⚡ Weekly Recap: MongoDB Attacks, Wallet Breaches, Android Spyware, Insider Crime & More

The Hacker News’ weekly recap notes that a newly disclosed MongoDB vulnerability, CVE-2025-14847 (MongoBleed), is under active exploitation with more than 87,000 potentially vulnerable instances identified worldwide, and users are urged to update to affected MongoDB versions including 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32 and 4.4.30, with Censys data showing the bulk of exposed instances in the U.S., China, Germany, India and France; Wiz puts the figure of vulnerable cloud environments at about 42%.

The roundup also highlights attribution claims around several other campaigns, including Evasive Panda’s DNS poisoning to push MgBot, targeting Türkiye, China and India, and Fly described by Intrinsec as a threat actor behind the Russian Market, though these attributions are framed as claims. In broader 2025 coverage, North Korea-linked hackers are alleged to have stolen about $2.02 billion in crypto during the year, leading the sector in global theft, according to The Hacker News.

The piece also covers other notable incidents and trends, such as a U.S. DOJ charge related to an ATM jackpotting scheme using Ploutus malware, and a continuing pattern of rapid exploitation of new and existing flaws. The December 29 2026 recap thus paints a threat landscape where attackers move faster than fixes, with significant implications across databases, crypto assets and espionage campaigns.