This week’s threat intelligence report delves into a series of significant cyber incidents that continue to shape the security landscape. Supply-Chain and Data Breaches: Noteworthy is the eScan antivirus supply-chain compromise, potentially impacting numerous users. Additionally, the Crunchbase data breach has resulted in the exposure of 2 million records, raising concerns over data privacy. Meanwhile, the Qilin ransomware has targeted Tulsa Airport, highlighting the persistent threat ransomware poses to critical infrastructure. Vulnerabilities and Exploits: Among the most critical vulnerabilities, the WinRAR path traversal flaw (CVE-2025-8088) stands out, actively exploited by state-backed entities. Other alarming discoveries include SmarterMail issues that enable remote code execution (RCE) and admin takeover, and an SSO authentication bypass in Fortinet FortiCloud. AI-Related Threats: This report identifies over 900 Clawdbot instances left exposed online and details malicious Chrome extensions linked to ChatGPT, which are stealing session tokens. The RedKitten campaign, assisted by large language models (LLMs), is specifically targeting Iranian activists. Check Point’s 2026 Cyber Security Report also emphasizes AI’s growing role as an attack multiplier and its contribution to ransomware fragmentation. Emerging Threats and Research: Reports document RansomHub’s breach of Luxshare, a key Apple supplier, and a massive leak of 72 million records affecting Under Armour. Cyberattacks have disrupted the network of Dresden’s museum in Germany. AI threats are escalating with phenomena such as prompt injection in Google Gemini and the creation of polymorphic malware via LLMs. GPT models are dramatically reducing the technical barrier for generating zero-day exploits. Critical vulnerabilities needing immediate attention include those found in Anthropic’s MCP server and vulnerabilities in Zoom routers. The discovery of VoidLink, a new AI-generated malware framework, is concerning, alongside KONNI’s targeted phishing campaign at developers, exploiting Microsoft Teams, and the appearance of a new ransomware family, Osiris. This report serves as a stark reminder of the evolving and multifaceted nature of cyber threats, urging continued vigilance and proactive defense strategies.

Collections

This week's threat intelligence covers major cyber incidents including the eScan antivirus supply-chain compromise, Crunchbase data breach exposing 2 million records, and Qilin ransomware attack on Tulsa Airport. Critical vulnerabilities include WinRAR path traversal (CVE-2025-8088) exploited by state actors, SmarterMail RCE flaws, and Fortinet FortiCloud SSO bypass. AI-related threats are escalating with 900+ exposed Clawdbot instances, malicious ChatGPT Chrome extensions stealing tokens, and LLM-assisted RedKitten campaign targeting Iranian activists. Notable incidents include RansomHub's breach of Apple supplier Luxshare, 72 million records leaked from Under Armour, and new threats like VoidLink AI-generated malware framework and Osiris ransomware family. GPT models are lowering barriers for zero-day exploit generation.

February 2nd – Comprehensive Threat Intelligence Report