Daily Cybersecurity News - January 9, 2026

Trend Micro has addressed a critical security vulnerability, CVE-2025-69258, in its Apex Central on-premise product that could allow unauthenticated remote attackers to execute arbitrary code with SYSTEM privileges. The vulnerability has been patched with the release of Critical Patch Build 7190.

A maximum severity vulnerability, CVE-2025-37164, exists in HPE OneView, which can lead to remote code execution and has been actively exploited in the wild. CISA has added this flaw to its Known Exploited Vulnerabilities catalog.

A Chinese-speaking threat actor exploited a compromised SonicWall VPN appliance to deliver a VMware ESXi exploit toolkit. The toolkit targeted zero-day vulnerabilities, potentially developed over a year before public disclosure, to compromise ESXi hypervisors.

The threat actor chained three vulnerabilities to achieve VM escape, compromising the hypervisor infrastructure. The attack involved deploying a backdoor on the ESXi hypervisor after escaping the VM.

The Kimwolf botnet, an Android variant of Aisuru, has infected over two million devices, primarily Android TV boxes, by exploiting vulnerabilities in residential proxy networks. The botnet is used for DDoS attacks, app installs, and selling proxy bandwidth.

Kimwolf spreads by exploiting weaknesses in residential proxy networks, allowing attackers to gain access to devices that are unknowingly exposed through poorly secured proxy services. The botnet is also used to launch extremely high-volume distributed denial-of-service attacks while simultaneously generating revenue through the sale of residential proxy access.

UAT-7290, a China-linked threat actor, is targeting telecommunications providers, expanding operations from South Asia to include organizations in Southeastern Europe. The group focuses on cyber-espionage and establishing operational relay box (ORB) infrastructure for other China-aligned actors.

UAT-7290 establishes deep, persistent access to strategically significant networks, acting as both an intelligence collector and initial access facilitator. The group shares overlaps in victimology, infrastructure, and tooling with groups like APT10 and Red Foxtrot.

Researchers at the World Economic Forum have demonstrated that readily available deepfake tools can be exploited by malicious actors to circumvent corporate security measures. This highlights a growing need for enhanced detection and prevention strategies.

The increasing sophistication and accessibility of deepfake technology pose a significant threat to organizations. As threat actors leverage these tools to bypass existing security protocols, businesses must prioritize investment in advanced detection mechanisms, employee training, and robust verification processes to mitigate potential financial and reputational damage. The shift towards "never trust, always verify" security cultures is becoming increasingly critical in an AI-powered world.

The DOJ has charged Kyle Svara of Illinois with orchestrating a phishing campaign targeting Snapchat users. Svara allegedly hacked nearly 600 accounts to steal private photos, some of which were sold online.

This incident highlights the ongoing threat of social engineering and the importance of verifying requests for sensitive information, even from seemingly legitimate sources.