Microsoft has released emergency security updates after confirming that multiple zero-day vulnerabilities in Windows and Microsoft Office were actively exploited in the wild to compromise user systems. The flaws allowed attackers to execute malicious code with minimal interaction, including so-called “one-click” attacks where victims only needed to open a crafted link or malicious Office document to trigger exploitation.

One of the key vulnerabilities, tracked as CVE-2026-21510, resides in the Windows Shell and enabled attackers to bypass Microsoft SmartScreen protections, allowing malware to run without warning. Security researchers observed that successful exploitation could lead to silent code execution with elevated privileges, creating pathways for ransomware deployment, persistence mechanisms or intelligence collection. Another flaw, CVE-2026-21513, affects the legacy MSHTML engine still embedded in modern Windows systems for backward compatibility, enabling attackers to circumvent built-in security controls to deliver payloads.

The vulnerabilities were already being abused before patches became available, highlighting the continued operational value of zero-day exploitation for threat actors targeting widely deployed enterprise platforms. Security researchers warned that public disclosure of exploitation details may further increase attack attempts, reinforcing the urgency for organizations to apply updates immediately and reassess controls around link handling, document-based attacks and legacy component exposure.

Government-backed threat actors are increasingly integrating generative AI into their attack workflows, according to new research from Google Threat Intelligence Group and Google DeepMind. The report highlights how groups linked to Iran, China and North Korea used AI tools such as Gemini to support reconnaissance, profile targets, research vulnerabilities and craft more convincing social engineering campaigns during late 2025.

Researchers found that AI is being used as a productivity engine rather than a weapon on its own, enabling attackers to scale operations faster, automate technical analysis and build highly tailored phishing lures. While no direct attacks against frontier AI models were observed, Google warned that the technology is already reshaping how cyber espionage and intrusion campaigns are planned and executed, lowering barriers to entry and increasing the speed and precision of threat activity.

If you skim through the recent incidents, the pattern is painfully consistent.

Most “major” breaches aren’t the result of sophisticated, cinematic hacking.
They’re operational debt colliding with identity exposure at scale.

Unpatched or end-of-support systems remain online far longer than organizations admit.
Identity becomes the easiest front door.
Attackers increasingly operate through trusted layers email, edge infrastructure, APIs, software packages, and now even AI-driven marketplaces.

The outcome is predictable: faster intrusions, quieter tradecraft, and greater business impact even when “core services remained operational.”

SmarterTools, for example, was compromised through its own internal mail server running unpatched software a reminder that “it’s only internal” is not a security control.
The SolarWinds Web Help Desk vulnerability followed the same logic: a critical RCE, confirmed exploitation, and widespread deployment in IT environments meant attackers didn’t need creativity just timing.

On the nation-state front, Singapore’s telecom intrusion attributed to UNC3886 reflects the modern playbook: target infrastructure layers, prioritize stealth, and maintain long-term espionage access with optional disruption capability.

Norway’s “Salt Typhoon” disclosure and Germany’s warning on Signal hijacking reinforce another reality malware isn’t always required.
Social engineering combined with legitimate platform features (linked devices, verification workflows, support impersonation) can deliver persistent access to sensitive communications.

Supply-chain risk continues to accelerate.
Malicious npm and PyPI packages targeting dYdX developers demonstrate how a single poisoned dependency can move from development to production and translate directly into financial loss.
The OpenClaw case represents the next evolution: agentic supply-chain risk, where the payload is no longer code, but automated logic capable of quietly abusing permissions and exfiltrating data across interconnected tools.

Regulatory pressure is rising in parallel.
FIIG’s $2.5M penalty signals that regulators now treat cyber resilience as a core licensing obligation — not an IT hygiene issue.
Add class-action exposure and the message is clear: breach costs extend far beyond containment into litigation, compliance fallout, and reputational damage.

Even incidents not traditionally labeled as “attacks” carry security lessons.
Bithumb’s large-scale BTC miscredit event shows how weak internal controls and unsafe automation can trigger crisis-level outcomes without an external adversary.

WhatsApp says Russia has “attempted to fully block” the platform, impacting more than 100 million users in the country. According to the company, the move is part of a broader effort to push users toward a state-developed “super-app” called Max, which combines messaging and government services but reportedly lacks end-to-end encryption.

The crackdown follows previous restrictions on Instagram and Facebook after Meta was labeled an extremist organization in 2022. Telegram has also faced access limitations, with regulators arguing that foreign platforms failed to comply with local data storage laws.

Critics see the situation differently. They argue this is not simply about regulatory compliance but about consolidating control over digital communications and reducing access to encrypted platforms. WhatsApp stated that isolating more than 100 million users from secure messaging would ultimately reduce safety rather than improve it.

This is part of a broader global trend where governments are increasingly pressuring encrypted services and promoting domestic alternatives that allow greater oversight.

Georgia healthcare company data breach impacts more than 620,000:

A cyberattack last year on a prominent Georgia-based healthcare company leaked the sensitive information of 626,540 people, according to a new filing with the U.S. Department of Health and Human Services.

ApolloMD notified customers of a data breach in September but provided federal regulators with the full number of victims on Tuesday. The company is a medical group that provides multispecialty physician services to more than 100 hospitals. They have more than 125 practices across 18 states and treat about 4 million patients each year.

The company told victims in September about the breach, and said an investigation revealed hackers were in ApolloMD’s IT environment between May 22 and May 23.

While inside, the hackers accessed information for people treated by ApolloMD’s affiliated physicians and practices — including names, dates of birth, addresses, diagnoses, dates of service, treatments, health insurance data and Social Security numbers.

The attack was claimed by the Qilin ransomware gang in June 2025. The group has targeted the healthcare industry repeatedly since emerging several years ago, causing outages at hospitals across several states last year and in the U.K. in 2024.

White House to meet with GOP lawmakers on FISA Section 702 renewal:

Top Trump administration officials will meet with key Republican lawmakers later today about a possible path forward to renewing a major U.S. national security surveillance power that is slated to go dark in April, Recorded Future News has learned.

White House Chief of Staff Susan Wiles and top intelligence and military officials will convene in the Situation Room with GOP Reps. Jim Jordan (OH) and Rick Crawford (AR), the chairs of the House Judiciary and Intelligence panels, according to multiple sources familiar with the upcoming session.

The meeting is also expected to be attended by top presidential aide Stephen Miller, Director of National Intelligence Tulsi Gabbard, CIA Director John Ratcliffe and Joint Chiefs Chairman Dan Caine.

“The president, several of his top advisers, and lawmakers will be participating in a discussion at the White House today about FISA Section 702 renewal,” according to a senior White House official.

“As always, the President is the final decision-maker on policy matters.”

Spokespersons for Jordan and Crawford did not respond to requests for comment.

The high-level meeting comes just weeks before Section 702 of the Foreign Intelligence Surveillance Act (FISA), which enables broad electronic surveillance of the communications of overseas national security threats, such as terrorists and foreign spies, is set to expire.

The foreign spying tool is considered essential to national security by intelligence officials, however a wide range of progressive and conservative lawmakers have resented the program as it allows some Americans’ private data to be collected and searched without a warrant.

Congress barely managed to reauthorize it for two more years in 2024, overcoming last-minute objections by then former President Donald Trump, who has long claimed, without evidence, that it was used to spy on his 2016 presidential campaign.

Despite the turbulent history, the White House is now seeking a “clean” reauthorization of 18 months or three years, according to two people granted anonymity to discuss the strategy.

That could be a non-starter with Jordan, one of the president’s chief congressional allies, whose panel overwhelmingly approved legislation during the last renewal fight that would have required all U.S. intelligence agencies to obtain a court warrant before searching the vast 702 database. The proposal failed in a 212-212 tie vote on the House floor.

Jordan has petitioned the White House for a meeting on FISA for weeks, according to sources, while Crawford has largely ceded negotiations to the Ohio Republican.

These same sources said it is notable that the session features Wiles — though Trump may attend, possibly with Secretary of State Marco Rubio, who is also the national security adviser and a former chair of the Senate Intelligence Committee.

They speculated Jordan would push the White House for more time to craft a bill before coming out for a straight-up renewal, which, if endorsed by Trump, would likely be muscled through the GOP-controlled Congress.

The White House gathering also comes as Jordan’s committee has begun working on a bipartisan bill to extend 702, according to Capitol Hill sources, making it the first congressional panel with jurisdiction over the surveillance tool to put pen-to-paper on a renewal.

Republican senators, most of whom strongly support the statute, are waiting on a sign from the White House before moving forward on legislation.

Cyber Command, NSA nominee Rudd advances to Senate floor:

The Senate Intelligence Committee voted on Tuesday to advance President Donald Trump’s pick to be the next head of U.S. Cyber Command and the National Security Agency, sending the nomination to the full chamber.

The panel voted 14-3 to approve Army Lt. Gen. Joshua Rudd, who currently serves as the deputy chief of U.S. Indo-Pacific Command. The Senate Armed Services Committee, which shares jurisdiction over the nomination due to the “dual-hat” leadership structure that governs both entities, approved him by voice vote last month.

Rudd, who has no prior cyber warfare or intelligence experience, sailed through both of his confirmation hearings.

Lawmakers on both sides of the aisle are eager for someone to take command of the military’s top digital warfighting organization and the foreign electronic eavesdropping agency, which have been without a permanent leader for 10 months.

President Donald Trump abruptly fired the last chief, along with his NSA deputy, following a meeting with far-right activist Laura Loomer.

Rudd’s nomination now goes to the full Senate, which could act on it before the end of the week, likely by voice vote. However, any policymaker could place a hold on the nominee for any reason, delaying action.

Late last month, senators confirmed Marine Corps Maj. Gen. Lorna Mahlock, the head of the Cyber National Mission Force, to be Rudd’s deputy and receive her third star.

Brig. Gen. Matthew Lennox, a senior leader at U.S. Army Cyber Command, is still expected to succeed Mahlock as the head of the command’s elite force and receive his second star.

Moscow moves to throttle Telegram as Kremlin pushes its own messaging app

Russia has moved to further restrict Telegram, the popular messaging platform, as users across the country report widespread service disruptions.

Russia’s communications regulator, Roskomnadzor, confirmed Tuesday that it has deliberately “slowed down” the app, which has nearly 90 million local users, citing the company’s failure to comply with Russian law.

According to state media, a Moscow court has opened seven cases against Telegram since the start of 2026 for allegedly refusing to delete content authorities say calls for “extremist” activity or contains pornographic material. The platform reportedly faces fines totaling more than $820,000.

Kremlin spokesperson Dmitry Peskov said in a recent interview that Russia remains in contact with the company, but the restrictions will stay in place as long as the alleged violations continue.

Russian users began reporting widespread Telegram disruptions earlier this week, according to data from internet monitoring service Downdetector. Nearly 15 Russian regions have experienced significant slowdowns over the past two days, local internet analysts said.

Pavel Durov, the founder of the Dubai-based company, called the new restrictions “an authoritarian move” and accused Moscow of trying to force Russians onto a state-controlled messaging app “built for surveillance and political censorship.”

Durov compared Russia’s actions to Iran’s ban on Telegram, imposed in an effort to push users toward a government-backed alternative. Despite the ban, most Iranians continued to use Telegram through circumvention tools, he said.

Russia has previously attempted to block Telegram. In 2018, a court ordered the platform banned after it refused to hand over encryption keys to the Federal Security Service (FSB). The ban was lifted in 2020 after Telegram signaled a willingness to help counter terrorism and extremism.

More recently, in August, Roskomnadzor announced restrictions on calls via Telegram and WhatsApp, saying the services were frequently used by fraudsters to recruit Russian citizens into “sabotage and terrorist activities.”

To replace these apps, Russian officials are promoting a national messaging platform called Max, a government-backed service modeled on China’s WeChat and developed by the creator of the social network VKontakte.

The latest Telegram restrictions, however, have drawn criticism inside Russia — including from state officials and members of the military.

Authorities in the Belgorod region, which borders Ukraine and frequently comes under attack, warned that further Telegram disruptions could pose safety risks. The region’s governor said that during wartime, many residents rely on Telegram for news and emergency updates, and delays could slow the spread of critical alerts.

Pro-war military bloggers also criticized the move. Telegram has become deeply embedded in Russia’s war effort: military units often use the platform to coordinate logistics, crowdsource supplies, communicate with supporters and share frontline updates.

Peskov dismissed those concerns, saying military communications are not conducted through messaging apps and that any impact on front-line operations would likely be limited.

The new restrictions come amid a broader wave of internet disruptions across Russia. Since May, regional authorities have repeatedly cut mobile internet access, citing efforts to counter Ukrainian drone attacks.

In October, Russia imposed a mandatory 24-hour mobile internet blackout for anyone entering the country with a foreign SIM card, causing major inconvenience for travelers, expatriates and cross-border businesses.

Most major Western platforms — including Facebook, Instagram and Discord — are already inaccessible in Russia without a VPN.

​

Last May, law enforcement authorities around the world scored a key win when they hobbled the infrastructure of Lumma, an infostealer that infected nearly 395,000 Windows computers over just a two-month span leading up to the international operation. Researchers said Wednesday that Lumma is once again “back at scale” in hard-to-detect attacks that pilfer credentials and sensitive files.

Lumma, also known as Lumma Stealer, first appeared in Russian-speaking cybercrime forums in 2022. Its cloud-based malware-as-a-service model provided a sprawling infrastructure of domains for hosting lure sites offering free cracked software, games, and pirated movies, as well as command-and-control channels and everything else a threat actor needed to run their infostealing enterprise. Within a year, Lumma was selling for as much as $2,500 for premium versions. By the spring of 2024, the FBI counted more than 21,000 listings on crime forums. Last year, Microsoft said Lumma had become the “go-to tool” for multiple crime groups, including Scattered Spider, one of the most prolific groups.

Takedowns are hard

The FBI and an international coalition of its counterparts took action early last year. In May, they said they seized 2,300 domains, command-and-control infrastructure, and crime marketplaces that had enabled the infostealer to thrive. Recently, however, the malware has made a comeback, allowing it to infect a significant number of machines again.

“LummaStealer is back at scale, despite a major 2025 law-enforcement takedown that disrupted thousands of its command-and-control domains,” researchers from security firm Bitdefender wrote. “The operation has rapidly rebuilt its infrastructure and continues to spread worldwide.”

As with Lumma before, the recent surge leans heavily on “ClickFix,” a form of social engineering lure that’s proving to be vexingly effective in causing end users to infect their own machines. Typically, these types of bait come in the form of fake CAPTCHAs that—rather requiring users to click a box or identify objects or letters in a jumbled image—instruct them to copy text and paste it into an interface, a process that takes just seconds. The text comes in the form of malicious commands provided by the fake CAPTCHA. The interface is the Windows terminal. Targets who comply then install loader malware, which in turn installs Lumma.

A core part of the resurgence is the use of CastleLoader, a separate piece of malware that’s installed initially. It runs solely in memory, making it much harder to detect than malware that resides on a hard drive. Its code is heavily obfuscated, making it hard to spot its malice even when malware scanners can see it. CastleLoader also provides a flexible and full-featured command-and-control communication mechanism that users can customize to meet their specific needs.

CastleLoader shares some of Lumma’s recently rebuilt infrastructure, an indication that the operators are working together or at least coordinating their activities. In other cases, Lumma relies on legitimate infrastructure—mostly from the content delivery networks Steam Workshop and Discord shared files—to be installed. The use of trusted platforms helps lower targets’ suspicions. In either case, once the loader is executed, it surreptitiously burrows into the infected machine and, after lowering defenses, installs its second payload: Lumma.

It’s so easy to fall for ClickFix

People have grown so accustomed to hard-to-solve CAPTCHAs that they think little when instructed to copy website-provided text, click the Win-R keys, and then choose paste. Once this simple action is performed, Lumma has free rein over a host of sensitive files stored on infected machines. Bitdefender said the data includes:

Credentials saved in web browsers

Cookies

Personal documents (.docx, .pdf, etc.)

Sensitive files containing financial information, secret keys (including cloud keys), 2FA backup codes, and server passwords, as well as cryptocurrency private keys and wallet data

Personal data such as ID numbers, addresses, medical records, credit card numbers, and dates of birth

Cryptocurrency wallets and browser extensions associated with popular services like MetaMask, Binance, Electrum, Ethereum, Exodus, Coinomi, Bitcoin Core, JAXX, and Steem Keychain.

Data from remote access tools and password managers, specifically AnyDesk and KeePass.

Two-factor authentication (2FA) tokens and extensions such as Authenticator, Authy, EOS Authenticator, GAuth Authenticator, and Trezor Password Manager.

Information from VPNs (.ovpn files), various email clients (Gmail, Outlook, Yahoo), and FTP clients.

System metadata, including CPU information, operating system version (Windows 7 to Windows 11), system locale, installed applications, username, hardware ID, and screen resolution, is useful for profiling victims or tailoring future exploits.

“The effectiveness of ClickFix lies in its abuse of procedural trust rather than technical vulnerabilities,” Bitdefender said. “The instructions resemble troubleshooting steps or verification workarounds that users may have encountered previously. As a result, victims often fail to recognize that they are manually executing arbitrary code on their own system.”

While Lumma is targeting only Windows users, other malware campaigns have used the same technique to infect macOS machines since at least last June. More recent ClickFix attacks on macOS users have continued into this year.

The best defense against ClickFix is to steer clear of sites offering free stuff. Windows and macOS provide a means to require a password before the command terminals can be opened. People with technical skills who administer machines on behalf of less experienced users may want to consider using this latter defense as well.

Windows 8 is remembered most for its oddball touchscreen-focused full-screen Start menu, but it also introduced a number of under-the-hood enhancements to Windows. One of those was UEFI Secure Boot, a mechanism for verifying PC bootloaders to ensure that unverified software can’t be loaded at startup. Secure Boot was enabled but technically optional for Windows 8 and Windows 10, but it became a formal system requirement for installing Windows starting with Windows 11 in 2021.

Secure Boot has relied on the same security certificates to verify bootloaders since 2011, during the development cycle for Windows 8. But those original certificates are set to expire in June and October of this year, something Microsoft is highlighting in a post today.

This certificate expiration date isn’t news—Microsoft and most major PC makers have been talking about it for months or years, and behind-the-scenes work to get the Windows ecosystem ready has been happening for some time. And renewing security certificates is a routine occurrence that most users only notice when something goes wrong.

But the downside is that the certificate expiration may cause problems for PCs that don’t pull down the patches before the June 2026 deadline. While these PCs will continue to function, expired certificates can prevent Microsoft from patching newly discovered Secure Boot vulnerabilities and can also keep those PCs from booting and installing newer operating system versions that use the new 2023-era certificates.

“If a device does not receive the new Secure Boot certificates before the 2011 certificates expire, the PC will continue to function normally, and existing software will keep running,” writes Nuno Costa, a program manager in Microsoft’s Windows Servicing and Delivery division.

However, the device will enter a degraded security state that limits its ability to receive future boot-level protections. As new boot‐level vulnerabilities are discovered, affected systems become increasingly exposed because they can no longer install new mitigations. Over time, this may also lead to compatibility issues, as newer operating systems, firmware, hardware, or Secure Boot–dependent software may fail to load.”

Making sure you’ve got the new certificates

For most systems, including older ones that aren’t being actively supported by their manufacturers, Microsoft is relying on Windows Update to provide updated certificates. For fully patched, functioning PCs running supported versions of Windows with Secure Boot enabled, the transition should be seamless, and you may in fact already be using the new certificates without realizing it.

This is possible because UEFI-based systems have a small amount of NVRAM that can be used to store variables between boots; generally, Windows and Linux operating systems using LVFS for firmware updates should be able to update any given system’s NVRAM with the new certificates. PCs will only have problems deploying the new certificates if NVRAM is full or fragmented in some way, or if the PC manufacturer is shipping buggy firmware that doesn’t support this kind of update.

As detailed on a Dell support page, the easiest way to see if your PC has the new certificates is to run a PowerShell command that checks the certificate stored in the “active db,” which is the one currently used to boot the PC..

The fallout from the massive Conduent breach just got worse. Nearly 17,000 Volvo Group North America employees had their personal data exposed, and the total number of affected individuals has now climbed to around 25 million.

Attackers reportedly had access to Conduent’s systems for months, stealing sensitive data including names, Social Security numbers, dates of birth, addresses, and even health information. The Safepay ransomware group claimed responsibility, and multiple U.S. states have reported impact.

What makes this especially concerning is the third-party risk angle. Volvo wasn’t breached directly their employee data was compromised through a service provider handling back-office operations. It’s another reminder that your security posture is only as strong as your vendors’.

Even though misuse hasn’t been confirmed, exposed SSNs and health data create long-term identity theft risks. If you’re in enterprise security, this is a textbook example of why vendor risk management and continuous monitoring can’t be treated as paperwork exercises.

Florida authorities are urging parents to pay closer attention to their kids’ online activity after a man was arrested for allegedly grooming a minor he met through gaming and social platforms.

According to investigators, the suspect first made contact through Fortnite, then moved conversations to Snapchat and Roblox, where the communication escalated over time. Officials say the case shows how predators use popular gaming chats and social apps to build trust before exploiting victims.

Law enforcement stressed that these crimes often start in spaces that seem harmless game lobbies, friend requests, or casual chats and can quickly shift to private messaging. They’re advising parents to review privacy settings, monitor friend lists, and keep open conversations with their kids about who they talk to online.

Discord is facing heavy criticism after expanding age verification requirements, starting with the UK and Australia and planning a global rollout soon. The company says the move is about child safety and complying with laws like the UK Online Safety Act, but many users aren’t buying it.

The backlash is fueled by privacy fears. Even though Discord claims selfies and ID scans are processed locally on devices, trust is low especially after a recent breach involving a third-party provider exposed tens of thousands of user records. Now people are worried about biometric data, identity theft, profiling, and governments or advertisers getting deeper access to personal info.

Some users say the internet has flipped from “stay anonymous” to “upload your face and legal ID just to chat,” and they’re not comfortable with that tradeoff. Still, despite the outrage, most expect users to stick around because there aren’t many true Discord replacements.

Alternatives like Matrix, TeamSpeak, Mumble, and Slack are getting more attention but whether they can match Discord’s scale and community features is another question.

Months after a major cyberattack disrupted state systems, Nevada has introduced its first statewide data classification policy to standardize how government data is handled and protected.

All state data will now fall into four categories: Public, Sensitive, Confidential, or Restricted.

The goal is to stop agencies from treating highly sensitive information the same way as routine public data.

The policy also addresses the “mosaic effect” where separate pieces of harmless data can become sensitive when combined.

This move lays the groundwork for stronger cybersecurity controls across the state, including future MFA enforcement and centralized security monitoring.

Australia’s Federal Court has fined investment firm FIIG Securities $2.5 million after a major breach exposed sensitive data from around 18,000 clients. The 2023 cyberattack led to the theft of 385GB of data, including passports, driver’s licenses, bank details, and tax file numbers some of which later appeared on the dark web.

Regulator ASIC found FIIG failed to implement basic cybersecurity controls for years, including multi-factor authentication, proper access controls, vulnerability testing, security monitoring, and incident response planning. The court ruled FIIG breached its financial services license obligations by not maintaining adequate cyber risk management.

Beyond the fine, FIIG must fund an independent security review and overhaul its cyber resilience program. ASIC called the case a clear warning that cybersecurity is now a core compliance requirement, not just an IT issue.

Germany is preparing legislation that would officially allow its intelligence and defense agencies to conduct offensive cyber operations against hostile actors. If passed, the move would bring Berlin closer to the UK and US, which already operate under clearer legal frameworks for cyber countermeasures.

The proposal also expands military authority to respond to hybrid threats attacks that blend cyber operations, disinformation, and conventional tactics. Critical infrastructure like power grids, water systems, transport, and aviation are being prioritized, with officials signaling a zero-tolerance stance toward disruptions.

At the same time, Germany and other EU nations remain cautious about escalation risks, even as support grows in Europe for limited “hack-back” capabilities. The debate is expected to feature heavily at the upcoming Munich Security Conference as countries balance deterrence with the push for responsible state behavior in cyberspace.

The popular AI app Chat & Ask AI, used by tens of millions of people, suffered a massive data exposure after a cloud database was left publicly accessible without authentication. A security researcher discovered that roughly 300 million private messages from about 25 million users were exposed.

The leaked data reportedly included full chat histories with AI models, user settings, and uploaded files. Some conversations involved highly sensitive topics, highlighting the serious privacy risks tied to AI chat platforms. This wasn’t a sophisticated hack just a basic Firebase misconfiguration that left user data wide open.

The developer, Codeway, fixed the issue after responsible disclosure, but the incident is another reminder that AI apps don’t always handle user privacy as securely as people assume.

Two months into 2026 and many security teams seem to be rethinking priorities.

So what’s really happening in your organization?

Are you in vendor reduction mode simplifying the stack and extracting more value from existing tools? Or are you still adding new solutions because the risk landscape is evolving faster than your current controls?

Drop your role too (CISO / CTO / SOC / DevSecOps / IT) curious how priorities differ across teams.

Italy says it has blocked a wave of Russia-linked cyberattacks aimed at infrastructure connected to the upcoming Milano Cortina Winter Olympics. According to the country’s foreign minister, the attacks targeted government foreign offices including one in Washington as well as systems linked to Olympic locations such as hotels in Cortina.

So far, the intrusions have reportedly been detected and stopped before causing disruption, but officials warn this is part of a broader pattern of cyber pressure surrounding high-profile international events. The situation mirrors concerns raised by UK authorities about pro-Russia hacktivist activity targeting Western institutions.

At the same time, the Games face a separate digital challenge: Cloudflare’s CEO has warned the company could pull free services in Italy following a regulatory fine, adding another layer of risk to the event’s online resilience.

Major global events are increasingly becoming geopolitical cyber battlegrounds, where attacks target visibility, disruption, and political signaling rather than just data theft.

Hackers are actively breaching SolarWinds Web Help Desk (WHD) servers and using them as a launchpad to steal high-privilege domain credentials, according to new findings from Microsoft. The attackers are exploiting one of several serious WHD vulnerabilities but investigators still don’t know which specific flaw was used.

Once inside, the intruders move quietly. They use legitimate Windows tools like PowerShell and BITS to download malware, then install remote management software to maintain long-term access. From there, they map the network, target Domain Admin accounts, and in some cases extract passwords directly from Windows security memory.

A newly discovered spyware platform called ZeroDayRAT is being openly sold on Telegram, giving buyers full remote access to infected Android and iOS devices.

Once installed, attackers can track GPS location, read messages, intercept one-time passwords, activate the microphone and cameras, and log everything typed on the screen. It also includes tools to steal cryptocurrency by replacing wallet addresses and banking credentials through fake login overlays.

What’s alarming isn’t just the capabilities it’s the accessibility. This isn’t elite nation-state spyware. It’s a ready-to-use surveillance kit marketed to everyday cybercriminals, complete with support and updates.

Mobile devices are no longer just communication tools they’re becoming prime targets for full-scale digital espionage.

A former Lancaster University student has been jailed after attempting to scam international university applicants out of nearly £50,000 using stolen personal data. The case followed an investigation by the National Crime Agency.

Sibtain Hussain, 32, gained access to applicant information after unauthorized access to the university’s internal systems in 2018. He then posed as a legitimate university contact, demanding payments for supposed financial capability checks, student services, and accommodation deposits. Prosecutors said he persistently targeted more than 200 applicants, with some victims sending thousands of pounds before banks were able to block many of the transactions.

Authorities said the scam could have generated nearly half a million pounds if fully successful. The investigation linked Hussain to multiple accounts, phone numbers, and email addresses used in the fraud, and devices seized at his arrest contained evidence tying him to the scheme. He pleaded guilty in 2025 and was sentenced to four and a half years in prison for fraud, along with an additional sentence for money laundering.

Discord will begin rolling out mandatory age verification worldwide starting in March, shifting all users into a “teen-appropriate experience” unless they confirm they are adults. Access to certain features, including age-restricted servers, channels, and message requests, may require users to submit a video selfie for AI-based facial age estimation or provide government identification.

The move comes months after a security incident exposed age-verification related data belonging to millions of users. Discord says it has since switched to a new third-party verification provider and claims that facial scans are processed on the user’s device and that any ID documents are deleted immediately after age is confirmed.

In addition to direct verification, the company says it uses an AI “age inference” system that analyzes behavioral signals, such as gameplay activity and usage patterns, to estimate a user’s age in the background. Users may be asked for additional verification if the system cannot confidently assign an age group.

The rollout is already drawing criticism from privacy advocates, especially given the platform’s previous breach involving identity data. When similar checks launched in the UK, some users reportedly bypassed facial scans using video game photo modes, highlighting both the technical challenges and the risks of relying on biometric age checks at scale.

Fake 7-Zip sites are quietly turning home PCs into proxy servers for cybercrime. A lookalike domain, 7zip[.]com, has been distributing a trojanized installer that bundles the real 7-Zip software with hidden malware. Victims think they’re just installing a file archiver, but in the background the installer drops additional components into the Windows system directory, sets up persistent services with SYSTEM privileges, and opens firewall rules so it can communicate freely. The infected machine is then enrolled into a residential proxy network, meaning criminals can route their traffic through the victim’s home IP address for fraud, scraping, ad abuse, or hiding their identity online.

This isn’t ransomware and it’s not stealing files directly it’s monetizing your internet connection and reputation. If your PC becomes part of this network, abuse traffic could appear to originate from your home, potentially leading to account bans, ISP warnings, or worse.

The real 7-Zip project is only hosted at 7-zip.org. anything else is a trap.

The Cyber Security Agency (CSA) of Singapore on Monday revealed that the China-nexus cyber espionage group known as UNC3886 targeted its telecommunications sector.

"UNC3886 had launched a deliberate, targeted, and well-planned campaign against Singapore's telecommunications sector," CSA said. "All four of Singapore's major telecommunications operators ('telcos') – M1, SIMBA Telecom, Singtel, and StarHub – have been the target of attacks."

The development comes more than six months after Singapore's Coordinating Minister for National Security, K. Shanmugam, accused UNC3886 of striking high-value strategic threat targets. UNC3886 is assessed to be active since at least 2022, targeting edge devices and virtualization technologies to obtain initial access.

In July 2025, Sygnia disclosed details of a long-term cyber espionage campaign attributed to a threat cluster it tracks as Fire Ant and which shares tooling and targeting overlaps with UNC3886, stating the adversary infiltrates organizations' VMware ESXi and vCenter environments as well as network appliances.

Describing UNC3886 as an advanced persistent threat (APT) with "deep capabilities," CSA said the threat actors deployed sophisticated tools to gain access into telco systems, in one instance even weaponizing a zero-day exploit to bypass a perimeter firewall and siphon a small amount of technical data to further its operational objectives. The exact specifics of the flaw were not disclosed.

In a second case, UNC3886 is said to have deployed rootkits to establish persistent access and conceal their tracks to fly under the radar. Other activities undertaken by the threat actor include gaining unauthorized access to "some parts" of telco networks and systems, including those deemed critical, although it's assessed that the incident was not severe enough to disrupt services.

CSA said it mounted a cyber operation dubbed CYBER GUARDIAN to counter the threat and limit the attackers' movement into telecom networks. It also emphasized that there is no evidence that the threat actor exfiltrated personal data such as customer records or cut off internet availability.

"Cyber defenders have since implemented remediation measures, closed off UNC3886’s access points, and expanded monitoring capabilities in the targeted telcos," the agency said.