Loading story…
A variety of cybersecurity incidents and trends were reported in early December, including the exposure of zero-day vulnerabilities, new phishing techniques, and the exploitation of smart home devices. Notable events included leaks revealing the use of zero-days by Intellexa to maintain Predator spyware, Google patching multiple security flaws in Chrome and Android (with some actively exploited), and attackers developing new methods to bypass multi-factor authentication in educational organizations. Additionally, there were reports of large-scale breaches, such as the hacking of 120,000 home security cameras in South Korea for illicit purposes, and the abuse of Microsoft Teams notifications for callback phishing attacks.
Security experts emphasized the importance of proactive measures to protect both organizations and individuals. Recommendations included updating software promptly, using strong and unique passwords, enabling multi-factor authentication, and researching device security before purchase. The risks associated with smart home devices were highlighted, with advice on securing IoT devices to prevent opportunistic attacks. These developments underscore the evolving tactics of threat actors and the need for continuous vigilance in both enterprise and consumer environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
Google issued updates for Chrome and Android to fix multiple security issues, including vulnerabilities reported as actively exploited in the wild.
Hackers compromised about 120,000 home security cameras in South Korea and used the access to produce sexploitation footage, illustrating the privacy risks of insecure IoT devices.
Reporting revealed that the Kohler Dekoda toilet camera was exposed after allegedly misleading users about its encryption protections, raising privacy concerns around health-related IoT devices.
The pro-Palestine group Handala published personal data belonging to Israeli Iron Dome engineers, escalating regional cyber tensions.
Ukraine's military intelligence cyber unit reportedly carried out a major cyberattack on a leading Russian logistics company, causing broad disruption and destroying data.
Uganda rolled out offline biometric voter kits to reduce hacking risks in preparation for the 2026 elections.
The French teleconsultation platform MédecinDirect suffered a data breach impacting almost 300,000 users; the company said video consultations and medical documents were not affected.
New research suggested Indonesia's gambling ecosystem may be serving as a front for state-sponsored cyber operations.
Attackers were reported using Microsoft Teams notifications as part of callback phishing campaigns to trick targets into contacting malicious operators.
BT introduced a sovereign platform intended to improve data security and regulatory compliance for UK organizations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
malwarebytes.com
Open sourcesherpaintelligence.substack.com
Open sourcezdnet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two weekly “roundup” articles summarized a broad set of security developments rather than a single incident. Reported items included **data breaches** (e.g., PayPal, SpyX, California Cryobank), **active exploitation of multiple vulnerabilities** (including a **Google Chrome 0-day** and critical issues in products such as *BeyondTrust*, *Ivanti EPMM*, *Splunk Enterprise*, and *Windows Admin Center*), and **ransomware activity** (e.g., **Hellcat** reportedly breaching Ascom’s ticketing infrastructure and exfiltrating ~44GB of data). The digest also highlighted availability risk via a reported **Cloudflare** global outage attributed to a cascading password-rotation failure. The week-in-review content also mixed security news with interviews and tool/project updates, including discussion of the evolving CISO role amid **agentic AI**, the release of *REMnux v8* (malware analysis distro) with AI integration, and commentary on “harvest now, decrypt later” **quantum** risk. It additionally referenced separate security headlines such as a **firmware-level Android backdoor** on tablets and a **Dell zero-day** reportedly exploited since 2024, but did not provide a unified, single-event narrative across the items.
Jun 29, 2026
Multiple organizations worldwide experienced significant cybersecurity incidents, including ransomware attacks, data breaches, and exploitation of zero-day vulnerabilities. Notable events include a ransomware attack on LG's battery subsidiary by the Akira group, a confirmed breach at Logitech linked to the Clop ransomware group, and a data breach at DoorDash affecting user information. The UK National Health Service (NHS) was compromised via an Oracle EBS zero-day, and Princeton University suffered a data breach impacting alumni, donors, faculty, students, and parents. Additional incidents involved the hacking of Somalia's e-visa system, resulting in the theft of over 35,000 applicants' data, and the disruption of Russian port operator Port Alliance due to a cyberattack. These incidents highlight the ongoing threat posed by ransomware groups, zero-day exploits, and targeted attacks on critical infrastructure and service providers. Security news roundups and technical digests reported on these incidents alongside broader threat intelligence developments. Updates included new and refined detection rules for cloud environments (AWS, Azure), Linux, and Windows, as well as coverage of phishing campaigns, credential theft, and the abuse of legitimate tools for persistence and lateral movement. The cybersecurity community also discussed the impact of AI on security, the proliferation of rogue npm packages, and the need for improved detection engineering to address evolving threats. These developments underscore the importance of timely patching, robust detection capabilities, and cross-sector collaboration to mitigate the impact of increasingly sophisticated cyberattacks.
Jun 29, 2026
Multiple cybersecurity developments were reported in the week of October 6 to October 13, 2025, spanning a wide range of topics and incidents. Apple raised concerns about a proposed age-check law, warning that it could compromise user privacy. The National Institute of Standards and Technology (NIST) updated its guidance on password complexity, suggesting that users do not need excessively complex passwords for security. Two AI companion applications were found to have exposed millions of private chat messages, raising significant privacy concerns. A fake VPN and streaming application was discovered to be distributing malware designed to drain victims' bank accounts. California enacted new data privacy legislation, giving residents greater control over their personal information. An investigation into a stolen iPhone uncovered a smuggling operation moving thousands of devices to China. Scammers were found targeting mature models in a new wave of modeling scams. Security researchers warned that some computer mice could be used for eavesdropping. Malicious actors used fake itch.io pages to distribute malware to gamers under the guise of game testing. A cryptocurrency scam known as 'Best Wallet' was reported to be actively targeting users. A data breach involving CPAP Medical resulted in the leak of personal information belonging to troops and veterans. Discord issued a warning to users after a third-party breach led to the theft of user data. In addition, a cyber threat intelligence briefing highlighted several technical developments. New and updated malware-as-a-service (MaaS) operations were observed launching in anticipation of the holiday season. A critical remote code execution vulnerability was identified in Redis, allowing authenticated users to execute arbitrary code via a Lua use-after-free flaw. The threat actor KTA517, also known as BatShadow, was found targeting digital marketing professionals with malicious ZIP files disguised as job descriptions. Microsoft reported that its Teams platform is being targeted at multiple stages of the attack chain, reflecting its growing importance in enterprise environments. A critical deserialization vulnerability in GoAnyWhere MFT’s License Servlet was exploited by the ransomware group KTA321 (Medusa), enabling attackers to bypass signature verification with forged license responses. These reports collectively illustrate the diverse and evolving threat landscape, with incidents affecting individuals, organizations, and critical infrastructure. The week’s developments underscore the importance of vigilance, timely patching, and user education in mitigating cybersecurity risks. Organizations are advised to monitor threat intelligence sources and apply recommended security measures to protect against these varied threats. The breadth of incidents reported highlights the need for a comprehensive, multi-layered approach to cybersecurity. Security teams should remain alert to both technical vulnerabilities and social engineering campaigns. The ongoing evolution of malware and exploitation techniques requires continuous adaptation of defense strategies.
Jun 29, 2026