> InfoSec News Nuggets 01/09/2026

Chinese-Speaking Threat Actors Exploited VMware ESXi Zero-Days Over a Year Before Disclosure Huntress security researchers uncovered a sophisticated VMware ESXi exploitation campaign using a zero-day toolkit dubbed MAESTRO that was built over a year before VMware’s public disclosure in March 2025. The toolkit exploits three critical vulnerabilities (CVE-2025-22224, CVE-2025-22225, CVE-2025-22226) to achieve virtual machine escape and supports 155 ESXi builds spanning versions 5.1 through 8.0, with PDB paths revealing simplified Chinese strings and a development date of February 2024. Huntress observed the December 2025 attack begin through a compromised SonicWall VPN, with threat actors deploying reconnaissance tools, modifying firewall rules, and executing the exploit chain approximately 20 minutes after toolkit deployment before the attack was stopped. The Shadowserver Foundation reports over 30,000 internet-exposed ESXi instances remain potentially vulnerable.   Trend Micro Patches Critical Apex Central Vulnerabilities Including CVSS 9.8 RCE Flaw Trend Micro released Critical Patch Build 7190 addressing three severe vulnerabilities in Apex Central on-premise, including CVE-2025-69258, a maximum-severity LoadLibraryEx flaw with a CVSS score of 9.8 that enables unauthenticated remote attackers to load malicious DLLs and execute code with SYSTEM privileges. The vulnerability was discovered by Tenable security researchers who have now published technical details and proof-of-concept exploits for all three flaws, which affect the MsgReceiver.exe process listening on default TCP port 20001. Trend Micro strongly encourages all customers using Apex Central versions below Build 7190 to update immediately, as the publication of working exploits significantly increases the risk of active exploitation.   Microsoft Warns of Phishing Surge Exploiting Complex Email Routing to Spoof Internal Domains Microsoft Threat Intelligence disclosed that attackers are increasingly exploiting misconfigured email routing and weak spoof protections to send phishing emails that appear to originate from within targeted organizations’ own domains. The campaigns, which have surged since May 2025, primarily leverage the Tycoon2FA phishing-as-a-service platform that provides adversary-in-the-middle capabilities to bypass multi-factor authentication, with Microsoft Defender for Office 365 blocking over 13 million Tycoon2FA-linked emails in October 2025 alone. Organizations with MX records not pointing directly to Office 365 and lacking strict DMARC reject and SPF hard-fail policies are particularly vulnerable, with phishing lures themed around voicemails, document sharing, HR communications, password resets, and fraudulent invoices. Microsoft emphasizes this is not a vulnerability in their Direct Send feature but rather a configuration issue that can be prevented through proper email authentication policies.   European Space Agency Confirms Second Major Data Breach in Two Weeks The European Space Agency confirmed to The Register its second major breach in two weeks, with a criminal group claiming to have stolen approximately 500GB of operational and contractor data including spacecraft procedures, subsystem documentation, and mission details from companies like SpaceX, Airbus, and Thales Alenia. The threat actors assert the vulnerability used to gain access in September remains unpatched and are offering live system access, though ESA has declined to address specific claims while beginning a criminal investigation. This incident follows a separate December breach involving more than 200GB of ESA data, raising concerns about the agency’s security posture and the protection of sensitive aerospace information.   CrowdStrike Acquires Identity Security Startup SGNL for $740 Million CrowdStrike announced it is acquiring identity management startup SGNL in a deal valued at nearly $740 million to enhance identity security capabilities on its Falcon platform for the AI era. The acquisition will enable continuous identity management for human, non-human, and AI identities with real-time access control based on dynamic risk assessment, addressing the growing challenge of autonomous AI agents that operate with high-privilege access across distributed cloud environments. The deal follows a trend of major cybersecurity consolidation, with CrowdStrike’s 2025 acquisitions of Pangea and Onum, Palo Alto Networks’ $25 billion acquisition of CyberArk, and Google’s $32 billion purchase of Wiz, as companies race to offer comprehensive security solutions in an increasingly competitive market. The transaction is expected to close during CrowdStrike’s first quarter of fiscal year 2027. The post InfoSec News Nuggets 01/09/2026 appeared first on AboutDFIR - The Definitive Compendium Project.