https://blog.dansec.red/actors/sshstalker/Recent content in SSHStalker on DanSec DailyHugoen-gbThu, 12 Feb 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-02-12-cybersecurity-news/Thu, 12 Feb 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-02-12-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>The Conduent data breach has impacted at least 25 million individuals, including nearly 17,000 Volvo Group employees whose data was exposed.</li> <li>The AgreeTo Outlook add-in was hijacked and used as a phishing kit, resulting in the theft of over 4,000 Microsoft account credentials.</li> <li>A surge in LummaStealer infections has been reported, linked to campaigns using the CastleLoader malware and the ClickFix social engineering technique.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>Apple released updates for all platforms (iOS, iPadOS, macOS, tvOS, watchOS, visionOS), addressing 71 vulnerabilities, including a zero-day exploited in sophisticated attacks against targeted individuals.</li> <li>Microsoft issued security updates for 59 vulnerabilities, including six zero-days that are actively exploited. Notable fixes include a remote code execution flaw in Windows 11 Notepad and vulnerabilities affecting Windows Secure Boot and other core components.</li> <li>Intel and AMD collectively addressed over 80 vulnerabilities across their chipsets in recent advisories.</li> <li>Ivanti patched vulnerabilities in Endpoint Manager, including a high-severity authentication bypass that could be exploited remotely without authentication.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>APT36 and SideCopy have launched campaigns targeting Indian defense and government-aligned organizations, deploying cross-platform remote access trojans (RATs) affecting both Windows and Linux environments.</li> <li>North Korea’s UNC1069 is increasingly targeting Web3 and cryptocurrency firms, employing large language models (LLMs), deepfakes, legitimate platforms, and ClickFix techniques.</li> <li>The SSHStalker botnet is leveraging IRC-based command-and-control channels and legacy Linux kernel exploits to control compromised systems.</li> <li>The Crazy ransomware gang is abusing legitimate employee monitoring tools and the SimpleHelp remote support tool to maintain persistence, evade detection, and facilitate ransomware deployment in corporate environments.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>Campaigns involving RenEngine and HijackLoader have distributed LummaStealer via complex infection chains since March 2025.</li> <li>There is increased abuse of AI models, with Google reporting that attackers are using Gemini AI for all stages of cyberattacks. Model extraction and distillation attacks are being observed using legitimate API access.</li> <li>Spam and phishing trends for 2025 include increased use of scam QR codes, ClickFix attacks, and lures involving ChatGPT subscriptions.</li> <li>Intentionally vulnerable training applications (e.g., OWASP Juice Shop, DVWA, Hackazon, bWAPP) are being targeted in cloud environments, exposing organizations to crypto-mining attacks.</li> <li>The first known malicious Microsoft Outlook add-in supply chain attack has been observed in the wild.</li> <li>WSL (Windows Subsystem for Linux) continues to be exploited within the malware ecosystem to facilitate cross-platform attacks.</li> <li>Arrests have been made in the Netherlands related to the sale of JokerOTP, a phishing automation tool capable of intercepting multi-factor authentication (MFA) one-time passcodes.</li> </ul> <h2 id="regulatory-or-policy-developments-affecting-the-security-industry">Regulatory or Policy Developments Affecting the Security Industry</h2> <ul> <li>Nevada has introduced a new statewide data classification policy, categorizing data as “public,” “sensitive,” “confidential,” or “restricted,” following a recent cyberattack.</li> <li>Microsoft announced plans to refresh Windows Secure Boot certificates in June 2026, replacing certificates that have been in use for over 15 years.</li> </ul>https://blog.dansec.red/posts/2026-02-11-cybersecurity-news/Wed, 11 Feb 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-02-11-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Warlock (Storm-2603) ransomware gang breached SmarterTools by exploiting an unpatched SmarterMail server on 29 January 2026.</li> <li>Volvo Group North America reported a customer data exposure due to a breach at Conduent, an IT services provider.</li> <li>Dutch Data Protection Authority and the Council for the Judiciary in the Netherlands confirmed cyberattacks exploiting Ivanti zero-day vulnerabilities, leading to exposure of employee contact data.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>Microsoft’s February 2026 Patch Tuesday addressed 58–60 vulnerabilities, including six zero-days (three actively exploited security feature bypass flaws) and three publicly disclosed vulnerabilities. Updates apply to Windows, Microsoft Edge, and other Microsoft products.</li> <li>Fortinet released patches for a critical SQL injection vulnerability in FortiClientEMS (CVE identifier not specified) that allows unauthenticated remote code execution.</li> <li>Adobe fixed 44 vulnerabilities in its Creative Cloud applications, several of which are critical and could allow arbitrary code execution.</li> <li>SAP patched 26 new and one updated vulnerability in CRM, S/4HANA, and NetWeaver products, including critical issues.</li> <li>Siemens, Schneider, Aveva, and Phoenix Contact issued patches for vulnerabilities in their industrial control systems as part of ICS Patch Tuesday.</li> <li>Microsoft began rolling out new Secure Boot certificates in Windows updates to replace expiring 2011 certificates, ahead of their June 2026 expiration.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>North Korea-linked UNC1069 targeted cryptocurrency organizations using AI-generated lures and new malware for Windows and macOS, including the ClickFix technique and tailored AI-generated video content.</li> <li>DPRK (North Korean) IT operatives are impersonating professionals on LinkedIn, applying for remote jobs using hijacked LinkedIn accounts to infiltrate organizations.</li> <li>Transparent Tribe (APT36), a Pakistan-linked group, is conducting a three-pronged cyber espionage campaign against Indian defense and government sectors, deploying GETA, ARES, and Desk RAT malware.</li> <li>A newly documented Linux botnet, SSHStalker, is leveraging IRC for command-and-control communications.</li> <li>A malicious 7-Zip website is distributing a trojanized installer that converts infected devices into residential proxy nodes.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>Reynolds ransomware incorporates a bring-your-own-vulnerable-driver (BYOVD) technique to disable EDR (Endpoint Detection and Response) security tools during attacks.</li> <li>Ransomware actors are shifting from simple encryption to maintaining persistent, “resident” access within victim environments.</li> <li>ZeroDayRAT, a commercial spyware kit marketed on Telegram, enables full compromise of Android and iOS devices, granting access to SIM, location data, SMS, and facilitating MFA bypass and account takeover.</li> <li>Surge in AI-enabled social engineering: AI-generated romance scams and “pig butchering” investment frauds are increasingly difficult to detect, as highlighted by recent law enforcement action against a $73M scheme.</li> <li>Phishing attacks are increasingly leveraging trusted platforms, with LinkedIn direct messages being used to target executives.</li> <li>Tax-related phishing and scams are prevalent during the tax season, with attackers impersonating IRS communications.</li> <li>Operational Technology (OT) attacks are employing “living-off-the-plant” techniques, using native tools and protocols to evade detection.</li> <li>Cloud incident response is being streamlined through automation and AI-driven tools, such as Tines, to reduce mean time to resolution (MTTR).</li> </ul> <h2 id="regulatory-or-policy-developments-affecting-the-security-industry">Regulatory or Policy Developments Affecting the Security Industry</h2> <ul> <li>The European Commission unconditionally approved Google’s $32B acquisition of Wiz, a major cloud security provider.</li> <li>Discord will restrict user profiles to teen-appropriate mode by default unless age is verified, to enhance child safety on the platform.</li> <li>Microsoft announced plans to introduce mobile-style app permission prompts in Windows 11, requiring explicit user consent before apps can access sensitive resources such as files, cameras, and microphones.</li> </ul>