Daily Cybersecurity News - January 10, 2026

• Initial Access: Spear phishing emails with malicious attachments or links, sometimes using QR codes.
• Execution: Exploiting legitimate tools like mshta.exe to download and execute malicious payloads.
• Defense Evasion: Using multi-component techniques and disguising LNK files as benign documents.

Kimsuky has bifurcated its tactics, utilizing "Quishing" to deploy the DocSwap Android RAT on mobile devices while using LNK/mshta.exe chains to persist on desktops. This hybrid approach targets both unmanaged personal devices and corporate endpoints.

• Target Profile: Government entities, think tanks, academic institutions, and individuals involved in political, economic, and military affairs, particularly in South Korea, the United States, Japan, and Europe.
• Infrastructure: Use of compromised websites and subdomains mimicking legitimate services.

• APT (Advanced Persistent Threat): A sophisticated, long-term cyberattack campaign conducted by a skilled actor.
• Spear Phishing: A targeted phishing attack that focuses on specific individuals or organizations, often using personalized information to increase success.

• Initial Access: Compromised SonicWall VPN appliance
• Execution: Exploitation of VMware ESXi zero-day vulnerabilities (CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226)
• Defense Evasion: Disabling VMCI drivers, loading unsigned kernel drivers, modifying firewall rules

• Target Profile: Organizations using VMware ESXi virtualization, particularly data centers and cloud environments
• Infrastructure: Targets included up to 155 ESXi builds

• VM Escape: An exploit that allows an attacker to break out of a virtual machine and access the host operating system or other VMs.
• Zero-Day: A vulnerability that is unknown to the vendor and for which no patch is available.

• Initial Access: Spearphishing emails with malicious links or attachments.
• Execution: Exploitation of vulnerabilities in webmail servers and use of PowerShell.
• Defense Evasion: Steganography, encryption, and MOTW bypasses.

• Target Profile: Individuals associated with a Turkish energy and nuclear research agency, European think tanks, and organizations in North Macedonia and Uzbekistan.
• Infrastructure: Legitimate cloud hosting (Webhook.site, InfinityFree, Mocky) and tunneling services (ngrok, Serveo) to mask command-and-control origins.

• Spearphishing: A targeted phishing attack that focuses on specific individuals or organizations, making it more personalized and deceptive.
• Lateral Movement: A technique used by attackers to progressively move through a network after gaining initial access, seeking access to sensitive data and assets.