Tracking Threats, Incidents, and Vulnerabilities
Tracking Threats, Incidents, and Vulnerabilities
Operation Sentinel, led by Interpol, arrested 574 individuals and recovered $3 million tied to cybercrimes across 19 countries, deactivating over 6,000 malicious links and decrypting six ransomware strains. The initiative highlights increasing cyber threats, with significant cases in Senegal, Ghana, Benin, and Cameroon reflecting joint international law enforcement efforts.
NIST faced issues with NTP servers after a power outage in Boulder caused atomic clock drift. A staffer contemplated shutting down servers to prevent spreading incorrect time, but a generator failure complicated efforts. Despite the outage, NIST maintained operations using backup power, reporting minimal time deviation. Users dependent on Boulder’s time were advised to use alternate sources. By December 21, services were restored, showing stability with only slight clock errors, emphasizing the importance of using multiple time sources.
https://www.theregister.com/2025/12/21/nist_ntp_outage_warning/
Europol warns of potential rampant robot crime by 2035 due to automation, predicting protests, riots, and hacking of AI-powered robots. The report highlights threats like drones used for attacks, urging police to prepare for criminal actions involving both humans and robots. While acknowledging some scenarios may be exaggerated, the warning illustrates the growing concerns about technology replacing humans in various sectors, leading to societal unrest.
https://www.vice.com/en/article/robot-crime-could-be-rampant-by-2035-law-enforcement-warns/
WIRED magazine's user data breach exposed 2.3M records, including email addresses and personal info. Users are advised to change passwords and enable two-factor authentication to enhance security. Breach occurred in September 2025, added to HIBP on December 27, 2025.
Access Now's Digital Security Helpline investigates government spyware hacks targeting journalists and activists. Staffed by experts from Costa Rica, Manila, and Tunisia, it assists victims by assessing potential spyware infections and offering support. The helpline has seen a surge in cases, now handling about 1,000 per year, driven by increased awareness and the proliferation of spyware. Collaborating with organizations like CiviCERT, they aim to empower civil society in navigating cybersecurity threats.
Trust Wallet's Chrome extension was hacked on December 24, leading to $7 million in stolen cryptocurrency. Users reported wallet drain incidents post-update. Trust Wallet confirmed the issue and released a security patch (version 2.69) to resolve it, advising users to update immediately. A phishing campaign targeting affected users also emerged, prompting Trust Wallet to warn about compromised domains. Users should refrain from using version 2.68 and secure their funds by moving them to new wallets.
Ronald Deibert, founder of the Citizen Lab, has worked for over two decades to uncover digital threats and abuses of power. Based at the University of Toronto, the lab is unique for its independence from government and corporate interests, focusing on public interest investigations into cyberthreats. Deibert warns that democracy, particularly in the U.S., is under threat, noting a rise in authoritarian practices. Despite risks to himself and his team, the lab's work continues to influence global human rights and cybersecurity discussions, including laying groundwork for sanctions against spyware vendors. Deibert emphasizes the importance of their mission, especially as similar research faces challenges in the U.S.
Cybersecurity Predictions 2026 highlight a major shift in threats as AI increasingly shapes cyber warfare. Over 100 expert forecasts indicate a rise in autonomous malware, identity-centric attacks, and ransomware, with ransomware victims projected to increase 40% and AI-driven attacks expected to comprise 50% of threats. Key trends include:
– Autonomous AI in cyberattacks revolutionizing traditional defenses.
– AI-enhanced phishing and deepfake technology complicating identity fraud.
– Increased reliance on cloud systems exposing new vulnerabilities.
– Emergence of Zero Trust Architectures to counteract identity theft.
– Regulatory compliance transforming into strategic business imperatives.
Organizations must adapt by embracing proactive defense strategies to measure resilience and recovery speed amidst evolving threats, asserting that future cybersecurity transcends mere IT concerns to become a core business priority.
https://cybersecuritynews.com/cybersecurity-predictions-2026/
LastPass's 2022 data breach allowed hackers to exploit weak master passwords, facilitating cryptocurrency thefts lasting into late 2025. TRM Labs linked these activities to Russian cybercriminals using their exchanges to launder over $35 million in stolen assets. Despite attempts to mask transactions with CoinJoin techniques, evidence revealed operational patterns leading to identifications. The breach highlights the lasting vulnerabilities of poor password security, with the U.K. fining LastPass $1.6 million for inadequate protections.
https://thehackernews.com/2025/12/lastpass-2022-breach-led-to-years-long.html
NIST and MITRE launch $20 million AI cybersecurity project, focusing on protecting critical infrastructure. Two centers established—one for manufacturing, another for AI-driven cybersecurity solutions for essential services like water and electricity. Aim: enhance U.S. tech, reduce adversarial risks, foster industry collaboration. Input from critical sectors emphasized for effective cybersecurity strategies.
https://cyberscoop.com/nist-mitre-announce-20-million-dollar-research-effort-on-ai-cybersecurity/
Critical CVSS 9.9 vulnerability found in n8n workflow automation platform allows arbitrary code execution. Affects versions ≥0.211.0 and <1.120.4, impacting over 103K instances. Fixes available in recent updates; users urged to patch ASAP or limit access.
https://thehackernews.com/2025/12/critical-n8n-flaw-cvss-99-enables.html
CISA's ransomware warning program, crucial in preventing $9 billion in damages, is jeopardized after its lead, David Stern, resigned rather than accept a reassignment. His departure raises concerns about the program's future and relationships with stakeholders, as it heavily depended on his connections and expertise. CISA asserts that the program continues, but its effectiveness may diminish without Stern's leadership.
https://www.cybersecuritydive.com/news/cisa-ransomware-warning-program-key-employee-left/808589/
New MacSync Stealer malware targets macOS users via digitally signed apps, operating silently unlike older versions. Disguised as a legitimate installer, it steals sensitive information after installation. The malware can bypass macOS security due to being signed with Apple’s Developer ID. Researchers noted a shift from requiring user action to automated processes, complicating detection. Following its identification, the malicious ID was reported and revoked by Apple.
OpenAI acknowledges AI browsers, like its Atlas, are perpetually at risk of prompt injection attacks, which manipulate AI to execute hidden malicious instructions. Despite efforts to enhance security, including a reinforcement learning-based automated attacker to identify flaws, prompt injections may never be fully mitigated, raising concerns about the safety of AI operation on the web. Ongoing layered defenses and user caution are recommended, yet the high access risk of these browsers poses a significant challenge.
Amazon’s Chief Security Officer, Stephen Schmidt, revealed that the company thwarted over 1,800 attempts by North Korean impostors to gain employment since April 2024. These impostors, often hired by contractors, aim to raise funds for the DPRK, including its weapons programs. Schmidt emphasized the importance of thorough background checks and advanced security software to detect such fraudulent activities.
