Cybersecurity Brief – 2026-02-26

Thu, 26 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Google, Mandiant, and partners disrupted a global espionage campaign by suspected China-nexus threat actor UNC2814, which breached at least 53 organizations across 42 countries, including telecom firms and government agencies. The campaign leveraged SaaS API calls to conceal malicious traffic.
UFP Technologies, a US-based medical device manufacturer, disclosed a cyberattack involving data theft and file-encrypting ransomware.
CarGurus suffered a data breach impacting over 12 million users, with hackers claiming theft of personally identifiable information and internal corporate data.
Wynn Resorts confirmed a data breach in which the ShinyHunters group exfiltrated employee data.
Marquis Software Solutions filed a lawsuit against SonicWall, alleging gross negligence and misrepresentation after a backup breach led to a ransomware attack.

Cisco disclosed CVE-2026-20127, a critical authentication bypass vulnerability in Catalyst SD-WAN Controller and Manager, actively exploited in the wild since 2023. The flaw allows remote attackers to gain administrative access.
Anthropic’s Claude Code AI-powered coding assistant was found to have multiple vulnerabilities (including CVE-2025-59536 and CVE-2026-21852) enabling remote code execution and API key exfiltration via project files.
Four malicious NuGet packages targeting ASP.NET developers were discovered, designed to steal sensitive data through supply chain compromise.
Zyxel released patches for a critical remote code execution vulnerability affecting over a dozen router models, which could allow unauthenticated attackers to execute commands remotely.
SolarWinds patched four critical vulnerabilities in its Serv-U product; exploitation would require administrative privileges.

Scattered LAPSUS$ Hunters (SLH) cybercrime group was observed offering $500–$1,000 per call to recruit women for IT help desk vishing attacks, focusing on social engineering.
North Korean threat actors were linked to a campaign using malicious Next.js repositories and fake job interviews to backdoor developers’ devices and establish persistent access.
A former L3Harris (US defense contractor) employee was sentenced to over seven years in prison for selling eight zero-day exploits to a Russian broker. The US Treasury also sanctioned the Russian broker involved in purchasing stolen exploits.
RAMP ransomware forum was seized, causing disruption and fragmentation within the ransomware ecosystem.
Chinese police were implicated in using ChatGPT for politically motivated influence operations targeting foreign officials.

Google’s latest GTIG AI Threat Tracker report highlights increasing adversarial use of AI, including distillation, experimentation, and integration of AI for malicious purposes.
Attackers are increasingly using telephone-oriented attack delivery (TOAD) emails, which contain only a phone number as payload, to bypass email security gateways.
The OpenClaw supply chain threat has generated significant discussion on dark web and Telegram channels, though current telemetry suggests more hype than widespread exploitation.
The PCI Security Standards Council reported that threats to payment systems are accelerating, requiring faster adaptation by the industry.
IBM X-Force reported that 56% of tracked vulnerabilities in 2025 required no authentication for exploitation, raising concerns about the weaponisation of agentic AI and the impact of stolen credentials.
A “Richter Scale” model has been introduced to rate the severity and effects of cybersecurity incidents in operational technology (OT) environments.
Drug cartels, such as Mexico’s CJNG, are adopting AI, drones, and social media for criminal operations.
Manual processes for sensitive data transfers remain prevalent in national security organizations, increasing risk exposure.

CISA issued an emergency directive requiring immediate action to secure Cisco SD-WAN systems affected by CVE-2026-20127.
Reddit was fined nearly $20 million by the UK data privacy watchdog for failures related to the protection of children’s personal information.