Major Incidents or Breaches

  • Chinese threat actors have conducted a years-long campaign targeting critical infrastructure in South, Southeast, and East Asia. The campaign, which includes sectors such as aviation and energy, leveraged web server exploits and post-exploitation tools like Mimikatz for credential theft.

Newly Discovered Vulnerabilities

  • The Cisco Catalyst SD-WAN vulnerability (CVE-2026-20127) is now being widely exploited in the wild, with WatchTowr observing exploitation attempts from numerous unique IP addresses.
  • DumpBrowserSecrets, a new tool, can harvest browser credentials, cookies, OAuth tokens, and autofill data from multiple browsers (Chrome, Edge, Firefox, Opera, Vivaldi) by bypassing App-Bound Encryption through Early Bird APC injection.

Notable Threat Actor Activity

  • Threat actors are abusing the “.arpa” DNS domain and IPv6 reverse DNS in phishing campaigns. This tactic enables phishing emails to evade domain reputation checks and email security gateways more effectively.

Trends, Tools, or Tactics of Interest

  • The rise of AI-based assistants or autonomous “agents” is shifting the security landscape. These agents, capable of accessing user computers, files, and online services, are being increasingly adopted by developers, raising new security considerations.

Regulatory or Policy Developments Affecting the Security Industry

  • An Advocate General of the Court of Justice of the EU has issued a formal opinion that banks must immediately refund customers affected by unauthorized transactions resulting from phishing attacks. This opinion, if adopted by the court, could significantly impact banking liability and customer protection across the EU.