. 700,000 records) in October 2025.
  • Fintech firm Betterment reported a breach exposing email addresses and personal information of 1.4 million accounts in January.
  • Zendesk users experienced a renewed spam wave, with inboxes flooded by “Activate account” emails due to abuse of unsecured support systems.
  • SystemBC malware remains active post law enforcement takedown, infecting over 10,000 devices and continuing to deliver ransomware and proxy traffic.
  • VS Code configuration files in GitHub Codespaces were found to automatically execute when opening repositories or pull requests, exposing users to potential attacks.

Newly Discovered Vulnerabilities

  • Anthropic’s Claude Opus 4.6 LLM identified over 500 previously unknown high-severity security flaws across major open-source libraries.
  • A critical sandbox escape vulnerability in the n8n workflow automation tool could enable arbitrary command execution and credential theft.
  • Researchers highlighted that VS Code-integrated configuration files can be abused in GitHub Codespaces to achieve remote code execution.
  • The EnCase forensic tool driver, signed with an expired digital certificate, is being weaponised for EDR evasion due to Windows security gaps.

Notable Threat Actor Activity

  • The Stan Ghouls campaign is targeting organisations in Russia and Uzbekistan using Java-based loaders and NetSupport RAT, with indications of IoT interest.
  • Infy (aka Prince of Persia), an Iranian threat group, resumed operations with new C2 infrastructure after the end of the Iran internet blackout and has evolved its operational security tactics.
  • A previously identified cyberspy group, likely China-linked, has compromised governments and critical infrastructure in 37 countries.
  • Italy reportedly thwarted Russian-linked cyberattacks against Winter Olympics websites and foreign ministry offices.
  • The DEAD#VAX campaign is distributing AsyncRAT by disguising malicious virtual hard disks as PDF attachments.
  • Ransomware operators are abusing ISPsystem virtual machines to host and deliver payloads at scale.
  • The AISURU/Kimwolf botnet launched a record-setting 31.4 Tbps DDoS attack lasting 35 seconds.

Trends, Tools, or Tactics of Interest

  • Proof-of-concept attacks demonstrate that large language models (LLMs) can be used to generate phishing pages and malicious JavaScript in real time.
  • Phishing-as-a-service (PhaaS) platforms are increasingly central to the cybercriminal economy, enabling actors of all skill levels to conduct advanced phishing campaigns.
  • AI-powered scams are industrialising website cloning, with one network creating over 150 cloned law firm websites and using Cloudflare and IP rotation for evasion.
  • Attackers are leveraging malicious scripts, such as Chrome injectors, to steal browser data.
  • BYOVD (Bring Your Own Vulnerable Driver) techniques persist, with threat actors weaponising legitimate drivers for EDR bypass.
  • Cloud log limitations are creating monitoring blind spots; network-level telemetry is highlighted as a more reliable visibility source.
  • Abuse of unsecured customer support systems (e.g., Zendesk) continues to facilitate spam and phishing campaigns.
  • AI-generated web platforms (e.g., Moltbook) have been found exposing sensitive data via insecure APIs.

Regulatory or Policy Developments Affecting the Security Industry

  • Microsoft announced the deprecation of Exchange Web Services (EWS) API for Exchange Online, effective April 2027.
  • Concerns have been raised regarding CISA’s silent updates to the Known Exploited Vulnerabilities (KEV) catalog, particularly relating to ransomware-exploited vulnerabilities.
  • Flock Safety’s ALPR cameras were found to have shared license plate data with hundreds of agencies without permission, prompting a California city to shut down its system.
  • Zscaler has acquired browser security firm SquareX, aiming to embed lightweight security extensions across browsers.