In December 2025, Poland experienced a significant cyber attack on its power grid, attributed to the Russia-linked hacking group Sandworm. Researchers from ESET analyzed the malware involved and determined that the attack was one of the largest targeting Poland's energy infrastructure. The involvement of Sandworm, known for its previous cyber operations, raises concerns about the security of critical national systems. This incident not only endangers the stability of Poland's energy supply but also highlights the ongoing risks posed by state-sponsored cyber threats in Europe. As nations increasingly rely on digital infrastructure, the implications for energy security and national defense become more pronounced.
The North Korean hacker group Konni is targeting blockchain developers and engineers with malware created using artificial intelligence. This new form of PowerShell malware is designed to infiltrate systems and steal sensitive information from individuals working in the blockchain sector. As the blockchain industry continues to grow, these attacks pose a significant risk to its security and the integrity of its projects. Developers in this field need to be particularly vigilant and ensure they have the latest security measures in place to protect against these sophisticated threats. The use of AI in malware creation represents a concerning evolution in cybercrime tactics, making it harder for security professionals to defend against such attacks.
In late December 2025, the Russian hacking group Sandworm attempted a significant cyber attack on Poland's power sector, described by officials as the largest of its kind targeting the country's energy infrastructure. The attack involved a new type of malware called DynoWiper, which was designed to disrupt power operations. Fortunately, the attack was thwarted, and Poland's energy minister, Milosz Motyka, confirmed that the country's cyberspace forces detected and responded to the threat in time. This incident emphasizes the ongoing risks facing critical infrastructure from state-sponsored actors and highlights the importance of robust cybersecurity measures in protecting essential services. As cyber threats continue to evolve, organizations must remain vigilant to safeguard against potential disruptions.
Cybernews has reported that fake cryptocurrency wallet applications are targeting Linux users, specifically those pretending to be popular wallets like Exodus, Trust Wallet, and Ledger Live. These malicious apps are available in the Canonical Snap Store and have been designed to steal cryptocurrency from unsuspecting users. This situation poses a significant risk for Linux users who may believe they are downloading legitimate software when in fact they are exposing themselves to malware. Users are advised to be cautious when downloading apps and to verify the authenticity of the software they use for managing their cryptocurrency. The increase in such scams highlights the ongoing dangers in the crypto space, especially for those using less traditional operating systems like Linux.
The Osiris ransomware, which emerged in November, is raising concerns among cybersecurity experts due to its advanced techniques that suggest the involvement of experienced attackers. This ransomware targets various organizations, encrypting their data and demanding a ransom for its release. The sophistication of Osiris indicates that it could pose a significant risk to businesses that might not have robust security measures in place. As ransomware continues to evolve, companies must be vigilant and proactive in their cybersecurity strategies to defend against such threats. Understanding the tactics used by Osiris can help organizations better prepare for potential attacks and minimize their impact.
Two Venezuelan nationals have been convicted for their involvement in an ATM jackpotting scheme that resulted in the theft of hundreds of thousands of dollars from U.S. banks. Federal prosecutors in South Carolina announced that after serving their prison sentences, the men will be deported back to Venezuela. Jackpotting refers to a method where criminals use malware to manipulate ATMs, causing them to dispense cash without proper authorization. This case highlights the ongoing risks of ATM fraud and the challenges law enforcement faces in addressing cybercrime that crosses international borders. The actions of these individuals not only impacted financial institutions but also posed risks to consumers and the integrity of banking systems in the U.S.
Two Venezuelan men have been convicted in the United States for their involvement in ATM jackpotting schemes, which use malware to hack into ATMs and dispense cash fraudulently. This conviction is part of a larger crackdown on a network of Venezuelan nationals charged with similar crimes. The attacks typically involve manipulating ATM software to trick machines into disbursing large amounts of money without authorization. This case is significant as it highlights the ongoing issue of international cybercrime and the risks posed to financial institutions and consumers. The convictions may serve as a deterrent to others considering similar criminal activities.
A new attack method called the 'Contagious Interview' has emerged, exploiting trust granted to repository authors in Visual Studio Code (VS Code). Once a user gives access to a malicious application from a compromised repository, the app can execute arbitrary commands on the user's system without requiring any further interaction. This poses a significant risk to developers and users who rely on VS Code for their projects, as it can lead to unauthorized access and control over their systems. The attack leverages the trust inherent in open-source collaborations, making it crucial for users to scrutinize the sources of their software. As this method becomes more prevalent, developers should be cautious about the repositories they trust.
A new type of Linux malware called VoidLink has emerged, specifically targeting cloud environments. What makes this malware stand out is that it has been primarily developed using artificial intelligence. Researchers are concerned about its sophistication and the potential risks it poses to organizations that rely on cloud services. The use of AI in its development could allow for more adaptive and dangerous attacks, making it critical for companies to bolster their security measures. As this malware evolves, it could lead to significant data breaches if not addressed promptly.
North Korean hackers are targeting macOS developers by luring them to malicious projects on GitHub and GitLab that are opened with Visual Studio Code. The attackers use these repositories to trick users into executing harmful code, potentially compromising their systems. This tactic poses a significant risk to developers who may unknowingly download and run these malicious projects, which could lead to data breaches or further exploitation of their systems. As these attacks exploit popular development tools, developers need to be vigilant about the sources of the projects they access. This incident emphasizes the ongoing threat posed by state-sponsored hackers and the need for heightened awareness in the software development community.
A new malware framework called VoidLink has been identified as a sophisticated threat targeting Linux systems. Research from Check Point indicates that this framework was likely developed by an individual with the help of artificial intelligence. The malware has reached an impressive 88,000 lines of code, showcasing its complexity and potential for damage. The findings also reveal operational security mistakes made by the author, which provided insights into its creation. This development is concerning for Linux users and organizations, as it points to an increasingly advanced and potentially widespread malware landscape.
USB drives pose a significant security risk for enterprises, as they can easily introduce malware into corporate networks. Researchers warn that these small devices often go unchecked and can lead to data breaches or unauthorized access. Many organizations still rely on USB drives for data transfer, making them an attractive target for cybercriminals. The ease of use and widespread availability means that employees might unwittingly use infected drives, compromising sensitive information and systems. Companies should implement strict policies regarding the use of USB drives and consider investing in security solutions that can monitor and control their use.
A malicious Visual Studio Code extension has been identified as a vehicle for distributing the Evelyn information-stealing malware. Cybersecurity researchers have found that this multi-stage attack can compromise sensitive information from affected users. Developers and users of Visual Studio Code are particularly at risk, as the extension can infiltrate systems through the widely used code editor. This incident underscores the need for caution when installing extensions from unverified sources. Users should ensure they only use trusted extensions and maintain updated security software to protect against such threats.
A new infostealer malware called SolyxImmortal has emerged, believed to be developed by a Turkish-speaking hacker. This malware allows attackers to covertly monitor users and steal sensitive data by utilizing legitimate application programming interfaces (APIs) and third-party libraries, making detection more difficult. The exact targets of this malware have not been specified, but its stealthy nature poses a significant risk to individuals and organizations that rely on affected software. As cybercriminals continuously evolve their tactics, it’s crucial for users to remain vigilant and ensure their systems are secure against such threats.
A new cybersecurity threat involves a malicious browser extension called NexShield, which uses social engineering tactics to crash users' browsers. This attack is designed to deliver a Python-based Remote Access Trojan (RAT), putting users' systems at risk of further compromise. The method relies on tricking users into installing the extension, which then takes control of their browsers. As a result, individuals and organizations that fall victim could face significant data theft or system damage. Users are advised to be cautious about browser extensions and ensure they are from trusted sources to avoid falling prey to such scams.