Major Incidents or Breaches#

  • Massachusetts Hospital Cyberattack

    • Signature Healthcare in Massachusetts experienced a cyberattack resulting in ambulance diversions, cancellation of some services, and pharmacy disruptions.

  • Snowflake SaaS Integrator Breach

    • Over a dozen companies suffered data theft attacks after a SaaS integration provider was breached, with attackers stealing authentication tokens.

  • Router Hijacking and Espionage by APT28

    • The Russia-linked APT28 (Forest Blizzard) compromised MikroTik and TP-Link routers globally, hijacking DNS settings to steal Microsoft 365 and Office authentication tokens.
    • An international law enforcement operation disrupted the “FrostArmada” APT28 campaign.

  • Critical Infrastructure Attacks by Iran-Linked Actors

    • Iran-affiliated threat actors targeted internet-exposed programmable logic controllers (PLCs) and SCADA systems in US critical infrastructure sectors, causing operational disruptions.

  • Doxing, Spyware, and Nonconsensual Abuse

    • Widespread abuse in Telegram groups, where individuals are purchasing hacking tools, sharing nonconsensual images, and engaging in doxing and spyware deployment.

Newly Discovered Vulnerabilities#

  • Docker Engine (CVE-2026-34040)

    • High-severity vulnerability allows bypass of authorization plugins (AuthZ), potentially granting unauthorized host access under specific conditions.

  • Ninja Forms WordPress Plugin

    • Critical flaw in the File Uploads premium add-on permits unauthenticated arbitrary file uploads, leading to remote code execution. Exploitation in the wild has been observed.

  • Flowise (CVE-2025-59528)

    • Maximum-severity vulnerability in the Flowise open-source LLM/agentic app builder allows arbitrary code execution via improper validation of user-supplied JavaScript. Active exploitation reported.

  • Android StrongBox

    • Severe denial-of-service vulnerability in the Android Framework component, now patched, could affect device security.

  • Grafana AI Integration

    • AI-related bug in Grafana could leak user data by ingesting attacker-controlled prompts, returning sensitive information to external servers.

Notable Threat Actor Activity#

  • North Korea – Contagious Interview Campaign

    • North Korean actors published over 1,700 malicious packages across npm, PyPI, Go, and Rust, targeting developers for supply chain compromise.

  • Iran-Linked OT Attacks

    • Ongoing campaigns by Iranian actors manipulate PLC and SCADA systems in US critical infrastructure, raising concerns of broader operational technology (OT) targeting.

  • Russian APT28 Router Exploitation

    • APT28 used vulnerabilities in older routers to mass harvest Microsoft Office authentication tokens and conduct adversary-in-the-middle attacks.

  • Storm-1175 Ransomware Activity

    • Storm-1175 deployed Medusa ransomware at high velocity, exploiting both N-day and zero-day vulnerabilities, with a focus on rapid campaign execution.

  • Masjesu DDoS Botnet

    • The Masjesu botnet targets IoT devices, exhibits persistence, avoids blacklisted IPs and critical infrastructure, and does not engage in widespread infection.

  • Voice Phishing (Vishing) Surge

    • Vishing surpassed email phishing as the top initial intrusion vector in 2025, with attackers leveraging live, interactive social engineering.

  • Custom Fonts to Bypass AI Defenses

    • Threat actors are using custom fonts to evade AI-based security controls, bypassing content inspection and detection mechanisms.

  • Webshell Deployment via File Write/RCE Vulnerabilities

    • Attackers continue to exploit arbitrary file write and remote code execution vulnerabilities to drop webshells for persistence on compromised servers.

  • Automated Pentesting Limitations

    • Automated penetration testing tools show early promise but fail to comprehensively test attack surfaces, leading to gaps in validation.

  • AI in Human Risk Management

    • Adoption of adaptive, behavior-based training platforms using AI to address human vulnerabilities, with social engineering implicated in 98% of incidents.

  • Identity Attack Surface Expansion

    • Fragmentation of enterprise identity across numerous applications is increasing risk, despite maturing IAM programs.

  • Agentic AI and Security

    • Rapid evolution of AI-driven agentic attacks is outpacing incremental defensive measures, requiring architectural responses.

Regulatory or Policy Developments Affecting the Security Industry#

  • US Law Enforcement Disruption of Russian Espionage

    • International operation involving public and private sector cooperation disrupted the APT28 DNS hijacking campaign targeting routers for credential theft.

  • Warnings on Cartel-Linked Scams

    • Authorities issued alerts on Mexican drug cartels conducting advance-fee fraud scams targeting timeshare owners.

  • FBI Cybercrime Loss Statistics

    • FBI reported a record $21 billion in cybercrime losses for US victims last year, driven by investment scams, BEC, tech support fraud, and data breaches.

  • AI Security Collaboration

    • Anthropic’s Project Glasswing, in partnership with Apple, Google, and 45+ organizations, aims to use the Claude Mythos AI model to identify and address zero-day vulnerabilities across major systems.