Cybersecurity Brief – 2026-02-06

Fri, 06 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Spain’s Ministry of Science has partially shut down IT systems following breach claims, disrupting several citizen- and company-facing services.
Rome’s La Sapienza University suffered a cyberattack causing widespread operational disruptions.
Romanian oil pipeline operator Conpet disclosed a cyberattack that disrupted business systems and took down its website; the Qilin ransomware group is reportedly involved.
Newsletter platform Substack notified users of a data breach after attackers stole email addresses and phone numbers (approx. 700,000 records) in October 2025.
Fintech firm Betterment reported a breach exposing email addresses and personal information of 1.4 million accounts in January.
Zendesk users experienced a renewed spam wave, with inboxes flooded by “Activate account” emails due to abuse of unsecured support systems.
SystemBC malware remains active post law enforcement takedown, infecting over 10,000 devices and continuing to deliver ransomware and proxy traffic.
VS Code configuration files in GitHub Codespaces were found to automatically execute when opening repositories or pull requests, exposing users to potential attacks.

Anthropic’s Claude Opus 4.6 LLM identified over 500 previously unknown high-severity security flaws across major open-source libraries.
A critical sandbox escape vulnerability in the n8n workflow automation tool could enable arbitrary command execution and credential theft.
Researchers highlighted that VS Code-integrated configuration files can be abused in GitHub Codespaces to achieve remote code execution.
The EnCase forensic tool driver, signed with an expired digital certificate, is being weaponised for EDR evasion due to Windows security gaps.

The Stan Ghouls campaign is targeting organisations in Russia and Uzbekistan using Java-based loaders and NetSupport RAT, with indications of IoT interest.
Infy (aka Prince of Persia), an Iranian threat group, resumed operations with new C2 infrastructure after the end of the Iran internet blackout and has evolved its operational security tactics.
A previously identified cyberspy group, likely China-linked, has compromised governments and critical infrastructure in 37 countries.
Italy reportedly thwarted Russian-linked cyberattacks against Winter Olympics websites and foreign ministry offices.
The DEAD#VAX campaign is distributing AsyncRAT by disguising malicious virtual hard disks as PDF attachments.
Ransomware operators are abusing ISPsystem virtual machines to host and deliver payloads at scale.
The AISURU/Kimwolf botnet launched a record-setting 31.4 Tbps DDoS attack lasting 35 seconds.

Proof-of-concept attacks demonstrate that large language models (LLMs) can be used to generate phishing pages and malicious JavaScript in real time.
Phishing-as-a-service (PhaaS) platforms are increasingly central to the cybercriminal economy, enabling actors of all skill levels to conduct advanced phishing campaigns.
AI-powered scams are industrialising website cloning, with one network creating over 150 cloned law firm websites and using Cloudflare and IP rotation for evasion.
Attackers are leveraging malicious scripts, such as Chrome injectors, to steal browser data.
BYOVD (Bring Your Own Vulnerable Driver) techniques persist, with threat actors weaponising legitimate drivers for EDR bypass.
Cloud log limitations are creating monitoring blind spots; network-level telemetry is highlighted as a more reliable visibility source.
Abuse of unsecured customer support systems (e.g., Zendesk) continues to facilitate spam and phishing campaigns.
AI-generated web platforms (e.g., Moltbook) have been found exposing sensitive data via insecure APIs.

Microsoft announced the deprecation of Exchange Web Services (EWS) API for Exchange Online, effective April 2027.
Concerns have been raised regarding CISA’s silent updates to the Known Exploited Vulnerabilities (KEV) catalog, particularly relating to ransomware-exploited vulnerabilities.
Flock Safety’s ALPR cameras were found to have shared license plate data with hundreds of agencies without permission, prompting a California city to shut down its system.
Zscaler has acquired browser security firm SquareX, aiming to embed lightweight security extensions across browsers.