European hospitality blue screen of death, Brightspeed investigates breach, Convicted Bitfinex launderer freed

Summary

Podcast Summary: Cybersecurity Headlines (January 6, 2026)

Host: Sarah Lane, CISO Series
Episode Theme:
A roundup of the top cybersecurity incidents and trends making news, with a particular focus on targeted attacks against specific industries, large-scale data breaches, ongoing cyber threats, and governmental responses to cyber incidents worldwide.

---

1. European Hospitality Industry Attacked with “Blue Screen of Death” Malware

Key Points:

• Attack Method: Securonics researchers discovered a Russian-linked campaign targeting European hotels. Attackers use phishing emails that masquerade as booking site reservation cancellations, featuring high charges (over €1,000) to create urgency.
• Malware Details: Clicking through delivers the “Fault Blix” malware, which deploys a fake Windows Blue Screen of Death to mask malicious activity.
• Impact & Tactics: The malware disables system defenses, steals credentials and clipboard data, and ensures long-term persistence on infected devices.
• Attribution Clues: Russian-language debug strings, infrastructure located in Russia, and malware sales on Russian underground forums all suggest a strong Russian connection.
  Notable Quote:
  "The malware disables defenses, steals credentials and clipboard data, and maintains persistence with Russian language debug strings infrastructure geolocated to Russia." – Sarah Lane [00:35]

---

2. Brightspeed Investigates Data Breach Claims

Key Points:

• Who’s Affected: Brightspeed, a major U.S. fiber broadband provider, is probing a breach after the Crimson Collective hacking group claimed to have stolen data on over 1 million customers.
• Alleged Data Stolen: Contact information, account/session data, payment histories, limited card data, and appointment records.
• Company Response: Brightspeed has confirmed an ongoing investigation, but cannot yet verify the criminals’ claims.
  Notable Quote:
  "Brightspeed confirmed it's probing a potential cybersecurity incident, but hasn't verified the claims." – Sarah Lane [01:08]

---

3. Bitfinex Bitcoin Launderer Released

Key Points:

• Background: Ilya Lichtenstein, convicted of laundering billions in Bitcoin from the infamous 2016 Bitfinex hack, has been released from prison just over a year into a five-year sentence.
• Reason for Release: Lichtenstein attributes his release to the bipartisan First Step Act, a U.S. prison reform law; now on home confinement.
• Crypto Impact: The Bitfinex hack led to the U.S. seizing a record $3.6 billion in stolen Bitcoin.
  Notable Quote:
  "Lichtenstein says his early release was due to the First Step Act, a bipartisan prison reform law." – Sarah Lane [01:32]

---

4. Ukrainian Military Targeted via Messaging Apps

Key Points:

• Attack Details: Russia-aligned hackers are delivering malware to Ukrainian government and military targets via the Viber messaging app, escalating the use of communication platforms for initial payload delivery.
• Payload: Malicious zip files with disguised Windows shortcut files install Hijack Loader and Remcos RAT, focused on espionage and data theft.
• Trends: Increased abuse of messaging apps (Viber, Signal, Telegram) to evade security defenses and keep persistence.
  Notable Quote:
  "Researchers say the group has escalated its tactics by abusing messaging platforms like Viber and also Signal and Telegram to evade detection and maintain persistent access." – Sarah Lane [02:07]

---

5. Greek Airspace Disruption Likely Not Cyber Attack

Key Points:

• Incident: Sunday outage of Greek airspace after all air traffic control channels suffered disruptive noise, causing grounding and delays for about 120 flights.
• Current Assessment: Authorities believe a cyber attack is unlikely, though multiple probes are ongoing. Call for modernization of outdated equipment renewed by air traffic controllers.
  Notable Quote:
  "Greek authorities say a radio communications failure that shut down the country's airspace for several hours on Sunday probably wasn't a cyber attack, though investigations are ongoing." – Sarah Lane [03:02]

---

6. Kimwolf Botnet Infects 2 Million+ Devices

Key Points:

• Research: Syntheant reports the Kimwolf Android botnet has now surpassed 2 million devices, with ties to Aceru botnet and record DDoS campaigns.
• Exploitation: Botnet monetized via residential proxy sales, fraudulent app installs, and DDoS-for-hire, affecting nearly 12 million unique IPs weekly.
• Vector: Linked to exposed Android Debug Bridge services and some pre-infected TV boxes. Abuse of China-based proxy provider infrastructure noted and later patched.
  Notable Quote:
  "Kim Wolf is being actively monetized through residential proxy sales, app install fraud, and DDoS for hire, with about 12 million unique IPs observed weekly." – Sarah Lane [03:45]

---

7. “Mongo Bleeding” Exploit Hits Active Servers

Key Points:

• The Flaw: Critical MongoDB vulnerability—unauthenticated remote attackers can leak server memory, plain text credentials, and tokens.
• Timeline: Public exploit code published Dec 29; widespread exploitation confirmed by CISA a few days later.
• Mitigation: Affected organizations should urgently patch, disable ZLib compression, and rotate compromised credentials.
  Notable Quote:
  "Exploitation began around December 29, just days after Proof of concept code was published, prompting CISA to confirm in the wild attacks." – Sarah Lane [04:16]

---

8. New Zealand Launches Review into Manage My Health Breach

Key Points:

• Incident: Breach of Manage My Health, which manages records for 1.85 million New Zealanders; more than 100,000 potentially affected.
• Attacker: Individual using alias “Kazu” claims to have over 428,000 files, threatens data release unless paid $60,000 ransom.
• Response: Incident reportedly contained; company works with law enforcement and cybersecurity teams to investigate actual data exposure.
  Notable Quote:
  "Manage My Health says the incident is contained and is working with law enforcement and cybersecurity experts to determine what data was accessed or downloaded." – Sarah Lane [05:10]

---

Notable Quotes & Memorable Moments

• "The malware disables defenses, steals credentials and clipboard data, and maintains persistence..." – Sarah Lane [00:35]
• "Brightspeed confirmed it's probing a potential cybersecurity incident, but hasn't verified the claims." – Sarah Lane [01:08]
• "Lichtenstein says his early release was due to the First Step Act, a bipartisan prison reform law." – Sarah Lane [01:32]
• "Researchers say the group has escalated its tactics by abusing messaging platforms like Viber and also Signal and Telegram..." – Sarah Lane [02:07]
• "Kim Wolf is being actively monetized through residential proxy sales, app install fraud, and DDoS for hire..." – Sarah Lane [03:45]

---

Timestamps for Important Segments

• [00:07] — Headlines Intro
• [00:11] — European hospitality industry malware attack
• [01:03] — Brightspeed breach investigation
• [01:27] — Bitfinex money launderer freed
• [01:53] — Ukraine targeted via Viber
• [03:02] — Greek flight disruption update
• [03:30] — Kimwolf botnet surge
• [04:07] — MongoDB "Mongo Bleeding" under attack
• [04:48] — New Zealand health breach and review

---

Summary:
This episode delivers a dense update on major cybersecurity incidents: European hotels facing sophisticated Russian-linked malware; U.S. broadband provider Brightspeed under breach investigation; significant movement in the aftermath of the 2016 Bitfinex hack; evolving attack methods against Ukraine; infrastructure-related airspace disruptions in Greece; a massive Android botnet surge; critical MongoDB vulnerability exploits; and a serious health data breach in New Zealand, collectively highlighting the global and multifaceted nature of current cyber threats.

Transcript

[A]

From the CISO series. It's Cybersecurity Headlines.

[B]

These are the cybersecurity headlines for Tuesday, January 6, 2026. I'm Sarah Lane. European hospitality industry hit with Blue Screen of Death Securonics researchers say suspected Russian hackers are targeting European hotels with a malware campaign Fault Blix that uses a fake Windows blue screen of Death to deliver DC Rat malware. It starts with phishing emails posing as booking site reservation cancellations, often listing charges above €1,000 to create urgency. The malware disables defenses, steals credentials and clipboard data, and maintains persistence with Russian language debug strings infrastructure geolocated to Russia and DC Rets sail on Russian underground forums, pointing to to that Russian link BrightSpeed investigates breach claims BrightSpeed, a major US fiber broadband provider serving rural and suburban areas across 20 states, says it's investigating breach and data theft claims made by the Crimson Collective extortion group. The attackers allege they stole personal and account data tied to more than 1 million customers, including contact details, account and session information, payment history, limited card data and appointment records. Brightspeed confirmed it's probing a potential cybersecurity incident, but hasn't verified the claims. Convicted Bitfinex launderer freed from prison Ilya Lichtenstein, who pleaded guilty to laundering billions in bitcoin stolen in the 2016 Bitfinex hack, has been released from prison just more than a year into a five year sentence handed down in late 2024. Lichtenstein says his early release was due to the First Step Act, a bipartisan prison reform law. Officials say he served significant time and is now on home confinement. The hack led to a record $3.6 billion bitcoin seizure. Hackers target Ukrainian military and government with Viber. The 360 Threat Intelligence center reports that Russia aligned hackers are targeting Ukrainian military and government entities by using the Viber messaging app to deliver malware. The campaign sends malicious zip files containing Windows shortcut files disguised as Word and Excel documents, which deploy Hijack Loader and ultimately install Remcos RAT for espionage and data theft. Researchers say the group has escalated its tactics by abusing messaging platforms like Viber and also Signal and Telegram to to evade detection and maintain persistent access. Huge thanks to our sponsor Hoxhunt. Traditional security training fails because it treats employees like the problem. Hoxhunt treats them like the solution. AI powered simulations mirror actual attacks hitting your inbox. Instant coaching turns mistakes into learning moments. Gamified rewards make security engaging. The result? Real behavior change that measurably reduces your risk. Thousands of companies trust Hoxhunt to transform human vulnerability into human defense. Visit hoxhunt.com cisoseries to learn more. Cyber attack unlikely over Greece Grounded flights Greek authorities say a radio communications failure that shut down the country's airspace for several hours on Sunday probably wasn't a cyber attack, though investigations are ongoing. Flights were grounded, diverted or delayed after noise disrupted all air traffic control channels, including backups affecting about 120 flights in Athens and Thessaloniki airports and stranding thousands of passengers. Officials have launched multiple probes and formed a multi agency investigative committee. Air traffic controllers renewed calls to replace outdated equipment. Kimwolf infects more than 2 million devices New research from Syntheant says the Kimwolf Android botnet has now infected more than 2 million devices, expanding on December reports that first tied it to the Aceru botnet and record setting DDoS attacks. Investigators say Kim Wolf is being actively monetized through residential proxy sales, app install Fraud and and DDoS for higher, with about 12 million unique IPs observed weekly. The update also links infections to exposed Android debug bridge services and pre infected Android TV boxes and confirms recent abuse of China based proxy provider EPDE infrastructure before a late December patch. Critical Mongo bleed bug under attack Attackers are actively exploiting a critical MongoDB vulnerability dubbed Mongo Bleeding that lets unauthenticated remote attackers leak server memory and steal clear text credentials, tokens and sensitive data. Exploitation began around December 29, just days after Proof of concept code was published, prompting CISA to confirm in the wild attacks. The flaw affects multiple MongoDB versions when ZLib compression is enabled and security vendor Rapid7 warns that organizations need to patch and rotate exposed credentials. MongoDB urges immediate upgrades or disabling Zlib compression. New Zealand reviews Manage My Health cyber attack New Zealand's health minister has ordered a government review into a cyber attack on patient portal provider Manage My Health after a breach potentially exposed data tied to more than 100,000 patients. The platform is used nationwide and and manages records for about 1.85 million people, with an estimated 6 to 7% affected. The attacker, using the alias Kazu, has claimed to steal more than 428,000 files and is demanding a $60,000 ransom, threatening to release the data publicly. Manage My Health says the incident is contained and is working with law enforcement and cybersecurity experts to determine what data was accessed or or downloaded. Want more great content from the CISO Series team? If you haven't subscribed to our YouTube channel yet. Now's the time. It's 2026 after all. Head on over to YouTube.com cisoseries for a whole lot more. We'll see you there. If you have thoughts on the news from today or about our show in general, be sure to reach out to [e-mail] we'd love to hear from you. I am Sarah Lane, reporting for the CISO series. Thanks so much for listening.

[A]

Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.