SOCshare January 2026: cybersecurity landscape review

January 2026 was characterised by precise operations against critical infrastructure and the exposure of sensitive aerospace data. These activities occurred alongside ongoing ransomware threats, weaponization of developer tools, new malware frameworks, and critical vulnerabilities. Key incidents during the month included the coordinated sabotage of renewable energy assets in Poland and a significant breach of the European Space Agency’s collaborative environments.

More about SOCshare

Coordinated sabotage on Poland’s energy sector

The defining incident of the period was a sophisticated, multi-stage attack targeting Poland’s distributed energy resources and industrial infrastructure, which reached its destructive phase on December 29, 2025, and dominated recovery efforts throughout January.

The targets

The campaign simultaneously hit over 30 wind and solar farms, a large Combined Heat and Power (CHP) plant serving nearly 500,000 customers, and a private manufacturing firm.

The mechanism

Attackers gained initial access through internet-exposed FortiGate VPN and firewall devices. Once inside, they deployed destructive wiper malware - specifically DynoWiper and LazyWiper - to overwrite system files.and damage industrial controllers.

The Impact

The attack caused a loss of visibility and remote control for grid operators at the affected substations. Although electricity generation and heat supply were not interrupted, the event represents the first large-scale coordinated attack against the "distributed edge" of a national power grid.

Attribution

CERT Polska attributed the activity to the threat cluster Static Tundra, citing infrastructure overlaps with previous energy-sector espionage.

European Space Agency (ESA) data exposures (700 GB Total)

The ESA faced two significant, distinct data breaches in quick succession, resulting in the theft of massive technical and development datasets.

The “Development” Breach (200 GB): The threat actor “888” exfiltrated 200 GB of data from external collaboration servers. This included internal source code, CI/CD pipeline configurations, access tokens, and JIRA/Bitbucket repositories.
The “Technical” Breach (500 GB): The group Scattered Lapsus$ Hunters disclosed the theft of 500 GB of highly sensitive technical documentation. Having gained access in September 2025 via a public vulnerability, the attackers moved laterally to an internal platform used by mission partners.
Impact on the Aerospace: The combined leaks exposed proprietary specifications and mission roadmaps for programs like the Next Generation Gravity Mission (NGGM) and Earth Observation (EO). Critically, the data included proprietary specifications from major aerospace players such as SpaceX, Airbus, and Thales Alenia Space.

What Else Happened in January 2026?

New Malware Framework – VoidLink: a new sophisticated “cloud-native” Linux malware framework emerged, written in Zig and attributed to Chinese-affiliated developers. Engineered for modern infrastructure, designed to detect and adapt its behavior to major cloud providers (AWS, Azure, GCP) and containerized environments like Kubernetes and Docker. Its architecture is centered around a custom Plugin API – inspired by Cobalt Strike- allowing operators to deploy over 37 specialized modules for reconnaissance, credential harvesting, and container escape.
Operation MaliciousCorgi: Attackers published two AI coding extensions, “ChatGPT – 中文版” and “ChatMoss,” which appeared to function as legitimate productivity tools. The malware was capable of exfiltrating up to 50 workspace files on command to servers based in China. Over 1.5 million users were potentially affected, leading to the exposure of proprietary code, internal configuration files, and credentials.
High-Severity Vulnerabilities in Automation: Two critical sandbox escape flaws in the n8n workflow automation platform allow authenticated users to bypass execution restrictions and achieve remote code execution. CVE-2026-1470 (CVSS 9.9) exploits gaps in JavaScript expression validation using deprecated language features, while CVE-2026-0863 (CVSS 8.5) abuses Python exception handling to access restricted built-ins. Both require workflow creation privileges but enable full host compromise when exploited.

Key takeaways

The IT-to-OT pivot

The sabotage in Poland proves that corporate IT vulnerabilities are now the primary gateway for reaching industrial control systems.

Developer tools are high-value targets

The MaliciousCorgi campaign proves that IDE extensions are a viable and high-impact vector for industrial espionage and credential theft.

Identity and extortion over encryption

Threat actors are increasingly favoring “encryptionless extortion,” focusing on data exfiltration and public pressure rather than just locking systems.

Looking Ahead

Organizations should prioritize:

OT and Energy Resilience: Strengthening segmentation for distributed energy resources and monitoring of industrial control systems.
Continuous Exposure Management: Shifting from monthly scans to continuous monitoring, as attackers exploit vulnerabilities within hours of discovery.
IDE and Extension Governance: Implementing strict allow-lists for developer extensions and monitoring for anomalous outbound traffic from development environments.

January 2026 proved that IT vulnerabilities are now the primary gateway to critical infrastructure, while developer tools have become high-value attack vectors – requiring organizations to shift from reactive scanning to continuous monitoring and strict policies.