Major Incidents or Breaches

  • Warlock (Storm-2603) ransomware gang breached SmarterTools by exploiting an unpatched SmarterMail server on 29 January 2026.
  • Volvo Group North America reported a customer data exposure due to a breach at Conduent, an IT services provider.
  • Dutch Data Protection Authority and the Council for the Judiciary in the Netherlands confirmed cyberattacks exploiting Ivanti zero-day vulnerabilities, leading to exposure of employee contact data.

Newly Discovered Vulnerabilities

  • Microsoft’s February 2026 Patch Tuesday addressed 58–60 vulnerabilities, including six zero-days (three actively exploited security feature bypass flaws) and three publicly disclosed vulnerabilities. Updates apply to Windows, Microsoft Edge, and other Microsoft products.
  • Fortinet released patches for a critical SQL injection vulnerability in FortiClientEMS (CVE identifier not specified) that allows unauthenticated remote code execution.
  • Adobe fixed 44 vulnerabilities in its Creative Cloud applications, several of which are critical and could allow arbitrary code execution.
  • SAP patched 26 new and one updated vulnerability in CRM, S/4HANA, and NetWeaver products, including critical issues.
  • Siemens, Schneider, Aveva, and Phoenix Contact issued patches for vulnerabilities in their industrial control systems as part of ICS Patch Tuesday.
  • Microsoft began rolling out new Secure Boot certificates in Windows updates to replace expiring 2011 certificates, ahead of their June 2026 expiration.

Notable Threat Actor Activity

  • North Korea-linked UNC1069 targeted cryptocurrency organizations using AI-generated lures and new malware for Windows and macOS, including the ClickFix technique and tailored AI-generated video content.
  • DPRK (North Korean) IT operatives are impersonating professionals on LinkedIn, applying for remote jobs using hijacked LinkedIn accounts to infiltrate organizations.
  • Transparent Tribe (APT36), a Pakistan-linked group, is conducting a three-pronged cyber espionage campaign against Indian defense and government sectors, deploying GETA, ARES, and Desk RAT malware.
  • A newly documented Linux botnet, SSHStalker, is leveraging IRC for command-and-control communications.
  • A malicious 7-Zip website is distributing a trojanized installer that converts infected devices into residential proxy nodes.

Trends, Tools, or Tactics of Interest

  • Reynolds ransomware incorporates a bring-your-own-vulnerable-driver (BYOVD) technique to disable EDR (Endpoint Detection and Response) security tools during attacks.
  • Ransomware actors are shifting from simple encryption to maintaining persistent, “resident” access within victim environments.
  • ZeroDayRAT, a commercial spyware kit marketed on Telegram, enables full compromise of Android and iOS devices, granting access to SIM, location data, SMS, and facilitating MFA bypass and account takeover.
  • Surge in AI-enabled social engineering: AI-generated romance scams and “pig butchering” investment frauds are increasingly difficult to detect, as highlighted by recent law enforcement action against a $73M scheme.
  • Phishing attacks are increasingly leveraging trusted platforms, with LinkedIn direct messages being used to target executives.
  • Tax-related phishing and scams are prevalent during the tax season, with attackers impersonating IRS communications.
  • Operational Technology (OT) attacks are employing “living-off-the-plant” techniques, using native tools and protocols to evade detection.
  • Cloud incident response is being streamlined through automation and AI-driven tools, such as Tines, to reduce mean time to resolution (MTTR).

Regulatory or Policy Developments Affecting the Security Industry

  • The European Commission unconditionally approved Google’s $32B acquisition of Wiz, a major cloud security provider.
  • Discord will restrict user profiles to teen-appropriate mode by default unless age is verified, to enhance child safety on the platform.
  • Microsoft announced plans to introduce mobile-style app permission prompts in Windows 11, requiring explicit user consent before apps can access sensitive resources such as files, cameras, and microphones.