Cybersecurity Brief – 2026-01-27

Tue, 27 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Crunchbase has confirmed a data breach following hacking claims. The incident is linked to the ShinyHunters group, which also targeted SoundCloud and Betterment.
A failed cyberattack on the Polish power grid has been attributed to the Russian APT group Sandworm. The attack involved the deployment of data-wiping malware but did not result in significant disruption.
Nearly 800,000 Telnet servers have been found exposed to remote attacks due to a critical authentication bypass vulnerability in GNU InetUtils, with ongoing exploitation attempts observed.
Cloudflare experienced a 25-minute BGP route leak affecting IPv6 traffic due to internal misconfiguration, causing congestion, packet loss, and approximately 12 Gbps of traffic disruption.

Microsoft has patched an actively exploited Office zero-day vulnerability rated as high severity.
Over 20 vulnerabilities were identified and patched in Dormakaba physical access control systems, which could have allowed attackers to unlock doors at major European firms.
CISA has reported active exploitation of a critical VMware vCenter Server remote code execution vulnerability, mandating U.S. federal agencies to secure their servers within three weeks.
The npm package manager’s Shai-Hulud supply-chain defenses can be bypassed via Git dependencies, exposing users to potential malicious package installations.

The North Korean Konni group has been observed targeting blockchain developers and engineering teams with a new AI-generated PowerShell backdoor, aiming to compromise development environments and cryptocurrency assets.
A campaign targeting Indian users with tax-themed phishing emails is delivering the Blackmoon malware as part of a suspected cyber espionage operation.
The Russian Sandworm APT group is confirmed to have attempted a wiper attack on Poland’s power grid.
The ShinyHunters group has claimed responsibility for the Crunchbase data breach.
The Kimwolf botnet operators reportedly compromised the control panel of the Badbox 2.0 botnet, which has infected over 2 million devices.

Two malicious Visual Studio Code extensions, posing as AI-powered coding assistants, were discovered stealing developer source code. The extensions had over 1.5 million installs.
The ‘Stanley’ malware-as-a-service toolkit is being marketed on cybercrime forums for $2,000–$6,000, offering phishing Chrome extensions that can bypass Google’s review and be published on the Chrome Web Store.
New attacks are leveraging the ClickFix method combined with fake CAPTCHA prompts and signed Microsoft App-V scripts to deliver the Amatera infostealer malware.
Offensive AI techniques are increasingly used by threat actors, including AI-generated malware and backdoors, complicating detection and response efforts.
Deepfake ‘nudify’ technology is becoming more advanced and accessible, increasing the risk and impact of sexual image abuse.
Threat actors are exploiting misconfigurations in Okta deployments, with security researchers highlighting six commonly overlooked settings that weaken identity security.

The European Commission has launched an investigation into X (formerly Twitter) to determine if the company properly assessed risks before deploying its Grok AI tool, following incidents involving the generation of sexually explicit images.
TikTok has finalized a deal to create a new American entity, averting a potential ban in the United States.