Cybersecurity Brief – 2026-01-06

Tue, 06 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Brightspeed, a major US broadband provider, is investigating claims of a security breach and data theft made by the Crimson Collective extortion gang. The group alleges theft of personal information of over 1 million customers.
Sedgwick confirmed a cyberattack on a file transfer system at its government subsidiary, affecting agencies it serves.
Ledger notified customers of a data breach at third-party payment processor Global-e, resulting in exposure of personal data.
Multiple corporate data theft incidents have been linked to threat actor Zestix, who breached ShareFile, Nextcloud, and OwnCloud instances and is offering stolen data from dozens of companies.
Artisans’ Bank and VeraBank, two US banks, disclosed security incidents.
NordVPN denied breach claims, stating that attackers only accessed dummy data from a third-party automated testing platform.
No evidence of cyberattack was found in the communications failure that grounded flights in Greece.

n8n, an open-source workflow automation platform, disclosed a critical vulnerability (CVSS 9.9) allowing authenticated users to execute arbitrary system commands.
The “@adonisjs/bodyparser” npm package is affected by a critical vulnerability (CVSS 9.2) enabling arbitrary file writes on servers.
A critical ‘MongoBleed’ vulnerability in MongoDB allows unauthenticated attackers to extract passwords and tokens via a memory leak. The flaw is under active attack.
VSCode IDE forks, including Cursor, Windsurf, Google Antigravity, and Trae, expose users to attacks via non-existent “recommended extensions” that can be abused for malicious purposes.
Risks associated with newer IP-based KVM devices have been highlighted, as out-of-band access could introduce security concerns.
WhatsApp metadata leak through device fingerprinting was reported, with Meta rolling out fixes.

Russia-aligned group UAC-0184 targeted Ukrainian military and government entities by delivering malicious ZIP archives via the Viber messaging platform.
The Kimwolf Android botnet has infected over 2 million devices, leveraging exposed ADB interfaces and residential proxy networks for DDoS attacks, app installs, and proxy bandwidth resale.
Zestix is offering for sale corporate data stolen from cloud file-sharing platforms.
The Crimson Collective extortion gang claimed responsibility for the Brightspeed breach.
US cyber professionals pleaded guilty to working as affiliates of the ALPHV/BlackCat ransomware group.
The RondoDox botnet has expanded operations by exploiting React2Shell vulnerabilities, targeting Next.js servers for cryptomining and botnet payload delivery.
New VVS Stealer malware, written in Python, is targeting Discord accounts to harvest credentials and tokens.

The ClickFix social engineering campaign is targeting the European hospitality sector, using fake Windows Blue Screen of Death (BSOD) screens to trick users into executing malware.
Threat actors are increasingly abusing cloud file-sharing platforms for corporate data theft.
The Kimwolf botnet demonstrates the growing use of residential proxy networks for botnet expansion and monetization.
AI-powered IDEs recommending non-existent extensions present a new supply chain risk vector.
Agentic AI adoption is raising identity management challenges, with AI agents acting as a new class of identity that CISOs must manage.
CISA’s Known Exploited Vulnerabilities (KEV) catalog expanded by 20% in 2025, now including 1,484 entries, with 24 new vulnerabilities known to be exploited by ransomware groups.
Automated License Plate Reader (ALPR) surveillance is discussed as a privacy and security concern.
Ineffectiveness of AI guardrails was highlighted following an incident involving Grok generating inappropriate content.

The early release of Ilya Lichtenstein, convicted for the Bitfinex cryptocurrency exchange hack, under the US First Step Act, was reported.