Major Incidents or Breaches

  • TriZetto Provider Solutions, part of Cognizant, suffered a data breach exposing sensitive health information of 3.4 million patients.
  • The FBI is investigating a breach affecting systems used to manage surveillance and wiretap warrants, with the scope and impact under assessment.
  • Transport for London experienced a data breach impacting 10 million users.
  • Iranian APT actors have compromised networks of US organizations, including an airport, a bank, and a software company, with activity observed since February.
  • Cyberattackers reportedly gained access to Mexican government agencies and citizens’ data using AI tools and detailed playbook prompts.
  • A Ghanaian national pleaded guilty to participating in a $100 million fraud ring leveraging business email compromise and romance scams.

Newly Discovered Vulnerabilities

  • CISA added three iOS vulnerabilities exploited in cyberespionage and crypto-theft attacks (via the Coruna exploit kit) to its Known Exploited Vulnerabilities list, affecting iOS versions 13 to 17.2.1. US federal agencies have been ordered to patch.
  • A Rockwell Automation ICS vulnerability, disclosed and mitigated in 2021, is now being actively exploited in the wild, allowing remote attacks on industrial control systems.
  • Avira antivirus vulnerabilities have been disclosed.

Notable Threat Actor Activity

  • The Pakistan-aligned APT group Transparent Tribe is using AI-powered coding tools to mass-produce malware implants in campaigns targeting India.
  • Iran-linked MuddyWater hackers deployed a new “Dindoor” backdoor in attacks against US companies, including banks, airports, and software firms.
  • Chinese APT actors targeted South American telecommunications infrastructure using TernDoor, PeerTime, and BruteEntry malware, affecting both Windows and Linux systems as well as edge devices.
  • North Korean APTs are employing AI tools to enhance IT worker scams, including face-swapping and automating communications.
  • Multi-stage VOID#GEIST malware campaigns are delivering XWorm, AsyncRAT, and Xeno RAT through batch scripts and encrypted payloads.
  • Fake calendar invitation campaigns have expanded from Gmail to Microsoft Outlook, increasing the attack surface for social engineering.
  • Threat actors are using a new InstallFix social engineering technique to distribute infostealers under the guise of legitimate installation guides, including fake Claude Code install guides.
  • Fake Google Meet update prompts are enrolling victims’ Windows PCs into attackers’ device management systems.
  • Bing search results have been manipulated to direct users to malicious GitHub repositories distributing fake OpenClaw installers.
  • A fake CleanMyMac website is distributing SHub Stealer, a macOS infostealer that steals credentials and backdoors crypto wallets.
  • Hundreds of attempts by Iranian state hackers to hijack consumer-grade security cameras have been observed, often timed to coincide with missile and drone strikes.

Trends, Tools, or Tactics of Interest

  • Increased use of AI by threat actors for malware development, phishing, and social engineering, including the use of large language models (LLMs) and playbook prompts for attack orchestration.
  • The use of C2 frameworks in APT attacks continues to be a significant trend, as highlighted in Q4 2025 exploit and vulnerability research.
  • Email weaponization remains a prevalent attack vector, with a wide array of tools enabling non-technical attackers to conduct sophisticated campaigns.
  • Data loss incidents are frequently attributed to human errors rather than technical failures, emphasizing the ongoing risk of insider threats and accidental disclosures.
  • Hacking of IP and consumer-grade security cameras is now a regular tactic in both state-sponsored cyber operations and hybrid warfare scenarios.
  • Social engineering attacks are increasingly leveraging fake software update prompts and manipulated search results to distribute malware.

Regulatory or Policy Developments Affecting the Security Industry

  • The European Union is introducing new cybersecurity standards for the automotive industry, with a focus on addressing risks from both climate change and cyber threats.
  • CISA has mandated urgent patching of iOS vulnerabilities for US federal agencies due to active exploitation.
  • The EC-Council launched an expanded Enterprise AI Credential Suite to bolster AI workforce readiness and security in the US.
  • James ‘Aaron’ Bishop has been appointed as the new Pentagon CISO, succeeding David McKeown.