Daily Cybersecurity News - January 2, 2026

A coordinated campaign targeted Adobe ColdFusion servers during the Christmas 2025 holiday, exploiting known vulnerabilities. The attackers aimed to gain initial access, likely for broader network reconnaissance.

The attacks leveraged WDDX deserialization flaws to trigger JNDI and LDAP injection, targeting the com.sun.rowset.JdbcRowSetImpl gadget chain. This technique has been used in Java ecosystems due to its reliability.

Transparent Tribe is conducting a new campaign targeting Indian government, academic, and strategic organizations. The threat actor utilizes a remote access trojan (RAT) to gain persistent control over compromised systems.

Transparent Tribe has expanded its toolset and is actively adapting its attack vectors to evade detection. The group is using cross-platform programming languages to target both Windows and Linux systems.

A phishing campaign abuses Google Cloud's Application Integration service to impersonate legitimate Google messages, targeting approximately 3,200 customers across various sectors. The attackers leverage the trust associated with Google Cloud infrastructure to bypass email security filters and steal credentials.

The campaign leverages trusted Google infrastructure to bypass traditional security filters, increasing the likelihood of successful credential theft. The attackers sent 9,394 phishing emails over a 14-day period.

This week's cybersecurity incidents highlight the persistent threats posed by malicious insiders and sophisticated backdoor attacks, emphasizing the need for robust security measures and vigilance. A compromised Trust Wallet Chrome extension led to significant financial losses, while a Chinese hacking group deployed a stealthy kernel backdoor.

These incidents underscore the importance of multi-layered security strategies. Organizations must prioritize both external and internal threat mitigation, focusing on supply chain security, robust access controls, and continuous monitoring. The increasing sophistication of attacks necessitates proactive threat hunting and investment in advanced detection capabilities to safeguard sensitive data and maintain operational integrity.

AI tools are becoming increasingly prevalent in embedded systems development, impacting critical infrastructure and requiring a re-evaluation of security practices. A recent survey by RunSafe Security indicates widespread adoption of AI in code generation, testing, and documentation, signaling a shift from experimental use to production integration.

The rapid integration of AI in embedded systems development presents both opportunities and challenges. While AI accelerates development and increases code volume, it also introduces new security risks and patterns that existing security practices may not adequately address. Organizations must prioritize robust security frameworks, focusing on AI-generated code and dependency management, to build resilient software and maintain the safety and reliability of critical infrastructure.

The DOJ announced that Ryan Goldberg and Kevin Martin, two cybersecurity professionals, pleaded guilty to participating in BlackCat ransomware attacks against multiple U.S. victims. The defendants face a maximum penalty of 20 years in prison and are scheduled to be sentenced on March 12, 2026.

The involvement of cybersecurity professionals in ransomware attacks highlights the insider threat and the potential for trusted individuals to exploit their knowledge for malicious purposes.

Flock's Condor PTZ cameras, designed for tracking people, were found to have exposed livestreams and administrator control panels, allowing unauthorized access to video feeds and camera settings. This exposure raises significant privacy and security concerns due to the potential for misuse of footage and manipulation of camera functions.

Red teams can use Shodan to identify exposed cameras and assess the security posture of organizations using Flock systems. Blue teams should implement strict access controls, regularly audit camera configurations, and monitor for unauthorized access to prevent similar exposures, ensuring the privacy of individuals being recorded.

Commercial product by Flock Safety.