Major Incidents or Breaches

  • Mazda disclosed a security incident detected in December that exposed information belonging to employees and business partners.
  • Crunchyroll is investigating claims of a data breach in which hackers allege theft of personal information for approximately 6.8 million users.
  • Trio-Tech, a semiconductor services firm, reported a ransomware attack on a subsidiary in Singapore, resulting in file encryption.
  • Navia Benefit Solutions, a U.S.-based employee benefits provider, was listed among recent victims in threat intelligence bulletins.
  • Microsoft is addressing an ongoing issue affecting Exchange Online, intermittently preventing access to mailboxes via Outlook mobile and Mac desktop clients.
  • Microsoft released emergency update KB5085516 to fix an issue breaking Microsoft account sign-ins across multiple apps, including Teams and OneDrive.

Newly Discovered Vulnerabilities

  • Citrix released patches for two vulnerabilities in NetScaler ADC and NetScaler Gateway, including a critical flaw that could allow unauthenticated data leaks.
  • QNAP patched four vulnerabilities exploited at Pwn2Own, which could enable attackers to access sensitive information, execute code, or cause unexpected behavior.
  • CISA ordered U.S. federal agencies to patch three iOS vulnerabilities exploited in attacks involving the DarkSword exploit kit, linked to cryptocurrency theft and espionage.
  • Multiple attack vectors were identified in AWS Bedrock, Amazon’s AI application platform, which could allow attackers to access enterprise data and systems.

Notable Threat Actor Activity

  • The Tycoon2FA phishing-as-a-service platform resumed full operations after a law enforcement takedown, with attack volumes and tactics returning to previous levels.
  • North Korean threat actors (WaterPlum/Contagious Interview) were observed abusing Visual Studio Code auto-run tasks to deploy StoatWaffle malware via malicious Microsoft Visual Studio project files.
  • TeamPCP group conducted wiper attacks targeting Kubernetes clusters configured for Iranian systems, using malicious scripts to wipe machines. The group was also behind the Trivy supply chain attack, distributing info-stealer malware via Docker Hub and compromising Aqua Security’s GitHub repositories.
  • The FBI issued a warning about Iranian Handala hackers using Telegram to facilitate malware attacks.
  • Attackers are using phishing campaigns with copyright infringement notices to deliver info-stealer malware, targeting sectors including healthcare, government, hospitality, and education.
  • A financially motivated group deployed the “CanisterWorm” wiper, spreading through poorly secured cloud services and targeting systems in Iran.
  • Microsoft reported an IRS-themed phishing campaign impacting 29,000 users, using urgency and tax season themes to deploy remote monitoring and management (RMM) malware and harvest credentials.

Trends, Tools, or Tactics of Interest

  • The Trivy supply chain attack demonstrated the risk of compromised open-source security tools, with attackers deploying info-stealers to steal cloud credentials, SSH keys, tokens, and sensitive secrets from CI/CD environments.
  • Ransomware operators are increasingly leveraging AI to accelerate attacks, bypass security controls, exploit valid credentials, and target data more efficiently.
  • The Mandiant M-Trends 2026 report highlighted that the time for initial access handoff between threat actors has shrunk from hours to as little as 22 seconds.
  • AI-generated phishing emails are becoming more sophisticated, with urgency and time pressure replacing traditional red flags such as poor grammar or spelling.
  • Security researchers observed the use of malicious Docker images and hijacked GitHub repositories to propagate malware in developer environments.
  • Attackers are mimicking official app stores with over 1,500 fake sites to distribute unvetted gambling apps.
  • Google announced “Advanced Flow” to make Android sideloading safer by slowing down scam-driven installs.

Regulatory or Policy Developments

  • CISA mandated immediate patching of actively exploited iOS vulnerabilities by U.S. federal agencies.
  • The FBI’s warning regarding the use of Telegram by Iranian threat actors signals ongoing law enforcement focus on encrypted communications in cyber operations.
  • OpenAI introduced a ‘Library’ feature for ChatGPT, allowing users to store personal files and images on OpenAI’s cloud, raising considerations for data security and privacy.
  • The RSAC 2026 Conference pre-event announcements included new security solutions and discussions on the role of humans in AI-powered security, with debate over the necessity of a “human in the loop.”