Microsoft
TRENDING TOPICS JAN 15, 2026 Microsoft Disrupts RedVDS Cybercrime Subscription Service Fueling Global Fraud Operations Microsoft has announced a coordinated legal and law enforcement action to dismantle RedVDS, a global cybercrime-as-a-service platform that enabled large-scale fraud, phishing, and business email compromise operations. Operating since at least 2019, RedVDS sold low-cost,
1 Initial Access via Exposed Edge Devices Phase Description The actor identifies internet-facing routers, VPN concentrators, and network management appliances with exposed administrative interfaces or weak access controls. These devices are frequently customer-managed instances hosted in cloud environments, where misconfigurations provide entry without the need to exploit vulnerabilities. Internet-Facing Devices
Reprompt
CVE-2026-20822 Critical Windows Graphics Component PRIVILEGE ESCALATION Windows Graphics Component Elevation of Privilege Vulnerability enabling local attackers to gain SYSTEM-level privileges. CVE-2026-20854 Critical Windows LSASS REMOTE CODE EXECUTION Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability allowing network-based exploitation. CVE-2026-20876 Critical Windows VBS Enclave PRIVILEGE ESCALATION Windows
Telegram
TRENDING TOPICS JAN 13, 2026 Hidden Telegram Proxy Links Enable One-Click IP Address Exposure Researchers have disclosed a Telegram client behavior that allows attackers to expose a user’s real IP address with a single click by abusing how MTProto proxy links are handled on mobile platforms. Specially crafted t[
EDRStartupHinder
TRENDING TOPICS JAN 12, 2026 EDRStartupHinder Introduces a New Way to Stop Security Tools From Starting on Windows A new proof-of-concept called EDRStartupHinder demonstrates how an attacker can prevent antivirus and EDR products from launching during Windows startup, including Microsoft Defender on Windows 11 25H2. Instead of trying to tamper
UAT-7290
CVE-2026-0625 Critical D-Link DSL/DIR/DNS Devices AUTHENTICATION BYPASS UNAUTHENTICATED END-OF-LIFE Affects multiple end-of-life D-Link DSL, DIR, and DNS devices and allows an unauthenticated attacker to bypass authentication and modify DNS settings via the exposed dnscfg.cgi endpoint, enabling DNS hijacking and traffic redirection attacks. Critical Action: Immediately decommission and
npm Packages
TRENDING TOPICS JAN 08, 2026 Update: Malicious NPM Packages Spreading NodeCordRAT via Developer Supply Chain Zscaler ThreatLabz identified three malicious npm packages in November 2025 that were designed to compromise developer systems and steal sensitive data: bitcoin-main-lib, bitcoin-lib-js, and bip40. The actor relied on look-alike naming tied to the legitimate
Emergence Date Timeline Activity assessed as early as 2004–2007, with continuous development observed across multiple operational phases. 2004-2007 Origins Continuous Development Multiple Operational Phases Long-Running Campaign Attribution Assessment Strongly assessed as Iran-aligned, based on targeting patterns, infrastructure, language artifacts, and long-term strategic alignment. Iran-Aligned Targeting Patterns Infrastructure Analysis Language
DocuSign
TRENDING TOPICS JAN 07, 2026 DocuSign Impersonation Wave Leveraging Real-Time LogoKit Customization Group-IB has identified a sustained wave of DocuSign impersonation campaigns that leverage real-time page customization to deliver highly convincing credential-harvesting attacks. These campaigns abuse the trust users place in widely adopted business platforms by closely mimicking legitimate DocuSign
Zestix
TRENDING TOPICS JAN 06, 2026 Zestix Targets Credential-Driven Access to Corporate File-Sharing Data Hudson Rock reports that a threat actor known as Zestix has been advertising stolen corporate data tied to dozens of organizations, with activity pointing to compromised ShareFile, Nextcloud, and ownCloud environments. The likely entry point was employee
MONTHLY WRAP MONTHLY WRAP Overview December 2025 demonstrated a clear pivot toward trust-plane exploitation, with both criminal and state-aligned actors favoring legitimate platforms, built-in tooling, and familiar workflows over novel exploits. Campaigns increasingly abuse AI platforms, developer tools, cloud services
Kimwolf Botnet
TRENDING TOPICS JAN 05, 2026 Kimwolf Botnet Breaches Home Networks via Proxy Abuse, Infecting Over 2 Million Devices Security researchers are warning about the rapid expansion of the Kimwolf botnet, which has compromised more than two million devices worldwide by exploiting weaknesses in residential proxy services. Unlike traditional botnets that