• A new Internet-of-Things (IoT) botnet called Kimwolf has spread to more than 2 million devices, forcing infected systems to participate in massive distributed denial-of-service (DDoS) attacks and to relay other malicious and abusive Internet traffic. Kimwolf’s ability to scan the local networks of compromised systems for other IoT devices to infect makes it a sobering threat to organizations, and new research reveals Kimwolf is surprisingly prevalent in government and corporate networks.

    Image: Shutterstock, @Elzicon.

    Kimwolf grew rapidly in the waning months of 2025 by tricking various “residential proxy” services into relaying malicious commands to devices on the local networks of those proxy endpoints. Residential proxies are sold as a way to anonymize and localize one’s Web traffic to a specific region, and the biggest of these services allow customers to route their Internet activity through devices in virtually any country or city around the globe.

    The malware that turns one’s Internet connection into a proxy node is often quietly bundled with various mobile apps and games, and it typically forces the infected device to relay malicious and abusive traffic — including ad fraud, account takeover attempts, and mass content-scraping.

    Kimwolf mainly targeted proxies from IPIDEA, a Chinese service that has millions of proxy endpoints for rent on any given week. The Kimwolf operators discovered they could forward malicious commands to the internal networks of IPIDEA proxy endpoints, and then programmatically scan for and infect other vulnerable devices on each endpoint’s local network.

    Most of the systems compromised through Kimwolf’s local network scanning have been unofficial Android TV streaming boxes. These are typically Android Open Source Project devices — not Android TV OS devices or Play Protect certified Android devices — and they are generally marketed as a way to watch unlimited (read:pirated) video content from popular subscription streaming services for a one-time fee.

    However, a great many of these TV boxes ship to consumers with residential proxy software pre-installed. What’s more, they have no real security or authentication built-in: If you can communicate directly with the TV box, you can also easily compromise it with malware.

    While IPIDEA and other affected proxy providers recently have taken steps to block threats like Kimwolf from going upstream into their endpoints (reportedly with varying degrees of success), the Kimwolf malware remains on millions of infected devices.

    A screenshot of IPIDEA’s proxy service.

    Kimwolf’s close association with residential proxy networks and compromised Android TV boxes might suggest we’d find relatively few infections on corporate networks. However, the security firm Infoblox said a recent review of its customer traffic found nearly 25 percent of them made a query to a Kimwolf-related domain name since October 1, 2025, when the botnet first showed signs of life.

    Infoblox found the affected customers are based all over the world and in a wide range of industry verticals, from education and healthcare to government and finance.

    “To be clear, this suggests that nearly 25% of customers had at least one device that was an endpoint in a residential proxy service targeted by Kimwolf operators,” Infoblox explained. “Such a device, maybe a phone or a laptop, was essentially co-opted by the threat actor to probe the local network for vulnerable devices. A query means a scan was made, not that new devices were compromised. Lateral movement would fail if there were no vulnerable devices to be found or if the DNS resolution was blocked.”

    Synthient, a startup that tracks proxy services and was the first to disclose on January 2 the unique methods Kimwolf uses to spread, found proxy endpoints from IPIDEA were present in alarming numbers at government and academic institutions worldwide. Synthient said it spied at least 33,000 affected Internet addresses at universities and colleges, and nearly 8,000 IPIDEA proxies within various U.S. and foreign government networks.

    The top 50 domain names sought out by users of IPIDEA’s residential proxy service, according to Synthient.

    In a webinar on January 16, experts at the proxy tracking service Spur profiled Internet addresses associated with IPIDEA and 10 other proxy services that were thought to be vulnerable to Kimwolf’s tricks. Spur found residential proxies in nearly 300 government owned and operated networks, 318 utility companies, 166 healthcare companies or hospitals, and 141 companies in banking and finance.

    “I looked at the 298 [government] owned and operated [networks], and so many of them were DoD [U.S. Department of Defense], which is kind of terrifying that DoD has IPIDEA and these other proxy services located inside of it,” Spur Co-Founder Riley Kilmer said. “I don’t know how these enterprises have these networks set up. It could be that [infected devices] are segregated on the network, that even if you had local access it doesn’t really mean much. However, it’s something to be aware of. If a device goes in, anything that device has access to the proxy would have access to.”

    Kilmer said Kimwolf demonstrates how a single residential proxy infection can quickly lead to bigger problems for organizations that are harboring unsecured devices behind their firewalls, noting that proxy services present a potentially simple way for attackers to probe other devices on the local network of a targeted organization.

    “If you know you have [proxy] infections that are located in a company, you can chose that [network] to come out of and then locally pivot,” Kilmer said. “If you have an idea of where to start or look, now you have a foothold in a company or an enterprise based on just that.”

    This is the third story in our series on the Kimwolf botnet. Next week, we’ll shed light on the myriad China-based individuals and companies connected to the Badbox 2.0 botnet, the collective name given to a vast number of Android TV streaming box models that ship with no discernible security or authentication built-in, and with residential proxy malware pre-installed.

    Further reading:

    The Kimwolf Botnet is Stalking Your Local Network

    Who Benefitted from the Aisuru and Kimwolf Botnets?

    A Broken System Fueling Botnets (Synthient).

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Alisa Viejo, United States, January 20th, 2026, CyberNewsWire One Identity, a trusted leader in identity security, today announces a major upgrade to One Identity Manager, a top-rated IGA solution, strengthening identity governance as a critical security control for modern enterprise environments.  One Identity Manager 10.0 introduces security-driven capabilities for risk-based governance, identity threat detection and […]

    The post One Identity Unveils Major Upgrade to Identity Manager, Strengthening Enterprise Identity Security appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Huntress discovers ‘CrashFix,’ a new attack by KongTuke hacker group using fake ad blockers to crash browsers and trick office workers into installing ModeloRAT malware.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The new EU-funded GCVE project is breaking dependence on US databases to track software flaws. Discover how this decentralised system aims to ensure global cybersecurity.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • On Saturday, Trump announced an economic war of coercion against more than a half-dozen U.S. allies in Europe, declaring “a 10% Tariff on any and all goods sent to the United States of America” from Denmark, Norway, Sweden, France, Germany, the U.K., the Netherlands, and Finland. “On June 1st, 2026, the Tariff will be increased to 25%. This Tariff will be due and payable until such time as a Deal is reached for the Complete and Total purchase of Greenland,” the president said on social media. 

    America’s NATO allies are deploying troops to Greenland to deter a U.S. invasion. Those developments were made public last week, shortly before Danish newspaper Berlingske reported Monday that U.S. officials attempted to obtain details about “military installations, ports and air bases…that could be important in planning an American attack on or invasion of Greenland,” and avoided traditional Ministry of Defense channels during the solicitation of that information at some point in 2025.  

    Developing: NORAD says it’s sending troops and aircraft to Greenland as well. The command’s Monday announcement cast it as part of “long-planned” operations “coordinated with the Kingdom of Denmark,” with these newly-arriving forces “operat[ing] with the requisite diplomatic clearances.”

    Worth noting: It’s remarkable that NORAD needs to clarify that the U.S. troops have the required diplomatic clearance. But it’s all part of a rapidly developing picture of American power at a crossroads under Trump during his second term in office. 

    Trump’s pace of disruption has accelerated since December, when the Supreme Court blocked his attempted deployment of National Guard troops to Chicago. Since then, he has abducted Venezuela’s leader, seized the country’s oil, intercepted at least a half-dozen tankers, sent more than five times as many ICE agents to Minneapolis as the city has police, threatened to invade Greenland, and last week threatened to invoke the Insurrection Act inside the U.S.

    Trump’s message to Norway: “I no longer feel an obligation to think purely of Peace, although it will always be predominant, but can now think about what is good and proper for the United States of America,” the president wrote in a highly unusual note to Norwegian Prime Minister Jonas Gahr Støre. 

    Trump said he has chosen to de-prioritize peace because he was not given the Nobel Peace Prize in 2025, which Norway’s government has no say over at any rate. “I have done more for NATO than any person since its founding, and now, NATO should do something for the United States. The World is not secure unless we have Complete and Total Control of Greenland. Thank you!” Trump wrote in the letter, which was made public on Sunday. 

    Historian reax: “Donald Trump now genuinely lives in a different reality, one in which neither grammar nor history nor the normal rules of human interaction now affect him,” warned Anne Applebaum of The Atlantic. She pointed out that at any point Republicans in Congress could move “to stop Trump from acting out his fantasy in Greenland and doing permanent damage to American interests.” Those lawmakers “owe it to the American people,” she said, “and to the world.”

    Former Marine and Iraq war veteran Ruben Gallego agrees, and told CNN Trump “would rather just break whatever he can to get what he wants,” the Arizona Democratic senator warned. “Let's be clear. The reason he's there is because we have cowardly republicans in the Senate, in the House that are not standing up to this man…And if we pay in the process, we as Americans, he doesn't care, right? This is the danger,” Gallego said, and moments later was even more blunt. “I've been very clear. He is a madman. He is insane. He's only thinking about himself,” he said. “The man is threatening war against a NATO ally.” 

    “He is destroying our world reputation or potentially our economic opportunity or economic might and power around the world because he is being petty,” Gallego said. “None of this is rational. Everyone needs to stop pretending this is rational.”

    By the way, Trump’s Greenland aggression could spike U.S. borrowing costs and notably harm the dollar, writes Financial Times columnist Katie Martin. “Bad stuff is very clearly happening with regards to Greenland,” she says. And relatedly, there is “a strong hint that investors are doing two things: disregarding the dollar and Treasuries as safe retreats, huddling instead in the warm embrace of gold, and treating a U.S.-born shock as a reason to sell U.S. assets…It is a brave new world for the U.S., however, and one that will reinforce the urge among big investment firms to park a greater share of their resources in Europe, Asia and indeed anywhere else over time.”

    Martin is hardly alone in her concerns about Trump’s apparent instability. The Wall Street Journal’s Gerald Baker, former editor-in-chief of the paper with more than three decades of experience in journalism, wrote a column of warning Monday entitled, “A Look Back at the War That Is About to Begin.” He writes in a sort of speculative-fiction mode, describing in retrospect the damage to the world that may follow from a possible U.S. invasion of Greenland. 

    “The fallout did almost as much harm to the U.S. as to Europe,” he writes. “The dollar sank, pushing up retail prices in America and causing a run on Treasury bonds that flattened mortgage lending and battered corporate finances. Seizing their opportunity, Russia and China demonstrated the value of allyship and pounced. Russia suspended its campaign in Ukraine and quickly moved on the Baltics. With NATO gone, Europeans were deeply divided about whether to offer support; but as a harsh winter descended, the desperate need for cheap energy soon forced them to assent to Russian control over large swathes of Eastern Europe.” 

    According to Baker’s telling, China fairly quickly seizes Taiwan. Then the U.S., “along with its remaining three allies—El Salvador, Qatar and Senegal—it struck an uneasy peace, a tripartite charter that replaced the American-denominated global order with a condominium of Russia, China and the U.S. dominant in their respective regions.” Read the rest, here

    A veteran U.S. diplomat warns, “Trump’s Greenland ambitions could wreck 20th-century alliances that helped build the modern world order,” writing Monday in The Conversation

    In Denmark, protesters have begun mocking Trump’s MAGA slogan with “Make America Go Away” hats, the Associated Press reported Monday from Copenhagen. “The mock hats were created by Copenhagen vintage clothing store owner Jesper Rabe Tonnesen. Early batches flopped last year—until the Trump administration recently escalated its rhetoric over Greenland. Now they are popping up everywhere.” Story, here

    In the Caribbean, “crew on board the United States' newest aircraft carrier are growing increasingly frustrated by design flaws that lead to regular failures in the ship's toilet system,” NPR reported Saturday about the USS Gerald R. Ford carrier, citing Navy documents obtained through a Freedom of Information Act request. 

    Additional reading: 


    Welcome to this Tuesday edition of The D Brief, a newsletter focused on developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. It’s more important than ever to stay informed, so we’d like to take a moment to thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1972, Pakistan launched its effort to develop nuclear weapons; it would perform its first, and so far only, live tests in 1998.

    Escalation watch: Troops in US cities

    Developing: Pentagon readies 1,500 soldiers for possible deployment to Minnesota, unnamed officials told several news outlets over the weekend. 

    Two infantry battalions of the Army’s 11th Airborne Division have been given prepare-to-deploy orders for the Midwest state, where thousands of federal agents have been conducting aggressive immigration raids. According to the Associated Press, “One defense official said the troops are standing by to deploy to Minnesota should President Donald Trump invoke the Insurrection Act, a rarely used 19th century law that would allow him to employ active duty troops as law enforcement.” Read more at the Washington Post or the Wall Street Journal.

    Analysis: The Trump administration’s actions amount to “state terror,” veteran terrorism analyst Adam Silverman wrote on Saturday: “I've seen a lot of terms thrown around for what the Trump admin is doing w/ICE, CBP, & other federal law enforcement (LE). The now largely out of use term is state terror.” 

    The origins for the term come from “the Reign of Terror during the French revolution,” Silverman explains. “The outcome was to coerce the population through the threat & actual use of violence against victims who were not necessarily the target audience.”

    How it works: “The power of the nation-state is being directed at the citizenry through threats [and] acts of violence, all done under the color of law, including extrajudicial executions, in order to coerce the citizenry into compliance through fear [and] intimidation. This includes using legal power/lawfare,” Silverman says. 

    American precedents. “State terror in the U.S. is not a new thing that [Stephen] Miller concocted, it was the modus operandi of the Confederate in all but name Jim Crow states,” Silverman says. “It's why in the Jim Crow states you have a variety of non-state actors from the genteel [and] seemingly legit white citizen councils all the way to a number of different white Christian supremacist terrorist groups like the Klu Klux Klan.” 

    This time around the perpetrators are largely ICE in addition to militia groups like the Oath Keepers and the Proud Boys. But also the U.S. military via Trump’s “attempts to use the National Guard,” which Silverman said, “makes sense as, like Robespierre's movement, the Trump/MAGA movement is a revolutionary movement.”

    Second opinion: “Lawful extremism,” is how extremism scholar J.M. Berger described what’s playing out in Minnesota and elsewhere in ICE raids. “What we're seeing is anti-immigration extremists carrying out violence against in-group dissenters,” he wrote in response to Silverman’s analysis. 

    Expert three: “We are a long way from Civil War, but the Minnesota National Guard is now wearing bright green vests to distinguish [them] from ‘other agencies,’” noted Robert Pape, director of the Chicago Project on Security and Threats at the University of Chicago. “This is now ‘us’ versus ‘them’ combat forces.” 

    “Trump is taking [the] U.S. to a very dark place,” Pape said, adding that it’s “Crucial that the [Minnesota National] Guard and ICE do not clash.”

    Expert four: There’s no mistaking that Trump has “launch[ed] a paramilitary occupation of an American city” and is now “sending armed goons to spread state-sponsored violence against the local population,” warns German historian Thomas Zimmer, writing Tuesday. 

    However, he pointed out, “Several times over the past twelve months, the regime pushed the country right up to the edge of the kind of authoritarian escalation that would have taken America across the line into full-blown autocratic territory,” but then officials “were either unable or didn’t dare to force that next step,” he writes with a note of optimism in an essay, “The Limits of Violent Authoritarianism.” 

    “I am not trying to tell you that things are fine. The situation is acutely dangerous,” he continues. “The outcome of the current struggle against the authoritarian assault on democratic self-government remains undetermined. At the start of 2026, America is no longer a democracy.”

    “What I am arguing is that being lawless, immoral, and violent does not make the Trumpists omnipotent,” Zimmer says. “Their authoritarian desires are limitless, but their ability to impose them on the country is not.” Read on, here

    Some Army recruiters are wooing high-schoolers by saying enlisting could protect their families from ICE. CNN documents a pitch in Minnesota, adding to a similar New York Times report last week from Oregon.

    Additional reading: 

    Around the Defense Department

    Trump’s ‘battleship’ could be the most expensive U.S. warship in history. Congressional researchers said ThursdayThe first Trump-class “battleship” ordered up by the White House could cost as much as $22 billion, and could cut into the Navy’s plans for next-generation destroyers, iDefense One’s Thomas Novelly reports, here.

    CNO drops hints about forthcoming ‘Fighting Instructions’ strategy. “That document will be my strategy for naval operations going forward,” Adm. Daryl Caudle  said during a speech at the Surface Navy Association symposium outside Washington, D.C. “It will explain how I view the Navy as the joint-force hedge for achieving our vital national interest.” That’s coming “in the near future,” a defense official told Defense One’s Meghann Myers, here

    Etc.

    China is building ‘full-stack’ defense-innovation cities. While the U.S. and others struggle to build rare-earth processing plants, magnet factories, and high-performance motor supply chains, Beijing is doing all of those at once, in city-scale clusters that will widen its advantage in next-generation technologies, write Tye Graham and Peter Singer in Defense One’s The China Intelligence column.

    And lastly, it’s been one full year of President Trump’s second term in office, so CNN used the occasion as an opportunity to find out how Americans feel about their elected leader now. Among the findings: 

    • 58% percent of Americans believe that Trump’s first year in office has been a failure;
    • Americans worry most about the economy, but concerns about democracy come in second; 
    • 66% think Trump doesn’t care about people like them;
    • 53% think he doesn’t have the stamina and sharpness to serve effectively as president;
    • And 65% said Trump is not someone they are proud to have as president.
    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Madison, United States, 20th January 2026, CyberNewsWire

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A set of three security vulnerabilities has been disclosed in mcp-server-git, the official Git Model Context Protocol (MCP) server maintained by Anthropic, that could be exploited to read or delete arbitrary files and execute code under certain conditions. “These flaws can be exploited through prompt injection, meaning an attacker who can influence what an AI assistant reads (a malicious README,

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers have uncovered a new phishing campaign that exploits social media private messages to propagate malicious payloads, likely with the intent to deploy a remote access trojan (RAT). The activity delivers “weaponized files via Dynamic Link Library (DLL) sideloading, combined with a legitimate, open-source Python pen-testing script,” ReliaQuest said in a report shared with

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • As emotional computing applications proliferate, the security threats they face require frameworks beyond traditional approaches.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • This week in cybersecurity from the editors at Cybercrime Magazine

    Sausalito, Calif. – Jan. 20, 2026

    Read the full story in World Economic Forum

    “Cybersecurity is the foundation for our digital world. It is at the heart of trust and will allow society to fully benefit from the transformations enabled by new technologies like AI and quantum,” Michael Miebach, CEO at Mastercard, told the World Economic Forum (WEF) in Davos, Switzerland, this week. “But it’s not something one can do on their own. We have to come together, share intelligence globally, and develop the skills equal to emerging risks. Society knows what’s at stake if we get this wrong. It’s critical that we get it right. If we do, we’ll be able to deliver on the many possibilities for so many people around the world.”

    As it relates to the potential for getting it wrong, a 2025 article in Central Bank Payment News by Mastercard’s Rigo Van den Broeck, EVP, Cybersecurity and Jesse McWaters, EVP, Head of Global Policy, said “Ransomware, scams and other kinds of financial crime have increased in prevalence, with cybercrime expected to cost $10.5 trillion annually by 2025, up from $3 trillion in 2015, according to Cybersecurity Ventures. Threat actors and cybercriminals are taking advantage of new and emerging technologies, like Generative AI (Artificial Intelligence), to enhance their sophistication of social engineering campaigns at scale and for far less cost, making the fraud problem even more challenging.”

    Mastercard previously reported that global losses and damages from cyberattacks came to $9.5 trillion in 2024, according to Cybersecurity Ventures, making cybercrime the third-largest economy in the world. By 2031, it is predicted that cybercrime will cost the world as much as $1 trillion per month.

    Valdecy Urquiza, Secretary-General, INTERPOL concurs with Miebach and had this to say at WEF: “Facing rapid innovation in tech combined with the transformative impact of AI, law enforcement cannot fight cyber crime in isolation. Protecting communities now depends on true multi-stakeholder cooperation. Only together can we stay ahead of criminals and uphold safety, rights, and resilience for a secure digital future.”

    Truly, it is time for all of us to come together in the war against cybercrime.

    Read the Full Story



    Cybercrime Magazine is Page ONE for Cybersecurity. Go to any of our sections to read the latest:

    • SCAM. The latest schemes, frauds, and social engineering attacks being launched on consumers globally.
    • NEWS. Breaking coverage on cyberattacks and data breaches, and the most recent privacy and security stories.
    • HACK. Another organization gets hacked every day. We tell you who, what, where, when, and why.
    • VC. Cybersecurity venture capital deal flow with the latest investment activity from various sources around the world.
    • M&A. Cybersecurity mergers and acquisitions including big tech, pure cyber, product vendors and professional services.
    • BLOG. What’s happening at Cybercrime Magazine. Plus the stories that don’t make headlines (but maybe they should).
    • PRESS. Cybersecurity industry news and press releases in real time from the editors at Business Wire.
    • PODCAST. New episodes daily on the Cybercrime Magazine Podcast feature victims, law enforcement, vendors, and cybersecurity experts.
    • RADIO. Tune into WCYB Digital Radio at Cybercrime.Radio, the first and only round-the-clock internet radio station devoted to cybersecurity.

    Contact us to send story tips, feedback and suggestions, and for sponsorship opportunities and custom media productions.

    The post Mastercard CEO Michael Miebach On Cybersecurity at World Economic Forum appeared first on Cybercrime Magazine.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶