Zscaler is hosting a webinar focused on automating exposure validation to keep pace with AI-powered cyberattacks. The session comes as new research from their ThreatLabz team reveals that AI has significantly compressed response times for defenders while simultaneously making VPNs a vulnerable entry point for rapid breaches. The webinar aims to address how security teams can adapt their validation processes to match the accelerated threat landscape created by AI-enhanced attacks.

A sophisticated cyberattack targeting Venezuelan energy firms and utilities in late 2025 deployed a new data-wiping malware called Lotus Wiper that systematically destroyed system recovery mechanisms, overwritten physical drives, and deleted files to leave systems unrecoverable. Security researchers at Kaspersky Lab found the attack used living-off-the-land techniques with two coordinated batch scripts, and appears to match a December attack on Venezuela's state-run oil company PDVSA, which the company blamed on the US. The incident represents a growing trend of nation-state actors using destructive wiper malware as a cost-effective cyber weapon to cause operational damage to critical infrastructure, with experts warning that many energy and utility organizations remain unprepared for such well-resourced attacks.

A Chinese national accused of being part of the Silk Typhoon hacking group has been extradited from Italy to the US to face charges of cyberattacks on American universities and COVID-19 researchers. Xu Zewei allegedly worked for China's Ministry of State Security, targeting virologists and immunologists in 2020 and 2021, and participated in exploiting Microsoft Exchange Server vulnerabilities that compromised thousands of systems worldwide. He faces nine counts including wire fraud and computer hacking, while his alleged co-conspirator remains at large.

A new ransomware variant called VECT 2.0 has emerged with an unusually destructive approach, permanently destroying files larger than 131 kilobytes instead of encrypting them for potential recovery. The malware targets multiple operating systems including Windows, Linux, and ESXi, making it a cross-platform threat that eliminates the possibility of ransom payment and file restoration for affected organizations. This marks a shift from traditional ransomware tactics, as attackers appear focused on pure destruction rather than financial gain.

Spectrum Security has come out of stealth mode with 19 million dollars in seed funding led by TechOperators. The San Francisco-based startup, founded this year, offers an automated threat detection platform that works with existing security tools to identify and fix coverage gaps in real-time. The company says its solution reduces engineering hours while continuously monitoring environments to ensure full security coverage, addressing what CEO Meny Har calls those critical blind spots that appear in breach post-mortems.

Germany suspects Russia is behind a sophisticated phishing campaign on Signal that compromised around 300 accounts belonging to high-ranking officials, military personnel, and journalists. The attackers used a fake Signal security chatbot to trick users into scanning QR codes or entering PINs, which linked their accounts to devices controlled by the hackers, giving them access to past chats, ongoing conversations, and stored data. Federal prosecutors opened an investigation in mid-February, and similar attacks have been reported in the Netherlands, as tensions between Western nations and Russia remain high following the invasion of Ukraine.

Kaspersky researchers have discovered PhantomRPC, a new Windows privilege escalation technique that exploits architectural weaknesses in the operating system's Remote Procedure Call mechanism to allow attackers to gain System-level access. The vulnerability works by deploying fake RPC servers that impersonate legitimate Windows services, intercepting requests from high-privilege processes and abusing Windows's built-in impersonation functionality. Microsoft has classified the issue as moderate severity and says it doesn't require immediate patching, as exploitation requires an attacker to first compromise a privileged service, though researchers found multiple attack paths across all Windows versions.

Electric motorcycles and scooters from Zero Motorcycles and Yadea are vulnerable to hacking attacks that could pose serious safety risks to riders. Zero's vulnerability allows attackers within Bluetooth range to connect to bikes and upload malicious firmware that could manipulate critical safety systems like throttle response and braking, while Yadea's scooter flaw lets attackers intercept and replicate key fob commands to steal vehicles. CISA has classified these vulnerabilities as medium to high severity, with Zero planning a firmware patch in May but Yadea yet to release a fix.

Sevii has launched Cyber Swarm Defense, a new pricing model for its AI-powered security platform that charges a fixed annual rate per protected asset rather than by AI token usage. This addresses a growing problem for security teams where unpredictable AI costs can spike during multiple simultaneous attacks, potentially exhausting budgets mid-incident and leaving organizations vulnerable. The service automatically scales defensive AI agents as needed during attack swarms while maintaining predictable costs, allowing CISOs to better plan budgets and maintain sufficient in-house staff for critical security decisions.

Security researchers have discovered more than 70 suspicious extensions in the Open VSX marketplace linked to the GlassWorm malware campaign, which targets developer credentials and cryptocurrency. These extensions are clones of popular legitimate extensions, published by newly created accounts as "sleepers" that appear harmless initially but can deliver malware through future updates. At least six of the cloned extensions have already been activated, continuing a pattern that began in October when GlassWorm first emerged using hidden code and blockchain-based command-and-control infrastructure.