Cyber Intelligence Weekly (January 4, 2026): Our Take on Three Things You Need to Know

Welcome to our weekly newsletter where we share some of the major developments on the future of cybersecurity that you need to know about. Make sure to follow my LinkedIn page as well as Echelon’s LinkedIn page to receive updates on the future of cybersecurity!

To receive these and other curated updates to your inbox on a regular basis, please sign up for our email list here: https://echeloncyber.com/ciw-subscribe

Before we get started on this week’s CIW, I’d like to highlight that Echelon has a whole library of hot cybersecurity topics that we are willing to give at professional organization meetings and seminars! We know that finding great speakers is hard, so we are providing our readers with an easy button.

𝗪𝗲 𝘁𝗮𝗸𝗲 𝗲𝗱𝘂𝗰𝗮𝘁𝗶𝗼𝗻 𝘀𝗲𝗿𝗶𝗼𝘂𝘀𝗹𝘆.

We’re not just practitioners... we’re educators.

That’s why we built a speaker catalog of cybersecurity topics we regularly update and deliver to teams and leadership groups.

Want us to come speak to your organization? DM us.

Download the speaker menu here: 📖 https://lnkd.in/ercSaf_k

Away we go!

1.  Another Federal Contractor Hit: Lessons from Sedgwick’s Cyber Incident

Sedgwick has confirmed a cybersecurity incident affecting its federal-focused subsidiary, Sedgwick Government Solutions, after the TridentLocker ransomware group claimed responsibility for an attack late on New Year’s Eve. According to the attackers, roughly 3.4 GB of data was exfiltrated from the environment. Sedgwick acknowledged the incident and stated that it is actively investigating with the support of external cybersecurity experts engaged through outside counsel.

The subsidiary provides claims and risk management services to a wide range of U.S. federal agencies, including DHS, ICE, CBP, USCIS, the Department of Labor, and CISA itself—placing the incident squarely within the sensitive government-contractor ecosystem. Sedgwick emphasized that the affected system was an isolated file-transfer environment, that the subsidiary is segmented from the rest of the enterprise, and that there is currently no evidence of access to core claims management systems or operational disruption to client services.

While the company’s segmentation claims are encouraging, the incident highlights a recurring pattern: ransomware groups continue to view government contractors as high-value leverage points, even when direct government systems are not accessible. These organizations often hold regulated data, sensitive personal information, and operational documentation that can create downstream risk for public agencies without breaching federal networks themselves.

TridentLocker is a relatively new ransomware group, emerging publicly in November, but its rapid targeting of government-adjacent organizations mirrors tactics used by more established actors. For federal contractors and regulated service providers, this incident reinforces the need for rigorous third-party risk management, continuous monitoring of “isolated” systems, and tabletop-tested incident response plans that assume attackers will target peripheral infrastructure rather than core production platforms.

Botnet Campaign Exploits React2Shell Vulnerability in Cloud and Edge Infrastructure

In the realm of cloud security, researchers have uncovered a botnet campaign exploiting a critical vulnerability in the React framework that spans serverless and cloud-connected devices. Security firm CloudSEK reported that a botnet known as RondoDox has been leveraging the recently disclosed React2Shell flaw to compromise endpoints that host React Server Components — a widely deployed technology in modern web stacks.

What elevates this from a typical patching issue to a strategic cloud security threat is the diversity of environments impacted. Because React Server Components are embedded in numerous cloud-hosted applications, microservices, and edge functions, attackers have been able to infect everything from traditional web servers to containers and serverless functions. Once footholds are established, the botnet attempts lateral propagation and integrates compromised nodes into its distributed network.

Cloud architects and DevOps teams should take note: this isn’t purely a software library flaw confined to local codebases. The interplay between cloud services, CI/CD pipelines, and bundled frameworks means that vulnerabilities in ubiquitous dependencies can manifest as cloud security gaps at scale, especially when automation and ephemeral instances are involved.

The response is twofold: first, ensure vulnerable versions of React Server Components are remediated across all environments; second, tighten runtime controls and detection around suspicious traffic patterns and unusual process behaviors in cloud workloads. This incident reinforces that cloud security now requires dependency hygiene as a core pillar, not an afterthought.

2.  California’s New Privacy Tool Takes Aim at the Data Broker Economy

California has quietly crossed an important privacy threshold with the launch of a new statewide tool that allows residents to demand deletion of their personal data from hundreds of data brokers at once. The Delete Requests and Opt-Out Platform (DROP), created under the state’s 2023 Delete Act, replaces what was previously a fragmented, manual opt-out process with a single, centralized request mechanism. For the first time, individuals can submit one verified request that applies to every registered data broker operating in the state—now and in the future.

The platform doesn’t trigger immediate deletion. Data brokers will begin processing requests in August 2026 and will have up to 90 days to comply and report back. If a broker claims it cannot locate a user’s data, residents can submit additional identifying details to support the request. Importantly, the requirement applies only to third-party data brokers that buy or sell personal information—not to companies holding first-party data collected directly from customers. Certain categories of information, such as public records or data regulated under other frameworks like HIPAA, are excluded.

From a security and risk perspective, DROP represents more than a consumer convenience feature. By reducing the volume of personal data circulating through opaque broker ecosystems, the state is attempting to shrink a major source of downstream exposure tied to identity theft, fraud, and increasingly, AI-enabled impersonation and social engineering attacks. The California Privacy Protection Agency has been explicit that this initiative is intended to lower both nuisance-level abuse—such as spam and robocalls—and systemic cyber risk stemming from large-scale data aggregation.

For organizations that rely on enriched consumer data, this shift signals a tightening regulatory environment with real financial consequences. Brokers that fail to register or ignore deletion requests face penalties of $200 per day, plus enforcement costs. More broadly, DROP reinforces a growing expectation that privacy controls are no longer optional friction points, but enforceable governance requirements—ones that intersect directly with cybersecurity, fraud prevention, and AI risk management strategies.

“AI Agents as Insider Threats” — The New Paradigm CISOs Can’t Ignore

A fresh industry interview this week with Palo Alto Networks’ Chief Security Intelligence Officer, Wendi Whitmore, highlights a trend every security leader must take seriously: AI agents themselves are emerging as insider threats rather than purely defensive tools. According to the discussion, as enterprises rapidly deploy autonomous AI agents across workflows — expected to grow from 5% to 40% of enterprise apps by the end of 2026 — these agents are now appearing in contexts that rival traditional privileged insiders.

Unlike conventional malware or external attackers, AI agents often operate with broad access and are deeply embedded in business logic. This means they can access sensitive data, trigger actions, and interact with systems on behalf of users or processes. When these agents are compromised, configured poorly, or even manipulated through malicious input, the resulting damage can mimic insider abuse without the threat actor ever touching corporate endpoints.

From a defense standpoint, this evolution forces a rethink of identity and access management, zero-trust segmentation, and AI lifecycle governance. Traditional audit and monitoring don’t necessarily capture an agent’s “thought process” or decision patterns, creating blind spots in detection and incident response. Security teams now need policies, tooling, and telemetry that treat AI components as first-class assets within their risk posture, subject to the same scrutiny as human accounts and privileged credentials.

The implications are broad: as AI agents proliferate, CISOs must plan for scenarios where an “insider” event may not be human at all. This shift demands tighter controls around agent permissions, continuous behavior profiling, and hardened interfaces for agent-to-system interactions.

3.  New Report, How the LastPass Hack May Still Be Costing Millions

More than three years after the initial compromise, the 2022 breach of LastPass is still producing real-world harm—this time in the form of large-scale cryptocurrency theft. New research from TRM Labs shows that attackers have been quietly draining crypto wallets long after encrypted password vaults were stolen, exploiting weak master passwords to crack vaults offline and extract private keys and seed phrases. The delayed nature of the thefts underscores a critical reality: breaches involving encrypted data don’t necessarily end when systems are secured—they can remain active for years.

The original incident involved attackers compromising a developer environment, then later using stolen credentials to access cloud backups containing customer vaults. While the vaults were encrypted, customers who reused passwords or relied on weaker master passwords were exposed to offline cracking. According to TRM’s analysis, the resulting wallet drains occurred in distinct waves—months or even years later—suggesting a slow, methodical decryption process rather than a single smash-and-grab operation. Investigators found no evidence of phishing or malware on victims’ devices, reinforcing the conclusion that the attackers already possessed valid private keys before executing the thefts.

What makes this campaign particularly notable is what happened after the wallets were emptied. Attackers converted stolen assets into Bitcoin and attempted to obscure the trail using CoinJoin transactions through Wasabi Wallet, a built-in privacy feature designed to make transaction flows harder to trace. TRM analysts were nonetheless able to correlate deposits and withdrawals by examining timing, transaction structure, and behavioral patterns across multiple incidents. Treating the activity as a coordinated campaign—rather than isolated thefts—allowed researchers to link more than $35 million in stolen cryptocurrency to the same operational infrastructure.

Those funds were ultimately laundered through a small set of Russian-linked exchanges, including Cryptex and Audi6, aligning with earlier findings from the U.S. Secret Service, which seized over $23 million in related crypto in 2025. For security leaders, the takeaway is stark: sensitive secrets stored today can become tomorrow’s breach—even years later—if encryption is paired with weak user controls. Password hygiene, key management discipline, and long-term breach impact modeling are no longer theoretical concerns; they’re playing out on-chain, in public view.

Thanks for reading!

About us: Echelon is a full-service cybersecurity consultancy that offers wholistic cybersecurity program building through vCISO or more specific solutions like penetration testing, red teaming, security engineering, cybersecurity compliance, and much more! Learn more about Echelon here: https://echeloncyber.com/about