Home
The first week of 2026 confirmed a clear trend: attackers are shifting from noisy infrastructure takeovers to trust abuse and perception manipulation. Instead of large, unambiguous “smash-and-grab” breaches, the week was shaped by:
- A high‑profile but non‑production NordVPN “breach” claim, weaponizing incomplete test data exposure and social perception.
- An escalation in Russia‑aligned UAC‑0184 espionage using Viber as a delivery channel for Hijack Loader and Remcos RAT against Ukrainian military and government targets.
- A major e‑commerce supply chain compromise at Global‑e impacting Ledger customers and other brands, with over 200M records claimed by data brokers.
- A sophisticated PHALT#BLYX ClickFix campaign targeting European hospitality via fake Booking.com emails, fake BSOD screens, and abuse of PowerShell and MSBuild to deploy DCRat.
- A Lynx ransomware attack claim against French fashion retailer Hartford, reinforcing that rebranded RaaS operations are aggressively expanding into new verticals.
Strategic observation: the battleground is shifting from infrastructure to trust planes—third‑party providers, collaboration platforms, and user perception. CISOs must assume that any trusted platform (VPN brands, booking systems, messaging apps) can become a vehicle for extortion or intrusion, even when core infrastructure is not technically breached.
>>Outpace Attackers With AI-Based Automated Penetration Testing
Incident 1: NordVPN Development Environment Exposure Claim
Date of Report: 4 January 2026
Sources: BleepingComputer, eSecurityPlanet, TechRadar, CyberPress
Overview
On 4 January 2026, a threat actor using the alias “1011” posted on BreachForums claiming to have compromised a NordVPN server and exfiltrated “10+ databases” containing Salesforce API keys, Jira tokens, and other sensitive data tied to NordVPN’s internal systems. The actor shared table listings and sample fields to bolster credibility, triggering widespread coverage and customer concern.
NordVPN quickly responded, stating that the data originated from a third‑party development/test environment used in a vendor evaluation, populated only with dummy test data and fully isolated from production infrastructure and real customer information. According to NordVPN, this environment was decommissioned months earlier and never connected to live systems.
Explanation
The incident centers on perception rather than technical impact:
- Alleged intrusion:
- 1011 claimed to have found and brute‑forced a misconfigured NordVPN‑related server, obtaining access to multiple databases, including a Salesforce database and Jira-related tables.
- Shared metadata included objects such as salesforce_api_step_details and purported token tables to suggest access to integration workflows.
- NordVPN’s forensic position:
- The server belonged to a third‑party vendor under evaluation, not NordVPN’s production infrastructure.
- Data were synthetic, created for test purposes; credentials and tokens were non-functional.
- Environment had no network path to NordVPN’s production systems, VPN infrastructure, or payment platforms.
No reputable source has provided evidence contradicting NordVPN’s assessment as of 6 January 2026.
Impact
- Operational:
- No outage, no confirmed compromise of production systems, and no VPN service degradation.
- No evidence of customer session data, keys, or real internal tokens being exposed.
- Data:
- Exposed content appears limited to test schemas and dummy records.
- The primary data value is contextual (e.g., revealing potential internal naming conventions) rather than directly exploitable secrets.
- Reputational:
- High. Public headlines framed the story as a “NordVPN breach” before full technical clarification.
- Customer uncertainty requires deliberate communication to avoid erosion of trust in VPN privacy guarantees.
Details
MITRE ATT&CK Mapping (based on claims, not proven exploitation):
- Initial Access – T1110.001 Brute Force: Threat actor claims brute‑forcing access to the server.
- Discovery – T1087 Account Discovery / T1083 File and Directory Discovery: Enumerating database tables and schemas to identify high-value objects.
- Collection/Exfiltration – T1530 Data from Cloud Storage Object / T1041 Exfiltration Over C2 Channel: Bulk extraction of database content (if genuine).
Key Technical Elements:
- Server Role: Third‑party test environment for Salesforce-related integration evaluation.
- Schema Artifacts (from actor’s screenshots/posts):
- Tables labeled similarly to salesforce_api_step_details, integration_logs, and generic user/token tables.
- Forum TTPs:
- Actor used sample rows and schema exports as proof rather than full data dumps—typical of reputation- and extortion-oriented postings.
No production IOCs (IPs, domains, hashes) tied to NordVPN’s core environment have been published by reputable threat intel sources.
Takeaway for CISO
This is a vendor governance and crisis-communications exercise, not a classical breach.
- Treat every third‑party test or PoC environment as a potential public liability, even when populated with dummy data:
- Isolate on dedicated VLANs or private cloud accounts.
- Enforce hard time‑boxed lifecycles with automatic teardown and credential revocation.
- Build an internal “breach claim” runbook that locks together security, legal, and communications so you can respond within hours when a threat actor posts partial or misleading data.
- Assume threat actors will increasingly attempt reputation attacks—using ambiguous data to sow doubt—especially against security brands. Your preparation should focus as much on evidence-based narrative control as on technical containment.
>>Outpace Attackers With AI-Based Automated Penetration Testing
Incident 2: UAC‑0184 Viber Espionage Against Ukrainian Targets
Date of Report: 5 January 2026
Sources: TheHackerNews, Rescana, Security Affairs, SOC Defenders
Overview
Russia‑aligned threat actor UAC‑0184 (also referenced as Hive0156) was observed continuing and intensifying a spearphishing campaign targeting Ukrainian military and government organizations using the Viber messaging platform. The objective is espionage, with full remote access established via Hijack Loader and Remcos RAT.
Explanation
Infection Chain (high level):
- Delivery via Viber
- Victims receive Viber messages containing ZIP attachments (e.g., A2393.zip) allegedly from the Verkhovna Rada of Ukraine (parliament) or other official entities.
- ZIP archives include LNK shortcuts masquerading as Word/Excel documents.
- Execution via LNK
- User double‑clicks the LNK file, which silently executes a PowerShell script rather than opening a document.
- PowerShell downloads a secondary ZIP, often named smoothieks.zip, from attacker infrastructure.
- DLL Side‑Loading & Hijack Loader
- smoothieks.zip contains a legitimate signed binary such as CFlux.exe and a malicious DLL.
- The benign executable is abused for DLL side‑loading, loading the malicious DLL which reconstructs Hijack Loader in memory using module stomping and custom control flow.
- Remcos RAT Deployment
- Hijack Loader injects Remcos RAT into a legitimate process like chime.exe, providing full RAT capabilities: keystroke logging, screen capture, file exfiltration, and command execution.
- Persistence & Evasion
- Malware scans for security products using CRC32 hashes of known vendors (Kaspersky, Bitdefender, Microsoft, etc.) and adjusts behavior accordingly.
- Persistence is typically achieved through scheduled tasks, allowing survival across reboots.
Impact
- Operational:
- Long‑term persistence on endpoints used by Ukrainian military and government personnel.
- Ability to capture operational plans, communications, and credentials.
- Strategic:
- Direct contribution to battlefield and strategic intelligence for Russia, particularly around logistics, deployments, and political decision-making.
- Defensive Complexity:
- Heavy reliance on living‑off‑the‑land binaries (LOLBins), side‑loading, and steganographic techniques makes signature-only defenses ineffective.
Details
MITRE ATT&CK Mapping:
- T1566.001 – Phishing: Spearphishing Attachment (ZIP with LNK via Viber)
- T1204.002 – User Execution: Malicious File (LNK disguised as document)
- T1059.001 – Command and Scripting Interpreter: PowerShell
- T1574.002 – Hijack Execution Flow: DLL Side‑Loading (CFlux.exe + malicious DLL)
- T1055.012 – Process Injection: Process Hollowing (Remcos into chime.exe)
- T1053.005 – Scheduled Task for persistence
- T1027.009 – Obfuscated/Steganographic Content (IDAT/PNG techniques reported in related UAC‑0184 activity)
Representative IOCs (from public analysis and related campaigns):
- Files & Processes:
- ZIP archives: A2393.zip, smoothieks.zip
- Legitimate binaries: CFlux.exe, chime.exe
- Injected or trojanized loaders with IDAT steganography and module stomping characteristics.
- Network & C2:
- Remcos C2 example from related UAC‑0184 analysis: 194.87.31[.]181
- Dynamic domains and HTTPS-based C2 endpoints.
Hunting & Log Patterns:
text
# LNK + PowerShell staging
index=edr
(process_name=”powershell.exe” OR process_name=”pwsh.exe”)
AND parent_process_name=”explorer.exe”
AND command_line=”*smoothieks.zip*”
| stats count by host, user, command_line
# DLL side-loading of CFlux.exe
index=edr process_name=”CFlux.exe”
| join type=inner host
[ search index=edr event_type=”image_load”
loaded_module!=”*\\cflux.dll” ] # Non-standard DLLs
| table _time host process_name loaded_module
# Suspicious scheduled tasks
index=edr event_type=”task_created”
| where parent_process!=”svchost.exe” AND parent_process!=”taskschd.msc”
| table _time host task_name parent_process
Takeaway for CISO
Messaging platforms are now first‑class attack surfaces.
- Email controls alone will not stop this: Viber, Signal, WhatsApp, and other messaging apps must be considered Tier‑1 ingress channels.
- Prioritize endpoint behavioral monitoring over protocol-specific perimeter defenses:
- Look for LNK → PowerShell → LOLBin → RAT chains, irrespective of initial delivery.
- For organizations in or adjacent to active geopolitical conflict, invest in continuous threat hunting specifically targeting loader families (Hijack Loader, IDAT Loader) and Remcos RAT, not just commodity malware names.
Incident 3: Ledger / Global‑e E‑Commerce Supply Chain Breach
Date of Report: 5 January 2026
Sources: The Register, other breach roundups
Overview
On 5 January 2026, Ledger confirmed that customer order data had been exposed via a breach at its e‑commerce partner Global‑e. Data from multiple brands using Global‑e were impacted. Data broker ShinyHunters claimed to be in possession of more than 200 million records, though exact figures remain unverified.
Explanation
- Breach locus: Global‑e’s cloud‑based information systems hosting e‑commerce order data for multiple merchants, including Ledger.
- Data exposed (per Global‑e and Ledger communications):
- Names, email addresses, postal addresses, phone numbers
- Order metadata: order IDs, product names, amounts paid
- No passwords, seed phrases, or payment card numbers were reported exposed.
The attack vector has not yet been publicly detailed. The scale of the dataset suggests either misconfigured cloud storage, compromised application credentials, or abused internal APIs.
Impact
- Customer Risk:
- High risk of targeted phishing and brand impersonation, leveraging accurate order details and personal data.
- High potential for downstream fraud campaigns (crypto scams positioned as Ledger support, refund scams, etc.).
- Regulatory:
- Ledger and other impacted brands may face GDPR and other regulatory inquiries due to PII exposure via their processor.
- Reputational:
- Ledger must manage customer perception despite being a downstream victim.
Details
MITRE ATT&CK Mapping (at Global‑e level):
- T1199 – Trusted Relationship (compromised third‑party e‑commerce platform)
- T1530 – Data from Cloud Storage Object (cloud‑resident order data)
- T1567.002 – Exfiltration to Cloud Storage or Web Services (mass export)
Technical Indicators & Patterns (conceptual):
- Massive read/export operations on order tables / storage buckets over long periods.
- Access tokens or API keys misused outside normal IP ranges and time windows.
Example query pattern for merchants monitoring partner logs:
sql
— Partner-side anomaly detection for bulk export
SELECT actor_id, COUNT(*) AS export_ops, SUM(bytes_transferred) AS total_bytes
FROM global_e_audit
WHERE event_type = ‘EXPORT’
AND event_time > ‘2025-10-01’
GROUP BY actor_id
HAVING total_bytes > 10 * 1024 * 1024 * 1024; — >10 GB
Takeaway for CISO
Your brand bears the cost of your partners’ mistakes.
- Treat all processors, e‑commerce platforms, and fulfillment providers as extensions of your own environment:
- Contractually require near real‑time breach notification, not “without undue delay.”
- Demand auditable logs and telemetry sharing for your tenants.
- Minimize shared data:
- Only send the fields absolutely required for order processing.
- Implement data minimization and retention SLAs with partners; reduce the historical footprint they hold.
- Internally, assume that any PII shared with a third party can be compromised. Architect your customer communication and fraud detection playbooks on that basis, not as an exception.
>>Outpace Attackers With AI-Based Automated Penetration Testing
Incident 4: PHALT#BLYX ClickFix Campaign Targets European Hospitality
Date of Report: 4–6 January 2026
Sources: TheHackerNews, Infosecurity Magazine, Securonix, SC World, The Record
Overview
A sophisticated campaign dubbed PHALT#BLYX targets the European hospitality sector, combining fake Booking.com reservation emails, fake BSOD (“Blue Screen of Death”) pages, and ClickFix-style prompts to trick hotel staff into manually executing a PowerShell command that deploys DCRat (Dark Crystal RAT).
The campaign was observed beginning in late December 2025 and remained active through early January 2026, hitting hotels during one of the busiest booking periods of the year.
Explanation
End-to-end infection flow:
- Phishing Email (Booking.com Impersonation)
- Email subject/body references reservation cancellations with high-value charges (often >€1000) to create urgency.
- “See details” links lead to an attacker-controlled domain via redirectors (e.g., oncameraworkout[.]com/ksbo → low-house[.]com).
- Fake CAPTCHA → Fake BSOD Page
- Landing page initially shows a CAPTCHA, then transitions to a fake Windows BSOD-style screen.
- Page provides “recovery instructions”: open Windows Run, paste a copied command, and press Enter.
- User‑Executed PowerShell Command
- The pasted PowerShell one-liner locates msbuild.exe on the system, downloads a MSBuild project file (v.proj), and executes it.
- This replaces earlier ClickFix variants which used mshta.exe or HTA files.
- MSBuild‑Based Loader
- The MSBuild project:
- Adds Windows Defender exclusions for selected paths and file types.
- Downloads a customized DCRat binary (sometimes named staxs.exe).
- Creates a Startup .url shortcut for persistence.
- Connects to C2 over port 3535, then injects the DCRat payload into a legitimate process (e.g., aspnet_compiler.exe) via process hollowing.
- The MSBuild project:
- DCRat RAT Execution
- DCRat provides full remote access, including keylogging, command execution, data exfiltration, and secondary payload deployment (e.g., cryptominers).
Impact
- Operational:
- Compromised hotel admin workstations can lead to unauthorized access to booking systems, payment workflows, and internal file shares.
- Data:
- Threat actors gain access to guest records, reservation details, and potentially payment workflows (depending on network architecture).
- Sectoral:
- Campaign specifically targets European hospitality; the lure is highly tailored to hotel operations and brand recognition (Booking.com).
Details
MITRE ATT&CK Mapping:
- T1566.002 – Phishing: Spearphishing Link (Booking.com-themed emails)
- T1204.001 – User Execution: Malicious Link / Instructions (ClickFix-style prompt)
- T1059.001 – PowerShell (user-pasted command)
- T1127.001 – Trusted Developer Utilities Proxy Execution: MSBuild
- T1055 – Process Injection (DCRat into aspnet_compiler.exe)
- T1060 / T1547.009 – Shortcut Modification / .url startup persistence
- T1562.004 – Impair Defenses: Windows Defender exclusions
Representative IOCs:
- Domains:
- low-house[.]com
- Redirectors like oncameraworkout[.]com/ksbo
- Process & Tools:
- msbuild.exe executed on non‑developer endpoints
- aspnet_compiler.exe exhibiting unusual network or child-process behavior
- C2:
- DCRat communicating over TCP/3535 to attacker infrastructure
Detection & Hunting Patterns:
text
# Detect PowerShell launched via Run dialog with suspicious content
index=edr process_name=”powershell.exe”
| where parent_process_name=”explorer.exe” AND command_line=”*msbuild*http*”
| table _time host user parent_process_name command_line
# MSBuild misuse on non-dev machines
index=edr process_name=”msbuild.exe”
| where role!=”developer_workstation”
| stats count by host, user, command_line
Takeaway for CISO
ClickFix campaigns prove that training alone is not enough.
- Attackers now routinely convince users to execute commands themselves, bypassing many mail and endpoint filters.
- For sectors with large non‑technical user bases (hospitality, retail, BPO):
- Treat PowerShell and MSBuild as high‑risk binaries on user endpoints.
- Disable or heavily restrict MSBuild on non‑developer systems.
- Create high‑severity alerts for user-initiated PowerShell spawned from the Run dialog or browser context.
- Update awareness programs to specifically cover fake BSOD and ClickFix tactics: “Never paste commands from a website or email into Run/PowerShell under any circumstances.”
>>Outpace Attackers With AI-Based Automated Penetration Testing
Incident 5: Lynx Ransomware Attack Claimed Against Hartford (hartford.fr)
Date of Report: 4–5 January 2026
Sources: DeXpose, Darktrace, Ransomware.live, other Lynx analyses
Overview
On 4–5 January 2026, the Lynx ransomware group listed Hartford (hartford.fr), a French fashion retailer, on its data leak site, claiming a successful attack and threatening to publish stolen data. While Hartford has not publicly disclosed specific operational impact, threat intel indicates Lynx executed its standard double‑extortion playbook.
Lynx is widely assessed as a rebranded evolution of INC ransomware, active since mid‑2024 and known for aggressive targeting of enterprises across multiple sectors.
Explanation
Typical Lynx behavior (from Darktrace, Palo Alto Networks, Fortinet, Picus, and others):
- Initial Access:
- Likely via phishing, compromised credentials, or exploitation of exposed services (specific vector for Hartford not yet public).
- Pre‑Encryption Stage:
- Enumerates network shares, mounts hidden and remote drives.
- Kills processes and services associated with backups, databases, and mail servers (e.g., Veeam, MSSQL, Exchange).
- Deletes Volume Shadow Copies and backup partitions to inhibit recovery.
- Encryption:
- Uses ECC (Curve25519) + AES hybrid encryption; ECC-derived shared secret is hashed with SHA‑512 to derive AES keys.
- Appends .lynx extension to encrypted files.
- Avoids encrypting certain system directories and files to maintain OS stability.
- Ransom Note & Extortion:
- Drops README.txt ransom notes system‑wide and often changes desktop wallpaper.
- Directs victims to a Tor negotiation portal with a unique victim ID.
- Operates a data leak site listing victims and publishing stolen data if payment is not made.
For Hartford specifically, public reporting focuses on Lynx’s claim and threat to leak exfiltrated business data (contracts, internal documents, and potentially customer information).
Impact
- Operational (Hartford):
- Unknown; website availability at time of reporting suggests at least partial continuity, but internal systems may have been impacted.
- Data:
- High risk of corporate data and customer PII exposure, depending on what systems Lynx accessed before encryption.
- Broader Threat:
- Lynx continues to prove that rebranded ransomware families can quickly gain traction and build a sizeable victim list.
Details
MITRE ATT&CK Mapping (generic Lynx TTPs):
- T1078 – Valid Accounts (where credential reuse or purchase is used)
- T1021.002 – SMB/Windows Admin Shares for lateral movement
- T1486 – Data Encrypted for Impact
- T1490 – Inhibit System Recovery (deleting shadow copies, backup volumes)
- T1565 – Data Manipulation (if limited destructive actions)
- T1027 – Obfuscated Files or Information (encrypted markers and ECC+AES implementation)
Key Technical Markers:
- File Extension: .lynx on encrypted files
- Ransom Note: README.txt in affected directories
- Behavioral:
- Unusual volumes of SMB reads/writes across shares matching encryption patterns.
- Use of Restart Manager API (RstrtMgr) to target in-use files.
- Multi‑threaded encryption across many files in parallel.
Takeaway for CISO
Don’t chase names; chase behaviors.
- Lynx, like many modern ransomware families, is part of a lineage (INC → Lynx) and will almost certainly be rebranded again. Defenses based on specific family names are fragile.
- Focus on common ransomware behaviors:
- Massive SMB write bursts, especially with simultaneous read/write of the same file sizes.
- Sudden creation of .lynx (or any new extension) and README.txt across many directories.
- Unusual process trees from domain admins performing large file operations outside backup windows.
- Ensure you can recover without paying:
- Maintain immutable, offline, or logically isolated backups that cannot be modified even with domain admin credentials.
- Test restoration at scale and under time pressure; tabletop exercises should assume backup indexes themselves were targeted.
