Good morning. This is your security briefing for Friday, January 30, 2026, covering nine articles analyzed overnight. All attribution is by the article authors. All article analysis is automated.
CERT Poland reports that on December 29, 2025, coordinated destructive cyberattacks using wiper malware targeted over 30 renewable energy farms, a manufacturing company, and a combined heat and power plant in Poland. The attacks, linked to threat actors including Static Tundra, Berserk Bear, Ghost Blizzard, and Dragonfly, targeted industrial control systems including RTUs and HMIs, with the wiper malware destroying firmware, deleting system files, and disrupting communications between renewable energy facilities and distribution operators.
Lab52, the intelligence team at S2 Group, has discovered a sophisticated offensive Operational Technology framework called Black Industry being sold on the dark web by actors linked to Iran's Islamic Revolutionary Guard Corps, potentially through the CyberAv3ngers group. The framework targets critical infrastructure and industrial control systems with capabilities including exploitation of industrial protocols like Modbus, S7comm, and OPC UA, firmware-level PLC backdoors, air-gap penetration, and SCADA manipulation.
Alibaba Cloud Computing has published analysis of previously undisclosed APT32 malware samples utilizing an anti-sandbox bypass technique involving backslash characters. APT32, also known as OceanLotus, is a Vietnamese nation-state threat actor known for targeting government, media, and corporate entities across Southeast Asia, and this technique represents a defense evasion method designed to avoid automated malware analysis systems.
CtrlAltNod reports that state-sponsored hackers breached SonicWall's MySonicWall cloud service in September 2025, extracting firewall configuration backup files that were used to bypass defenses and conduct a ransomware attack on Marquis Software Solutions in August 2025. This attack impacted 74 U.S. banks and credit unions and compromised personal information of over 400,000 individuals including Social Security numbers and financial account details.
According to vxunderground, Okta experienced a data breach through its third-party vendor Sitel, with attackers gaining unauthorized access to Okta's support case management system. The breach exposed customer data including potentially PII, authentication details, and support-related information from customers who had interacted with Okta support.
Citrix has released a NetScaler Secure Deployment Guide providing security hardening recommendations addressing configuration weaknesses including exposed management interfaces, default credentials, weak cipher suites, and SSH host key check issues in high availability deployments fixed in version 14.1-60.52. Key recommendations include restricting NSIP internet exposure, replacing default TLS certificates, enforcing HTTPS-only access, and implementing SSH public key authentication with custom RSA keys.
Logan Diomedi at Depth Security has introduced RelayKing, a new defensive tool designed to detect and report NTLM relay attack vectors in Active Directory environments. The tool scans for missing SMB signing, lack of Extended Protection for Authentication across multiple protocols including LDAP, MSSQL, HTTP, RPC, and WinRM, NTLM reflection vulnerabilities including CVE-2025-33073, and Net-NTLMv1 usage.
Google's Project Zero reports that a security researcher discovered nine distinct bypass vulnerabilities in Windows 11's Administrator Protection feature during its insider preview phase. The bypasses exploited UAC weaknesses and implementation flaws involving logon sessions, DOS device directories, and token impersonation to achieve silent elevation to full administrator privileges, and Microsoft has since disabled the feature due to application compatibility issues.
Researcher Florian at infosec.pub conducted a retrospective threat hunt for binaries containing a specific Claude refusal magic string, searching for malware or suspicious executables that include Claude AI's characteristic refusal responses. The research appears to focus on identifying patterns in malicious binaries related to AI language model outputs, possibly indicating AI-assisted malware development or obfuscation techniques.
That concludes today's briefing.