Major Incidents or Breaches

  • Dutch telecommunications provider Odido disclosed a data breach impacting 6 million customers, with hackers stealing personal information including names, addresses, and phone numbers from a customer contact system.
  • South Korea fined luxury brands Louis Vuitton, Christian Dior Couture, and Tiffany a combined $25 million for failing to implement adequate security measures, which resulted in unauthorized access and data breaches.
  • Researchers identified malicious Google Chrome extensions stealing data associated with Meta Business Suite and Facebook Business Manager; a total of 30 credential-stealing Chrome extensions have been uncovered.
  • Threat actors are abusing Claude LLM artifacts and Google Ads in ClickFix campaigns to deliver infostealer malware to macOS users.
  • Fake online shops are targeting fans of the Winter Olympics 2026, with nearly 20 fraudulent sites identified selling counterfeit merchandise.

Newly Discovered Vulnerabilities

  • Researchers observed active exploitation of CVE-2026-1731, a critical unauthenticated remote code execution vulnerability (CVSS 9.9) affecting BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) products. Exploitation began within 24 hours of public PoC release.
  • CISA flagged a critical Microsoft Configuration Manager (SCCM) vulnerability, patched in October 2024, as being exploited in the wild.
  • Chrome version 145 patched 11 vulnerabilities, including three high-severity flaws.
  • CISA warned of active exploitation of vulnerabilities in SolarWinds and Notepad++ products, including a SolarWinds flaw likely exploited as a zero-day since December 2025.

Notable Threat Actor Activity

  • North Korean threat actors are targeting software developers, particularly those with JavaScript and Python skills, using fake job recruiter campaigns. These campaigns employ social engineering and malicious coding challenges, often related to cryptocurrency, to deliver malware.
  • Google Threat Intelligence Group attributed malware attacks using the CANFAIL family to a previously undocumented Russian threat actor, targeting Ukrainian organizations.
  • Several state-sponsored actors from China, Iran, Russia, and North Korea are conducting coordinated cyber operations against the defense industrial base sector. Espionage groups have exploited at least two dozen zero-days in edge devices to infiltrate defense contractors.
  • A previously unknown threat actor, tracked as UAT-9921, is using a new modular malware framework called VoidLink to target technology and financial services sectors.

Trends, Tools, or Tactics of Interest

  • Threat actors are exploiting Windows drivers to carry out BYOVD (Bring Your Own Vulnerable Driver) attacks, terminating security processes in targeted networks.
  • AI agents are increasingly being deployed in coordinated, autonomous “swarms,” amplifying organizational attack surfaces and security complexity.
  • Integration of external IP-based threat intelligence (e.g., Criminal IP) into SIEM and SOAR platforms like IBM QRadar is enhancing automated detection and response workflows.
  • Threat actors are leveraging widely used platforms (such as Google Ads and Chrome extensions) for malware delivery and credential theft.
  • npm completed a major authentication overhaul in December 2025 to harden its supply chain in response to previous incidents.

Regulatory or Policy Developments Affecting the Security Industry

  • CISA announced new town halls to engage stakeholders on cyber incident reporting requirements for critical infrastructure.
  • Check Point acquired three Israeli cybersecurity firms-Cyata, Cyclops, and Rotate-reflecting ongoing consolidation in the cybersecurity sector.
  • South Korean regulatory action against major luxury brands for data protection failures underscores increased enforcement of data security obligations.
  • The US government (CISA) has issued new directives for federal agencies to secure systems against actively exploited vulnerabilities, including those in Microsoft Configuration Manager.