SmarterTools on DanSec Daily

Cybersecurity Brief – 2026-02-11

Wed, 11 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Warlock (Storm-2603) ransomware gang breached SmarterTools by exploiting an unpatched SmarterMail server on 29 January 2026.
Volvo Group North America reported a customer data exposure due to a breach at Conduent, an IT services provider.
Dutch Data Protection Authority and the Council for the Judiciary in the Netherlands confirmed cyberattacks exploiting Ivanti zero-day vulnerabilities, leading to exposure of employee contact data.

Newly Discovered Vulnerabilities

Microsoft’s February 2026 Patch Tuesday addressed 58–60 vulnerabilities, including six zero-days (three actively exploited security feature bypass flaws) and three publicly disclosed vulnerabilities. Updates apply to Windows, Microsoft Edge, and other Microsoft products.
Fortinet released patches for a critical SQL injection vulnerability in FortiClientEMS (CVE identifier not specified) that allows unauthenticated remote code execution.
Adobe fixed 44 vulnerabilities in its Creative Cloud applications, several of which are critical and could allow arbitrary code execution.
SAP patched 26 new and one updated vulnerability in CRM, S/4HANA, and NetWeaver products, including critical issues.
Siemens, Schneider, Aveva, and Phoenix Contact issued patches for vulnerabilities in their industrial control systems as part of ICS Patch Tuesday.
Microsoft began rolling out new Secure Boot certificates in Windows updates to replace expiring 2011 certificates, ahead of their June 2026 expiration.

Notable Threat Actor Activity

North Korea-linked UNC1069 targeted cryptocurrency organizations using AI-generated lures and new malware for Windows and macOS, including the ClickFix technique and tailored AI-generated video content.
DPRK (North Korean) IT operatives are impersonating professionals on LinkedIn, applying for remote jobs using hijacked LinkedIn accounts to infiltrate organizations.
Transparent Tribe (APT36), a Pakistan-linked group, is conducting a three-pronged cyber espionage campaign against Indian defense and government sectors, deploying GETA, ARES, and Desk RAT malware.
A newly documented Linux botnet, SSHStalker, is leveraging IRC for command-and-control communications.
A malicious 7-Zip website is distributing a trojanized installer that converts infected devices into residential proxy nodes.

Trends, Tools, or Tactics of Interest

Reynolds ransomware incorporates a bring-your-own-vulnerable-driver (BYOVD) technique to disable EDR (Endpoint Detection and Response) security tools during attacks.
Ransomware actors are shifting from simple encryption to maintaining persistent, “resident” access within victim environments.
ZeroDayRAT, a commercial spyware kit marketed on Telegram, enables full compromise of Android and iOS devices, granting access to SIM, location data, SMS, and facilitating MFA bypass and account takeover.
Surge in AI-enabled social engineering: AI-generated romance scams and “pig butchering” investment frauds are increasingly difficult to detect, as highlighted by recent law enforcement action against a $73M scheme.
Phishing attacks are increasingly leveraging trusted platforms, with LinkedIn direct messages being used to target executives.
Tax-related phishing and scams are prevalent during the tax season, with attackers impersonating IRS communications.
Operational Technology (OT) attacks are employing “living-off-the-plant” techniques, using native tools and protocols to evade detection.
Cloud incident response is being streamlined through automation and AI-driven tools, such as Tines, to reduce mean time to resolution (MTTR).

Regulatory or Policy Developments Affecting the Security Industry

The European Commission unconditionally approved Google’s $32B acquisition of Wiz, a major cloud security provider.
Discord will restrict user profiles to teen-appropriate mode by default unless age is verified, to enhance child safety on the platform.
Microsoft announced plans to introduce mobile-style app permission prompts in Windows 11, requiring explicit user consent before apps can access sensitive resources such as files, cameras, and microphones.

Cybersecurity Brief – 2026-02-10

Tue, 10 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Chinese threat actor UNC3886 breached Singapore’s four largest telecommunications providers (Singtel, StarHub, M1, Simba) in a targeted cyber espionage campaign. The intrusions were confirmed by Singapore’s Cyber Security Agency.
The European Commission disclosed a breach involving its mobile device management platform, exposing staff data. An investigation is ongoing.
SmarterTools suffered a ransomware breach by the Warlock gang, who exploited vulnerabilities in SmarterMail. The attack compromised internal systems but did not impact business applications or customer account data.
A security researcher discovered an exposed database for the Chat & Ask AI app, leaking 300 million messages linked to 25 million users due to a Firebase misconfiguration.
Two Connecticut men were charged in the US for defrauding FanDuel and other gambling sites of $3 million using the stolen identities of approximately 3,000 individuals.
Malicious actors are deploying fake 7-Zip download sites, infecting home PCs and converting them into residential proxy nodes.
Romania’s national oil pipeline operator, Conpet, was targeted in a cyberattack, as reported in Check Point’s weekly threat intelligence bulletin.

Newly Discovered Vulnerabilities

Fortinet patched a critical SQL injection vulnerability (CVE pending) in FortiClientEMS that could allow unauthenticated attackers to execute arbitrary code.
BeyondTrust released updates for a critical pre-authentication remote code execution vulnerability in its Remote Support (RS) and Privileged Remote Access (PRA) products. The flaw allows unauthenticated attackers to execute arbitrary code.
SolarWinds Web Help Desk (WHD) vulnerabilities have been exploited as zero-days since December 2025, enabling remote code execution on exposed servers. Attackers have used these flaws to deploy legitimate tools, such as Velociraptor, for post-exploitation activities.
SmarterMail vulnerabilities were exploited by the Warlock ransomware gang to breach SmarterTools’ network.

Notable Threat Actor Activity

UNC3886, a China-linked APT, conducted a coordinated cyber espionage campaign against Singapore’s telecommunications sector, leveraging sophisticated tactics to breach multiple major providers.
Bloody Wolf threat actor targeted Uzbekistan and Russia in a spear-phishing campaign delivering NetSupport RAT for remote access.
TeamPCP orchestrated a large-scale campaign compromising cloud-native environments through automated worm-like attacks on exposed services, establishing criminal infrastructure for further exploitation.
The Warlock ransomware group exploited SmarterMail vulnerabilities to breach SmarterTools.
Attackers are exploiting SolarWinds WHD vulnerabilities to gain initial access and deploy forensics and DFIR tools for lateral movement.
Ransomware groups, notably those distributing “Reynolds” ransomware, are embedding vulnerable drivers (BYOVD - Bring Your Own Vulnerable Driver) with their payloads to facilitate defense evasion.

Trends, Tools, or Tactics of Interest

Ransomware groups are reportedly pivoting back to encryption-based extortion as data theft-only tactics yield diminishing returns.
Attackers are leveraging targeted wordlists derived from public organizational language (using tools such as CeWL) to improve password guessing success rates, without employing AI.
Malicious RTF documents exploiting CVE-2026-21509, attributed to APT28, are in active use for initial access.
Fake software distribution sites, such as those mimicking 7-Zip, are being used to covertly turn victim PCs into proxy infrastructure.
Automated exploitation of cloud infrastructure is being used at scale (TeamPCP) to build botnets and criminal infrastructure.
The use of legitimate digital forensics tools (e.g., Velociraptor) by attackers post-exploitation is increasing, complicating detection and response.
YARA-X 1.13.0 was released, offering improvements and bugfixes for threat hunting.
RSAC released Quantickle, an open-source browser-based threat intelligence visualization tool.
New research (KEVology) and tools are available to help security teams interpret and prioritise CISA KEV catalog vulnerabilities more effectively.

Regulatory or Policy Developments Affecting the Security Industry

Initial requirements of the EU AI Act come into effect this month (February 2026), beginning with compliance around banned activities.

Cybersecurity Brief – 2026-02-07

Sat, 07 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Flickr has disclosed a potential data breach caused by a vulnerability at a third-party email service provider, exposing users’ real names, email addresses, IP addresses, and activity data.
An Illinois man has pleaded guilty to hacking nearly 600 women’s Snapchat accounts to steal, sell, or trade private photos.
Compromised npm and PyPI packages associated with dYdX have been used to deliver wallet stealers and remote access trojans (RATs) in a new software supply chain attack.
Germany’s domestic intelligence agency has warned of suspected state-sponsored phishing attacks targeting high-ranking individuals via the Signal messaging app.

Newly Discovered Vulnerabilities

CISA has issued a warning about CVE-2026-24423, an unauthenticated remote code execution vulnerability in SmarterMail, which has been exploited in ransomware attacks.
Security researchers have identified multiple insecurities in the OpenClaw AI assistant, including vulnerabilities related to malicious add-ons (“skills”) and problematic configuration settings.
ESET product vulnerabilities were noted in a roundup of recent security issues, though specific details were not provided.

Notable Threat Actor Activity

A previously undocumented Asian state-backed group, tracked as TGR-STA-1030, has breached at least 70 government and critical infrastructure entities across 37 countries over the past year in a cyber espionage campaign.
China-linked threat actors have been operating the DKnife adversary-in-the-middle (AitM) framework since at least 2019, targeting routers and edge devices for traffic hijacking and malware delivery in espionage campaigns.
State-sponsored threat actors are suspected in the recent phishing campaign targeting senior figures in Germany via Signal.

Trends, Tools, or Tactics of Interest

A new malware-as-a-service kit called “Stanley” is offering guaranteed publication in the Chrome Web Store by bypassing Google’s security verification process.
Supply chain attacks continue to pose significant risk, as seen in the compromise of npm and PyPI packages and recent incidents involving self-propagating worms.
Modern browser-based attacks are increasingly able to evade detection by traditional EDR, email, and SASE solutions, operating entirely within the browser with minimal forensic evidence.
Apple Pay users are being targeted by phishing campaigns involving fake support calls designed to steal payment details.
Research highlights that attackers are evolving tradecraft to leverage AI assistants and agents in malicious operations (“living off the AI”).

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a binding operational directive requiring federal agencies to identify and remove unsupported or end-of-life network edge devices to reduce federal network risk.
Five bills aimed at boosting cybersecurity defenses for the U.S. energy sector have cleared a House panel.
The European Commission has announced that TikTok is facing a large fine for addictive platform design elements that may violate regulatory standards.
The Electronic Frontier Foundation has launched the “Encrypt It Already” campaign, urging major technology companies to implement end-to-end encryption by default across their services.

Cybersecurity Brief – 2026-01-23

Fri, 23 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Under Armour suffered a ransomware breach resulting in the alleged exposure of data belonging to 72 million customers. The stolen data is reported to be circulating on the dark web.
Fortinet FortiGate devices are being actively targeted and compromised in automated attacks. Threat actors are creating rogue accounts and stealing firewall configuration data, with reports of malicious configuration changes even on fully patched devices.
A major food service franchisee operator in Southeast Asia was targeted by the new Osiris ransomware family in November 2025, leveraging a Bring Your Own Vulnerable Driver (BYOVD) attack using the POORTRY driver.
SmarterTools SmarterMail email servers are being actively exploited via an authentication bypass vulnerability. Attackers are hijacking admin accounts and resetting passwords, with exploitation observed within two days of patch release.
Researchers were able to recover stolen data from 12 U.S. organizations impacted by INC ransomware due to an operational security failure by the threat actors.
Okta SSO accounts are being targeted in active vishing-based data theft attacks, with attackers employing custom phishing kits tailored for voice-based social engineering.

Newly Discovered Vulnerabilities

A critical vulnerability (CVE-2026-24061, CVSS 9.8) was disclosed in GNU InetUtils telnetd, allowing attackers to bypass login and gain root access. The flaw was present for nearly 11 years.
Atlassian, GitLab, and Zoom released security patches addressing over two dozen vulnerabilities, including several critical- and high-severity issues.
Cisco released patches for a critical zero-day vulnerability (CVE-2026-20045) in Cisco Unified CM, which could allow unauthenticated remote code execution and is under active exploitation.
A new authentication bypass flaw in SmarterMail is being exploited in the wild to hijack administrator accounts.
At Pwn2Own Automotive 2026, researchers exploited 29 zero-day vulnerabilities across automotive technologies in a single day.

Notable Threat Actor Activity

North Korean-linked threat actor KONNI is conducting a phishing campaign targeting developers, using AI-generated PowerShell backdoors.
DPRK actors are deploying spear-phishing campaigns that utilise VS Code Tunnels and trusted Microsoft infrastructure to facilitate remote hacking while evading detection.
A widespread phishing campaign is targeting LinkedIn users via automated comments posted by bots impersonating LinkedIn personnel.
A malicious PyPI package impersonating the SymPy library was discovered deploying XMRig cryptominer on Linux hosts.
Fake LastPass maintenance phishing emails are targeting users, urging them to back up their vaults within 24 hours.
Threat actors are using trusted Remote Monitoring and Management (RMM) tools as backdoors, as observed in a dual-vector campaign exploiting legitimate RMM software for persistent access.

Trends, Tools, or Tactics of Interest

Attackers are increasingly exploiting trusted and familiar systems, such as RMM tools, VS Code Tunnels, and routine services, to gain and maintain access.
Social engineering tactics are evolving, with a rise in vishing attacks targeting Okta SSO and phishing campaigns leveraging LinkedIn comments.
The use of AI is expanding in both attack and defence: threat actors are using AI to generate malware, while defenders are integrating AI-driven detection into security products.
Old attack techniques, such as Linux page cache exploits, are being optimised for greater speed and efficiency by researchers.
The abuse of software supply chains continues, with malicious packages on PyPI and impersonation of popular libraries.
Microsoft Teams will introduce brand impersonation warnings to help detect social engineering attempts during calls.

Regulatory or Policy Developments Affecting the Security Industry

The EU AI Act introduces a legal requirement for AI literacy training, shifting best practice into a compliance mandate for organisations operating in or with the EU.
The developer of the curl project is ending its bug bounty programme on HackerOne due to a high volume of low-quality, AI-generated vulnerability reports.
Increased scrutiny in Europe regarding overreliance on US cybersecurity technology providers, with ongoing policy discussions about technology sovereignty and supply chain risks.
The Australian government is reviewing the cybersecurity risks of Chinese-made electric buses, which have been found to contain vulnerabilities and a potential remote “kill switch.”

Cybersecurity Brief – 2025-12-31

Wed, 31 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

The European Space Agency (ESA) confirmed a breach of external servers containing unclassified information related to collaborative engineering and project management activities. The compromised systems were outside ESA’s corporate network.
Korean Air reported that data belonging to approximately 30,000 employees was stolen following a breach at its former subsidiary KC&D, which was linked to an Oracle E-Business Suite (EBS) hack.
Two former employees of cybersecurity incident response firms Sygnia and DigitalMint pleaded guilty to conducting BlackCat (ALPHV) ransomware attacks against U.S. companies in 2023.

Newly Discovered Vulnerabilities

The Cyber Security Agency of Singapore (CSA) issued an alert regarding a critical remote code execution vulnerability in SmarterTools SmarterMail email software. The flaw is rated maximum severity and can be exploited for full compromise.
CISA ordered U.S. federal agencies to patch the actively exploited MongoBleed vulnerability in MongoDB, which can be used to steal credentials, API keys, and other sensitive data.

Notable Threat Actor Activity

The Chinese APT Mustang Panda was observed deploying a previously undocumented, signed kernel-mode rootkit driver to load a new variant of the TONESHELL backdoor. The driver contains user-mode shellcodes for execution.
The threat actor Silver Fox has shifted focus to India, conducting phishing campaigns using income tax-themed lures to deliver the ValleyRAT (Winos 4.0) modular remote access trojan.

Trends, Tools, or Tactics of Interest

Researchers at Push Security identified a new “ConsentFix” technique that blends OAuth consent phishing with ClickFix-style prompts, enabling attackers to trick users into handing over OAuth tokens and compromise accounts.
A new cybercrime service, ErrTraffic, is automating ClickFix attacks by generating fake browser glitches on compromised websites, luring users into downloading malicious payloads or following malicious prompts.
A campaign dubbed Zoom Stealer has been detected, in which 18 malicious browser extensions targeting Chrome, Firefox, and Edge have affected 2.2 million users. The extensions harvest online meeting data, including corporate meeting intelligence.
Analysis of cyber-insurance claims data identified six cybersecurity technologies that are most effective in reducing losses and are recommended for deployment by 2026.
The rapid deployment of artificial intelligence (AI) in security operations is exposing new risks, with practitioners struggling to consistently operationalise AI while maintaining security.

Regulatory or Policy Developments

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) lifted sanctions on three individuals previously linked to the Intellexa Consortium, the commercial spyware vendor behind Predator spyware.
The total disclosed value of cybersecurity M&A deals in 2025 exceeded $84 billion, with eight acquisitions surpassing the $1 billion mark.