TLDR INFORMATION SECURITY 2026-01-15

CONVINCING LINKEDIN COMMENT-REPLY TACTIC USED IN NEW PHISHING

Scammers are flooding LinkedIn posts with fake reply comments from company pages impersonating LinkedIn (e.g., "Linked Very"), warning users about bogus policy violations and directing them to credential-harvesting sites. The campaign gains credibility by using LinkedIn's official lnkd.in URL shortener to mask phishing domains, making malicious links harder to identify without clicking. LinkedIn confirmed awareness and emphasized that it never communicates policy violations through public comments.

CYBERATTACK FORCES BELGIAN HOSPITAL TO TRANSFER CRITICAL CARE PATIENTS

A ransomware attack on AZ Monica hospital in Antwerp severely disrupted IT systems, forcing servers offline and halting most surgeries and many treatments, including imaging and chemotherapy. Critical patients were moved with Red Cross help, while other hospitals, including Amsterdam UMC, took over urgent chemotherapy.

PERSONAL DETAILS OF THOUSANDS OF BORDER PATROL AND ICE AGENTS ALLEGEDLY LEAKED IN HUGE DATA BREACH

Sensitive data belonging to around 4,500 ICE and Border Patrol employees has been released by a Department of Homeland Security whistleblower. The leaked data includes names, work emails, phone numbers, roles, and some resume data. The data was leaked to the ICE List website, which stated that it would conduct a manual review to filter out certain roles before releasing the data.

VOIDLINK: THE CLOUD-NATIVE MALWARE FRAMEWORK

VoidLink is a sophisticated Zig-based Linux malware framework from Chinese-affiliated developers. It features a cloud-first design that detects AWS, GCP, Azure, Alibaba, and Tencent environments and adapts its behavior based on detected EDRs and security controls. The framework includes 37+ plugins inspired by Cobalt Strike's BOF architecture, environment-adaptive rootkit deployment (LD_PRELOAD, eBPF, or LKM-based on the kernel version), and multiple C2 channels, including HTTP, DNS tunneling, ICMP, and P2P mesh networking. VoidLink's credential-harvesting targets cloud environments, Git repositories, and SSH keys, suggesting that software engineers and cloud infrastructure are primary targets for espionage or supply chain attacks.

CVE-2025-64155: THREE YEARS OF REMOTELY ROOTING THE FORTINET FORTISIEM

A series of vulnerabilities in Fortinet's FortiSIEM platform allows a remote, unauthenticated attacker to gain full control of the appliance, from admin access to root. The weakness lies in how the phMonitor service processes certain storage-related requests, ultimately enabling crafted data to reach a curl-based health-check script and inject extra arguments. By abusing curl's features, an attacker can write arbitrary files as the FortiSIEM admin user and then leverage a writable script executed by root via cron to escalate privileges. Combined, these flaws permit long-term, stealthy compromise of FortiSIEM deployments.

CHOOSING A MANAGED SERVICE PROVIDER

The UK's NCSC released a guide and checklist for small- to medium-sized enterprises (SMEs) seeking to choose a Managed Service Provider (MSP) for IT and security services. Organizations should request any certifications the MSP has, customer testimonials, and ensure the MSP communicates clearly and transparently. Organizations should also ask the MSP about their policies on patching, backups, data access, logging, and incident response.

with no credit card

AI-KNOWLEDGE-GRAPH

ai-knowledge-graph is a Python tool that extracts Subject-Predicate-Object triplets from unstructured text using any OpenAI-compatible LLM endpoint and generates interactive knowledge graph visualizations. It features automatic text chunking, entity standardization across document segments, and relationship inference to connect disconnected graph components. The tool outputs interactive HTML visualizations with community detection, centrality-based node sizing, and filtering controls.

AURA-INSPECTOR

Aura-inspector is a Swiss Army knife of Salesforce Experience Cloud testing. It facilitates in discovering misconfigured Salesforce Experience Cloud applications as well as automates much of the testing process.

NOVEE (PRODUCT LAUNCH)

Novee offers a continuous, AI-driven penetration testing platform that simulates sophisticated real-world attackers to uncover novel vulnerabilities, including complex business logic flaws. It also provides exploit validation, automated retesting, and remediation guidance.

PHYSICAL ATTACKS ON CRYPTO HOLDERS - WRENCH ASSAULTS RISING?

France has experienced a surge in violent "wrench attacks" targeting cryptocurrency holders and their relatives between 2024 and 2026, exploiting self-custody's fundamental weakness: anyone with the key or seed phrase can irreversibly transfer funds without bank intervention. Attackers identify targets through public displays of wealth on social media, data leaks from crypto firms like Ledger, and potentially compromised access to government databases, including new EU crypto-asset reporting systems under DAC8. Recommended mitigations include operational security measures, time-locked transactions, and multisignature wallet schemes requiring geographically distributed keys.

RESEARCHERS NULL-ROUTE OVER 550 KIMWOLF AND AISURU BOTNET COMMAND SERVERS

Black Lotus Labs null-routed over 550 C2 nodes associated with the AISURU/Kimwolf botnet, which has infected more than 2 million Android devices—primarily unsanctioned TV streaming boxes with exposed Android Debug Bridge (ADB) services. The botnet exploits vulnerabilities in residential proxy services to propagate, turning compromised devices into proxy nodes for DDoS attacks and malicious traffic relay. Security teams should monitor for ADB exposure on network devices and block traffic to the identified C2 infrastructure.

I ALMOST LOST MY APPLE ACCOUNT TO THE MOST SOPHISTICATED PHISHING ATTACK I'VE EVER SEEN

A security-conscious user received several 2FA prompts and SMS verification codes for their Apple account one afternoon, followed by an automated call warning them that their account was under attack. After receiving this call, a second call came from a very professional-sounding employee who created a support case for the user, verified that it was from Apple to build trust, and walked the user through resetting their password. The phish then had the user “close the case” via an SMS link, which directed them to a sophisticated phishing site where they could steal the user's credentials.

UKRAINE'S ARMY TARGETED IN NEW CHARITY-THEMED MALWARE CAMPAIGN

CERT-UA reported that the suspected Russian threat group Void Blizzard targeted Ukrainian Defense Forces officials via Signal and WhatsApp with charity-themed lures delivering the PluggyApe backdoor, which now features MQTT-based C2 communication and dynamic address retrieval from paste sites.

GLOBAL CYBERSECURITY OUTLOOK 2026

The WEF's fifth annual cybersecurity report shows 94% see AI as the main cyber driver, 87% cite AI vulnerabilities as the fastest-growing risk, and 91% of large organizations are revising cybersecurity strategies due to geopolitical volatility.

ANTHROPIC FINDS $1.5 MILLION TO HELP PYTHON FOUNDATION IMPROVE SECURITY

Anthropic is donating $1.5 million to the Python Software Foundation to enhance security in CPython and PyPI, thereby lowering supply chain risks for millions of Python developers and possibly other open source ecosystems too.