In today’s cybersecurity news…

OpenClaw targets ClawHub users

Security researchers warn that OpenClaw, the self-hosted AI assistant formerly known as Clawdbot and Moltbot, is being abused to distribute malware. OpenSourceMalware says at least 14 malicious “skills” posing as crypto trading or wallet tools were uploaded to ClawHub in late January, tricking Windows and macOS users into running obfuscated commands that fetch malware. The incident highlights how OpenClaw’s unsandboxed skills model and rapid rebranding have made it an easy target for social engineering. (Tom’s Hardware) (The Register)

Notepad++ update delivers malware 

State-sponsored attackers hijacked Notepad++’s update mechanism, redirecting some users to malicious servers that delivered malware, according to the project’s maintainer. The compromise occurred at the hosting provider level, not in Notepad++’s code, and involved targeted redirection of update traffic starting as early as last June. Security researchers link the activity to China-nexus group Violet Typhoon, which targeted telecom and financial organizations in East Asia. Notepad++ has since moved hosting providers and hardened its update process. (The Hacker News)

APT28 attackers abuse Microsoft Office zero-day

CERT-UA says Russia-linked APT28, also known as Fancy Bear, is already exploiting a newly disclosed Microsoft Office zero-day, to target Ukrainian government agencies and organizations across the EU. The bug went from disclosure to active exploitation in days, with phishing emails delivering malicious Word documents that quietly pull down malware and deploy the COVENANT post-exploitation framework. Microsoft has released patches, but CERT-UA warns attacks are likely to increase as many users delay or are unable to update. (The Register)

January update affects more Windows PCs

Microsoft says a shutdown bug introduced by January updates affects more PCs than previously known, extending beyond Windows 11 to Windows 10 systems with Virtual Secure Mode enabled. The issue causes affected devices to restart instead of shutting down or entering hibernation after installing recent updates, including Secure Launch-capable machines. Microsoft has issued out-of-band fixes for some Windows 11 systems and advises impacted users to manually shut down via command line while it works on a broader fix. (BleepingComputer)

Huge thanks to our sponsor, Strike48

Poland’s energy infrastructure lacked security measures?

CERT Polska says a December cyberattack linked to Russian threat actors compromised wind and solar farms and a heat-and-power plant in Poland, though it didn’t disrupt electricity supplies. The agency claims the affected operators had basic security failures, including default credentials, unpatched perimeter devices, and no multifactor authentication. While ESET and Dragos attribute the activity to the GRU-linked Sandworm group, CERT Polska ties it to a separate Russian cluster known as Berserk Bear or Dragonfly, marking the first publicly described destructive activity linked to that group. (The Cyber Wire)

ShinyHunters expands scope of attacks

Mandiant says the ShinyHunters cybercrime group has expanded its SaaS extortion campaign beyond Salesforce to platforms including Microsoft 365, SharePoint, Slack, and Okta, using vishing and branded credential-harvesting sites to steal SSO credentials and MFA codes. Google tracks multiple ShinyHunters-linked clusters that exfiltrate sensitive SaaS data and use it for aggressive extortion, including ransom demands backed by data leaks and DDoS threats. Researchers warn the activity shows a clear escalation in both targeting and tactics, despite earlier law enforcement takedowns. (Dark Reading)

Massive attack breaks records

Cloudflare reports the Aisuru botnet set a new DDoS record in December with an attack peaking at 31.4 Tbps and 200 million requests per second, primarily targeting telecom providers. The botnet, estimated to control one to four million compromised devices including home routers, CCTV systems, and Android TV devices, is sold as a botnet-for-hire and can also be used for credential stuffing, scraping, and phishing. The scale highlights how poorly secured consumer devices are increasingly being weaponized for internet-wide attacks. (ZDNet)

StopICE hacked, admins accuse sabotage

StopICE says it was targeted in an attack that sent fake text messages warning users their data had been “sent to the authorities,” which the group claims is false. The ICE-tracking service says it does not store users’ names, addresses, or GPS data, and alleges the attack originated from a personal server linked to a U.S. Customs and Border Protection agent, an accusation CBP has not yet commented on. StopICE says the attempted server attack was quickly contained and describes the incident as part of frequent DDoS and harassment campaigns against the service. (The Register)