Major Incidents or Breaches

  • Chinese threat actor UNC3886 breached Singapore’s four largest telecommunications providers (Singtel, StarHub, M1, Simba) in a targeted cyber espionage campaign. The intrusions were confirmed by Singapore’s Cyber Security Agency.
  • The European Commission disclosed a breach involving its mobile device management platform, exposing staff data. An investigation is ongoing.
  • SmarterTools suffered a ransomware breach by the Warlock gang, who exploited vulnerabilities in SmarterMail. The attack compromised internal systems but did not impact business applications or customer account data.
  • A security researcher discovered an exposed database for the Chat & Ask AI app, leaking 300 million messages linked to 25 million users due to a Firebase misconfiguration.
  • Two Connecticut men were charged in the US for defrauding FanDuel and other gambling sites of $3 million using the stolen identities of approximately 3,000 individuals.
  • Malicious actors are deploying fake 7-Zip download sites, infecting home PCs and converting them into residential proxy nodes.
  • Romania’s national oil pipeline operator, Conpet, was targeted in a cyberattack, as reported in Check Point’s weekly threat intelligence bulletin.

Newly Discovered Vulnerabilities

  • Fortinet patched a critical SQL injection vulnerability (CVE pending) in FortiClientEMS that could allow unauthenticated attackers to execute arbitrary code.
  • BeyondTrust released updates for a critical pre-authentication remote code execution vulnerability in its Remote Support (RS) and Privileged Remote Access (PRA) products. The flaw allows unauthenticated attackers to execute arbitrary code.
  • SolarWinds Web Help Desk (WHD) vulnerabilities have been exploited as zero-days since December 2025, enabling remote code execution on exposed servers. Attackers have used these flaws to deploy legitimate tools, such as Velociraptor, for post-exploitation activities.
  • SmarterMail vulnerabilities were exploited by the Warlock ransomware gang to breach SmarterTools’ network.

Notable Threat Actor Activity

  • UNC3886, a China-linked APT, conducted a coordinated cyber espionage campaign against Singapore’s telecommunications sector, leveraging sophisticated tactics to breach multiple major providers.
  • Bloody Wolf threat actor targeted Uzbekistan and Russia in a spear-phishing campaign delivering NetSupport RAT for remote access.
  • TeamPCP orchestrated a large-scale campaign compromising cloud-native environments through automated worm-like attacks on exposed services, establishing criminal infrastructure for further exploitation.
  • The Warlock ransomware group exploited SmarterMail vulnerabilities to breach SmarterTools.
  • Attackers are exploiting SolarWinds WHD vulnerabilities to gain initial access and deploy forensics and DFIR tools for lateral movement.
  • Ransomware groups, notably those distributing “Reynolds” ransomware, are embedding vulnerable drivers (BYOVD - Bring Your Own Vulnerable Driver) with their payloads to facilitate defense evasion.

Trends, Tools, or Tactics of Interest

  • Ransomware groups are reportedly pivoting back to encryption-based extortion as data theft-only tactics yield diminishing returns.
  • Attackers are leveraging targeted wordlists derived from public organizational language (using tools such as CeWL) to improve password guessing success rates, without employing AI.
  • Malicious RTF documents exploiting CVE-2026-21509, attributed to APT28, are in active use for initial access.
  • Fake software distribution sites, such as those mimicking 7-Zip, are being used to covertly turn victim PCs into proxy infrastructure.
  • Automated exploitation of cloud infrastructure is being used at scale (TeamPCP) to build botnets and criminal infrastructure.
  • The use of legitimate digital forensics tools (e.g., Velociraptor) by attackers post-exploitation is increasing, complicating detection and response.
  • YARA-X 1.13.0 was released, offering improvements and bugfixes for threat hunting.
  • RSAC released Quantickle, an open-source browser-based threat intelligence visualization tool.
  • New research (KEVology) and tools are available to help security teams interpret and prioritise CISA KEV catalog vulnerabilities more effectively.

Regulatory or Policy Developments Affecting the Security Industry

  • Initial requirements of the EU AI Act come into effect this month (February 2026), beginning with compliance around banned activities.