UNC6619 on DanSec Daily

Cybersecurity Brief – 2026-02-09

Mon, 09 Feb 2026 00:00:00 +0000

BridgePay, a major U.S. payment gateway provider, confirmed a ransomware attack that caused significant outages across its services. The incident began on Friday and resulted in key systems being taken offline.
Moltbook, a social network for AI agents, exposed personal data belonging to real users. The exposure was not limited to AI-generated content but included sensitive information about actual individuals.

Organizations have been urged to replace discontinued edge devices following reports that unsupported hardware is being actively targeted by state-sponsored threat actors. The US government has highlighted ongoing attacks exploiting vulnerabilities in these obsolete devices.

A state-aligned cyberespionage group tracked as TGR-STA-1030/UNC6619 has conducted “Shadow Campaigns,” targeting government infrastructure in 155 countries. The operation is global in scale and focused on espionage objectives.
German federal agencies (BfV and BSI) issued a joint advisory regarding a phishing campaign using the Signal messaging app. The campaign specifically targets politicians, military personnel, and journalists in Germany.

OpenClaw (formerly Moltbot/Clawdbot) has integrated VirusTotal scanning into its ClawHub skill marketplace, scanning uploaded skills for malicious content.
A new open-source tool named Tirith has been released to detect and block homoglyph (imposter) attacks in command-line environments by analyzing URLs in typed commands and preventing the execution of suspicious commands.

Sun, 08 Feb 2026 00:00:00 +0000

BridgePay, a major U.S. payment gateway provider, confirmed a ransomware attack resulting in a widespread outage and disruption of multiple services. The incident began on Friday and impacted key systems.
Moltbook, a social network platform for AI agents, exposed personal data belonging to real human users due to a security lapse.

US authorities warned that discontinued edge devices lacking vendor support are being actively targeted in attacks by state-sponsored hackers.

German federal agencies (BfV and BSI) issued a joint advisory regarding Signal phishing campaigns targeting politicians, military personnel, and journalists. The campaign aims to compromise sensitive communications.
A state-aligned cyberespionage group, tracked as TGR-STA-1030/UNC6619, conducted a global operation dubbed “Shadow Campaigns,” targeting government infrastructure across 155 countries.

Sat, 07 Feb 2026 00:00:00 +0000

Flickr has disclosed a potential data breach caused by a vulnerability at a third-party email service provider, exposing users’ real names, email addresses, IP addresses, and activity data.
An Illinois man has pleaded guilty to hacking nearly 600 women’s Snapchat accounts to steal, sell, or trade private photos.
Compromised npm and PyPI packages associated with dYdX have been used to deliver wallet stealers and remote access trojans (RATs) in a new software supply chain attack.
Germany’s domestic intelligence agency has warned of suspected state-sponsored phishing attacks targeting high-ranking individuals via the Signal messaging app.

CISA has issued a warning about CVE-2026-24423, an unauthenticated remote code execution vulnerability in SmarterMail, which has been exploited in ransomware attacks.
Security researchers have identified multiple insecurities in the OpenClaw AI assistant, including vulnerabilities related to malicious add-ons (“skills”) and problematic configuration settings.
ESET product vulnerabilities were noted in a roundup of recent security issues, though specific details were not provided.

A previously undocumented Asian state-backed group, tracked as TGR-STA-1030, has breached at least 70 government and critical infrastructure entities across 37 countries over the past year in a cyber espionage campaign.
China-linked threat actors have been operating the DKnife adversary-in-the-middle (AitM) framework since at least 2019, targeting routers and edge devices for traffic hijacking and malware delivery in espionage campaigns.
State-sponsored threat actors are suspected in the recent phishing campaign targeting senior figures in Germany via Signal.

A new malware-as-a-service kit called “Stanley” is offering guaranteed publication in the Chrome Web Store by bypassing Google’s security verification process.
Supply chain attacks continue to pose significant risk, as seen in the compromise of npm and PyPI packages and recent incidents involving self-propagating worms.
Modern browser-based attacks are increasingly able to evade detection by traditional EDR, email, and SASE solutions, operating entirely within the browser with minimal forensic evidence.
Apple Pay users are being targeted by phishing campaigns involving fake support calls designed to steal payment details.
Research highlights that attackers are evolving tradecraft to leverage AI assistants and agents in malicious operations (“living off the AI”).

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a binding operational directive requiring federal agencies to identify and remove unsupported or end-of-life network edge devices to reduce federal network risk.
Five bills aimed at boosting cybersecurity defenses for the U.S. energy sector have cleared a House panel.
The European Commission has announced that TikTok is facing a large fine for addictive platform design elements that may violate regulatory standards.
The Electronic Frontier Foundation has launched the “Encrypt It Already” campaign, urging major technology companies to implement end-to-end encryption by default across their services.