Cybersecurity Brief – 2026-02-14

Sat, 14 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Dutch telecommunications provider Odido disclosed a data breach impacting 6 million customers, with hackers stealing personal information including names, addresses, and phone numbers from a customer contact system.
South Korea fined luxury brands Louis Vuitton, Christian Dior Couture, and Tiffany a combined $25 million for failing to implement adequate security measures, which resulted in unauthorized access and data breaches.
Researchers identified malicious Google Chrome extensions stealing data associated with Meta Business Suite and Facebook Business Manager; a total of 30 credential-stealing Chrome extensions have been uncovered.
Threat actors are abusing Claude LLM artifacts and Google Ads in ClickFix campaigns to deliver infostealer malware to macOS users.
Fake online shops are targeting fans of the Winter Olympics 2026, with nearly 20 fraudulent sites identified selling counterfeit merchandise.

Researchers observed active exploitation of CVE-2026-1731, a critical unauthenticated remote code execution vulnerability (CVSS 9.9) affecting BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) products. Exploitation began within 24 hours of public PoC release.
CISA flagged a critical Microsoft Configuration Manager (SCCM) vulnerability, patched in October 2024, as being exploited in the wild.
Chrome version 145 patched 11 vulnerabilities, including three high-severity flaws.
CISA warned of active exploitation of vulnerabilities in SolarWinds and Notepad++ products, including a SolarWinds flaw likely exploited as a zero-day since December 2025.

North Korean threat actors are targeting software developers, particularly those with JavaScript and Python skills, using fake job recruiter campaigns. These campaigns employ social engineering and malicious coding challenges, often related to cryptocurrency, to deliver malware.
Google Threat Intelligence Group attributed malware attacks using the CANFAIL family to a previously undocumented Russian threat actor, targeting Ukrainian organizations.
Several state-sponsored actors from China, Iran, Russia, and North Korea are conducting coordinated cyber operations against the defense industrial base sector. Espionage groups have exploited at least two dozen zero-days in edge devices to infiltrate defense contractors.
A previously unknown threat actor, tracked as UAT-9921, is using a new modular malware framework called VoidLink to target technology and financial services sectors.

Threat actors are exploiting Windows drivers to carry out BYOVD (Bring Your Own Vulnerable Driver) attacks, terminating security processes in targeted networks.
AI agents are increasingly being deployed in coordinated, autonomous “swarms,” amplifying organizational attack surfaces and security complexity.
Integration of external IP-based threat intelligence (e.g., Criminal IP) into SIEM and SOAR platforms like IBM QRadar is enhancing automated detection and response workflows.
Threat actors are leveraging widely used platforms (such as Google Ads and Chrome extensions) for malware delivery and credential theft.
npm completed a major authentication overhaul in December 2025 to harden its supply chain in response to previous incidents.

CISA announced new town halls to engage stakeholders on cyber incident reporting requirements for critical infrastructure.
Check Point acquired three Israeli cybersecurity firms-Cyata, Cyclops, and Rotate-reflecting ongoing consolidation in the cybersecurity sector.
South Korean regulatory action against major luxury brands for data protection failures underscores increased enforcement of data security obligations.
The US government (CISA) has issued new directives for federal agencies to secure systems against actively exploited vulnerabilities, including those in Microsoft Configuration Manager.

Tue, 17 Jun 2025 00:00:00 +0000

The Washington Post disclosed a cyberattack in which email accounts of several journalists, including those covering national security, economic policy, and China, were compromised. The attack is believed to have been conducted by a foreign government and involved breaches of Microsoft accounts.
Zoomcar Holdings reported a data breach impacting 8.4 million users, as disclosed in a filing with the U.S. Securities and Exchange Commission.
Law enforcement agencies from six countries seized the Archetyp Market darknet drug marketplace and arrested its administrator. Archetyp Market had been operating since May 2020.

A high-severity vulnerability in ASUS Armoury Crate software was disclosed, allowing local attackers to escalate privileges to SYSTEM level on Windows machines.
Microsoft acknowledged that June 2025 Windows Server security updates are causing DHCP service freezes on some systems.
Microsoft also published a workaround for a known issue causing classic Outlook to crash when opening or composing messages.

Google and external threat intelligence researchers reported that the Scattered Spider threat group has shifted focus to targeting U.S. insurance companies, employing previously observed tactics.
The U.S. Department of Justice seized $7.74 million in cryptocurrency, NFTs, and other assets tied to North Korea’s global fake IT worker network, which is used to funnel illicit funds to the regime.
An emerging threat group, dubbed “Water Curse,” is targeting cybersecurity professionals by distributing weaponized GitHub repositories masquerading as legitimate penetration testing tools, facilitating supply chain attacks.
Malicious Python packages, notably the “Chimera” tool, have been identified on PyPI. Unlike traditional malware, Chimera targets data specific to corporate and cloud infrastructures to facilitate supply chain attacks.

Google’s Mandiant published research on increasingly sophisticated vishing (voice phishing) attacks, which are being used as initial access vectors in recent ransomware campaigns.
Google reported a rise in travel-themed scams, with attackers leveraging the summer holiday period to target consumers.
The Anubis ransomware-as-a-service kit has added data wiper functionality, enabling affiliates to both encrypt and permanently erase files, making recovery impossible even after ransom payment.
Researchers observed the use of steganography, specifically malicious payloads hidden within JPEG images, as a technique for evading detection.
Kali Linux 2025.2 was released, introducing 13 new tools and expanding its car hacking toolkit, enhancing capabilities for penetration testing and automotive security assessments.
The ongoing increase in third-party and supply chain risks was highlighted, with recommendations for continuous monitoring of partner vulnerabilities.

The U.S. National Institute of Standards and Technology (NIST) released SP 1800-35, providing 19 real-world examples for implementing zero-trust architecture using commercial technologies.
Meta announced the introduction of advertising on WhatsApp, stating that the ads are designed with privacy considerations.