Back in the saddle with my Cybersecurity Weekly Roundup for 2026.

This week’s signal: CISA moves (KEV + retired Emergency Directives), critical patching for Veeam/Trend Micro/n8n/Cisco ISE, legacy edge gear still getting farmed, “internal-looking” phishing tricks, and malicious browser extensions stealing AI chats.

15 stories, quick briefs, and my practitioner take:
https://www.kylereddoch.me/blog/cybersecurity-weekly-roundup-january-2-9-2026/

#Cybersecurity #InfoSec #VulnManagement #ThreatIntel #Ransomware #BlueTeam #CybersecurityWeeklyRoundup #CybersecKyle

Back in the saddle with my Cybersecurity Weekly Roundup for 2026.

This week’s signal: CISA moves (KEV + retired Emergency Directives), critical patching for Veeam/Trend Micro/n8n/Cisco ISE, legacy edge gear still getting farmed, “internal-looking” phishing tricks, and malicious browser extensions stealing AI chats.

15 stories, quick briefs, and my practitioner take:
https://www.kylereddoch.me/blog/cybersecurity-weekly-roundup-january-2-9-2026/

#Cybersecurity #InfoSec #VulnManagement #ThreatIntel #Ransomware #BlueTeam #CybersecurityWeeklyRoundup #CybersecKyle

Oh well that's fucking clever. A threat actor is sending out phishing emails pretending to be SendGrid, and explaining that all their emails will include "Support ICE" banners in order to trigger ragebait clicks through to the phishing kit.

#threatintel

https://www.linkedin.com/posts/simokohonen_ragebait-as-a-phishing-tactic-a-threat-activity-7415349853754638336-gcCu?utm_source=social_share_send&utm_medium=member_desktop_web&rcm=ACoAABIZhqYBjXCQuV7JX7N_3xlpxZY6alHZ77o

Happy Friday, folks! New research from us:

THE KNOWNSEC LEAK: Yet Another Leak of China’s Contractor-Driven Cyber-Espionage Ecosystem

DTI researchers have been ripping apart 60+ sample screenshots from the Knownsec dump since November.

What emerged were deep technical details about Knownsec's platform and capabilities.

#threatintel

https://dti.domaintools.com/the-knownsec-leak-yet-another-leak-of-chinas-contractor-driven-cyber-espionage-ecosystem/

More Subjects to search on for that Sendgrid thing mentioned by Ian here.

https://masto.deoan.org/@neurovagrant/115865145438282370

API Authentication Issue
API Endpoint Communication Failed
API Endpoint Disabled
API Endpoint Failure
API Endpoint Issue
API Endpoint Issue
API Error Detected
API Request Failures Detected

API Request Status Update

Action required by January 13
Holiday Email Volume
ICE Support Initiative
Issue with Your API Request
JSON Payload Error
Language Preference Updated
Malformed JSON Payload
Migration to Sinch Authentication
New Pride Template
Pride Month Theme Update
We Couldn't Process Your Request

Your API endpoint has been rate limited
Your request couldn't be completed

#threatIntel

More Subjects to search on for that Sendgrid thing mentioned by Ian here.

https://masto.deoan.org/@neurovagrant/115865145438282370

API Authentication Issue
API Endpoint Communication Failed
API Endpoint Disabled
API Endpoint Failure
API Endpoint Issue
API Endpoint Issue
API Error Detected
API Request Failures Detected

API Request Status Update

Action required by January 13
Holiday Email Volume
ICE Support Initiative
Issue with Your API Request
JSON Payload Error
Language Preference Updated
Malformed JSON Payload
Migration to Sinch Authentication
New Pride Template
Pride Month Theme Update
We Couldn't Process Your Request

Your API endpoint has been rate limited
Your request couldn't be completed

#threatIntel

So here's the historical pDNS and domain data for sender domains in the headers of these emails from the samples I have.

SendGrid UPNs have been a bust so far, but guessing the attack isn't something to really write home about, but I'd like to see this group in particular inconvenienced for the ragebait aspect.

#threatintel

https://drive.proton.me/urls/V2AGD9P57W#MqEEZYyRVjmI

So here's the historical pDNS and domain data for sender domains in the headers of these emails from the samples I have.

SendGrid UPNs have been a bust so far, but guessing the attack isn't something to really write home about, but I'd like to see this group in particular inconvenienced for the ragebait aspect.

#threatintel

https://drive.proton.me/urls/V2AGD9P57W#MqEEZYyRVjmI