Exploitation of widely deployed software vulnerabilities featured prominently, including CVE-2026-20805 in Windows Desktop Window Manager and a critical Node.js async_hooks flaw. Both issues enabled denial-of-service or memory disclosure impacts across large production environments before fixes were issued.

Healthcare disruption continued following a ransomware attack on AZ Monica hospitals in Belgium. Server shutdowns across Antwerp campuses halted surgeries, restricted emergency care, and required the transfer of unstable patients to other hospitals.

Large-scale botnet activity remained active, with Kimwolf and Aisuru compromising more than two million Android devices. The botnets leveraged exposed Android Debug Bridge services on consumer TV boxes to operate residential proxy networks and conduct DDoS activity.

Cybercrime-as-a-service infrastructure faced coordinated disruption as authorities dismantled RedVDS, a virtual desktop platform used for phishing, business email compromise, and financial fraud. The service provided unlicensed Windows servers to multiple threat actors across several regions.

Denial-of-service risks extended beyond operating systems into application ecosystems, with AsyncLocalStorage crashes affecting modern JavaScript frameworks. The flaw demonstrated how core observability and context-tracking features could destabilise production services at scale.

Ukraine’s CERT has disclosed cyber espionage campaigns using PLUGGYAPE malware against defence forces between October and December 2025. The activity is attributed with medium confidence to a Russian-linked group known as Void Blizzard, which used Signal and WhatsApp to impersonate charities and deliver malware-laced archives. The Python-based backdoor supports multiple communication protocols and dynamically retrieves command servers from public paste services to increase resilience.

The Node.js project disclosed a flaw where stack exhaustion could abruptly terminate applications using async hooks, enabling denial-of-service conditions. The issue affected widely used frameworks such as React and Next.js, as well as most application performance monitoring tools relying on AsyncLocalStorage. A fix released in January 2026 restores predictable error handling by preventing fatal process exits in these scenarios.

Monroe University disclosed that a December 2024 cyberattack led to the theft of personal, financial, and health information affecting more than 320,000 individuals. Attackers accessed the university’s network for around two weeks, with compromised data including identification details, financial records, and medical information. The breach was confirmed in 2025 following a review of stolen files submitted to US regulators.

Chainalysis estimates cryptocurrency scams and fraud generated more than $17 billion in losses during 2025, driven by rapid growth in impersonation schemes and AI-enabled tactics. Impersonation scams increased sharply year on year, while operations became more industrialised through phishing-as-a-service platforms, deepfake technology, and professional laundering networks. The analysis also highlights strong links to organised crime groups in East and Southeast Asia, alongside record-scale law enforcement seizures.

A suspected ransomware attack on AZ Monica hospital in Belgium caused widespread IT outages, forcing the transfer of several critical care patients to other facilities. The hospital shut down its servers across two campuses in Antwerp to contain the incident, leading to cancelled surgeries and reduced emergency services. While patient safety was prioritised, access to electronic records and several treatments was significantly disrupted.

Microsoft Threat Intelligence detailed how a virtual desktop provider known as RedVDS supported large-scale cybercrime, including phishing, business email compromise, and financial fraud. The service offered low-cost, unlicensed Windows servers that were widely used by multiple threat actors across Europe, North America, and Australia. Microsoft worked with law enforcement to disrupt the infrastructure, linking RedVDS-enabled activity to tens of millions of dollars in reported losses.

Security researchers null-routed more than 550 command servers linked to the Kimwolf and Aisuru botnets, which have compromised over two million Android devices, primarily unregulated TV streaming boxes. The infrastructure was used to run large-scale DDoS attacks and to sell infected devices as residential proxies, enabling malicious traffic to blend into normal consumer internet use. Investigations linked the botnet’s rapid growth to abuse of exposed Android Debug Bridge services and weaknesses in proxy networks.