Based on the sensors reporting to ISC, this activity started on the 13 Jan 2026. My own sensor started seeing the first scan on the 21 Jan 2026 with limited probes. So far, this activity has been limited to a few scans based on the reports available in ISC [5] (select Match Partial URL and Draw):
The KRVTZ IDS alerts dated 2026-01-25 represent network reconnaissance activity detected by an intrusion detection system. These alerts are categorized as low severity and indicate scanning behavior consistent with information gathering phases of a potential attack. No specific vulnerabilities or exploits are identified, and no patches or mitigations are directly applicable. The threat is primarily observational, with no known active exploitation in the wild. European organizations may experience increased scanning activity, which could precede more targeted attacks. The threat does not require authentication or user interaction and affects network monitoring systems rather than specific software products. Given the low severity and reconnaissance nature, the immediate risk is limited but should be monitored as part of broader threat intelligence. Countries with significant internet infrastructure and critical industries may be more likely to observe such scanning activity. Overall, this represents a low-level network threat that should be incorporated into ongoing security monitoring and incident response processes.
The WorldLeaks cybercrime group claims to have stolen information from the footwear and apparel giant’s systems. The post Nike Probing Potential Security Incident as Hackers Threaten to Leak Data appeared first on SecurityWeek .
Other noteworthy stories that might have slipped under the radar: Cloudflare WAF bypass, Canonical Snap Store abused for malware delivery, Curl terminating bug bounty program The post In Other News: €1.2B GDPR Fines, Net-NTLMv1 Rainbow Tables, Rockwell Security Notice appeared first on SecurityWeek .
Threat actors are leveraging the file-sharing service for payload delivery in AitM phishing and BEC attacks. The post Phishers Abuse SharePoint in New Campaign Targeting Energy Sector appeared first on SecurityWeek .
Under Armour is investigating a recent data breach that purloined customers’ email addresses and other personal information. The post Under Armour Looking Into Data Breach Affecting Customers’ Email Addresses appeared first on SecurityWeek .
A new study shows that verse-based prompts can slash the effectiveness of AI safety constraints. We’re breaking down an experiment involving 25 language models and its key takeaways.
A compromised EmEditor installer was used in a software supply chain attack to deliver multistage malware. The attack, discovered in late December 2025, targeted users of this widely-used text editor. The malware performs credential theft, data exfiltration, and enables lateral movement. It uses obfuscated PowerShell scripts and geofencing techniques, suggesting possible Russian origin. The malware disables security features, gathers system information, and exfiltrates data to a command-and-control server. This incident highlights the importance of validating installer integrity, monitoring PowerShell usage, preserving endpoint telemetry, and enforcing least privilege principles. Software publishers are advised to secure download infrastructure and prepare incident response plans.
Pwn2Own participants disclosed a total of 76 vulnerabilities during the three-day event. The post Infotainment, EV Charger Exploits Earn Hackers $1M at Pwn2Own Automotive 2026 appeared first on SecurityWeek .
The Contagious Interview campaign, attributed to North Korea, continues to target software developers through fake recruitment schemes. A new technique in their arsenal leverages Microsoft Visual Studio Code task files to execute malicious code when a project is opened. The report documents observations of this vector, presents GitHub-based discovery methods, highlights findings including a new malicious NPM package, and outlines detection opportunities. The campaign exploits VS Code's Task feature, using the runOptions property to automatically execute malicious shell commands when a workspace is opened. Various obfuscation techniques are employed, including hiding commands with whitespace and masquerading payloads as image or font files.
A new ransomware called Osiris was used in an attack on a major food service franchisee operator in Southeast Asia in November 2025. The ransomware shares similarities with previous Inc ransomware attacks, including the use of Wasabi buckets for data exfiltration and a specific version of Mimikatz. Osiris has typical ransomware functions, uses a hybrid encryption scheme, and drops a ransom note. The attack chain involved data exfiltration using Rclone, deployment of dual-use tools, and the use of a malicious driver called Abyssworker or Poortry. The attackers employed bring-your-own-vulnerable-driver (BYOVD) techniques to disable security software. While the impact of Osiris on the ransomware landscape remains uncertain, it appears to be wielded by experienced attackers with potential links to Inc ransomware or its affiliates.
Dozens of Venezuelan nationals have been charged by the US for their role in ATM jackpotting attacks. The post 2 Venezuelans Convicted in US for Using Malware to Hack ATMs appeared first on SecurityWeek .
CVE-2026-1363 is a critical vulnerability in JNC's IAQS product caused by client-side enforcement of server-side security controls (CWE-603). This flaw allows unauthenticated remote attackers to bypass authentication and gain administrator privileges by manipulating the web front-end. The vulnerability requires no user interaction or privileges and can be exploited remotely over the network. With a CVSS 4.0 score of 9.3, it poses a severe risk to confidentiality, integrity, and availability of affected systems. No patches or known exploits are currently reported. European organizations using IAQS, especially in critical infrastructure or industrial automation sectors, face significant risks of unauthorized control and data compromise. Mitigation requires immediate network-level protections, strict access controls, and vendor engagement for patches. Countries with high adoption of JNC IAQS and strategic industrial targets, such as Germany, France, and the Netherlands, are most likely affected.
CVE-2026-0778 is a high-severity vulnerability in the Enel X JuiceBox 40 electric vehicle charging stations, specifically in the Telnet service running on TCP port 2000. The flaw is due to missing authentication, allowing network-adjacent attackers to execute arbitrary code remotely without any credentials or user interaction. Exploitation results in full compromise of confidentiality, integrity, and availability of the affected device. Although no known exploits are currently in the wild, the vulnerability poses a significant risk to installations running version 4.2.7. European organizations using these charging stations could face operational disruptions and potential lateral movement into broader networks. Mitigations include network segmentation, disabling Telnet if possible, restricting access to port 2000, and monitoring for unusual activity. Countries with high EV adoption and deployments of Enel X JuiceBox 40, such as Germany, France, Italy, and the Netherlands, are most likely to be impacted. Given the ease of exploitation and critical impact, this vulnerability demands urgent attention from defenders.
CVE-2026-0793 is a high-severity heap-based buffer overflow vulnerability in the ALGO 8180 IP Audio Alerter device, specifically in its InformaCast functionality. This flaw allows remote attackers to execute arbitrary code without requiring authentication or user interaction by sending specially crafted data that overflows a heap buffer. The vulnerability arises from improper validation of user-supplied data length before copying it into a heap buffer. Exploitation can compromise the device's confidentiality, integrity, and availability, potentially allowing full control over the device. No known exploits are currently active in the wild. European organizations using ALGO 8180 IP Audio Alerter version 5.5 are at risk, especially critical infrastructure and enterprises relying on these devices for audio alerting. Mitigation requires applying vendor patches once available and implementing network-level protections to restrict access to the device. Countries with higher adoption of ALGO products and significant critical infrastructure deployments, such as Germany, France, the UK, and the Netherlands, are most likely to be affected.
