https://blog.dansec.red/actors/unc6201/Recent content in UNC6201 on DanSec DailyHugoen-gbThu, 19 Feb 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-02-19-cybersecurity-news/Thu, 19 Feb 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-02-19-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Figure Technology Solutions suffered a data breach impacting nearly one million accounts, exposing personal and contact information.</li> <li>Betterment’s data breach is more severe than initially reported, with leaked data including sensitive personal and financial details.</li> <li>A vast online database containing billions of records, including Social Security Numbers, was found exposed and accessible, posing significant identity theft risks.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>Grandstream GXP1600 series VoIP phones are affected by a critical unauthenticated remote code execution vulnerability (CVE-2026-2329), allowing attackers root-level access and enabling call interception, toll fraud, and user impersonation.</li> <li>Four widely used Microsoft Visual Studio Code extensions (collectively over 125 million installs) were found to contain multiple vulnerabilities, potentially enabling threat actors to compromise developer environments.</li> <li>Multiple Honeywell CCTV products used in critical infrastructure are vulnerable to an authentication bypass flaw, allowing unauthorized access to video feeds and account hijacking.</li> <li>Dell RecoverPoint for Virtual Machines is affected by a maximum severity zero-day vulnerability (CVE-2026-22769), exploited since mid-2024 by a China-linked threat group (UNC6201) for lateral movement, persistence, and malware deployment.</li> <li>Foxit and Apryse PDF platforms contained 16 vulnerabilities that could be exploited for account takeover and data exfiltration via malicious documents or URLs.</li> <li>CISA has added a vulnerability in TeamT5’s ThreatSonar Anti-Ransomware to its Known Exploited Vulnerabilities (KEV) catalog; the issue was patched in 2024 but is being actively exploited.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>The China-nexus threat actor UNC6201 has exploited Dell RecoverPoint for VMs zero-day since mid-2024.</li> <li>Kenyan authorities reportedly used Cellebrite’s forensic extraction tool against a dissident’s mobile device while in custody.</li> <li>Telegram underground channels rapidly weaponized SmarterMail vulnerabilities (e.g., CVE-2024-XXXX), sharing PoCs and stolen credentials shortly after public disclosure.</li> <li>New Keenadu Android malware has been found preinstalled on thousands of devices and distributed via Google Play and other app stores.</li> <li>Hackers are actively exploiting a vulnerability in TeamT5’s ThreatSonar Anti-Ransomware product.</li> <li>AI platforms such as Grok and Microsoft Copilot are being abused as covert communication channels for malware command-and-control (C2) activity.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>AI and quantum advancements are driving recommendations for substantially longer passwords (25+ characters) to withstand brute-force and future cryptanalytic attacks.</li> <li>AI-powered chatbots are being weaponized for scams, including a fake “Gemini” chatbot used to pitch fraudulent “Google Coin” schemes.</li> <li>Phishing campaigns are leveraging fake Google Forms sites to harvest Google login credentials from job seekers.</li> <li>Anti-phishing heuristic rules in Microsoft Exchange Online mistakenly blocked legitimate emails and Teams messages, disrupting business communications.</li> <li>Microsoft 365 Copilot bug has caused confidential emails to be summarized by the AI assistant, bypassing organizations’ data loss prevention policies.</li> <li>A significant percentage (over 40%) of South Africans reported being scammed in 2025, highlighting the prevalence of scalable, low-friction scams.</li> <li>Underground threat communities are accelerating the weaponization of disclosed vulnerabilities, as evidenced by rapid exploitation of SmarterMail flaws.</li> <li>Malware campaigns are increasingly using steganography, such as embedding payloads in image files.</li> </ul> <h2 id="regulatory-or-policy-developments-affecting-the-security-industry">Regulatory or Policy Developments Affecting the Security Industry</h2> <ul> <li>CISA has issued warnings regarding active exploitation of vulnerabilities in Honeywell CCTV products and TeamT5 ThreatSonar Anti-Ransomware, urging immediate patching and mitigation.</li> <li>CISA’s KEV catalog continues to expand with newly exploited vulnerabilities, reinforcing mandatory remediation timelines for federal and critical infrastructure entities.</li> </ul>https://blog.dansec.red/posts/2026-02-18-cybersecurity-news/Wed, 18 Feb 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-02-18-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Eurail confirmed a data breach with millions of user records being offered for sale on cybercrime forums. The full scope of affected individuals is still under investigation.</li> <li>Poland’s energy sector survived wiper attacks targeting wind and solar infrastructure, as well as a manufacturer and a heating/power plant. Russia-aligned groups are suspected.</li> <li>Singapore and its four major telecommunications providers successfully fended off a zero-day attack attributed to Chinese hackers.</li> <li>Microsoft Teams experienced a significant outage affecting users in the United States and Europe, causing delays and access issues.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>A critical zero-day vulnerability (CVE-2026-22769) in Dell RecoverPoint has been exploited since mid-2024 by a Chinese state-backed group (UNC6201).</li> <li>CISA added four security flaws to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation.</li> <li>Multiple high- and critical-severity vulnerabilities were discovered in popular Visual Studio Code (VSCode) extensions, exposing over 128 million downloads to potential credential and file theft.</li> <li>Google released an emergency update for Chrome to patch an actively exploited zero-day allowing code execution via malicious webpages.</li> <li>Password managers including Bitwarden, LastPass, Dashlane, and 1Password were found vulnerable to vault compromise if a malicious server is present.</li> <li>Notepad++ enhanced its update security with a new “double-lock” mechanism following a supply-chain compromise.</li> <li>Research identified widespread exposure of secrets such as API keys in JavaScript front-end code, after scanning 5 million applications.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>Kaspersky uncovered the Keenadu Android backdoor, embedded in device firmware and Google Play apps, with links to major Android botnets. Keenadu enables data exfiltration, remote control, ad fraud, and browser hijacking via supply chain compromise.</li> <li>Chinese state-backed hackers exploited a Dell zero-day (CVE-2026-22769) for espionage purposes.</li> <li>A 47-year-old suspect linked to the Phobos ransomware group was arrested in Poland; authorities seized evidence including stolen credentials and server access data.</li> <li>ClickFix campaigns are abusing DNS lookup commands to deliver ModeloRAT malware, adapting to bypass recent security defenses.</li> <li>SmartLoader attacks are distributing a trojanized Oura MCP server to deploy StealC infostealer malware.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>Attackers are increasingly abusing legitimate DKIM-signed emails (DKIM replay attacks) to bypass security filters and deliver scams, leveraging trusted invoice and notification templates.</li> <li>Sophisticated phishing campaigns are bypassing Microsoft 365 multi-factor authentication (MFA) protections.</li> <li>Remote Monitoring and Management (RMM) software is being widely abused by threat actors for stealth, persistence, and operational efficiency, often replacing traditional malware.</li> <li>AI-powered assistants (including Copilot and Grok) with web access are being demonstrated as potential command-and-control (C2) proxies for malware operations.</li> <li>Attackers are exploiting API vulnerabilities at greater scale and speed, with AI-driven systems amplifying potential impact.</li> <li>The use of AI and context-aware tools is accelerating security operations, especially in cloud breach investigations and SOC workflows.</li> <li>Three new threat groups began targeting industrial control systems (ICS/OT) in 2025, according to Dragos.</li> <li>Hobbyist coding error led to the exposure of live camera feeds, microphones, and floor plans from thousands of vacuum robots, highlighting risks in IoT device security.</li> </ul> <h2 id="regulatory-or-policy-developments">Regulatory or Policy Developments</h2> <ul> <li>Spain’s courts ordered NordVPN and ProtonVPN to block access to 16 websites facilitating illegal LaLiga football match streaming.</li> <li>Ireland’s Data Protection Commission opened a formal investigation into X (formerly Twitter) over the use of its Grok AI tool to generate sexual images, focusing on data protection and regulatory compliance.</li> </ul>