Cybersecurity Brief – 2026-02-21

Sat, 21 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Japanese tech company Advantest disclosed a ransomware attack impacting its corporate network, with ongoing investigation into potential compromise of customer and employee data.
The University of Mississippi Medical Center (UMMC) closed all statewide clinics following a ransomware attack.
A data breach at the French bank registry affected 1.2 million accounts, as confirmed by the French Ministry of Finance.
PayPal notified customers of a data breach caused by a software error in a loan application, which exposed sensitive personal information, including Social Security numbers, for nearly six months.
Age verification vendor Persona was found to have left its frontend exposed, enabling access to extensive identity and watchlist screening processes behind a basic age check.
Attackers leveraged Facebook ads to distribute fake Windows 11 downloads, which delivered password-stealing malware targeting credentials and cryptocurrency wallets.

Newly Discovered Vulnerabilities

A critical remote code execution (RCE) vulnerability (CVE-2026-1731) in BeyondTrust Remote Support and Privileged Remote Access products is being actively exploited, including in ransomware attacks. Threat actors have used the flaw to deploy web shells, backdoors, and exfiltrate data. CISA has updated its Known Exploited Vulnerabilities (KEV) catalog accordingly.
Researchers identified a new toolset used by threat actors to scan for React2Shell exposures, targeting high-value networks for exploitation.
A surge in vulnerabilities affecting industrial control systems (ICS) has been reported, increasing risks to operational technology environments.

Notable Threat Actor Activity

A supply chain attack on the open-source Cline CLI (version 2.3.0) resulted in the deployment of OpenClaw, an autonomous AI agent, onto developer systems.
The ClickFix campaign is abusing compromised legitimate websites to deliver a previously undocumented remote access trojan (MIMICRAT), facilitating remote access and control.
The FBI reported a surge in ATM jackpotting attacks across the US, with over 1,900 incidents since 2020 and $20 million stolen in 2025. The Ploutus malware, active for over a decade, remains a primary tool.
A Ukrainian national was sentenced in the US to five years in prison for facilitating North Korea’s fraudulent IT worker scheme, which involved supplying stolen identities to infiltrate US companies.
Japanese-language phishing campaigns continue to target users, indicating ongoing localized social engineering efforts.

Trends, Tools, or Tactics of Interest

Outbound email security incidents in Microsoft 365 environments remain prevalent, with 91% of organizations affected, primarily due to human error.
Threat actors are increasingly exploiting AI-powered agents and manipulating them to bypass security policies and guardrails, as evidenced by incidents involving Microsoft Copilot and other AI models.
The shift-left approach in software development has led to increased security risks, as speed and automation in CI pipelines often override security checks, according to analysis of public container images.
The use of Facebook ads as a vector for malware distribution is increasing, with attackers disguising malicious payloads as legitimate software downloads.
Latin America’s slow pace of cybersecurity upgrades is creating opportunities for initial access brokers and ransomware gangs.
Metadata in official documents, such as PDF files related to sensitive government projects, continues to expose information about authors and contributors.

Regulatory or Policy Developments Affecting the Security Industry

Insurers and regulators are placing increased emphasis on identity posture when assessing cyber risk, with “identity cyber scores” emerging as a new metric influencing cyber insurance policies.
The European Parliament has enacted a ban on certain uses of AI, reflecting a growing regulatory focus on artificial intelligence in security contexts.
The US Department of Homeland Security is pursuing a unified biometric search platform for faces and fingerprints, while reducing centralized privacy reviews and limits on facial recognition technology.
NIST announced a breakthrough in quantum technology with the development of a chip capable of producing single photons, potentially broadening access to quantum key distribution (QKD) for organizations.

Cybersecurity Brief – 2026-02-20

Fri, 20 Feb 2026 00:00:00 +0000

Major Incidents and Breaches

The French Ministry of Economy reported unauthorized access to the national bank account registry (FICOBA), exposing 1.2 million bank accounts.
Blockchain-based lender Figure confirmed a data breach after threat actor ShinyHunters leaked over 2GB of data, compromising nearly 1 million user records.
German rail operator Deutsche Bahn experienced a large-scale DDoS attack that disrupted information and booking systems for several hours.
Abu Dhabi Finance Week inadvertently exposed VIP passport details due to unprotected cloud storage.
Intimate products company Tenga suffered a phishing attack, potentially exposing US customer data.
A Nigerian national was sentenced to eight years in prison for hacking tax preparation firms in Massachusetts and filing fraudulent tax returns worth over $8.1 million.

Newly Discovered Vulnerabilities

Microsoft patched CVE-2026-26119, a privilege escalation vulnerability in Windows Admin Center.
A critical vulnerability in Grandstream GXP1600 series VoIP phones allows unauthenticated remote attackers to gain root privileges and eavesdrop on communications.
The US Cybersecurity and Infrastructure Security Agency (CISA) ordered federal agencies to patch a maximum-severity, actively exploited Dell vulnerability within three days.
OpenClaw, following a supply chain attack via a malicious npm package (Cline v2.3.0), continues to face security and misconfiguration issues despite recent patches.
Ivanti zero-day vulnerabilities have seen a surge in exploitation, with attacks traced back to July 2025, including shell access, reconnaissance, and malware delivery.
Foxit PDF software and OpenSSL both reported new remote code execution vulnerabilities, with active exploitation noted in the wild.

Notable Threat Actor Activity

The CRESCENTHARVEST campaign is targeting supporters of Iran’s protests with remote access trojan (RAT) malware for information theft and espionage.
ShinyHunters leaked user data stolen from Figure, a blockchain lender.
A supply chain attack injected the OpenClaw backdoor into Cline npm package, downloaded over 4,000 times.
Threat actors are targeting Microsoft Entra accounts in technology, manufacturing, and financial sectors using combined device code phishing and vishing to abuse OAuth 2.0 Device Authorization Grant.
INTERPOL’s Operation Red Card 2.0 resulted in 651 arrests and the recovery of $4.3 million, targeting online scams, investment fraud, mobile money scams, and fake loan applications across 16 African countries.

Trends, Tools, and Tactics of Interest

AI-assisted social engineering attacks remain the top initial access vector, with reports of a 1200% surge in AI-driven fraud during December 2025. Threat actors are leveraging AI for bot deployment, phishing, and identity fraud.
The PromptSpy Android malware is the first known mobile malware to leverage generative AI (Google Gemini) at runtime for persistence and adaptation across devices.
The Massiv Android banking trojan, disguised as IPTV apps, is actively targeting users in southern Europe with device takeover and financial theft capabilities.
The Arkanix Stealer, written in C++ and Python, has been distributed as malware-as-a-service (MaaS) with a referral program, targeting a wide range of user data.
Infostealer dumps are increasingly linking stolen credentials to real-world identities, correlating usernames, cookies, and behavioural data across personal and enterprise accounts.
The Starkiller phishing kit, available as phishing-as-a-service (PhaaS), bypasses multi-factor authentication (MFA) by live-proxying legitimate login sites.
AI-generated passwords have been found to be highly predictable and less secure compared to traditional random password generation methods.
IoT security risks continue due to reused passwords, lack of network segmentation, and poor sanitisation processes, increasing the attack surface.
Google blocked over 1.75 million Play Store app submissions in 2025 and prevented more than 255,000 apps from obtaining excessive access to sensitive user data.

Regulatory or Policy Developments

Texas filed a lawsuit against TP-Link, alleging deceptive marketing of its routers as secure while allowing exploitation of firmware vulnerabilities by Chinese state-backed hackers.
CISA issued an emergency directive for federal agencies to patch an actively exploited Dell vulnerability within three days.
Three former Google engineers were indicted in the US for allegedly stealing trade secrets and transferring them to Iran.

Cline on DanSec Daily

Cybersecurity Brief – 2026-02-21

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Cybersecurity Brief – 2026-02-20

Major Incidents and Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, and Tactics of Interest

Regulatory or Policy Developments