VulnHub

The Cybersecurity and Infrastructure Security Agency (CISA) has updated 59 entries in its Known Exploited Vulnerabilities (KEV) catalog to indicate that these vulnerabilities are being actively exploited in ransomware attacks. This update raises concerns among security experts because it implies that organizations may be unaware that their systems are vulnerable to these specific attacks. The vulnerabilities affect a range of products, and the updates were made without much public awareness, which could leave many companies at risk. It's crucial for organizations to review these updates and apply necessary patches to protect against potential ransomware threats. This situation stresses the need for better communication regarding vulnerability management in the cybersecurity community.

Researchers have identified a new ransomware-as-a-service (RaaS) variant known as 'Vect'. This operation stands out due to its custom malware, which poses a significant threat to organizations. The Vect RaaS allows attackers to easily deploy ransomware attacks, potentially affecting a wide range of victims, from small businesses to larger enterprises. The introduction of this variant raises concerns about the increasing sophistication of ransomware operations, making it crucial for companies to bolster their cybersecurity measures. Users are advised to stay vigilant and regularly update their security protocols to defend against such evolving threats.

Hackers have successfully compromised an update server belonging to MicroWorld Technologies, the company behind eScan Antivirus. This breach allowed attackers to inject malicious files into updates that were sent to eScan customers, effectively turning the antivirus software into a delivery mechanism for malware. Users who updated their eScan software during this incident may have inadvertently installed harmful files on their systems. This incident raises significant concerns about the security of software supply chains, highlighting how even trusted software can be weaponized. Users are advised to remain vigilant and consider checking their systems for any signs of compromise.

On January 20, Kaspersky detected malware associated with a supply chain attack targeting eScan antivirus software. This incident suggests that attackers compromised the update mechanism of eScan, potentially allowing them to distribute malicious updates to users. Companies using eScan antivirus are at risk, as the malware could lead to unauthorized access or data breaches. Users of the software should be vigilant and consider immediate actions to protect their systems. Kaspersky has provided indicators of compromise and mitigation strategies for affected users to follow in order to secure their environments.

MicroWorld Technologies, the company behind the eScan antivirus software, has confirmed that one of its update servers was compromised. This breach allowed attackers to distribute a malicious update to a small number of eScan users earlier this month. The unauthorized update was later analyzed and flagged as harmful, raising concerns about the security of users' systems. Although the number of affected customers is limited, the incident underscores the risks associated with software updates and the potential for malicious actors to exploit vulnerabilities in update mechanisms. Users of eScan should remain vigilant and ensure their software is updated from legitimate sources to avoid such threats.

A defect in WinRAR, a popular file compression tool, has been exploited by cybercriminals and nation-state groups for the past six months. This vulnerability is particularly concerning as it has been used to target sensitive sectors, including military, government, and technology organizations, primarily for espionage purposes. As attackers take advantage of this flaw, affected organizations risk data breaches and unauthorized access to sensitive information. Users of WinRAR are strongly urged to update their software to the latest version to mitigate these risks. The ongoing exploitation of this defect illustrates the persistent threat posed by both cybercriminals and state-sponsored actors in today's digital landscape.

This week, cybersecurity experts noted a series of vulnerabilities and security incidents that demonstrate how attackers are exploiting both old and new methods to breach systems. Flaws in firewalls and browser-based traps are particularly concerning, as they reveal weaknesses in tools that users often trust. These security lapses suggest that just because a software issue has been patched doesn't mean it is safe. The ongoing evolution of malware, including AI-generated variants, presents a significant challenge for companies trying to defend against increasingly sophisticated threats. Organizations need to stay vigilant and update their defenses regularly to protect against these emerging risks.

A new ransomware strain called Osiris was identified in a November 2025 attack targeting a significant food service franchise in Southeast Asia. Researchers from Symantec and Carbon Black reported that the attackers used a malicious driver known as POORTRY through a technique called Bring Your Own Vulnerable Driver (BYOVD) to disable security tools. This method allowed the ransomware to operate without detection, posing a serious risk to the affected organization. With ransomware attacks on the rise, this incident highlights the need for companies to strengthen their defenses against evolving tactics. The incident serves as a reminder for businesses to continuously update their security measures and remain vigilant against such threats.