-
·
Atlanta, GA, United States, 20th January 2026, CyberNewsWire¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
The North Korean threat actors associated with the long-running Contagious Interview campaign have been observed using malicious Microsoft Visual Studio Code (VS Code) projects as lures to deliver a backdoor on compromised endpoints. The latest finding demonstrates continued evolution of the new tactic that was first discovered in December 2025, Jamf Threat Labs said. “This activity involved
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Madison, United States, January 20th, 2026, CyberNewsWire Veteran cybersecurity leader brings decades of experience and patented innovation to advance the next generation of proactive security solutions. Sprocket Security today announced the appointment of Eric Sheridan as Chief Technology Officer (CTO). In this role, Sheridan will lead the company’s technology vision and execution, accelerating innovation and advancing Sprocket Security’s mission to […]
The post Sprocket Security Appoints Eric Sheridan as Chief Technology Officer appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A new Internet-of-Things (IoT) botnet called Kimwolf has spread to more than 2 million devices, forcing infected systems to participate in massive distributed denial-of-service (DDoS) attacks and to relay other malicious and abusive Internet traffic. Kimwolf’s ability to scan the local networks of compromised systems for other IoT devices to infect makes it a sobering threat to organizations, and new research reveals Kimwolf is surprisingly prevalent in government and corporate networks.

Image: Shutterstock, @Elzicon.
Kimwolf grew rapidly in the waning months of 2025 by tricking various “residential proxy” services into relaying malicious commands to devices on the local networks of those proxy endpoints. Residential proxies are sold as a way to anonymize and localize one’s Web traffic to a specific region, and the biggest of these services allow customers to route their Internet activity through devices in virtually any country or city around the globe.
The malware that turns one’s Internet connection into a proxy node is often quietly bundled with various mobile apps and games, and it typically forces the infected device to relay malicious and abusive traffic — including ad fraud, account takeover attempts, and mass content-scraping.
Kimwolf mainly targeted proxies from IPIDEA, a Chinese service that has millions of proxy endpoints for rent on any given week. The Kimwolf operators discovered they could forward malicious commands to the internal networks of IPIDEA proxy endpoints, and then programmatically scan for and infect other vulnerable devices on each endpoint’s local network.
Most of the systems compromised through Kimwolf’s local network scanning have been unofficial Android TV streaming boxes. These are typically Android Open Source Project devices — not Android TV OS devices or Play Protect certified Android devices — and they are generally marketed as a way to watch unlimited (read:pirated) video content from popular subscription streaming services for a one-time fee.
However, a great many of these TV boxes ship to consumers with residential proxy software pre-installed. What’s more, they have no real security or authentication built-in: If you can communicate directly with the TV box, you can also easily compromise it with malware.
While IPIDEA and other affected proxy providers recently have taken steps to block threats like Kimwolf from going upstream into their endpoints (reportedly with varying degrees of success), the Kimwolf malware remains on millions of infected devices.

A screenshot of IPIDEA’s proxy service.
Kimwolf’s close association with residential proxy networks and compromised Android TV boxes might suggest we’d find relatively few infections on corporate networks. However, the security firm Infoblox said a recent review of its customer traffic found nearly 25 percent of them made a query to a Kimwolf-related domain name since October 1, 2025, when the botnet first showed signs of life.
Infoblox found the affected customers are based all over the world and in a wide range of industry verticals, from education and healthcare to government and finance.
“To be clear, this suggests that nearly 25% of customers had at least one device that was an endpoint in a residential proxy service targeted by Kimwolf operators,” Infoblox explained. “Such a device, maybe a phone or a laptop, was essentially co-opted by the threat actor to probe the local network for vulnerable devices. A query means a scan was made, not that new devices were compromised. Lateral movement would fail if there were no vulnerable devices to be found or if the DNS resolution was blocked.”
Synthient, a startup that tracks proxy services and was the first to disclose on January 2 the unique methods Kimwolf uses to spread, found proxy endpoints from IPIDEA were present in alarming numbers at government and academic institutions worldwide. Synthient said it spied at least 33,000 affected Internet addresses at universities and colleges, and nearly 8,000 IPIDEA proxies within various U.S. and foreign government networks.

The top 50 domain names sought out by users of IPIDEA’s residential proxy service, according to Synthient.
In a webinar on January 16, experts at the proxy tracking service Spur profiled Internet addresses associated with IPIDEA and 10 other proxy services that were thought to be vulnerable to Kimwolf’s tricks. Spur found residential proxies in nearly 300 government owned and operated networks, 318 utility companies, 166 healthcare companies or hospitals, and 141 companies in banking and finance.
“I looked at the 298 [government] owned and operated [networks], and so many of them were DoD [U.S. Department of Defense], which is kind of terrifying that DoD has IPIDEA and these other proxy services located inside of it,” Spur Co-Founder Riley Kilmer said. “I don’t know how these enterprises have these networks set up. It could be that [infected devices] are segregated on the network, that even if you had local access it doesn’t really mean much. However, it’s something to be aware of. If a device goes in, anything that device has access to the proxy would have access to.”
Kilmer said Kimwolf demonstrates how a single residential proxy infection can quickly lead to bigger problems for organizations that are harboring unsecured devices behind their firewalls, noting that proxy services present a potentially simple way for attackers to probe other devices on the local network of a targeted organization.
“If you know you have [proxy] infections that are located in a company, you can chose that [network] to come out of and then locally pivot,” Kilmer said. “If you have an idea of where to start or look, now you have a foothold in a company or an enterprise based on just that.”
This is the third story in our series on the Kimwolf botnet. Next week, we’ll shed light on the myriad China-based individuals and companies connected to the Badbox 2.0 botnet, the collective name given to a vast number of Android TV streaming box models that ship with no discernible security or authentication built-in, and with residential proxy malware pre-installed.
Further reading:
The Kimwolf Botnet is Stalking Your Local Network
Who Benefitted from the Aisuru and Kimwolf Botnets?
A Broken System Fueling Botnets (Synthient).
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Alisa Viejo, United States, January 20th, 2026, CyberNewsWire One Identity, a trusted leader in identity security, today announces a major upgrade to One Identity Manager, a top-rated IGA solution, strengthening identity governance as a critical security control for modern enterprise environments. One Identity Manager 10.0 introduces security-driven capabilities for risk-based governance, identity threat detection and […]
The post One Identity Unveils Major Upgrade to Identity Manager, Strengthening Enterprise Identity Security appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Huntress discovers ‘CrashFix,’ a new attack by KongTuke hacker group using fake ad blockers to crash browsers and trick office workers into installing ModeloRAT malware.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
The new EU-funded GCVE project is breaking dependence on US databases to track software flaws. Discover how this decentralised system aims to ensure global cybersecurity.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
·
On Saturday, Trump announced an economic war of coercion against more than a half-dozen U.S. allies in Europe, declaring “a 10% Tariff on any and all goods sent to the United States of America” from Denmark, Norway, Sweden, France, Germany, the U.K., the Netherlands, and Finland. “On June 1st, 2026, the Tariff will be increased to 25%. This Tariff will be due and payable until such time as a Deal is reached for the Complete and Total purchase of Greenland,” the president said on social media.America’s NATO allies are deploying troops to Greenland to deter a U.S. invasion. Those developments were made public last week, shortly before Danish newspaper Berlingske reported Monday that U.S. officials attempted to obtain details about “military installations, ports and air bases…that could be important in planning an American attack on or invasion of Greenland,” and avoided traditional Ministry of Defense channels during the solicitation of that information at some point in 2025.
Developing: NORAD says it’s sending troops and aircraft to Greenland as well. The command’s Monday announcement cast it as part of “long-planned” operations “coordinated with the Kingdom of Denmark,” with these newly-arriving forces “operat[ing] with the requisite diplomatic clearances.”
Worth noting: It’s remarkable that NORAD needs to clarify that the U.S. troops have the required diplomatic clearance. But it’s all part of a rapidly developing picture of American power at a crossroads under Trump during his second term in office.
Trump’s pace of disruption has accelerated since December, when the Supreme Court blocked his attempted deployment of National Guard troops to Chicago. Since then, he has abducted Venezuela’s leader, seized the country’s oil, intercepted at least a half-dozen tankers, sent more than five times as many ICE agents to Minneapolis as the city has police, threatened to invade Greenland, and last week threatened to invoke the Insurrection Act inside the U.S.
Trump’s message to Norway: “I no longer feel an obligation to think purely of Peace, although it will always be predominant, but can now think about what is good and proper for the United States of America,” the president wrote in a highly unusual note to Norwegian Prime Minister Jonas Gahr Støre.
Trump said he has chosen to de-prioritize peace because he was not given the Nobel Peace Prize in 2025, which Norway’s government has no say over at any rate. “I have done more for NATO than any person since its founding, and now, NATO should do something for the United States. The World is not secure unless we have Complete and Total Control of Greenland. Thank you!” Trump wrote in the letter, which was made public on Sunday.
Historian reax: “Donald Trump now genuinely lives in a different reality, one in which neither grammar nor history nor the normal rules of human interaction now affect him,” warned Anne Applebaum of The Atlantic. She pointed out that at any point Republicans in Congress could move “to stop Trump from acting out his fantasy in Greenland and doing permanent damage to American interests.” Those lawmakers “owe it to the American people,” she said, “and to the world.”
Former Marine and Iraq war veteran Ruben Gallego agrees, and told CNN Trump “would rather just break whatever he can to get what he wants,” the Arizona Democratic senator warned. “Let's be clear. The reason he's there is because we have cowardly republicans in the Senate, in the House that are not standing up to this man…And if we pay in the process, we as Americans, he doesn't care, right? This is the danger,” Gallego said, and moments later was even more blunt. “I've been very clear. He is a madman. He is insane. He's only thinking about himself,” he said. “The man is threatening war against a NATO ally.”
“He is destroying our world reputation or potentially our economic opportunity or economic might and power around the world because he is being petty,” Gallego said. “None of this is rational. Everyone needs to stop pretending this is rational.”
By the way, Trump’s Greenland aggression could spike U.S. borrowing costs and notably harm the dollar, writes Financial Times columnist Katie Martin. “Bad stuff is very clearly happening with regards to Greenland,” she says. And relatedly, there is “a strong hint that investors are doing two things: disregarding the dollar and Treasuries as safe retreats, huddling instead in the warm embrace of gold, and treating a U.S.-born shock as a reason to sell U.S. assets…It is a brave new world for the U.S., however, and one that will reinforce the urge among big investment firms to park a greater share of their resources in Europe, Asia and indeed anywhere else over time.”
Martin is hardly alone in her concerns about Trump’s apparent instability. The Wall Street Journal’s Gerald Baker, former editor-in-chief of the paper with more than three decades of experience in journalism, wrote a column of warning Monday entitled, “A Look Back at the War That Is About to Begin.” He writes in a sort of speculative-fiction mode, describing in retrospect the damage to the world that may follow from a possible U.S. invasion of Greenland.
“The fallout did almost as much harm to the U.S. as to Europe,” he writes. “The dollar sank, pushing up retail prices in America and causing a run on Treasury bonds that flattened mortgage lending and battered corporate finances. Seizing their opportunity, Russia and China demonstrated the value of allyship and pounced. Russia suspended its campaign in Ukraine and quickly moved on the Baltics. With NATO gone, Europeans were deeply divided about whether to offer support; but as a harsh winter descended, the desperate need for cheap energy soon forced them to assent to Russian control over large swathes of Eastern Europe.”
According to Baker’s telling, China fairly quickly seizes Taiwan. Then the U.S., “along with its remaining three allies—El Salvador, Qatar and Senegal—it struck an uneasy peace, a tripartite charter that replaced the American-denominated global order with a condominium of Russia, China and the U.S. dominant in their respective regions.” Read the rest, here.
A veteran U.S. diplomat warns, “Trump’s Greenland ambitions could wreck 20th-century alliances that helped build the modern world order,” writing Monday in The Conversation.
In Denmark, protesters have begun mocking Trump’s MAGA slogan with “Make America Go Away” hats, the Associated Press reported Monday from Copenhagen. “The mock hats were created by Copenhagen vintage clothing store owner Jesper Rabe Tonnesen. Early batches flopped last year—until the Trump administration recently escalated its rhetoric over Greenland. Now they are popping up everywhere.” Story, here.
In the Caribbean, “crew on board the United States' newest aircraft carrier are growing increasingly frustrated by design flaws that lead to regular failures in the ship's toilet system,” NPR reported Saturday about the USS Gerald R. Ford carrier, citing Navy documents obtained through a Freedom of Information Act request.
Additional reading:
- “Top Catholic Clerics Denounce U.S. Foreign Policy,” the New York Times reported on Monday;
- “America vs. the World,” is how Robert Kagan described Trump’s foreign policy, writing Sunday in The Atlantic;
- “Splits Emerge Among Venezuelans as Revolutionary Dream Fades,” the New York Times reported Monday;
- ICYMI, Israeli Prime Minister Benjamin “Netanyahu ‘persuaded Trump to postpone airstrikes against Iran’,” the UK Times writes after the New York Times reported the allegation on Thursday, citing a U.S. official;
- Relatedly, read “How Trump Went From ‘Locked and Loaded’ to Hitting Pause on Striking Iran,” the Wall Street Journal reported Friday; Axios has similar reporting, here;
- And in Syria, “Clashes Erupt Around Syrian Prisons Holding Islamic State Fighters,” the Times reported Monday.
Welcome to this Tuesday edition of The D Brief, a newsletter focused on developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. It’s more important than ever to stay informed, so we’d like to take a moment to thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1972, Pakistan launched its effort to develop nuclear weapons; it would perform its first, and so far only, live tests in 1998.
Escalation watch: Troops in US cities
Developing: Pentagon readies 1,500 soldiers for possible deployment to Minnesota, unnamed officials told several news outlets over the weekend.
Two infantry battalions of the Army’s 11th Airborne Division have been given prepare-to-deploy orders for the Midwest state, where thousands of federal agents have been conducting aggressive immigration raids. According to the Associated Press, “One defense official said the troops are standing by to deploy to Minnesota should President Donald Trump invoke the Insurrection Act, a rarely used 19th century law that would allow him to employ active duty troops as law enforcement.” Read more at the Washington Post or the Wall Street Journal.
Analysis: The Trump administration’s actions amount to “state terror,” veteran terrorism analyst Adam Silverman wrote on Saturday: “I've seen a lot of terms thrown around for what the Trump admin is doing w/ICE, CBP, & other federal law enforcement (LE). The now largely out of use term is state terror.”
The origins for the term come from “the Reign of Terror during the French revolution,” Silverman explains. “The outcome was to coerce the population through the threat & actual use of violence against victims who were not necessarily the target audience.”
How it works: “The power of the nation-state is being directed at the citizenry through threats [and] acts of violence, all done under the color of law, including extrajudicial executions, in order to coerce the citizenry into compliance through fear [and] intimidation. This includes using legal power/lawfare,” Silverman says.
American precedents. “State terror in the U.S. is not a new thing that [Stephen] Miller concocted, it was the modus operandi of the Confederate in all but name Jim Crow states,” Silverman says. “It's why in the Jim Crow states you have a variety of non-state actors from the genteel [and] seemingly legit white citizen councils all the way to a number of different white Christian supremacist terrorist groups like the Klu Klux Klan.”
This time around the perpetrators are largely ICE in addition to militia groups like the Oath Keepers and the Proud Boys. But also the U.S. military via Trump’s “attempts to use the National Guard,” which Silverman said, “makes sense as, like Robespierre's movement, the Trump/MAGA movement is a revolutionary movement.”
Second opinion: “Lawful extremism,” is how extremism scholar J.M. Berger described what’s playing out in Minnesota and elsewhere in ICE raids. “What we're seeing is anti-immigration extremists carrying out violence against in-group dissenters,” he wrote in response to Silverman’s analysis.
Expert three: “We are a long way from Civil War, but the Minnesota National Guard is now wearing bright green vests to distinguish [them] from ‘other agencies,’” noted Robert Pape, director of the Chicago Project on Security and Threats at the University of Chicago. “This is now ‘us’ versus ‘them’ combat forces.”
“Trump is taking [the] U.S. to a very dark place,” Pape said, adding that it’s “Crucial that the [Minnesota National] Guard and ICE do not clash.”
Expert four: There’s no mistaking that Trump has “launch[ed] a paramilitary occupation of an American city” and is now “sending armed goons to spread state-sponsored violence against the local population,” warns German historian Thomas Zimmer, writing Tuesday.
However, he pointed out, “Several times over the past twelve months, the regime pushed the country right up to the edge of the kind of authoritarian escalation that would have taken America across the line into full-blown autocratic territory,” but then officials “were either unable or didn’t dare to force that next step,” he writes with a note of optimism in an essay, “The Limits of Violent Authoritarianism.”
“I am not trying to tell you that things are fine. The situation is acutely dangerous,” he continues. “The outcome of the current struggle against the authoritarian assault on democratic self-government remains undetermined. At the start of 2026, America is no longer a democracy.”
“What I am arguing is that being lawless, immoral, and violent does not make the Trumpists omnipotent,” Zimmer says. “Their authoritarian desires are limitless, but their ability to impose them on the country is not.” Read on, here.
Some Army recruiters are wooing high-schoolers by saying enlisting could protect their families from ICE. CNN documents a pitch in Minnesota, adding to a similar New York Times report last week from Oregon.
Additional reading:
- “ICE’s Facial Recognition App Misidentified a Woman. Twice,” 404 Media reported Monday;
- “FBI opened probe on Minneapolis shooting; none exists now, Justice Dept. says,” the Washington Post reported Sunday;
- “FBI Agent’s Sworn Testimony Contradicts Claims ICE’s Jonathan Ross Made Under Oath,” WIRED reported last week;
- “Trump Warned of a Tren de Aragua ‘Invasion.’ US Intel Told a Different Story,” WIRED reported last week as well;
- And “Trump’s Big Changes to Government Might Not Last,” says Yuval Levin of the American Enterprise Institute, writing Tuesday in The Atlantic.
Around the Defense Department
Trump’s ‘battleship’ could be the most expensive U.S. warship in history. Congressional researchers said ThursdayThe first Trump-class “battleship” ordered up by the White House could cost as much as $22 billion, and could cut into the Navy’s plans for next-generation destroyers, iDefense One’s Thomas Novelly reports, here.
CNO drops hints about forthcoming ‘Fighting Instructions’ strategy. “That document will be my strategy for naval operations going forward,” Adm. Daryl Caudle said during a speech at the Surface Navy Association symposium outside Washington, D.C. “It will explain how I view the Navy as the joint-force hedge for achieving our vital national interest.” That’s coming “in the near future,” a defense official told Defense One’s Meghann Myers, here.
Etc.
China is building ‘full-stack’ defense-innovation cities. While the U.S. and others struggle to build rare-earth processing plants, magnet factories, and high-performance motor supply chains, Beijing is doing all of those at once, in city-scale clusters that will widen its advantage in next-generation technologies, write Tye Graham and Peter Singer in Defense One’s The China Intelligence column.
And lastly, it’s been one full year of President Trump’s second term in office, so CNN used the occasion as an opportunity to find out how Americans feel about their elected leader now. Among the findings:
- 58% percent of Americans believe that Trump’s first year in office has been a failure;
- Americans worry most about the economy, but concerns about democracy come in second;
- 66% think Trump doesn’t care about people like them;
- 53% think he doesn’t have the stamina and sharpness to serve effectively as president;
- And 65% said Trump is not someone they are proud to have as president.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Madison, United States, 20th January 2026, CyberNewsWire
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A set of three security vulnerabilities has been disclosed in mcp-server-git, the official Git Model Context Protocol (MCP) server maintained by Anthropic, that could be exploited to read or delete arbitrary files and execute code under certain conditions. “These flaws can be exploited through prompt injection, meaning an attacker who can influence what an AI assistant reads (a malicious README,
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶


