All news in category “Threat and Trends Reports”

🔒 This week's recap highlights persistent, trust‑based attacks that quietly exploited updates, extensions, sessions, and messages to scale impact across IoT, browsers, and collaboration platforms. A nine‑month RondoDox campaign leveraged React2Shell for RCE in React Server Components, while a supply‑chain compromise of Trust Wallet extensions exposed GitHub secrets and Chrome Web Store keys, enabling roughly $8.5M in crypto theft. Newly observed groups like DarkSpectre abused legitimate extensions to reach millions of users, and well‑resourced actors reused successful trust vectors rather than relying on one‑off exploits.

🔎 Elliptic's analysis shows Chinese-language darknet marketplaces on Telegram have expanded to unprecedented scale, despite Telegram's early‑2025 takedowns of two major sites. The current leading platforms, Tudou Guarantee and Xinbi Guarantee, are estimated to facilitate nearly $2 billion per month in money‑laundering and illicit commerce. They traffic in stolen data, scam infrastructure, fake investment sites, AI deepfake tools, and a wide range of illegal services that directly enable large-scale "pig butchering" romance and investment scams.

🔐 Cybersecurity in 2025 is framed as an architectural challenge rather than a set of isolated controls. This contributed report surveys shifts across authentication, endpoint and network security, software supply chains, SaaS data governance, AI-driven defenses, and human risk. It highlights hardware‑backed authentication, passkeys, binary-level verification, and network telemetry as pivotal controls. Vendors stress speed, visibility, and provable trust as the operational priorities.

🐍 Researchers disclosed a new Python-based information stealer called VVS Stealer that harvests Discord tokens, account data and browser credentials. The malware, sold on Telegram with subscription and one-time tiers, is obfuscated with Pyarmor and packaged via PyInstaller to hinder analysis. It persists by adding itself to the Windows Startup folder and shows fake "Fatal Error" pop-ups. VVS injects into Discord and uses a downloaded obfuscated JavaScript payload to monitor traffic via the Chrome DevTools Protocol for session hijacking.

🔐 Federated Identity Management (FIM) enables a single authentication to span multiple applications or organizations, letting users sign in once and reuse identity assertions across services. It improves user experience and resilience while introducing architectural complexity, potential vendor lock-in, and additional service costs. Implementations commonly rely on cloud identity providers such as Google, Microsoft, or Okta and use protocols like SAML, OAuth 2.0, and OpenID Connect.

🔒 A Qualys survey and analysis of roughly 44 million public-cloud VMs highlights widespread misconfiguration: 45% of AWS, 63% of GCP and 70% of Azure instances showed issues. Respondents reported breaches and identified misconfigured services as a leading cloud risk. Experts cite neglected logging, monitoring and MFA, rushed M&A integrations and understaffed small firms as common causes. The piece recommends concrete controls — from Infrastructure as Code and continuous scanning to private networking and least-privilege — to reduce exposure.

🔍 Attack Surface Management often produces growing inventories and alerts, but visibility alone rarely demonstrates reduced incidents. The author argues organizations should shift ROI assessment from raw discovery counts to outcome metrics such as mean time to asset ownership, reduction in unauthenticated, state-changing endpoints, and time to decommission after ownership loss. Making ownership and exposure duration visible across teams accelerates remediation and makes ASM defensible in budget reviews.

🔍 Unit 42 provides a detailed technical analysis of VVS stealer, a Python-based malware family that targets Discord users and Chromium/Firefox browsers to exfiltrate tokens, credentials, and browser data. The report explains distribution as PyInstaller packages protected with Pyarmor (observed v9.1.4) and documents the deobfuscation steps used to recover bytecode, AES keys, and encrypted strings. It summarizes runtime behaviors including Discord client injection via modified Electron files, webhook-based exfiltration, persistence in %APPDATA%, and sample indicators defenders can monitor.

🛡️ ISC2’s 2025 Cybersecurity Workforce Study of 16,029 professionals finds that skills shortages have overtaken headcount as the primary concern for security teams. Budget constraints leave 33% of respondents unable to adequately staff and 29% unable to afford skilled hires, while 88% reported at least one incident linked to skills gaps. The report highlights rapidly accelerating AI adoption—69% are at some adoption stage—and stresses capability development, targeted training, and realistic workload expectations over simple headcount increases.

🛡️ Third-party risk is a growing enterprise threat underscored by recent supply-chain attacks, including the June 2024 compromise of TeamViewer by APT29. The article argues organizations often depend on hundreds or thousands of vendors with limited transparency, immature security practices, and hidden subcontractors, which makes traditional vendor assessments a weak defense. It proposes the musk oxen strategy: collective intelligence-sharing, coordinated remediation support, and joint negotiation to strengthen common weak links and reduce systemic risk.

🔒 2025 saw a convergence of large-scale breaches, state-aligned intrusions, and rapidly maturing AI-enabled attacks that reshaped the threat landscape. High-profile incidents included the ByBit $1.5B Ethereum heist, Clop exploitation of Oracle zero-days, and mass data-theft campaigns targeting Salesforce and adult platforms. Attackers amplified impact with terabit-scale DDoS, developer supply-chain abuse, and social-engineering techniques such as ClickFix and help-desk compromises. Organizations raced to patch zero-days, lock down developer pipelines, and defend against AI-powered malware and novel prompt-injection vectors.

📄 IT leaders are preparing strategies for 2026 that prioritize agility, flexibility, and measurable business outcomes. The January 2026 Enterprise Spotlight, produced by editors from CIO, Computerworld, CSO, InfoWorld, and Network World, synthesizes trends and technologies — from cloud-native operations and automation to cybersecurity and workforce enablement — expected to drive IT agendas. It outlines practical priorities, investment areas, and the metrics organizations should track to deliver tangible results.

🔒 Cybersecurity in 2025 was defined by high-profile breaches, weaponized AI and renewed focus on supply-chain and vulnerability management. Major events included vendor withdrawals from MITRE ATT&CK evaluations, a large-scale IoT proxy network, a critical Fortinet zero-day in active exploitation, and the fast mitigation of an npm package compromise. New risks such as 'quishing', LLM-driven hallucination attacks and agentic AI guidance from OWASP also shaped the year.

🔎 This post summarizes a cross‑national pattern of LinkedIn job scams in which fake employers and recruiters extract money or credentials from prospective employees. Tactics vary by market: tech‑job baiting in India, referral‑style fraud in Kenya, fake formal roles in Mexico, and credential‑harvesting schemes in Nigeria. The author emphasizes these are employer‑side frauds and distinct from scams where attackers pose as employees to secure remote work.

🔒 Many enterprise CISOs continue to struggle to abandon passwords despite decades of effort and mounting security risks. RSA’s ID IQ Report 2026, based on a survey of 2,000 security professionals, finds that 90% of respondents report problems with passwordless deployments. Technical complexity across hybrid environments, legacy systems, OT/IoT devices, and inconsistent platform support creates gaps that often force organizations to retain insecure fallbacks. Experts recommend sequencing rollouts to secure privileged users first, using reverse proxies or VPN-enforced SSO for legacy apps, and ensuring end-to-end phishing-resistant enrollment and recovery.

🔍 Cybercrime has evolved into a structured, global underground economy that frequently outperforms corporate IT in speed, efficiency and scale. Organized groups now run with defined roles, measurable KPIs and productized offerings such as Ransomware-as-a-Service, enabling nontechnical affiliates to launch high-impact attacks. The decisive metric is no longer if an organization will be targeted but how quickly it can recover and limit reputational and operational damage.

⚠️ Cybercrime has matured into a structured, global underground economy that often outstrips corporate defenders. Groups now operate with division of labor, formal processes and professional marketing, and Ransomware-as-a-Service offerings enable nontechnical actors to lease malware, support and revenue-sharing schemes. The result is scalable, fast-moving criminal supply chains that exploit human error, weaponize stolen data and exploit slow, bureaucratic response models. Organizations must move beyond pure prevention to measurable resilience, rehearsed recovery and decisive incident leadership.

🔍 Post-incident reviews are a structured means to understand security incidents and improve future defenses. Conducted promptly, they preserve fresh details and enable accurate timelines that reveal where delays or failures occurred. Reviews must include root-cause analysis, evaluation of detection and response performance, and assessment of business impact. Involving legal, governance, finance, HR, and board stakeholders helps connect technical findings to policy and risk decisions, while avoiding blame and assigning concrete, timebound follow-up is essential.

⚠️ ErrTraffic is a self-hosted cybercrime platform that automates ClickFix social engineering by injecting code into compromised websites to display convincing browser or font 'glitches' and prompt victims to install updates or run commands. The service, promoted on Russian-speaking forums for a one-time $800 fee, fingerprints OS and geolocation to deliver architecture-specific payloads. According to Hudson Rock, infections deploy Windows info-stealers (Lumma, Vidar), Android Cerberus, macOS AMOS, and various Linux backdoors, while the operator has excluded CIS countries.

🔐 The convergence of operational technology (OT) and information technology (IT) creates major business opportunities but also introduces significant cybersecurity complexity and risk. Legacy OT equipment, cultural divides between OT and IT teams, and a historical focus on uptime over security increase exposure as organisations digitise critical infrastructure. Leaders must embed security by design, address compliance such as NIS2, and unite teams to manage cloud, AI and device proliferation.