VulnHub

A new malware toolkit called 'Stanley' is being sold on cybercrime forums for between $2,000 and $6,000. This toolkit enables attackers to create counterfeit websites that mimic legitimate ones, facilitating phishing attacks. The post claims that the toolkit can publish these fraudulent sites on the Chrome Web Store, increasing their visibility and potential for success. This poses a significant risk to users who may unknowingly provide sensitive information to these spoofed sites. The emergence of such tools highlights the ongoing challenges in combating online fraud and the need for users to be vigilant when navigating web applications.

Poland's energy sector recently faced a severe cyber attack attributed to the Russian hacking group Sandworm. This incident involved a wiper malware that aimed to disrupt the functioning of the power grid, posing significant risks to the country's energy stability. Authorities have raised alarms about the potential for further attacks, as Sandworm is known for its destructive tactics and has previously targeted critical infrastructure. The implications of this attack extend beyond Poland, reflecting ongoing geopolitical tensions and the vulnerability of national infrastructures to cyber warfare. As the situation develops, experts urge energy companies to enhance their cybersecurity measures to prevent similar incidents in the future.

Researchers at Check Point have linked an active phishing campaign to the North Korean hacking group KONNI, also known by several other names. This campaign specifically targets software developers and engineers, using deceptive emails that present fake documentation related to blockchain projects. The attackers are employing an AI-generated PowerShell backdoor to infiltrate systems. This tactic not only showcases the group's evolving methods but also raises concerns about the security of developers working in the rapidly growing blockchain sector. The implications are significant, as successful compromises could lead to data theft and further exploitation of vulnerabilities within the tech community.

Russian hackers known as Sandworm have been accused of launching a cyberattack on Poland's power grid using data-wiping malware. This incident comes a decade after they disrupted the Ukrainian power grid, indicating a pattern of targeting critical infrastructure in Eastern Europe. The attack poses significant risks, not only to Poland's energy supply but also raises concerns about regional security and the potential for similar incidents in other countries. As tensions between Russia and NATO continue, this incident could escalate fears about cyber warfare and its impact on national security. Authorities are investigating the attack and assessing the full extent of its impact on the power grid operations.

In December 2025, Poland experienced a significant cyber attack on its power grid, attributed to the Russia-linked hacking group Sandworm. Researchers from ESET analyzed the malware involved and determined that the attack was one of the largest targeting Poland's energy infrastructure. The involvement of Sandworm, known for its previous cyber operations, raises concerns about the security of critical national systems. This incident not only endangers the stability of Poland's energy supply but also highlights the ongoing risks posed by state-sponsored cyber threats in Europe. As nations increasingly rely on digital infrastructure, the implications for energy security and national defense become more pronounced.

A newly discovered vulnerability in VMware products allows attackers to execute remote code by sending specially crafted network packets. This critical-severity flaw poses a serious risk for organizations using affected VMware systems, as it could lead to unauthorized access and control over their networks. VMware has not specified which products are impacted, but the nature of the vulnerability suggests that any systems relying on VMware technologies could be at risk. Companies should prioritize patching their systems as soon as updates are available to prevent potential exploitation. The urgency is heightened as this vulnerability is now a target for attackers.

A new ransomware strain called Osiris was identified in a November 2025 attack targeting a significant food service franchise in Southeast Asia. Researchers from Symantec and Carbon Black reported that the attackers used a malicious driver known as POORTRY through a technique called Bring Your Own Vulnerable Driver (BYOVD) to disable security tools. This method allowed the ransomware to operate without detection, posing a serious risk to the affected organization. With ransomware attacks on the rise, this incident highlights the need for companies to strengthen their defenses against evolving tactics. The incident serves as a reminder for businesses to continuously update their security measures and remain vigilant against such threats.

The North Korean hacker group Konni is targeting blockchain developers and engineers with malware created using artificial intelligence. This new form of PowerShell malware is designed to infiltrate systems and steal sensitive information from individuals working in the blockchain sector. As the blockchain industry continues to grow, these attacks pose a significant risk to its security and the integrity of its projects. Developers in this field need to be particularly vigilant and ensure they have the latest security measures in place to protect against these sophisticated threats. The use of AI in malware creation represents a concerning evolution in cybercrime tactics, making it harder for security professionals to defend against such attacks.

Nike is currently investigating a potential security incident after the WorldLeaks cybercrime group claimed to have stolen sensitive data from the company. The attackers have threatened to leak this information if their demands are not met. This situation raises concerns about the security of customer data and proprietary company information, which could lead to significant reputational damage for Nike. As the investigation unfolds, it is important for users and stakeholders to stay informed about the nature of the data involved and any implications for their privacy and security. Companies like Nike must remain vigilant to protect against such threats as cybercriminals continue to target large organizations.

In late December 2025, the Russian hacking group Sandworm attempted a significant cyber attack on Poland's power sector, described by officials as the largest of its kind targeting the country's energy infrastructure. The attack involved a new type of malware called DynoWiper, which was designed to disrupt power operations. Fortunately, the attack was thwarted, and Poland's energy minister, Milosz Motyka, confirmed that the country's cyberspace forces detected and responded to the threat in time. This incident emphasizes the ongoing risks facing critical infrastructure from state-sponsored actors and highlights the importance of robust cybersecurity measures in protecting essential services. As cyber threats continue to evolve, organizations must remain vigilant to safeguard against potential disruptions.