Major Incidents or Breaches

  • Navia Benefit Solutions disclosed a data breach impacting approximately 2.7 million individuals, with sensitive information exposed to attackers.
  • Security firm Aura reported a breach affecting 900,000 records after an employee was targeted via phone phishing, leading to data theft from a marketing tool.
  • Marquis confirmed a data breach affecting 672,000 individuals, with previous estimates suggesting over 1.6 million may be impacted.
  • Medical technology company Stryker suffered a destructive cyberattack that wiped around 80,000 devices. The FBI subsequently seized Handala hacktivist group’s data leak sites used to publicise the breach.
  • Bitrefill, a crypto-powered gift card store, attributed a recent cyberattack to North Korean Lazarus (Bluenoroff) group activity.
  • Ex-data analyst convicted of stealing company data and attempting to extort $2.5 million from Brightly Software while still employed as a contractor.

Newly Discovered Vulnerabilities

  • A critical “PolyShell” vulnerability affects all Magento Open Source and Adobe Commerce stable version 2 installations, enabling unauthenticated remote code execution and account takeover.
  • Ubiquiti patched two vulnerabilities in the UniFi Network Application, including a maximum-severity flaw that could allow account takeover.
  • A critical Microsoft SharePoint vulnerability, patched in January, is now being actively exploited in the wild.
  • ScreenConnect issued an update to address a critical vulnerability exposing machine keys, now adding encrypted storage and management for enhanced protection.

Notable Threat Actor Activity

  • Russian APT28 (GRU-linked) is exploiting a Zimbra Collaboration Suite vulnerability in attacks targeting Ukrainian government entities, leveraging insufficient sanitization of CSS content in HTML emails.
  • Multiple threat actors have been using the DarkSword iOS exploit kit, which chains six vulnerabilities (including three zero-days), for full device takeover since at least November 2025. Apple has issued warnings to users of older, unpatched iPhones.
  • North Korean Lazarus (Bluenoroff) group is linked to the cyberattack on Bitrefill.
  • Iranian threat actors prepared cyberattack infrastructure over a six-month period, including the use of US-based shell companies, to increase their operational resilience ahead of recent kinetic events.

Trends, Tools, or Tactics of Interest

  • EDR killer malware continues to evolve, with 54 EDR killers leveraging the Bring Your Own Vulnerable Driver (BYOVD) technique to exploit 35 signed vulnerable drivers and disable endpoint security solutions.
  • New Android malware family “Perseus” is actively targeting devices for takeover and financial fraud, monitoring user notes apps to extract sensitive data such as passwords and recovery phrases.
  • Speagle malware is hijacking the legitimate Cobra DocGuard program to exfiltrate data via compromised servers.
  • Recent DDoS botnet takedowns (Aisuru, Kimwolf, JackSkid, Mossad) highlight the continued threat from large-scale IoT botnets, with over 3 million infected devices used in record-breaking 31.4 Tbps attacks.
  • MCP (Model Code Provider) security issues in LLM (Large Language Model) environments are considered architectural and not easily patchable, posing ongoing risks.
  • Attackers are increasingly targeting password reset workflows for privilege escalation; security guidance has been issued to harden these processes.
  • Criminals are actively trading stolen tax records on dark web forums during tax season, with tax forms selling for as little as $20.

Regulatory or Policy Developments

  • The US Department of Justice, in cooperation with Canadian and German authorities, dismantled the infrastructure behind several major IoT botnets, including Aisuru, Kimwolf, JackSkid, and Mossad.
  • CISA issued advisories urging organisations to secure Microsoft Intune endpoint management systems, following their exploitation in the Stryker cyberattack.
  • Major providers are piloting quantum-safe HTTPS, reducing certificate size and improving both latency and transparency.