Major Incidents or Breaches

  • Aura, an identity protection company, confirmed a data breach exposing nearly 900,000 marketing contacts, including names and email addresses.
  • Marquis, a Texas-based financial services provider, disclosed that a ransomware attack in August 2025 led to the theft of data belonging to 672,000 individuals and operational disruption.
  • Nordstrom’s email system was abused to send cryptocurrency scam emails to customers from a legitimate company address.
  • Stryker, a medtech company, continues recovery efforts following a cyberattack attributed to the Iranian-linked Handala group, likely using malware-stolen credentials.

Newly Discovered Vulnerabilities

  • Cisco Secure Firewall Management Center (FMC): CVE-2026-20131, a critical zero-day vulnerability, is being actively exploited by the Interlock ransomware group for remote code execution and root access.
  • GNU InetUtils telnetd: CVE-2026-32746, a critical unpatched flaw, allows unauthenticated remote attackers to execute arbitrary code as root.
  • Ubuntu Desktop: CVE-2026-3888, a high-severity vulnerability in default installations (24.04+), allows privilege escalation to root via a systemd cleanup timing exploit.
  • ConnectWise ScreenConnect: A cryptographic signature verification vulnerability has been patched, which could have allowed unauthorized access and privilege escalation.
  • Zimbra Collaboration Suite: An XSS vulnerability is being actively exploited; CISA has ordered urgent patching. Microsoft SharePoint is also under active exploitation for a separate flaw.
  • Claude AI: A trio of vulnerabilities, including prompt injection, exposes Claude users to potential data theft through chained attacks initiated from Google searches.
  • Apple WebKit: CVE-2026-20643, a vulnerability that could allow sites to access user data, has been patched via a background security update.
  • IP KVM Devices: Nine critical vulnerabilities across four vendors allow unauthenticated attackers to gain root access and take control of host systems.

Notable Threat Actor Activity

  • Interlock ransomware: Actively exploiting the Cisco FMC zero-day (CVE-2026-20131) in a campaign ongoing since January 2026.
  • Horabot: New campaign in Mexico identified, involving sophisticated multi-stage malware delivery and targeting financial information.
  • SideWinder: Espionage group, suspected to be India-linked, expanding operations across Southeast Asia targeting governments, telecom, and critical infrastructure using spear-phishing, old vulnerabilities, and rotating infrastructure.
  • DPRK IT Worker Network: OFAC sanctioned six individuals and two entities for funding North Korean WMD programs through fraudulent remote IT work.
  • Iranian-linked Handala group: Attributed to the Stryker breach, leveraging credentials stolen via malware.
  • Magecart: Ongoing use of novel techniques, such as hiding payloads in EXIF data of third-party favicons, to evade repository scanners and steal payment information.
  • Darksword iOS Exploit Kit: Used by state-sponsored and criminal actors, this kit chains multiple iOS zero-days to compromise devices for surveillance and data theft, targeting users in Saudi Arabia, Turkey, Malaysia, Ukraine, and reportedly by Russian hackers.
  • SnappyClient: A new C2 implant targeting cryptocurrency wallets, supporting remote access, data theft, and spyware capabilities.
  • Shipping-Themed Phishing: Surge in phishing campaigns targeting Middle East and Africa, leveraging shipping themes.

Trends, Tools, or Tactics of Interest

  • Refund Fraud Economy: Increase in organized refund fraud exploiting major retailers and payment platforms, with methods and tutorials being commercialized.
  • Fake Shop Networks: Discovery of a network of over 20,000 fake online shops designed to steal payment and personal data.
  • Font-Rendering Evasion: Researchers demonstrated a method to hide malicious commands from AI assistants using font-rendering tricks.
  • Scanning Activity: Increased scans for “adminer” and “phpMyAdmin” observed in honeypots.
  • Shadow AI: SaaS applications are enabling unmonitored AI activity, increasing risk of data exposure and breaches.
  • Security Tooling: Emergence of autonomous offensive security platforms (e.g., XBOW) and new AI detection/response startups (e.g., Manifold, Native) focused on vulnerability discovery and endpoint security.

Regulatory or Policy Developments

  • OFAC Sanctions: The US Treasury’s OFAC sanctioned individuals and entities tied to North Korean IT worker schemes funding WMD programs.
  • EU Sanctions: The European Union sanctioned Chinese and Iranian companies and individuals for cyberattacks against EU member states, expanding measures already in place in the US and UK.
  • CISA Directives: CISA issued emergency directives for US government agencies to patch actively exploited vulnerabilities in Zimbra and SharePoint.