Every week, ISMG rounds up cybersecurity incidents and breaches around the world. This week, Moody’s predicted obsolesce of the firewall, Romanian critical infrastructure hacked, Sedgwick data breach and a D-Link DSL router flaw. Finland seized the Fitburg. Microsoft says Direct Send not to blame for Exchange phishing. Malicious Chrome extensions, European hotels targeted and health breaches.
Firewalls Headed for Obsolesce, Predicts Moody’s
Credit rating agency Moody’s is predicting a “new era of adaptive, fast evolving threats” over the next five years due to increased artificial intelligence capabilities. In a pay walled look-ahead report, the financial services firm repeats the industry consensus that threat actors to date have used AI to merely amplify existing hacking techniques rather than introduce entirely new ones. “No major breach has yet been fully attributed to AI-driven innovation,” it writes.
That may change as AI develops to allow threat actors to deploy self-rewriting code attacking previously unknown security flaws in automated campaigns that simultaneously attack thousands of targets.
“A growing concern is the use of AI to automate vulnerability discovery – continuously scanning networks and applications for flaws such as missing patches or misconfigurations – at a scale and speed that outpaces defenders’ ability to remediate them,” Moody’s wrote.
The most immediate concerns linked to AI are AI-fueled phishing attacks that evade traditional detection methods and enterprises that do a poor job of securing their own AI applications as well as AI poisoning.
Emerging risks include deploying AI to accelerate attack times and indicators that AI is already becoming more capable of automating attacks (see: AI Tool Ran Bulk of Cyberattack, Anthropic Says).
Over the next three to five years, Moody’s predicts, AI-coded malware will be able to autonomously modify its code and behavioral patterns in real time to evade detection, “rendering static defenses, like antivirus shields and firewalls, obsolete.”
Romanian Power Producer Hit by Gentlemen Ransomware
Romania’s state-owned power producer Complexul Energetic Oltenia disclosed a ransomware attack that disrupted key business IT systems, marking the second major cyber incident affecting Romanian critical infrastructure during the December holiday period.
The company in a Dec. 27 Facebook post said attackers wielding “The Gentlemen” ransomware encrypted certain documents and files and temporarily rendered several critical applications unavailable. Affected systems included enterprise resource planning platforms, document management tools, email services and the company’s public website.
The incident interrupt the energy grid, according to the operator. Complexul Energetic Oltenia plays a significant role in the country’s electricity production, particularly during peak demand periods.
The disclosure follows a separate ransomware attack on Romania’s national water authority Apele Române, confirmed by the Romanian national cybersecurity directorate on Dec. 21, 2025. That incident affected approximately 1,000 IT systems across 10 regional water basin authorities, disrupting geographic information system platforms, servers and email systems.
Security researchers tracking Gentlemen say the ransomware emerged in mid-2025. Gentlemen ransomware has been tied to campaigns across at least 17 countries, with victims spanning sectors including manufacturing, healthcare and insurance.
Sedgwick Confirms Government Subsidiary Breach
Global claims and risk management provider Sedgwick said its federal subsidiary, Sedgwick Government Solutions, was the victim of a New Year’s Eve data breach.
Ransomware as a service group TridentLocker, which first surfaced online in November 2025, has claimed the breach. On its leak site, the group said it stole 3.39 gigabytes of data, or 2,497 files in total.
Sedgwick’s government solutions arm handles claims and risk management solutions for many of the Department of Homeland Security component agencies, Immigration and Customs Enforcement, Customs and Border Protection, the Cybersecurity and Infrastructure Security Administration and the Coast Guard.
“No wider Sedgwick systems or data were affected. Further, there is no evidence of access to claims management servers nor any impact on Sedgwick Government Solutions ability to continue serving its clients,” a Sedgwick spokesperson said.
Sedgwick primarily operates in the insurance and risk solutions sector, employing 33,000 people worldwide to serve 10,000 clients across 80 countries – 59% of which belong to the Fortune 500. Estimates of the company’s annual revenue sit between $4 billion and 5 billion.
New D-Link DSL Router Vulnerability Under Active Exploitation
Security researchers reported active exploitation of a critical command injection vulnerability in legacy D-Link DSL routers, exposing networks still running unsupported hardware.
The flaw, tracked as CVE-2026-0625, stems from improper input sanitization in the dnscfg.cgi DNS configuration endpoint. It allows an unauthenticated remote attacker to inject and execute arbitrary shell commands, resulting in remote code execution on vulnerable devices.
Cybersecurity firm VulnCheck says affected end-of-life models include DSL-526B, DSL-2640B, DSL-2740R and DSL-2780B. D-Link stopped supporting the routers in early 2020.
Security agencies have repeatedly warned that unpatched, end-of-life routers are an easy target for criminal and nation-state hackers. The FBI and U.S. Cybersecurity and Infrastructure Security Agency have documented how hackers compromise routers to repurpose them into proxy networks, botnets or traffic-forwarding nodes.
Finland Seizes Cargo Vessel Fitburg in Undersea Cable Damage Investigation
Finnish police formally seized on Wednesday the cargo vessel Fitburg after earlier arresting two crew members as part of an ongoing criminal investigation into damage to an undersea telecommunications cable between Finland and Estonia (see: Finnish Police Investigating New Undersea Cable Incident).
The Police of Finland said one crew member is in pre-trial detention and the government imposed a travel ban on three other Fitburg sailors.
The vessel was sailing from Russia and was boarded by the Finnish Border Guard on Dec. 31 while in Finland’s exclusive economic zone after it dragged its anchor for hours – apparently rupturing the cable while it was in the Estonian economic zone. Finnish telecom Elisa said at the time the incident did not disrupt service.
Finnish customs discovered onboard Russian steel subject to international sanctions but on Wednesday concluded that the crew did not violate those sanctions by bringing the steel into Finnish territorial waters. The ship “entered Finnish territorial waters at the request of Finnish authorities,” the customs agency said.
Finnish prosecutors in 2025 charged the captain and two senior officers of another Russia-linked vessel, the oil tanker Eagle S, that damaged submarine cables in the Baltic Sea on Christmas Day, 2024 (see: Finland Suspects Eight in Deep-Sea Cable Sabotage Incident).
A Helsinki court in October dismissed the charges because the damaged cables were outside Finland’s territorial waters.
Phishing Actors Exploit Email Routing Misconfigurations
Phishing groups are abusing complex email routing configurations and weak authentication controls to spoof corporate domains and deliver malicious messages that appear to originate from inside targeted organizations, Microsoft wrote in a Tuesday blog post.
The tech giant said attackers are exploiting misconfigured DMARC and SPF settings in email systems whose DNS records do not point directly to Office 365. These gaps allow external emails to pass spoofing checks and evade detection.
Microsoft said it wrote the blog post to refute public reporting that threat actors are taking advantage of a vulnerability in Direct Send, an Exchange feature that allows devices such as printers and third-party services to send email through the organization’s domain without authentication. The malicious activity “rather takes advantage of complex routing scenarios and misconfigured spoof protections,” the computing giant wrote.
The activity, observed throughout 2025 and continuing into January 2026, is linked to phishing-as-a-service operations, including the Tycoon2FA platform, which specializes in adversary-in-the-middle attacks to bypass two-factor or multifactor authentication in cloud environments.
An August 2025 analysis by SpyCloud shows that Tycoon2FA infrastructure was used to harvest nearly 160,000 credentials, including usernames, passwords and session cookies. More than half of the compromised accounts belonged to users in the United States, with Microsoft and Google email services most frequently targeted.
Chrome Extensions Caught Harvesting Private AI Chats from Millions
A widespread malware campaign abused Google’s Chrome Web Store for months, exposing private AI chatbot conversations and browsing data from roughly 900,000 users, cybersecurity researchers at Ox Security said Wednesday.
The campaign involved two malicious browser extensions, identified as “ChatGPT for Chrome with GPT-5, Claude Sonnet & DeepSeek AI” and “AI Sidebar with DeepSeek, ChatGPT, Claude and more.” The extensions impersonated AItopia, a legitimate Chrome-based AI productivity tool that allows users to interact with multiple large language models through a browser sidebar.
Once installed, the fake extensions requested permission to collect “anonymous, non-identifiable analytics data,” but instead harvested complete ChatGPT and DeepSeek conversations along with users’ open-tab URLs and browser metadata.
Captured data could include intellectual property, internal business queries, personal information and authentication tokens.
One of the extensions carried Google’s “Featured” badge in the Web Store gaps in vetting processes for third-party add-ons.
The findings mirror a broader trend of popular browser extensions intercepting AI chatbot activity. In a recent incident involving Urban VPN Proxy, researchers found that a widely used, Google-featured VPN extension was collecting complete AI chat conversations across multiple platforms, affecting millions of users.
European Hospitality Sector Targeted in PHALT#BLYX Malware Campaign
Threat researchers uncovered a malware campaign dubbed “PHALT#BLYX,” that uses fake system crash screens and trusted Windows build tools to infect systems. The threat actor behind it appears to be primarily targeting the European hospitality sector.
Security firm Securonix said the campaign begins with phishing emails posing as booking.com reservation cancellation notices. The messages claim a pending financial charge, pressuring recipients to click embedded links. Victims are redirected to a spoofed website that displays a fraudulent CAPTCHA followed by a fake blue screen of death, creating the impression that the system has crashed.
The fake BSOD instructs users to paste a PowerShell command into Windows Run, a social-engineering technique known as ClickFix. Executing the command triggers the download of a malicious MSBuild project file. By abusing msbuild.exe, a legitimate Microsoft developer utility, attackers are able to evade application whitelisting and bypass security controls.
Once executed, the malware deploys a modified version of the Dark Crystal RAT, a commercially available remote access Trojan that has been in circulation since at least 2018. Analysis from Splunk shows that DCRat is modular and configurable, allowing attackers to enable capabilities such as system reconnaissance, screenshot capture, clipboard monitoring and remote command execution.
Richmond Behavioral Health Authority Breach
Richmond Behavioral Health Authority, a public provider of mental health and substance abuse and prevention services to citizens of Richmond, Virginia, reported to federal regulators that a September ransomware attack has compromised the protected health information of more than 113,000 patients.
The municipal agency said that on or about Sept. 30, 2025, it became aware that it was a “victim” of a cyber incident.
“Our investigation revealed that malicious actors gained access to RBHA’s network on or about Sept. 29, 2025, and deployed ransomware to encrypt portions of the network. The malicious actors’ network access was terminated as soon as it was detected,” RBHA said.
Information potentially affected in the incident includes patients’ full name or first initial and last name combined with their Social Security number, passport number, financial account information or health information.
“RBHA has implemented additional security measures designed to further protect the privacy of our students, staff and partners,” the organization said. Among other steps taken, RBHA said it has engaged a strategic service provider to monitor its cybersecurity systems, review its system’s architecture and shored up its cyber defenses.
Sleep Disorder Center Hack
New Jersey-based Persante Health Care, which operates 90 sleep disorder testing centers across the United States, notified nearly 112,000 individuals of a hacking incident discovered in January 2025. The U.S. Department of Health and Human Services listed the incident on its running list of healthcare sector HIPAA violations over the holiday period.
Persante said in a breach notice that it became aware on Jan. 28, 2025 of unusual activity in its network and took “immediate” steps to secure its network. It also reported the incident to the FBI.
An investigation determined that threat actors gained access to Persante’s network between Jan. 23, 2025 and Jan. 28, 2025 and potentially accessed or acquired certain files containing individuals’ personal and protected health information.
Persante Health Care said it worked with affected medical facilities to coordinate individual notification efforts.
The information potentially compromised in the incident included names, dates of birth, Social Security numbers, driver’s license numbers passport numbers, dates of medical service and medical condition or treatment information.
Also among the information potentially affected was Medicare or Medicaid numbers, individual health insurance policy numbers, financial account numbers, payment card numbers, patient account numbers, medical record numbers, medical device identifiers and biometric identifiers.
Other Stories From This Week
With reporting from Information Security Media Group’s Marianne Kolbasuk-McGee in the Boston exurbs, Gregory Sirico in New Jersey and David Perera in Northern Virginia.