Infy on DanSec Daily

Cybersecurity Brief – 2026-02-06

Fri, 06 Feb 2026 00:00:00 +0000

Spain’s Ministry of Science has partially shut down IT systems following breach claims, disrupting several citizen- and company-facing services.
Rome’s La Sapienza University suffered a cyberattack causing widespread operational disruptions.
Romanian oil pipeline operator Conpet disclosed a cyberattack that disrupted business systems and took down its website; the Qilin ransomware group is reportedly involved.
Newsletter platform Substack notified users of a data breach after attackers stole email addresses and phone numbers (approx. 700,000 records) in October 2025.
Fintech firm Betterment reported a breach exposing email addresses and personal information of 1.4 million accounts in January.
Zendesk users experienced a renewed spam wave, with inboxes flooded by “Activate account” emails due to abuse of unsecured support systems.
SystemBC malware remains active post law enforcement takedown, infecting over 10,000 devices and continuing to deliver ransomware and proxy traffic.
VS Code configuration files in GitHub Codespaces were found to automatically execute when opening repositories or pull requests, exposing users to potential attacks.

Anthropic’s Claude Opus 4.6 LLM identified over 500 previously unknown high-severity security flaws across major open-source libraries.
A critical sandbox escape vulnerability in the n8n workflow automation tool could enable arbitrary command execution and credential theft.
Researchers highlighted that VS Code-integrated configuration files can be abused in GitHub Codespaces to achieve remote code execution.
The EnCase forensic tool driver, signed with an expired digital certificate, is being weaponised for EDR evasion due to Windows security gaps.

The Stan Ghouls campaign is targeting organisations in Russia and Uzbekistan using Java-based loaders and NetSupport RAT, with indications of IoT interest.
Infy (aka Prince of Persia), an Iranian threat group, resumed operations with new C2 infrastructure after the end of the Iran internet blackout and has evolved its operational security tactics.
A previously identified cyberspy group, likely China-linked, has compromised governments and critical infrastructure in 37 countries.
Italy reportedly thwarted Russian-linked cyberattacks against Winter Olympics websites and foreign ministry offices.
The DEAD#VAX campaign is distributing AsyncRAT by disguising malicious virtual hard disks as PDF attachments.
Ransomware operators are abusing ISPsystem virtual machines to host and deliver payloads at scale.
The AISURU/Kimwolf botnet launched a record-setting 31.4 Tbps DDoS attack lasting 35 seconds.

Proof-of-concept attacks demonstrate that large language models (LLMs) can be used to generate phishing pages and malicious JavaScript in real time.
Phishing-as-a-service (PhaaS) platforms are increasingly central to the cybercriminal economy, enabling actors of all skill levels to conduct advanced phishing campaigns.
AI-powered scams are industrialising website cloning, with one network creating over 150 cloned law firm websites and using Cloudflare and IP rotation for evasion.
Attackers are leveraging malicious scripts, such as Chrome injectors, to steal browser data.
BYOVD (Bring Your Own Vulnerable Driver) techniques persist, with threat actors weaponising legitimate drivers for EDR bypass.
Cloud log limitations are creating monitoring blind spots; network-level telemetry is highlighted as a more reliable visibility source.
Abuse of unsecured customer support systems (e.g., Zendesk) continues to facilitate spam and phishing campaigns.
AI-generated web platforms (e.g., Moltbook) have been found exposing sensitive data via insecure APIs.

Microsoft announced the deprecation of Exchange Web Services (EWS) API for Exchange Online, effective April 2027.
Concerns have been raised regarding CISA’s silent updates to the Known Exploited Vulnerabilities (KEV) catalog, particularly relating to ransomware-exploited vulnerabilities.
Flock Safety’s ALPR cameras were found to have shared license plate data with hundreds of agencies without permission, prompting a California city to shut down its system.
Zscaler has acquired browser security firm SquareX, aiming to embed lightweight security extensions across browsers.

Mon, 22 Dec 2025 00:00:00 +0000

Hackers stole millions of PornHub users’ data for extortion purposes.
The U.S. Department of Justice indicted 54 individuals for a multi-million dollar ATM jackpotting scheme involving the use of Ploutus malware.

Cisco disclosed a zero-day vulnerability for which no patch is currently available.

The Iranian Infy (aka Prince of Persia) APT group has resurfaced after nearly five years of inactivity, exhibiting new malware activity.

Android malware operations are increasingly merging the use of malicious dropper apps with SMS theft and remote access trojan (RAT) capabilities at scale, as seen in campaigns distributing the Wonderland SMS stealer.
RansomHouse ransomware-as-a-service has upgraded its encryptor, moving from a single-phase linear technique to a multi-layered data processing method, enhancing the complexity of its encryption process.

Sun, 21 Dec 2025 00:00:00 +0000

PornHub has suffered a data breach in which hackers stole data belonging to millions of users. The attackers are reportedly using the stolen information for extortion purposes.

The Iranian APT group Infy (also known as Prince of Persia) has resurfaced after nearly five years of inactivity. New malware activity attributed to Infy has been observed targeting victims in Sweden.
RansomHouse ransomware-as-a-service operators have upgraded their encryption techniques, moving from a single-phase linear approach to a more complex, multi-layered data processing method.
The U.S. Department of Justice has indicted 54 individuals involved in a large-scale ATM jackpotting scheme. The conspiracy utilised Ploutus malware to compromise ATMs and steal millions of dollars.

Cisco has disclosed a zero-day vulnerability for which there is currently no available patch.

RansomHouse’s enhancement of its encryptor to a multi-layered data processing model indicates a trend toward increased sophistication in ransomware encryption techniques.

The U.S. Department of Justice’s action against the ATM jackpotting scheme demonstrates ongoing law enforcement efforts targeting cybercrime operations involving malware and large-scale financial theft.