APT44

CVE-2025-8088 (CVSS 8.8), a path traversal flaw abusing Windows Alternate Data Streams, continues to be exploited by Russian APTs, Chinese actors, and cybercriminals to achieve persistence via Startup folder drops.

Russia's Sandworm deployed DynoWiper malware against ~30 Polish energy facilities on December 29-30, 2025—the first major cyberattack targeting distributed energy resources. Some equipment was damaged beyond repair.