Cybersecurity Brief – 2026-02-10

Tue, 10 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Chinese threat actor UNC3886 breached Singapore’s four largest telecommunications providers (Singtel, StarHub, M1, Simba) in a targeted cyber espionage campaign. The intrusions were confirmed by Singapore’s Cyber Security Agency.
The European Commission disclosed a breach involving its mobile device management platform, exposing staff data. An investigation is ongoing.
SmarterTools suffered a ransomware breach by the Warlock gang, who exploited vulnerabilities in SmarterMail. The attack compromised internal systems but did not impact business applications or customer account data.
A security researcher discovered an exposed database for the Chat & Ask AI app, leaking 300 million messages linked to 25 million users due to a Firebase misconfiguration.
Two Connecticut men were charged in the US for defrauding FanDuel and other gambling sites of $3 million using the stolen identities of approximately 3,000 individuals.
Malicious actors are deploying fake 7-Zip download sites, infecting home PCs and converting them into residential proxy nodes.
Romania’s national oil pipeline operator, Conpet, was targeted in a cyberattack, as reported in Check Point’s weekly threat intelligence bulletin.

Fortinet patched a critical SQL injection vulnerability (CVE pending) in FortiClientEMS that could allow unauthenticated attackers to execute arbitrary code.
BeyondTrust released updates for a critical pre-authentication remote code execution vulnerability in its Remote Support (RS) and Privileged Remote Access (PRA) products. The flaw allows unauthenticated attackers to execute arbitrary code.
SolarWinds Web Help Desk (WHD) vulnerabilities have been exploited as zero-days since December 2025, enabling remote code execution on exposed servers. Attackers have used these flaws to deploy legitimate tools, such as Velociraptor, for post-exploitation activities.
SmarterMail vulnerabilities were exploited by the Warlock ransomware gang to breach SmarterTools’ network.

UNC3886, a China-linked APT, conducted a coordinated cyber espionage campaign against Singapore’s telecommunications sector, leveraging sophisticated tactics to breach multiple major providers.
Bloody Wolf threat actor targeted Uzbekistan and Russia in a spear-phishing campaign delivering NetSupport RAT for remote access.
TeamPCP orchestrated a large-scale campaign compromising cloud-native environments through automated worm-like attacks on exposed services, establishing criminal infrastructure for further exploitation.
The Warlock ransomware group exploited SmarterMail vulnerabilities to breach SmarterTools.
Attackers are exploiting SolarWinds WHD vulnerabilities to gain initial access and deploy forensics and DFIR tools for lateral movement.
Ransomware groups, notably those distributing “Reynolds” ransomware, are embedding vulnerable drivers (BYOVD - Bring Your Own Vulnerable Driver) with their payloads to facilitate defense evasion.

Ransomware groups are reportedly pivoting back to encryption-based extortion as data theft-only tactics yield diminishing returns.
Attackers are leveraging targeted wordlists derived from public organizational language (using tools such as CeWL) to improve password guessing success rates, without employing AI.
Malicious RTF documents exploiting CVE-2026-21509, attributed to APT28, are in active use for initial access.
Fake software distribution sites, such as those mimicking 7-Zip, are being used to covertly turn victim PCs into proxy infrastructure.
Automated exploitation of cloud infrastructure is being used at scale (TeamPCP) to build botnets and criminal infrastructure.
The use of legitimate digital forensics tools (e.g., Velociraptor) by attackers post-exploitation is increasing, complicating detection and response.
YARA-X 1.13.0 was released, offering improvements and bugfixes for threat hunting.
RSAC released Quantickle, an open-source browser-based threat intelligence visualization tool.
New research (KEVology) and tools are available to help security teams interpret and prioritise CISA KEV catalog vulnerabilities more effectively.

Initial requirements of the EU AI Act come into effect this month (February 2026), beginning with compliance around banned activities.

Fri, 28 Nov 2025 00:00:00 +0000

OpenAI disclosed a data breach affecting ChatGPT API customers, resulting from a compromise at third-party analytics provider Mixpanel. Limited identifying information of API customers was exposed. Multiple Mixpanel customers were impacted by the incident.
Asahi, a Japanese company, suffered a ransomware attack that resulted in the theft of personal information of customers and employees, impacting approximately 2 million individuals and significantly disrupting operations.
The CodeRED emergency alert system in the US experienced a ransomware attack, leading to a nationwide outage and a data breach, putting millions at risk.
Amazon and the FBI have issued warnings regarding a surge in account takeover attacks targeting holiday shoppers, with scammers impersonating brands to gain access to user accounts.

The APT group Tomiris has adopted new tools and techniques, including multi-language reverse shells and the use of open-source frameworks Havoc and AdaptixC2. The group has also been observed using Discord and Telegram for command and control communications.
Bloody Wolf, a threat actor, has expanded its campaign targeting Kyrgyzstan and Uzbekistan, delivering NetSupport RAT via Java-based attacks since at least June 2025.

Increased use of open-source command and control frameworks (Havoc, AdaptixC2) and mainstream messaging platforms (Discord, Telegram) for malicious communications by APT groups.
Growing prevalence of AI-powered malware, voice phishing (vishing) campaigns, and scams leveraging advanced technologies, as highlighted in recent threat bulletins.
Rise in attacks exploiting digital trust, including brand impersonation and account takeover targeting consumers during high-activity periods such as holidays.

Microsoft has announced a 2026 update to Entra ID’s Content Security Policy that will block unauthorized script injection attacks during authentication, aiming to strengthen login security.