**I Scan, You Scan, We All Scan for... Knowledge?**

Welcome to this week's edition of the Threat Source newsletter! This issue is all about the importance of reconnaissance in cybersecurity and how it's often overlooked due to alert fatigue. I'll also be sharing some top security headlines from around the world.

**The Importance of Reconnaissance**

I recently had a conversation with a colleague who asked me what I think are the most essential things to protect our own network. My answer, which no one ever wants to hear, is that we should prioritize reconnaissance. Yes, you read that right - reconnaissance! It's not about scanning for specific threats or vulnerabilities; it's about understanding your environment and being aware of potential risks.

We all know the feeling of alert fatigue - managing too many devices, dealing with too many data points, generating too many logs, and facing too few resources to handle it all. But I've always believed that it's a mistake to dismiss reconnaissance events to clear the way for analysts to look for "real" problems.

My first rule is: "Know your environment." The bad actors are only getting better at the recon portion, both on the wire and in social engineering. AI tooling has made many of the most challenging aspects of reconnaissance automagical. If you search the dark web for postings from initial access brokers (IABs), you'll find that they excel in reconnaissance and understanding your own environment.

**Recent Vulnerabilities and Patches**

Cisco Talos researchers recently discovered and disclosed vulnerabilities in Foxit PDF Editor, Epic Games Store, and MedDream PACS. These vulnerabilities include privilege escalation, use-after-free, and cross-site scripting issues that could allow attackers to execute malicious code or gain unauthorized access.

These vulnerabilities could have enabled attackers to escalate privileges, execute arbitrary code, or compromise sensitive systems, potentially leading to data breaches or system outages. Even though patches are available, unpatched systems remain at risk. Organizations should make sure all affected software is updated with the latest patches and review security monitoring for signs of exploitation attempts.

**Top Security Headlines**

Here are some top security headlines from around the world:

  • How a hacking campaign targeted high-profile Gmail and WhatsApp users across the Middle East: TechCrunch analyzed the source code of the phishing page, and believes the campaign aimed to steal Gmail and other online credentials, compromise WhatsApp accounts, and conduct surveillance by stealing location data, photos, and audio recordings.
  • LastPass warns of fake maintenance messages targeting users' master passwords: The campaign, which began on or around Jan. 19, 2026, involves sending phishing emails claiming upcoming maintenance and urging them to create a local backup of their password vaults in the next 24 hours.
  • Everest Ransomware claims McDonald's India breach involving customer data: The claim was published on the group’s official dark web leak site earlier today, January 20, 2026, stating that they exfiltrated a massive 861GB of customer data and internal company documents.
  • North Korea-linked hackers pose as human rights activists, report says: North Korea-linked hackers are using emails that impersonate human rights organizations and financial institutions to lure targets into opening malicious files.
  • Hackers use LinkedIn messages to spread RAT malware through DLL sideloading: The attack involves approaching high-value individuals through messages sent on LinkedIn, establishing trust, and deceiving them into downloading a malicious WinRAR self-extracting archive (SFX).

**Talos Takes: Cyber Certifications and You**

Listen to the latest episode of Talos Takes as Amy Ciminnisi explores certifications in cybersecurity with Joe Marshall. They discuss the benefits and drawbacks of obtaining certifications and how they can impact your career.

**Microsoft Patch Tuesday for January 2026**

Microsoft has released its monthly security update for January 2026, which includes 112 vulnerabilities affecting a range of products, including 8 that Microsoft marked as "critical."

**Most Prevalent Malware Files from Talos Telemetry**

Here are some of the most prevalent malware files from Talos telemetry over the past week:

  • SHA256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507
  • MD5: 2915b3f8b703eb744fc54c81f4a9c67f
  • SHA256: 90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59
  • MD5: c2efb2dcacba6d3ccc175b6ce1b7ed0a
  • SHA256: a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91
  • MD5: 7bdbd180c081fa63ca94f9c22c457376
  • SHA256: 96fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974
  • MD5: aac3165ece2959f39ff98334618d10d9
  • SHA256: 47ecaab5cd6b26fe18d9759a9392bce81ba379817c53a3a468fe9060a076f8ca
  • MD5: 71fea034b422e4a17ebb06022532fdde

**Stay Safe and Informed**

As always, remember to stay vigilant and keep your environment up-to-date with the latest patches. Review security monitoring for signs of exploitation attempts, and educate users on the risks of opening suspicious files or clicking unknown links.

**Talos Rep: https://talosintelligence.com/talos_file_reputation**

Stay safe and informed - follow us on social media to stay up-to-date with the latest threat intelligence and security news!