Author: Staff Writer

Essential Insights Authorities seized and disrupted four major botnets—Aisuru, Kimwolf, JackSkid, and Mossad—that hijacked over 3 million devices to carry out more than 300,000 DDoS attacks, some of which reached record sizes. The operation, supported by global law enforcement especially in Canada and Germany, cut off the botnets’ command-and-control infrastructure, preventing further attacks and infection. Kimwolf, one of the largest DDoS botnets ever detected, exploited residential proxy networks, infecting over 2 million Android devices, marking a significant shift in botnet operation methods. Infected devices included DVRs, webcams, routers, and TV boxes—many in the U.S.—highlighting how consumer IoT devices are vulnerable…

Top Highlights A critical zero-day vulnerability (CVE-2026-20131) in Cisco Secure Firewall Management Center and Security Cloud Control has been actively exploited in ransomware attacks, prompting CISA to add it to the Known Exploited Vulnerabilities Catalog. The vulnerability involves deserialization of untrusted data via the web-based management interface, allowing remote attackers to execute arbitrary Java code with root privileges, leading to full system compromise. Exploitation enables attackers to bypass security defenses, manipulate security policies, conduct network mapping, exfiltrate data, and deploy ransomware across enterprise networks. Urgently, organizations must apply official patches or mitigations by March 22, 2026, and restrict network access…

Fast Facts Sicherheitsbehörden in Nordamerika und Deutschland haben zwei der weltweit größten Botnetze «Aisuru» und «Kimwolf» erfolgreich zerschlagen, die vor allem für DDoS-Angriffe genutzt wurden. Das Botnetz «Aisuru» infizierte hauptsächlich IoT-Geräte und führte den größten bekannten DDoS-Angriff mit 31,4 Terabit pro Sekunde durch; «Kimwolf» konzentrierte sich auf Android- und Consumer-Geräte. Durch internationale Kooperation wurden die Infrastruktur der Botnets abgeschaltet, wobei zwei mutmaßliche Administratoren identifiziert, aber keine Tatverdächtigen festgenommen wurden. Bei den Durchsuchungen in Deutschland und Kanada wurden umfangreiche Beweismittel, darunter Kryptowährungen im fünfstelligen Bereich, sichergestellt; rechtliche Konsequenzen sind zu erwarten. The Core Issue The story reports a major international law…

Top Highlights Navia, a U.S. benefits administrator, experienced a data breach exposing sensitive personal and health information of approximately 2.7 million individuals, involving a breach window from December 2025 to January 2026. The breach primarily compromised core identity data and limited Protected Health Information, which could enable social engineering and identity theft, though financial account data remained unaffected. Navia responded by securing its systems, engaging law enforcement, and offering impacted individuals 12 months of free identity monitoring and credit protection through Kroll, while implementing enhanced security measures. Experts recommend affected individuals activate fraud alerts, security freezes, and regularly monitor financial…

Summary Points SpyCloud’s 2026 Identity Exposure Report reveals a 23% increase in stolen identity data, totaling 65.7 billion records, with a significant rise in non-human identities like API keys and machine credentials, many lacking MFA and operating with broad permissions. Phishing remains a top enterprise threat, with 28.6 million compromised identities in 2025, nearly half of which are corporate users; attackers exploit session cookies, tokens, and MFA data for sophisticated session hijacking and MFA bypass via advanced techniques. Malware-based exfiltration also continues, with over 642 million credentials stolen from 13.2 million infections, often on devices with security tools, demonstrating endpoint…

Quick Takeaways A Russian state-linked threat actor, attributed to APT28 (Fancy Bear), exploited a stored XSS vulnerability in Zimbra Collaboration Suite to target a Ukrainian government agency, stealing email data and credentials without typical malware indicators. The attack, dubbed “Operation GhostMail,” involved a sophisticated, two-stage browser-based payload delivered via a seemingly innocuous phishing email, enabling silent credential harvesting and long-term mailbox access. The campaign exploited CVE-2025-66376, a patched vulnerability, by embedding encoded JavaScript in emails, which executed silently in Zimbra’s Classic UI, capturing sensitive data and exfiltrating it covertly over HTTPS and DNS channels. Organizations using Zimbra are advised to…

Essential Insights Authorities worldwide dismantled the command-and-control infrastructure of four major IoT botnets (Aisuru, KimWolf, JackSkid, Mossad), which infected over three million devices and launched record-breaking DDoS attacks reaching 30 Tbps. The botnets exploited vulnerable IoT devices, including cameras and routers, often behind firewalls, and used sophisticated evasion techniques to infect isolated devices. Operators monetized the botnets by leasing access as a cybercrime platform, enabling others to carry out large-scale DDoS and extortion attacks targeting critical infrastructure and organizations globally, including U.S. defense networks. The coordinated law enforcement action involved seizures, legal procedures, and international collaborations, demonstrating the vital role…

Top Highlights The US government urges organizations to strengthen endpoint management security, emphasizing role-based access control, multi-factor authentication, and multi-admin approval processes, especially for services like Microsoft Intune. The recent Stryker attack illustrates how threat actors can exploit trusted endpoint management tools like Microsoft Intune to remotely wipe devices and disrupt operations at a global scale. Experts warn that endpoint management systems are high-value targets; securing them requires strict privilege controls, continuous monitoring, micro-segmentation, and rapid incident response capabilities. Governments and security researchers are actively disrupting threat infrastructure, exemplified by the FBI seizing two Handala websites linked to Iranian threat…

Fast Facts AI-powered financial fraud is now 4.5 times more profitable than traditional methods, with criminals exploiting it for sophisticated, scalable attacks. AI lowers entry barriers for cybercriminals, enabling less-skilled actors to conduct convincing, real-time, personalized phishing, impersonation, and deepfake extortion. The ongoing, rapid learning capabilities of AI allow fraud schemes to continuously evolve, increasing their effectiveness and making defenses slow to catch up. Organizations must enhance cybersecurity strategies by training teams, adopting AI-integrated defenses, promoting verification and critical thinking, and consulting industry experts to stay ahead of AI-driven threats. The Core Issue Recently, cybercriminals have harnessed AI, transforming it…

Top Highlights Zscaler expands its global data sovereignty capabilities with over 160 data centers and region-specific control and logging planes for compliance and data residency needs. Its decentralized architecture enables localized data control, including in-region SSL inspection and private service edges, strengthening data protection and regulatory adherence. The platform offers enhanced compliance features like full encryption key control, standardized security controls across regulations, and regional support, ensuring transparency and legal conformity. Zscaler’s resilient cloud infrastructure, owned and operated by itself, guarantees high availability and business continuity while enabling organizations to meet local sovereignty and security requirements. Enhancing Data Control with…