Executive SummaryThe findings in this report come from the results of active defense engagements with BEC threat actors. Every month, Fortra Intelligence & Research Experts (FIRE) conducts hundreds of these engagements to collect comprehensive intelligence about BEC tactics and trends to help better understand how the BEC threat landscape is evolving. The primary findings for January 2026...

A coordinated cyberattack that targeted Poland's energy infrastructure in late December 2025 has prompted cybersecurity agencies to issue urgent warnings to critical national infrastructure operators on both sides of the Atlantic.The attack, which Poland's Computer Emergency Response Team compared to "deliberate arson," targeted approximately 30 wind and solar farms, a heat and power plant, and...

The viral AI work caricature trend on Instagram is prompting users to generate job‑based AI images, unintentionally exposing sensitive personal and professional information. This activity highlights how easily threat actors can identify potential targets, exploit publicly shared details, and attempt LLM account takeovers or prompt‑based data extraction. The trend underscores broader risks of shadow AI, including the leakage of proprietary or sensitive data when employees use public LLMs. Organizations are encouraged to strengthen AI governance, monitor for compromised credentials, and deploy data‑security tools to prevent unauthorized access and disclosure.

SFTP uses SSH to encrypt data and ensure secure authentication for file transfers, while FTPS relies on SSL/TLS to secure FTP connections. SFTP operates on a single port, streamlining firewall configurations, whereas FTPS may require multiple ports.

Software as a Service (SaaS) efficiency dominates with more than 85% of business using at least one SaaS application. While it has widespread adoption, it does come with new data security risks. Some of the risks include companies that don’t comply with security standards and aren’t transparent about security. Also consider that allowing users remote access with any device can increase convenience...

Fortra's January 2026 Patch Priority Index (PPI) brings together important vulnerabilities for Microsoft and Google.Up first on the list are patches for Microsoft Edge (Chromium-based) that resolves an insufficient policy enforcement vulnerability.Next on the list are patches for Microsoft Office, Word, and Excel. These patches resolve 11 issues...

In this blog, learn the benefits of integrated DLP and data classification, and understand why their interoperability is critical for modern data security.

The start of a new year is always a good time to take stock. In cybersecurity, one perennial problem - the persistence of “vintage” open source vulnerabilities like Heartbleed and Shellshock – should force us to ask some hard questions. Why do so many vulnerabilities persist in Open Source (OS) tools, and how do we fix the problem? In theory, OS tools should be more secure. In practice, it hasn’t...

Security needs to be reevaluated in the context of AI, but not everything needs to change at once. Organizations that take a measured approach will do better, not giving into the AI hype cycle but recognizing the strategic ways AI is changing the game — and the ways it is changing security trajectories for the better.AI Is Weakening DefensesAI-enabled attacks are increasing, weakening existing...

Cobalt Strike 4.12 is now available. We are excited to introduce a new look and feel for the Cobalt Strike GUI, a REST API, User Defined Command and Control (UDC2), new process injection options, new UAC bypasses, a new BOF API BeaconDownload for in-memory buffers, and new drip loading Malleable C2 options.Additionally, we have overhauled pivot Beacons so that they now support the novel Sleepmask...

Imagine the scene. It's a cold Monday morning in Moscow. You walk out to your car, coffee in hand, ready to face the day. You press the button to unlock your car, and ... nothing happens. You try again. Still nothing. The alarm starts blaring. You can't turn it off.Welcome to Monday 26 January, 2026, and the chaos that was caused by a cyberattack on Delta - a Russian company that provides smart...

Introduction to the HaxorSEO MarketplaceFortra Intelligence and Research Experts (FIRE) have uncovered a group of active malicious threat actors operating since 2020. The group refers to themselves as Haxor, a slang word for hackers, and their marketplace as HxSEO, or HaxorSEO. HxSEO has established its primary base of operations and marketplace on Telegram and WhatsApp. HxSEO stands out for...

Post-exploitation tasks frequently require manual analysis, such as relying on an operators’ expertise to scan a target environment for sensitive information that could support in the pursuit of an objective. For example, searching file shares and internal applications for sensitive information of credentials. These tasks are often time consuming, but can be dramatically improved with the...

The 6.2 release of Fortra’s Secure Email Gateway marks a significant milestone in email security. This major update introduces cutting-edge enhancements powered by the Fortra Threat Brain, designed to deliver superior protection against phishing, malware, and spam.What's New in Version 6.2?At the heart of this release is the Fortra Threat Brain, a sophisticated intelligence engine that aggregates...