Brightspeed, a major U.S. fiber broadband provider, is reportedly the target of a significant cyberattack, with the threat group “Crimson Collective” claiming responsibility for breaching the company’s systems and allegedly obtaining sensitive data. This incident raises concerns about the security of critical national infrastructure, given Brightspeed’s extensive operations across 20…

A sophisticated and dangerous new malware, dubbed Kimwolf botnet, has stealthily compromised over two million devices globally. These infected devices are being exploited as illegal proxy servers without their owners’ knowledge, enabling a range of illicit online activities. Discovered in late 2025 by cybersecurity researchers, the Kimwolf botnet has a…

Ilya Lichtenstein, previously convicted in connection with the 2016 Bitfinex cryptocurrency hack, has announced his early release from prison. Lichtenstein, who pleaded guilty to money laundering charges, stated his release was facilitated by the First Step Act, a U.S. federal law enacted in 2018. His projected release date, according to…

A threat actor, identified as 1011, has claimed to have accessed and leaked sensitive development data from NordVPN, including over ten database source codes and critical authentication credentials. The alleged breach, disclosed on a dark web forum on January 4, 2026, reportedly stems from a misconfigured development server in Panama,…

CyberKnight has partnered with Hexnode, a global Unified Endpoint Management (UEM) provider, to enhance endpoint visibility and control for businesses in the Middle East and Africa (MEA). This collaboration aims to centralize the management of diverse device fleets, addressing the increasing complexity faced by organizations as they adopt digital transformation…

Cardano users are the target of a sophisticated phishing campaign promoting a fake “Eternl Desktop” application. The scheme aims to trick individuals into downloading malicious software disguised as a legitimate wallet solution. This new threat highlights the growing ingenuity of cybercriminals exploiting the excitement around new cryptocurrency ecosystem developments. The…

The U.S. Treasury Department this week removed three Iranian individuals from its sanctions list who had been previously accused of working for Intellexa, the consortium known for developing Predator spyware. The decision comes despite recent investigations highlighting the spyware’s potential to bypass human rights safeguards and continued concerns from researchers.…

A sophisticated cyber threat group, known as the RondoDoX botnet, has intensified its campaign by aggressively exploiting newly discovered vulnerabilities in web applications and Internet of Things (IoT) devices. Analysis of command-and-control logs from March to December 2025 reveals a persistent and escalating strategy to compromise enterprise infrastructure, deploying cryptominers…

Iranian-linked hacking group Handala claimed responsibility in December 2025 for a significant cyberattack targeting two prominent Israeli political figures, gaining what they described as full mobile device compromise. However, a detailed analysis by Kela cyber intelligence researchers revealed a more targeted breach: the attackers compromised specific Telegram accounts rather than…

Cybersecurity researchers have uncovered a modified and highly obfuscated version of the Shai Hulud malware strain. This updated variant, detailed in recent security analyses, provides critical insights into the evolving tactics of threat actors targeting software development environments to exfiltrate sensitive data. The discovery underscores the persistent threat posed by…

After a ten-year hiatus, the sophisticated cyber threat group known as Careto, also recognized as “The Mask,” has re-emerged with advanced attack strategies. Security researchers have detected renewed activity from Careto, indicating a significant evolution in their methods to compromise critical infrastructure and maintain persistent access to sensitive networks. The…

As 2026 dawns, the cybersecurity landscape is already demonstrating that threat actors operate with relentless evolution, not seasonal breaks. This year’s opening ThreatsDay Bulletin highlights a concerning trend: a shift towards more subtle, precise attacks that often go unnoticed until significant damage is done. In essence, the era of noisy,…