Archive for January 15, 2026

« Older Entries

Insider Threats: Flashpoint observes 91,321 instances in 2025

Posted in Commentary with tags on January 15, 2026 by itnerd

Every organization houses sensitive assets that threat actors actively seek. Whether it is proprietary trade secrets, intellectual property, or the personally identifiable information (PII) of employees and customers, these datasets are the lifeblood of the modern enterprise—and highly lucrative commodities within the illicit underground.

In 2025, Flashpoint observed 91,321 instances of insider recruiting, advertising, and threat actor discussions involving insider-related illicit activity. This underscores a critical reality—it is far more efficient for threat actors to recruit an “insider” to circumvent multi-million dollar security stacks than it is to develop a complex exploit from the outside. 

Last year, Flashpoint collected and researched:

  • 91,321 posts of insider solicitation and service advertising
  • 10,475 channels containing insider-related illicit activity
  • 17,612 total authors

On average, 1,162 insider-related posts were published per month, with Telegram continuing to be one of the most prominent mediums for insiders and threat actors to identify and collaborate with each other. Analysts also identified instances of extortionist groups targeting employees at organizations to financially motivate them to become insiders.

Insider Threat Landscape by Industry

The telecommunications industry observed the most insider-related activity in 2025. This is due to the industry’s central role in identity verification and its status as the primary target for SIM swapping—a fraudulent technique where threat actors convince employees of a mobile carrier to link a victim’s phone number to a SIM card controlled by the attacker. This allows the threat actor to receive all the victim’s calls and texts, allowing them to bypass SMS-based two-factor authentication.

Insider Threat data from January 1, 2025 to November 24, 2025

Flashpoint analysts identified 12,783 notable posts where the level of detail or the specific target was particularly concerning.

Top Industries for Insiders Advertising Services (Supply):

  • Telecom
  • Financial
  • Retail
  • Technology

Top Industries for Threat Actors Soliciting Access (Demand):

  • Technology
  • Financial
  • Telecom
  • Retail

Flashpoint shares more details in a blog post, published today. It’s honestly worth your time to read.

Leave a comment »

Unit 42 Puts Out A Report on Cyber Threats To Watch Out For At The Winter Olympics

Posted in Commentary with tags on January 15, 2026 by itnerd

To help defenders protect their infrastructure, venues, suppliers, athletes and more, Unit 42 is releasing a new report, “Defending the 2026 Milan-Cortina Winter Games,” that details the top attackers, motives and tactics to prepare for ahead of the event, including steps organizations and local governments can take to protect themselves and the games.

The report builds on Unit 42’s prior work monitoring and preparing defenders for major events – including the 2024 Paris Olympics where authorities reported 140+ cyber incidents. The embargoed report (attached) shares highlights including:

  • Threat actor types: Ransomware gangs, nation-state actors, and hacktivist groups
  • Threat actors to watch: Muddled Libra, Insidious Taurus, and Salt Typhoon
  • Tactics to guard against: Social engineering attacks, DDoS attacks, API vulnerabilities and more.
  • Tips for defenders: Zero trust, runtime security, AI-driven automation and more.

You can read the report here: https://www.paloaltonetworks.com/resources/research/unit-42-cyber-vigilance-program/2026-winter-games-milano-cortina

Leave a comment »

Elon Musk Claims To Have Stopped Grok From Creating Highly Objectionable Content…. But Reports Suggest Otherwise….

Posted in Commentary with tags on January 15, 2026 by itnerd

Elon Musk appears to have climbed down from fighting the fact his AI chatbot Grok was creating all sorts of content that should never, ever be allowed to create. To recap, after this was discovered, and the predictable backlash happened, Elon tried to paywall this. The result was unsurprisingly more backlash. Now he’s finally just killed the ability for Grok to make this sort of content at all:

Elon Musk’s Grok artificial intelligence chatbot will no longer edit “images of real people in revealing clothing” on the X platform, the company confirmed Wednesday evening, following global outrage after Grok was found to be complying with user requests to digitally undress images of adults and in some cases children.

“We have implemented technological measures to prevent the Grok account from allowing the editing of images of real people in revealing clothing such as bikinis. This restriction applies to all users, including paid subscribers,” X wrote via its Safety team account.

This may have had something to do with the fact that a whole lot of governments around the world were investigating Elon over this. After all, this sort of thing is illegal. And rightly so. But Elon doesn’t see it that way that only this man who clearly has issues, lots of issues, understands.

Anyway this isn’t over. Why? Well, there’s this:

It’s still extremely easy to undress women and edit them into sexualized poses using the X and Grok mobile apps or websites, however, even without making a subscription payment that would connect your account to an easily identifiable source. In her testing, my fellow UK-based colleague Jess Weatherbed found that she was not blocked from using Grok’s image editing feature to create sexualized deepfakes of herself.

After uploading a fully clothed photograph to X and Grok, prompting the chatbot to “put her in a bikini” or “remove her clothes” produced only blurred, censored results. The bot did comply with every other request, however, including prompts to “show me her cleavage,” “make her breasts bigger,” and “put her in a crop top and low-rise shorts” — the last of which placed her in a bikini. The bot also generated images of her “leaning down” with a sexualized pose and facial expression, and in extremely revealing lingerie.

Clearly ether he’s not taking this seriously, or whatever minions he has behind this are inept. While both could be true at the same time, I am going to go with he’s not taking this seriously. That’s pretty dumb from a guy who bills himself as the smartest guy in the room. And it’s likely going to cost him. Various governments are fed up with his antics and are likely to lower the boom on him to drive home the point that his behaviour is not acceptable by any standard. And I am her for when that happens.

Leave a comment »

The Media Trust Expands Digital Trust and Safety Solutions with Microsoft Owned and Operated Publishers

Posted in Commentary with tags on January 15, 2026 by itnerd

The Media Trust today announced its technology and team helping strengthen trust and safety across Microsoft’s advertising ecosystem.

Through this collaboration, The Media Trust will provide critical global threat detection and real-time mitigation solutions to enhance Microsoft’s ability to protect users of its owned and operated publishers from malware, redirects, cloaked ads, and other malicious activities that can undermine user experience and disrupt digital revenue. This collaboration will enhance Microsoft’s ability to deliver a secure, high-quality advertising environment for consumers and partners worldwide.

The Media Trust will utilize its proprietary AI detection, global infrastructure, and malware team visibility across other partner inventory to identify and eliminate threats at the source, ensuring protection without unnecessarily disrupting legitimate advertiser revenue. TMT’s global infrastructure, advanced emulation technology, and expert malware analysis teams provide the scale and precision needed to meet the complex challenges of modern ad ecosystems.

This collaboration reflects The Media Trust’s continued leadership in digital trust, helping global brands, platforms, and agencies safeguard their users and revenue through a cleaner, more transparent advertising ecosystem.

Leave a comment »

The AI Reality Check: Why Curated Security Data Wins in 2026

Posted in Commentary with tags on January 15, 2026 by itnerd

DataBee this week published a round of predictions and recommendations from data experts. In 2025, enterprises sprinted toward AI, but DataBee predicts that in 2026 these same enterprises will discover that the real differentiator isn’t the model; it’s actually the quality, normalization, and lineage of the data fueling the model. 

he AI Reality Check: Why Curated Security Data Wins in 2026

In 2025, enterprises sprinted toward AI. In 2026, they’ll discover that the real differentiator isn’t the model—it’s the quality, normalization, and lineage of the data fueling it. Expect a rollback of AI hype as organizations confront fragmented security tooling, manual reporting, and point-in-time compliance. The leaders who win will shift to continuous controls compliance anchored in curated, clean datasets—then layer agentic AI on top as a “data expertise assistant” to scale decisions, not to shortcut rigor.

These predictions and recommendations come from Tyler Alfriend and Stephanie Whitnable, two of DataBee’s top data experts and practitioners. Drawing on their extensive experience in data engineering and analytics for compliance and cybersecurity, they share what organizations must do to turn AI hype into measurable business outcomes in 2026.

1) From Point-in-Time to Continuous Controls Compliance

Compliance is moving beyond 12-month lookbacks and sample-based testing into full-population monitoring at the data source. This shift makes compliance auditable, repeatable, and defensible—and it’s the only way to support real-time executive reporting and board-level confidence.

“The big intersection point is taking full populations from the data source to perform compliance tests—moving away from point-in-time and sample-based reporting.” — Tyler Alfriend

What to watch: Teams will sunset manual “number-hunting” in spreadsheets and instead, funnel direct, automated feeds from systems of record into compliance analytics.

2) Agentic AI Becomes the Data Expertise Assistant

As compliance gets data-centric, skill gaps surface: policy experts don’t always speak in SQL. In 2026, agentic AI steps in—not to replace domain expertise, but to amplify it. Think of it as a side-by-side assistant that translates policy into queries, navigates complex schemas, and surfaces exceptions—while the human retains judgment, context, and accountability.

“Agentic AI could be the ‘data expertise assistant’ that lets compliance pros operate in a new data-centric world without losing their core skill set.” — Tyler Alfriend

Leadership angle: Executives won’t start their day with dashboards; they’ll start with AI-generated briefings: “What’s in tolerance? Where should I focus?” Visuals still matter—but they become working dashboards for teams to validate, triage, and remediate with embedded automation.

3) Dashboards Don’t Die; They Get Practical

Rather than executive vanity metrics, 2026 rewards operational dashboards connected to automated workflows (tickets, playbooks, remediation actions). AI summarizes; dashboards execute. The cycle becomes: AI briefing → working dashboard → auto-generated remediation → continuous evidence trail.

“Dashboards stay, but as working spaces linked to automation, so teams can verify gaps and trigger remediation actions.” — Stephanie Whitnable

4) The Rise of Curated, Normalized Domain Datasets

AI won’t learn your unique policies or tool quirks out of the box. The key to unlocking AI’s potential is curated, clean domain datasets that abstract local nuance and enable AI to answer many questions—not just the one a single report was designed for. In 2026, data programs invert: build deep datasets first, then let AI generate the metrics and views on demand.

“It’s about building deep datasets around a domain—strip out nuance so AI can thrive.” — Tyler Alfriend

“The first word that comes to mind when I think about ‘AI-ready data’ is clean; normalized, clean data is required for the data sets feeding AI to answer lots of questions.” — Stephanie Whitnable

5) A Unified Security Data Fabric Moves from Idea to Imperative

Security teams live with more tools per capita than any other business unit, which obscures data clarity and creates inconsistent language across consoles. 2026 is the breaking point: the AI wave exposes data fragmentation and accelerates adoption of a security data fabric—a unifying layer that normalizes, enriches, and governs controls evidence across tools, then feeds it to AI and compliance analytics.

“Cybersecurity has way more tools per capita… and paradoxically less awareness of data problems. A security data fabric is the solution behind AI.” — Tyler Alfriend

6) The Great AI Reality Check

Enterprises expecting “push-button AI” will be disappointed. The constraint is data cleanliness and context, not model horsepower. Expect a rollback of hype as home-grown initiatives collide with messy datasets. The best outcome? A refocus on fixing data at the source and investing in people who can bridge business context with analytics and AI.

“It’s not going to work as perfectly as expected. Clean data still hasn’t had its spotlight.” — Stephanie Whitnable

“Don’t treat AI as an easy button. Build a good data environment, and AI can finally do what it’s hyped to do.” — Tyler Alfriend

2026 Playbook: Five Actions to Operationalize These Predictions

  1. Embed source-level data into compliance
    Replace sample-based checks with full-population, automated monitoring at the data source.
  2. Stand up curated domain datasets
    Normalize controls, events, assets, identities, and policies into clean, governed tables that AI can interrogate broadly.
  3. Deploy agentic AI for briefings; keep dashboards for work
    Give leaders morning summaries from AI, then route teams to dashboards with embedded remediation workflows.
  4. Invest in people and upskilling
    Pair business context owners with analytics upskilling and AI tools.
  5. Adopt a security data fabric
    Reduce “tool-silo sprawl.” Unify telemetry, controls evidence, and policy mappings in one fabric.

Leave a comment »

Xero introduces enterprise-grade analytics to empower small businesses to make smarter, faster decisions

Posted in Commentary with tags on January 15, 2026 by itnerd

Xero today announced the global launch of its new AI-powered analytics capabilities, setting a new standard for small business intelligence. Millions of business owners now have the ability to access leading analytics, insights, and reporting, and get instant answers to their financial questions directly within Xero.

Following its 2024 acquisition of Syft, a leading AI-powered reporting and insights platform, Xero has rapidly integrated the company’s powerful analytics features to put enterprise-grade intelligence into the hands of small businesses. In less than one year since closing the deal, analytics embedded within Xero have been made available to millions of customers worldwide.

Built for the business owner–not highly specialized data analysts–Xero’s analytics platform gives small businesses sophisticated yet easy-to-navigate insights tools, including:

  • Dashboards: customizable views of performance across revenue, expenses, and KPIs
  • Visualisations: graphs and tables to track profitability, cash flow, balance sheet health
  • Cash flow manager: projections up to 180 days, with the ability to scenario plan “what if” outcomes
  • AI insights: AI-generated suggestions and summaries provide a clear explanation of financial data
  • Business health scorecards: create custom scorecards that track key performance metrics alongside external data—like website traffic—for a consolidated view of business health

This milestone is part of Xero’s broader AI and insights strategy, which includes the recent unveiling of JAX, Xero’s AI financial superagent. Together, these innovations realize Xero’s vision to bring enterprise-grade intelligence to small businesses, delivered with the trust, accuracy, and human oversight that define the Xero brand. With 4.6 million subscribers today, Xero continues to successfully balance growth and profitability, recording a 20% increase in first-half revenue to NZD $1.2 billion (to the half year ended 30 September 2025), while delivering an above Rule of 40 outcome.

Leave a comment »

VVS Discord Stealer Using Pyarmor for Obfuscation and Detection Evasion

Posted in Commentary with tags on January 15, 2026 by itnerd

VS Stealer, a Python-based information-stealing malware, is targeting Discord users to steal their data, including exfiltrating sensitive information like credentials and tokens stored in their accounts.

Unit 42 has more details here: https://unit42.paloaltonetworks.com/vvs-stealer/

Martin Jartelius, AI Product Director at Outpost24, provided the following comments:

“This is in line with the “malware as a service” elements we have seen over the years. The scope is relatively slim, and the Windows-based persistence mechanisms, such as copying itself to the Start Menu autostart locations, are very noisy and not indicative of a highly sophisticated actor. That said, the analysis is still interesting, as it shows an actor making malware commercially available while using commercially available security tools themselves. While everything the malware does is mainstream, and the techniques used are somewhat dated, it once again offers a glimpse into an established and growing criminal ecosystem.”

The Unit 42 report makes for interesting reading as it gives a lot of detail as to how a campaign like this works. It’s worth your time to have a look.

Leave a comment »

An analysis on hack against major Spanish electricity and gas provider Endesa

Posted in Commentary with tags on January 15, 2026 by itnerd

Outpost24’s Threat Intelligence Research Team has released a detailed analysis on the recent cyberattack on Endesa, one of Spain’s largest electricity and gas providers. 

From publicly available evidence from underground forums, leaked dataset listings, and the threat actor’s own statements, the threat intel team examines the likely initial access vector, the probably origin of the data, and the broader security implications therein. 

Some key findings include: 

  1. Several indicators suggest the activity is attributable to a lone, Spanish-speaking individual rather than a coordinated group.
  2. The threat actor’s own statements, specifically “I also do cracking as a service” and “Don’t blame me for my work; blame your employees for not doing theirs,” strongly suggest that initial access was obtained through compromised credentials. 
  3. The actor’s minimal presence across forums and messaging platforms, combined with a lack of established reputation, suggests limited credibility among potential buyers. 
  4. Analysis of file names, object types, and export characteristics indicates the data originated from a CRM environment consistent with Salesforce.

For full details, the analysis can be read here: https://outpost24.com/blog/endesa-data-breach/

Leave a comment »

Windows exploit catches the attention of the CISA

Posted in Commentary with tags , on January 15, 2026 by itnerd

The CISA has added a vulnerability in Microsoft Windows, tracked as CVE-2026-20805 (CVSS Score of 8.7), to its Known Exploited Vulnerabilities catalog. Released this week in the Microsoft Patch Tuesday security update, this CVE is a Windows Desktop Window Manager flaw that lets attackers leak small pieces of memory information that can help attackers bypass security protection and is being actively exploited in the wild.

Here’s some insights from Adrian Culley, Senior Sales Engineer for SafeBreach and OWASP contributor:

“This is a ‘detected in the wild’ zero day attack. There is no publicly disclosed code or PoC, yet. CVE-2026-20805 is an information disclosure vulnerability affecting Desktop Window Manager. It was assigned a CVSSv3 score of 5.5 and was rated as important. Successful exploitation allows an authenticated attacker to access sensitive data. According to Microsoft, this vulnerability was exploited in the wild as a zero-day. Since exploitation requires local access and privileges, remote exploitation is not feasible, reducing the attack surface.”

This link from Microsoft has more details on this, along with the list of applicable patches from Microsoft depending on which Microsoft OS you’re running. It’s worth a read as this is one that you want to make sure that you’re defended against. Even if it’s not remotely exploitable.

Leave a comment »

Keepit strengthens global channel leadership with consolidated, partner-first team

Posted in Commentary with tags on January 15, 2026 by itnerd

 Keepit today announced a strengthened, consolidated global channel organization designed to accelerate growth through partners and reinforce its ambition to become the most partner-friendly organization in the world.

The expanded channel team is led globally by Jan Ursi, Global Vice President of Channels, and anchored by three regional leaders covering Southern Europe, Northern Europe, and the Americas. Together, the team brings deep channel experience, regional expertise, and a unified strategy built around one principle: partners come first.

Keepit operates a 100 percent channel-led go-to-market model, with all sales delivered through value-added resellers, managed service providers, GSIs and strategic alliances. Since launching the Keepit Partner Network and pivoting to a partner-only sales motion, the company has focused on creating a consistent global framework for enablement, joint marketing and collaborative sales execution — while giving regional teams the freedom to adapt to local market needs.

Ursi leads global channel strategy, messaging, and coordination across regions, aligning partner recruitment, enablement, and pipeline initiatives under a single narrative. His approach positions the channel as the default route to market, not an alternative, and prioritizes long-term collaboration over short-term gains.

Southern Europe and DACH: Building an ecosystem of fans

Southern Europe and DACH— including France, Italy, Spain, and Portugal, as well as Germany, Austria and Switzerland— is led by Cyril VanAgt, Regional Vice President of Channel, EMEA South. Based in Paris, VanAgt brings decades of channel leadership experience from Nutanix and NetApp.

The focus in Southern Europe is rapid ecosystem growth through local activation. This includes region-specific partner campaigns, PR-driven launches, and a structured Partner Academy program combining sales, technical, and marketing tracks. The academy model, already piloted in Paris, is being templated for rollout across the region.

The focus in DACH is to build on the region’s success by expanding the Keepit channel team to better support our top VAR and MSP partners across the Enterprise and Commercial segments, and to execute a strong distribution strategy to develop a run-rate business for the mid-sized and SMB segment in the region.

Northern Europe: Scaling repeatable success

Northern Europe — covering the UK and Ireland, the Nordics, Central Eastern Europe, and the Benelux — is led by Alex Walsh, Regional Vice President of Channel, EMEA North. Walsh brings more than 12 years of enterprise SaaS and channel experience, including senior leadership roles at Veeam and AppSense.

In the region, the focus is on expanding tier-one value-added reseller, managed service provider and distributor relationships, supported by a data-led strategy, consistent enablement cycles, and strong engagement with regional channel media.

Americas: Momentum through continuity

In the Americas, the channel organization is led by Jill Miracle, Director Channels Americas. Her focus is maintaining momentum with strategic focus partners while reinforcing Keepit’s long-term commitment to a partner-only model.

This includes synchronized enablement through Keepit’s global Partner Academy tracks, ensuring American partners have timely access to marketing assets, product updates, and certifications.

Global focus built around practical execution

With a unified global strategy and strong regional leadership, Keepit’s channel organization is designed to scale with partners — and grow together.

Keepit’s channel focus is built around practical execution: predictable partner economics, consistent enablement, and a vendor-independent SaaS backup and recovery platform that partners can take to customers across industries. The consolidated structure is designed to make it easier for partners to engage with Keepit, build pipeline, and scale delivery with a repeatable model.

With Ursi leading global strategy and regional leaders driving local execution, Keepit plans to increase partner recruitment, expand certifications, and deepen joint marketing across priority markets in 2026 — with one goal in mind: help partners grow profitable, durable SaaS data protection practices.

To become a Keepit partner, contact partner@keepit.com or visit keepit.com/partners.

Leave a comment »

« Older Entries