VulnHub

The DKnife toolkit has been in use since 2019, allowing attackers to hijack traffic from edge devices to spy on users and deliver malware. This toolkit targets routers and other network devices, making it a significant threat to both individuals and organizations that rely on these systems for internet connectivity. By intercepting data, attackers can monitor communications and potentially steal sensitive information. The ongoing use of DKnife illustrates the persistent risks posed by advanced cyber espionage techniques. Users and companies need to be vigilant about securing their network devices to prevent such intrusions.

The Cybersecurity & Infrastructure Security Agency (CISA) has issued a warning regarding a serious vulnerability, identified as CVE-2026-24423, in SmarterMail. This flaw allows for unauthenticated remote code execution (RCE), which means attackers could potentially take control of affected systems without needing any prior authentication. This vulnerability has already been leveraged in ransomware attacks, posing significant risks to users and organizations running SmarterMail. Users are urged to take immediate action to secure their systems, as the flaw could lead to severe data breaches and operational disruptions. The urgency of this warning stems from the active exploitation of the flaw in the wild, highlighting the need for prompt remediation.

A new global campaign is taking advantage of older home routers that are no longer receiving security updates. Attackers are exploiting these outdated devices to hijack domain name system (DNS) settings, which can lead to users being redirected to malicious websites without their knowledge. This affects anyone still using these vulnerable routers, which are particularly common in homes and small businesses. The lack of security updates makes these devices easy targets for cybercriminals, raising significant concerns about the safety of personal data and online activities. Users are urged to check their router's firmware and consider upgrading to newer models that receive regular updates.

In November 2025, a massive DDoS attack reached a peak of 31.4 terabits per second, making it one of the largest ever recorded. The attack was executed by the AISURU/Kimwolf botnet and lasted for just 35 seconds. Fortunately, Cloudflare's security systems were able to automatically detect and block the attack before it could cause significant disruption. This incident is part of a worrying trend of increasingly powerful and brief DDoS attacks that can overwhelm even the most robust defenses. Organizations must remain vigilant as such attacks not only threaten individual services but also have the potential to disrupt broader internet infrastructure.

German security officials are alerting the public about a series of phishing attempts targeting high-profile individuals, including military officials, diplomats, and investigative journalists, primarily using the messaging app Signal. Authorities believe these attacks are likely orchestrated by a state-backed hacking group, although they acknowledge that non-state actors could exploit similar tactics. The attackers are reaching out directly to their targets within the app, which raises concerns about the security of private communications among key figures. This situation is significant as it not only threatens the privacy of those affected but also poses risks to national security and the integrity of journalistic work. The potential for similar attacks by financially motivated cybercriminals adds another layer of urgency to the warnings.

On December 29, 2025, Poland's critical infrastructure faced a series of cyberattacks aimed at energy and industrial sectors, including wind and solar farms, a manufacturing company, and a combined heat and power plant. The attacks were executed by a single threat actor, as confirmed by Poland's national computer emergency response team, CERT Polska. Fortunately, these incidents were purely destructive and did not disrupt energy generation or distribution. The attackers gained access through exposed VPN connections, raising concerns about the security practices in place across the nation’s energy sector. This incident serves as a reminder of the vulnerabilities that can exist in critical infrastructure systems, emphasizing the need for improved cybersecurity measures.

Researchers have identified a supply chain attack affecting legitimate npm and PyPI packages, specifically targeting versions of @dydxprotocol/v4-client-js. The compromised versions include 3.4.1, 1.22.1, 1.15.2, and 1.0.31. Attackers have modified these packages to distribute malware designed to steal cryptocurrency wallet credentials and enable remote access through RAT (Remote Access Trojan) software. This incident poses a significant risk to developers and users relying on these packages, as it can lead to unauthorized access to sensitive financial information. Companies and individual developers should review their dependencies and ensure they are using safe versions to mitigate potential risks.

A significant vulnerability has been found in SmarterMail, a popular email server software, which allows attackers to execute arbitrary code remotely without needing authentication. This flaw has already been exploited in ransomware attacks, raising concerns for organizations that rely on this software. Attackers can send specially crafted HTTP requests to take control of affected systems, potentially leading to data breaches and operational disruptions. Users and administrators of SmarterMail are urged to take immediate action to protect their systems. The situation is critical as the vulnerability is currently being exploited in the wild, making prompt remediation essential.