US Cyber Operations Disrupt Venezuelan Air Defenses; UK Warns of Escalating Russian Hacktivist Attacks on Critical Infrastructure

Executive Summary

This week's intelligence cycle (January 13-20, 2026) reveals significant developments across multiple critical infrastructure domains, with offensive cyber operations, nation-state threats, and emerging vulnerabilities demanding immediate attention from infrastructure operators.

• Confirmed Offensive Cyber Operations: US officials have confirmed that cyberattacks were employed during operations in Venezuela, successfully disrupting power systems in Caracas and degrading air defense radar capabilities. This represents a significant public acknowledgment of cyber operations against critical infrastructure in a military context.
• Russian Hacktivist Threat Escalation: The UK National Cyber Security Centre (NCSC) has issued warnings about intensifying disruptive cyber campaigns by Russian-aligned hacktivist groups targeting critical infrastructure and local government organizations, signaling elevated threat levels for Western infrastructure operators.
• Hardware-Level Vulnerabilities: A newly disclosed hardware flaw dubbed "StackWarp" affects AMD processors across Zen 1-5 architectures, breaking SEV-SNP protections designed to secure confidential computing environments—a significant concern for cloud infrastructure and data centers.
• Ransomware and Access Broker Activity: A Jordanian national pleaded guilty to operating as an access broker, selling unauthorized access to 50+ enterprise networks. Separately, Ingram Micro disclosed a ransomware attack affecting 42,000 individuals, while new malware strains PDFSider and SolyxImmortal emerged targeting enterprise environments.
• Regulatory Developments: The European Union has launched its new vulnerability database (EUVD), and DHS is reportedly finalizing a replacement structure for the disbanded Critical Infrastructure Security Council.
• Quantum Threat Advancement: China has publicly claimed testing of over 10 quantum-based cyber weapons for potential warfare applications, accelerating concerns about post-quantum cryptography readiness.

Threat Landscape

Nation-State Threat Actor Activities

Russian-Aligned Hacktivist Operations (HIGH PRIORITY)

The UK government, through the NCSC, has issued formal warnings regarding ongoing malicious activity from Russian-aligned hacktivist groups. These campaigns are specifically targeting:

• Critical national infrastructure operators
• Local government organizations
• Public-facing services and systems

The attacks are characterized as "disruptive" in nature, suggesting focus on availability rather than data exfiltration. Infrastructure operators in NATO-aligned nations should assume elevated targeting risk and review defensive postures accordingly.

Source: Bleeping Computer, Infosecurity Magazine

Chinese Quantum Weapons Development

Chinese state media has claimed that over 10 quantum-based cyber weapons are currently being tested for warfare applications. While specific capabilities remain unverified, this announcement signals:

• Accelerated quantum computing weaponization efforts
• Potential near-term threats to current encryption standards
• Strategic messaging intended to influence adversary planning

Assessment: Organizations should accelerate post-quantum cryptography migration planning, particularly for long-lived secrets and critical infrastructure control systems.

Source: Homeland Security Today

US Offensive Cyber Operations Confirmed

Multiple reports confirm US cyber operations were employed during recent military activities in Venezuela, successfully:

• Disrupting electrical power systems in Caracas
• Degrading air defense radar capabilities

This public confirmation of offensive cyber operations against critical infrastructure has implications for defensive planning, as it demonstrates the operational maturity of such capabilities and may influence adversary doctrine development.

Source: SecurityWeek

Ransomware and Cybercriminal Developments

Black Basta Leadership Targeted

Ukrainian authorities conducted raids against suspects linked to the Black Basta ransomware group. Oleg Evgenievich Nefedov, allegedly one of the group's founders, has been placed on both Europol's and Interpol's Most Wanted lists. This law enforcement action may temporarily disrupt operations but historically such groups reconstitute under new branding.

Source: Infosecurity Magazine

Access Broker Prosecution

A Jordanian national has pleaded guilty in US federal court to operating as an access broker, selling unauthorized access to at least 50 enterprise networks to undercover agents. This case highlights:

• The maturity of the access-as-a-service ecosystem
• Ongoing law enforcement infiltration of criminal marketplaces
• The need for continuous network monitoring and access auditing

Source: SecurityWeek, Bleeping Computer

PDFSider Malware Targets Fortune 100

A new malware strain dubbed "PDFSider" was deployed against a Fortune 100 company in the financial services sector. The malware is designed for:

• Long-term, covert system access
• Delivery of additional malicious payloads on Windows systems
• Evasion of standard detection mechanisms

Financial sector organizations should prioritize threat hunting for indicators associated with this campaign.

Source: Bleeping Computer, Infosecurity Magazine

Tudou Guarantee Marketplace Closure

The Telegram-based criminal marketplace "Tudou Guarantee," which processed over $12 billion in illicit transactions, appears to be shutting down operations. While this removes one major fraud facilitation platform, operators and customers will likely migrate to alternative services.

Source: The Hacker News, Infosecurity Magazine

Emerging Attack Vectors

Malicious Browser Extensions Campaign

Multiple malicious Chrome extensions have been identified targeting enterprise users:

• CrashFix/NexShield: A fake ad blocker that deliberately crashes browsers to deploy ClickFix-style attacks delivering ModeloRAT malware
• Enterprise Session Hijacking: Five Chrome extensions discovered hijacking sessions for Workday and NetSuite enterprise platforms

Organizations should audit browser extension policies and implement allowlisting for approved extensions only.

Source: SecurityWeek, The Hacker News, CSO Online

AI Prompt Injection Vulnerabilities

Researchers disclosed a prompt injection vulnerability in Google Gemini that exposed private calendar data through malicious meeting invites. This attack vector demonstrates risks associated with AI integration into productivity tools and highlights the need for:

• Input validation for AI-processed content
• Careful scoping of AI assistant permissions
• User awareness training on AI-specific attack vectors

Source: The Hacker News

Sector-Specific Analysis

Energy Sector

Threat Level: ELEVATED

The confirmed use of cyber operations to disrupt Venezuelan power systems underscores the vulnerability of electrical infrastructure to sophisticated attacks. While this operation was conducted by a nation-state actor with significant resources, it demonstrates:

• Operational feasibility of grid disruption via cyber means
• Integration of cyber operations with kinetic military activities
• Potential for similar capabilities to be developed by adversaries

Recommended Actions:

• Review and test incident response plans for grid disruption scenarios
• Ensure OT/IT network segmentation is properly implemented
• Validate backup power and manual override capabilities
• Coordinate with regional reliability organizations on threat intelligence

Water & Wastewater Systems

Threat Level: ELEVATED

The UK NCSC warning specifically includes critical infrastructure targeting by Russian hacktivists. Water utilities should note:

• Hacktivist groups have previously targeted water treatment facilities
• Disruptive attacks may focus on SCADA/HMI systems
• Public-facing web applications remain common entry points

Recommended Actions:

• Audit remote access configurations and implement MFA
• Review and restrict internet-facing OT system exposure
• Ensure manual operation procedures are documented and tested

Communications & Information Technology

Threat Level: HIGH

TP-Link VIGI Camera Vulnerability

TP-Link has patched a critical vulnerability in VIGI network cameras that exposed devices to remote hacking. Researchers identified over 2,500 internet-exposed vulnerable devices. Given the widespread deployment of network cameras in critical infrastructure facilities, organizations should:

• Inventory all TP-Link VIGI camera deployments
• Apply available patches immediately
• Review network segmentation for surveillance systems
• Audit internet exposure of security camera systems

Source: SecurityWeek

AMD StackWarp Hardware Vulnerability

The newly disclosed StackWarp vulnerability affects AMD processors across Zen 1-5 architectures, breaking SEV-SNP (Secure Encrypted Virtualization-Secure Nested Paging) protections. This is significant for:

• Cloud service providers using AMD-based confidential computing
• Organizations relying on hardware-based isolation for sensitive workloads
• Data centers processing classified or regulated information

Assessment: Monitor AMD security advisories for firmware updates and assess exposure in confidential computing environments.

Source: The Hacker News

ServiceNow BodySnatcher Vulnerability

A vulnerability dubbed "BodySnatcher" in ServiceNow highlights risks associated with rushed AI integrations. Organizations using ServiceNow with AI features should review configurations and apply available mitigations.

Source: CSO Online

Transportation Systems

Threat Level: MODERATE

The confirmation of cyber operations degrading Venezuelan air defense radars has implications for aviation sector cybersecurity. While direct applicability to civil aviation is limited, the demonstrated capability to disrupt radar systems warrants:

• Review of cybersecurity controls for air traffic management systems
• Coordination with FAA on emerging threat intelligence
• Assessment of backup navigation and communication procedures

Coast Guard Leadership Transition

Admiral Kevin Lunday has been sworn in as the 28th Commandant of the U.S. Coast Guard. Maritime sector stakeholders should anticipate potential policy and priority adjustments during the leadership transition.

Source: Homeland Security Today

Healthcare & Public Health

Threat Level: ELEVATED

The Ingram Micro ransomware attack, while primarily affecting the technology distribution sector, exposed personal information including:

• Names and dates of birth
• Social Security numbers
• Employment-related data

Healthcare organizations using Ingram Micro services should assess potential exposure and monitor for identity theft indicators among affected personnel.

Source: SecurityWeek, Bleeping Computer

Financial Services

Threat Level: HIGH

The PDFSider malware specifically targeted a Fortune 100 financial services company, indicating continued threat actor focus on this sector. Additionally:

• Enterprise session hijacking extensions targeted Workday and NetSuite platforms commonly used in financial services
• The SolyxImmortal information stealer emerged, using Discord webhooks for data exfiltration
• A Tennessee man pleaded guilty to hacking the U.S. Supreme Court's electronic filing system and breaching accounts at federal agencies

Recommended Actions:

• Implement browser extension controls and monitoring
• Review Discord and similar platform access from corporate networks
• Enhance monitoring for lateral movement and data staging activities

Source: Bleeping Computer, Infosecurity Magazine

Government Facilities

Threat Level: ELEVATED

Multiple developments affect government sector security:

• UK local government organizations specifically cited in NCSC hacktivist warning
• Federal agency breaches disclosed (AmeriCorps, Department of Veterans Affairs)
• DHS restructuring critical infrastructure security coordination mechanisms

Government facility operators should maintain heightened awareness and ensure coordination with sector-specific ISACs.

Vulnerability & Mitigation Updates

Critical Vulnerabilities Requiring Immediate Attention

Vulnerability	Affected Systems	Severity	Action Required
TP-Link VIGI Camera RCE	TP-Link VIGI network cameras	HIGH	Apply vendor patch immediately; audit internet exposure
AMD StackWarp	AMD Zen 1-5 processors	HIGH	Monitor for firmware updates; assess confidential computing exposure
NTLMv1 Authentication	Windows environments using NTLMv1	HIGH	Migrate to NTLMv2 or Kerberos; Mandiant released cracking tool to demonstrate risk
Google Gemini Prompt Injection	Google Workspace with Gemini integration	MEDIUM	Review AI assistant permissions; implement calendar invite filtering
ServiceNow BodySnatcher	ServiceNow with AI integrations	MEDIUM	Review AI integration configurations; apply vendor guidance

Notable Patches and Updates

• TP-Link: Released patches for VIGI camera vulnerability enabling remote code execution
• Microsoft Intune: Update includes enforcement mechanisms that will disable outdated applications—organizations should review application inventories to prevent operational disruption

Authentication Security Alert

Mandiant has publicly released tools demonstrating the ability to crack NTLMv1 authentication, explicitly encouraging organizations to migrate away from this insecure protocol. Organizations still using NTLMv1 should:

• Audit authentication protocols across all systems
• Develop migration plans to NTLMv2 or Kerberos
• Implement network-level restrictions on NTLM usage where possible

Source: CSO Online

Recommended Defensive Measures

Browser Security Hardening

• Implement enterprise browser extension policies
• Deploy allowlisting for approved extensions only
• Monitor for unauthorized extension installations
• Consider enterprise browser solutions for sensitive operations

Information Stealer Defenses

• Block Discord webhook communications from corporate networks where not business-required
• Implement endpoint detection for known stealer families (StealC, SolyxImmortal)
• Monitor for credential harvesting indicators

Resilience & Continuity Planning

Lessons Learned: Venezuela Grid Disruption

The confirmed cyber operations against Venezuelan infrastructure provide valuable lessons for resilience planning:

• Cyber-Physical Integration: Attacks were coordinated with kinetic operations, demonstrating the need for unified physical and cyber incident response
• Air Defense Dependencies: Radar system disruption highlights the interconnection between different infrastructure systems
• Manual Override Capability: Organizations should ensure critical systems can operate in degraded modes without digital control systems

Post-Breach Trust Recovery

Security Magazine's analysis on post-breach narrative management emphasizes treating trust as a strategic asset. Key recommendations:

• Develop pre-incident communication plans
• Establish relationships with stakeholders before incidents occur
• Plan for long-term reputation recovery, not just immediate response

Source: Security Magazine

Supply Chain Security

The Ingram Micro breach affecting 42,000 individuals demonstrates supply chain risk propagation. Organizations should:

• Maintain inventories of third-party relationships and data sharing
• Include supply chain breach scenarios in incident response planning
• Establish notification procedures for downstream impact assessment

Information Sharing Effectiveness

SecurityWeek's "Cyber Insights 2026" report on information sharing notes that while sharing is widespread, it remains imperfect in practice. Organizations should:

• Evaluate current ISAC participation and engagement levels
• Establish bidirectional sharing relationships, not just consumption
• Develop internal processes for rapid indicator dissemination

Source: SecurityWeek

Regulatory & Policy Developments

EU Vulnerability Database Launch

The European Union has launched its new vulnerability database (EUVD), providing an alternative to US-based vulnerability tracking systems. Implications include:

• Potential for divergent vulnerability identification and scoring
• Additional compliance considerations for multinational organizations
• Opportunity for enhanced vulnerability intelligence through multiple sources

Organizations operating in EU jurisdictions should familiarize themselves with EUVD and assess integration with existing vulnerability management programs.

Source: CSO Online

DHS Critical Infrastructure Security Council Replacement

DHS is reportedly finalizing a replacement structure for the disbanded Critical Infrastructure Security Council. Stakeholders should:

• Monitor announcements for new coordination mechanisms
• Prepare to engage with revised public-private partnership structures
• Maintain existing sector coordination relationships during transition

Source: Homeland Security Today

AI Executive Order Implications

Analysis indicates that recent AI executive order changes shift security burdens to users and organizations. Security teams should:

• Review AI tool deployments for compliance implications
• Develop organizational AI governance frameworks
• Assess AI-related risks in vendor and supply chain relationships

Source: Security Magazine

International Counterterrorism Operations

US forces conducted strikes in Somalia targeting ISIS and Al-Shabab, and killed an Al-Qaeda affiliate leader linked to attacks on Americans in Syria. While primarily counterterrorism developments, these operations may influence:

• Retaliatory threat levels against US interests
• Potential for increased extremist messaging and recruitment
• Heightened awareness requirements for facilities with symbolic value

Source: Homeland Security Today

Training & Resource Spotlight

Leadership Transitions

Several significant personnel changes may affect sector coordination:

• Jen Easterly (former CISA Director) has joined RSAC as CEO, potentially influencing industry conference content and public-private engagement
• Admiral Kevin Lunday sworn in as 28th Coast Guard Commandant
• Charles Wall named Deputy Director of ICE
• Brian Given (former FEMA Acting Chief Security Officer) joins Georgetown University Public Safety Team

Source: Homeland Security Today

DHS S&T 2025 Year in Review

The DHS Science and Technology Directorate has published its 2025 Year in Review, highlighting research and development efforts relevant to critical infrastructure protection. Organizations should review for applicable technologies and partnership opportunities.

Source: Homeland Security Today

Enterprise Browser Security Resources

CSO Online has published a comparison guide for secure enterprise browsers, providing evaluation criteria for organizations considering browser security enhancements. Given the malicious extension campaigns identified this week, this resource is particularly timely.

Source: CSO Online

Top Cybersecurity Projects for 2026

CSO Online's analysis of priority cybersecurity projects for 2026 provides strategic planning guidance. Security leaders should review for alignment with organizational roadmaps.

Source: CSO Online

Threat Intelligence Resources

Researchers disclosed an XSS vulnerability in the StealC infostealer's control panel, which was exploited to gather intelligence on threat actor operations. This demonstrates the value of offensive security research in understanding adversary infrastructure.

Source: The Hacker News, Infosecurity Magazine

Looking Ahead: Upcoming Events & Considerations

Security Conferences & Events

• RSAC 2026: With Jen Easterly's appointment as CEO, anticipate enhanced government-industry dialogue at upcoming RSAC events
• NIST Hardware Security Standards Development: NIST is advancing next-generation secure hardware standards (publication dated January 28, 2026)—stakeholders should monitor for comment opportunities

Threat Periods Requiring Heightened Awareness

• Russian Hacktivist Activity: UK NCSC warning indicates ongoing campaign—maintain elevated monitoring posture
• Black Basta Reconstitution: Following law enforcement action, monitor for group rebranding or splinter operations
• Post-Quantum Transition Planning: China's quantum weapons claims accelerate timeline considerations for cryptographic migration

Regulatory Milestones

• DHS Critical Infrastructure Council Replacement: Announcement expected in near term—prepare for new engagement requirements
• EU Vulnerability Database Integration: Organizations with EU operations should assess EUVD incorporation into vulnerability management programs
• Microsoft Intune Application Enforcement: Review application inventories before enforcement mechanisms activate

Seasonal Considerations

• Q1 Budget Cycles: Security investment decisions being finalized—ensure critical infrastructure protection priorities are represented
• Winter Weather: Northern hemisphere winter conditions may stress physical infrastructure—ensure cyber-physical incident response coordination

---

This intelligence briefing is derived from open-source reporting and is intended to support critical infrastructure protection decision-making. Recipients are encouraged to validate information through sector-specific channels and report relevant threat indicators to appropriate authorities and ISACs.