Cybersecurity Brief – 2026-02-28

Sat, 28 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Over 900 Sangoma FreePBX instances remain compromised with web shells following exploitation of a command injection vulnerability in the endpoint manager’s interface, ongoing since December 2025.
ManoMano, an online marketplace, suffered a data breach allegedly impacting 38 million individuals, with stolen data including names, email addresses, phone numbers, and other personal information.
The U.S. Department of Justice seized $61 million in Tether cryptocurrency linked to “pig butchering” crypto scams.
Data broker breaches have contributed to nearly $21 billion in identity-theft losses, according to a new report.
A Ukrainian national pleaded guilty to operating OnlyFake, an AI-powered fake ID website that generated and sold over 10,000 fraudulent identification documents globally.

Newly Discovered Vulnerabilities

Juniper Networks PTX routers are affected by a critical remote code execution vulnerability (CVE-2026-21902) in Junos OS Evolved, addressed via an out-of-band security update.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) released details on the RESURGE malware, which can remain dormant on Ivanti Connect Secure devices after exploitation of CVE-2025-0282.
Researchers discovered that public Google API keys, previously considered non-sensitive, can be used to access Gemini AI data, exposing potentially sensitive information.

Notable Threat Actor Activity

The North Korean APT group ScarCruft (APT37) has been observed using new malware to breach air-gapped networks, leveraging Zoho WorkDrive for command-and-control and spreading via USB drives.
A malicious Go module has been identified stealing passwords, establishing SSH persistence, and deploying the Rekoobe Linux backdoor.
Threat actors are distributing trojanized gaming utilities via browsers and chat platforms to install Java-based remote access trojans (RATs).
Aeternum botnet loader is using Polygon blockchain-based smart contracts for resilient command-and-control infrastructure.
ShinyHunters has claimed responsibility for the Odido breach, as reported in industry news roundups.

Trends, Tools, or Tactics of Interest

The Kratos Phishing-as-a-Service (PhaaS) kit is industrializing credential compromise attacks, with projections that over 90% of such attacks will use modular PhaaS by 2026.
Fake Google security checks are being used as lures to trick users into granting browser permissions, enabling threat actors to harvest contacts, location data, and other sensitive information.
Malicious actors continue to exploit social engineering on Facebook, using compromised accounts to propagate scams.
Third-party software, including PDF readers and email clients, remains a significant attack surface due to inconsistent patching and update practices.
Cities hosting major events are being advised to enhance defenses against wireless and drone-based threats, beyond traditional cyber and physical security measures.
Microsoft is testing security improvements for batch file and CMD script execution in Windows 11 Insider Preview builds.
Meta has filed lawsuits against advertisers in Brazil, China, and Vietnam for running celebrity-bait scams on its platforms.

Regulatory or Policy Developments

The Pentagon has designated Anthropic as a supply chain risk, amid a dispute over the use of its AI technologies for military applications. Anthropic is resisting Pentagon demands for broader AI safeguards, seeking assurances against use for mass surveillance or autonomous weapons.
U.S. President Trump has ordered all federal agencies to phase out the use of Anthropic technology.
Europol-led “Project Compass” resulted in 30 arrests and 179 suspects being linked to “The Com,” a cybercrime group targeting children and teenagers.
Congressional scrutiny is increasing on data brokers following revelations about identity theft losses tied to industry breaches.

Cybersecurity Brief – 2026-02-27

Fri, 27 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

ManoMano, a major European DIY retail chain, has suffered a data breach impacting 38 million customers. The breach was caused by the compromise of a third-party service provider.
French football club Olympique de Marseille confirmed an attempted cyberattack following a data leak, with a threat actor claiming responsibility for breaching the club’s systems.
Conduent, a US-based business process services company, has revised the impact of its third-party breach to 25 million affected Americans.
A new malicious NuGet package, “StripeApi,” was discovered impersonating a legitimate Stripe library to steal API tokens, targeting the financial sector.
Google API keys previously considered harmless can now be abused to access private Gemini AI data if exposed in client-side code.
Anthropic patched vulnerabilities in its Claude AI code interpreter that could have allowed silent compromise of developer devices through malicious configuration files.

Newly Discovered Vulnerabilities

Trend Micro patched two critical remote code execution vulnerabilities in Apex One endpoint security products for Windows, and addressed a total of eight critical and high-severity issues across Windows and macOS versions.
A critical vulnerability in Juniper Networks’ PTX Series routers running Junos OS Evolved allows unauthenticated remote code execution with root privileges, enabling full router takeover.
Cisco disclosed and patched a maximum-severity zero-day vulnerability (CVE-2026-20127) in its SD-WAN software, which had been exploited for three years by a sophisticated threat actor, allowing authentication bypass and administrative access.
Zyxel patched a critical remote code execution vulnerability in the UPnP function affecting multiple device models.
Four vulnerabilities were disclosed in Gardyn smart garden products, allowing remote hacking; CISA has issued an advisory on these flaws.

Notable Threat Actor Activity

Google’s Threat Intelligence Group reported that nation-state actors are using Gemini and other AI tools to enhance phishing, malware development, and social engineering campaigns.
A previously undocumented threat cluster, UAT-10027, has been targeting US education and healthcare sectors since December 2025, deploying the Dohdoor backdoor.
The Aeternum C2 botnet loader was revealed to use encrypted command storage on the Polygon blockchain, making its command-and-control infrastructure highly resistant to takedown.
Microsoft observed a coordinated campaign targeting developers via malicious Next.js repositories purporting to be legitimate, delivering in-memory malware and establishing persistence.
Fake Zoom and Google Meet scams are distributing the legitimate Teramind monitoring tool as malware by exploiting trusted branding.
CISA released an updated analysis of the RESURGE malware, highlighting continued stealthy and active operations.
The US Treasury sanctioned Russian exploit broker Operation Zero, which acquired eight zero-day exploits from a US defense contractor.

Trends, Tools, or Tactics of Interest

Ransomware payment rates have dropped to a record low of 28% despite an increase in the number of attacks, indicating a shift in victim response and negotiation strategies.
Threat actors are increasingly leveraging AI-based tools, such as Gemini and Claude, to automate and refine attack techniques.
Blockchain technology is being adopted for resilient command-and-control infrastructure, as demonstrated by the Aeternum C2 botnet.
There is a rise in attacks targeting developers, including via malicious open-source packages and fake technical assessment repositories.
Open source project IronCurtain has been released, aiming to constrain and secure AI assistant agents to prevent unintended actions.

Regulatory or Policy Developments Affecting the Security Industry

Apple iPhone and iPad devices have been cleared for handling classified information by NATO, having been added to the NATO Information Assurance Product Catalogue (NIAPC).
The US government has imposed sanctions on Russian exploit broker Operation Zero for trafficking zero-day exploits.
A lawsuit (Marquis v. SonicWall) is raising questions about liability in third-party breaches, with a FinTech company holding a firewall provider responsible for breach damages.
New York Attorney General filed a lawsuit against Valve Corporation, alleging illegal gambling promotion through game loot boxes targeting minors.
Industry experts are recommending immediate preparation for post-quantum cryptography (PQC) to counter future risks of encrypted data theft and decryption.

Aeternum botnet on DanSec Daily

Cybersecurity Brief – 2026-02-28

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments

Cybersecurity Brief – 2026-02-27

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry