Key findings Introduction In December 2025, a previously unknown Ransomware-as-a-Service (RaaS) operation calling itself Sicarii began advertising its services across multiple underground platforms. The group’s name references the Sicarii, a 1st-century Jewish assassins group that opposed Roman rule in Judea. From its initial appearance, the Sicarii ransomware group distinguished itself through unusually explicit and persistent use of Israeli […] The post Sicarii Ransomware: Truth vs Myth appeared first on Check Point Research .
The Predator spyware is more sophisticated and dangerous than previously realized. The post Predator Spyware Turns Failed Attacks Into Intelligence for Future Exploits appeared first on SecurityWeek .
CVE-2025-68963 is a medium-severity vulnerability in Huawei's HarmonyOS version 4.3.1, caused by weak password requirements in the Clone module. This flaw enables a man-in-the-middle (MitM) attack that can compromise service confidentiality without impacting integrity or availability. Exploitation requires network-level access and some user interaction but no privileges. There are no known exploits in the wild, and no patches have been released yet. The vulnerability primarily threatens confidentiality by allowing attackers to intercept sensitive data during cloning operations. European organizations using HarmonyOS devices, especially those in sectors relying on Huawei technology, could be at risk. Mitigation involves enforcing stronger password policies, network segmentation, and monitoring for suspicious MitM activities. Countries with higher Huawei device adoption and strategic interest in Huawei technology, such as Germany, France, Italy, Spain, and the UK, are most likely affected.
CVE-2025-70747 is a high-severity stack overflow vulnerability found in the Tenda AX-1806 router, specifically in the serviceName parameter of the sub_65A28 function. Exploitation allows remote attackers to cause a denial of service (DoS) without requiring authentication or user interaction. The vulnerability has a CVSS score of 7.5, indicating significant impact on availability but no direct impact on confidentiality or integrity. No known exploits are currently in the wild, and no patches have been published yet. European organizations using Tenda AX-1806 routers could face network disruptions if targeted. Mitigation involves network segmentation, restricting access to router management interfaces, and monitoring for anomalous traffic. Countries with higher adoption of Tenda consumer networking equipment, such as Germany, France, and Italy, are more likely to be affected. Given the ease of exploitation and potential for service disruption, this vulnerability demands prompt attention to prevent denial of service attacks.
KRVTZ IDS alerts from January 14, 2026, report automated network reconnaissance and brute force attempts targeting Postfix mail servers. Multiple IP addresses were identified attempting SASL authentication brute forcing, with these attempts detected and blocked. One IP was also flagged for spam activity blocked via DNSBL. These activities represent the reconnaissance phase of attacks, aiming to discover valid credentials or vulnerable configurations. No specific vulnerabilities or exploits are associated, and no patches are available or needed. The threat is low severity due to the lack of successful compromises and absence of denial-of-service indicators. However, persistent brute forcing could lead to credential compromise if defenses are weak. The threat primarily affects European organizations running Postfix servers, with countries like Germany, France, and the UK most likely impacted. Effective monitoring, strong authentication policies, and dynamic IP blocking are critical to mitigating this threat.
A new Magecart network has been uncovered, targeting major payment networks including American Express, Diners Club, Discover, and Mastercard. The campaign, active since January 2022, uses web-skimming techniques to steal credit card information from online shoppers. The attackers inject malicious JavaScript code into compromised e-commerce websites, creating fake payment forms that capture and exfiltrate sensitive data. The skimmer employs sophisticated obfuscation techniques and mimics legitimate payment processes to avoid detection. Victims are unaware of the theft, as the malware allows the real transaction to proceed after capturing the data. The campaign demonstrates advanced knowledge of e-commerce platforms and continues to pose a significant threat to online retailers and consumers worldwide.
AI will assist companies in finding their external attack surface, but it will also assist bad actors in locating and attacking the weak points. The post Cyber Insights 2026: External Attack Surface Management appeared first on SecurityWeek .
This analysis examines a multi-stage Windows malware campaign called SHADOW#REACTOR. The infection chain uses obfuscated VBS, PowerShell downloaders, and text-based payloads to deliver a Remcos RAT backdoor. Key features include fragmented text staging, .NET Reactor protection, reflective loading, and MSBuild abuse as a living-off-the-land binary. The campaign leverages complex obfuscation and in-memory execution to evade detection while establishing persistent remote access. Defensive recommendations focus on script execution monitoring, LOLBin abuse detection, and enhanced PowerShell logging to counter the sophisticated evasion techniques employed.
VoidLink is an advanced malware framework designed for Linux systems, focusing on cloud and container environments. It includes custom loaders, implants, rootkits, and modular plugins for long-term access. The framework employs a flexible architecture with a Plugin API inspired by Cobalt Strike. VoidLink uses multiple security mechanisms, including runtime code encryption and adaptive behavior based on the detected environment. Developed by Chinese-affiliated developers, it demonstrates high technical expertise across multiple programming languages. The framework includes cloud-focused capabilities, credential harvesting, and various command-and-control channels. While its intended use remains unclear, VoidLink appears to be positioned for potential commercial use.
The 44-year-old individual planted remote access malware on a logistics firm’s systems, with help from employees. The post Dutch Port Hacker Sentenced to Prison appeared first on SecurityWeek .
Hackers stole complete customer information, including contact details, national identity numbers, and payment details. The post Spanish Energy Company Endesa Hacked appeared first on SecurityWeek .
Threat actors exploited Cloudflare's free-tier infrastructure and Python environments to deploy AsyncRAT, demonstrating advanced evasion techniques. The attack begins with phishing emails containing Dropbox links to malicious files. It uses legitimate Python downloads and sophisticated code injection targeting explorer.exe. The campaign ensures persistence through multiple vectors, including startup folder scripts and WebDAV mounting. It abuses trusted infrastructure like Cloudflare to mask activities and evade detection. The attackers employ social engineering tactics, such as displaying legitimate PDF documents, to reduce suspicion. This campaign highlights the trend of abusing cloud services for malware delivery and execution, emphasizing the need for multi-layered security approaches.
In 2025, AI did not revolutionize cyber attacks as predicted. Instead, adversaries used AI to accelerate traditional tradecraft, focusing on speed and accessibility rather than new offensive capabilities. The article examines several case studies showcasing AI-generated scripts for credential theft and browser exploitation. These attacks, while faster and more accessible to less-skilled operators, still rely on familiar techniques detectable by basic security measures. The outlook for 2026 suggests continued AI-driven commoditization of tradecraft, with more templated attacks and improved phishing attempts. However, fundamental security practices remain effective against these evolving threats.
APT28 was seen impersonating popular webmail and VPN services, including Microsoft OWA, Google, and Sophos VPN portals. The post Russia’s APT28 Targeting Energy Research, Defense Collaboration Entities appeared first on SecurityWeek .
For the latest discoveries in cyber research for the week of 12th January, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Manage My Health, New Zealand’s largest patient portal, has acknowledged a cyberattack occurred on December 2025, that potentially exposed data of nearly 110K users. An alleged attacker, dubbed Kazu, claimed responsibility and […] The post 12th January – Threat Intelligence Report appeared first on Check Point Research .
CVE-2026-0854 is a high-severity OS command injection vulnerability affecting Merit LILIN DH032 DVR/NVR devices. It allows authenticated remote attackers to inject and execute arbitrary operating system commands on the device without user interaction. The vulnerability stems from improper neutralization of special elements in OS commands (CWE-78). Exploitation requires authentication but no user interaction, and the attack vector is network-based. Although no known exploits are currently reported in the wild, the vulnerability poses a significant risk to device integrity and confidentiality. The affected devices are commonly used in video surveillance systems, which are critical infrastructure components in many European organizations. Mitigation requires applying vendor patches once available and implementing network segmentation and strict access controls. Countries with high adoption of Merit LILIN products and critical surveillance infrastructure, such as Germany, France, Italy, and the UK, are most likely to be impacted. Due to the high CVSS score of 8.7, this vulnerability demands urgent attention from security teams managing these devices.
