Cybersecurity Brief – 2026-02-10

Tue, 10 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Chinese threat actor UNC3886 breached Singapore’s four largest telecommunications providers (Singtel, StarHub, M1, Simba) in a targeted cyber espionage campaign. The intrusions were confirmed by Singapore’s Cyber Security Agency.
The European Commission disclosed a breach involving its mobile device management platform, exposing staff data. An investigation is ongoing.
SmarterTools suffered a ransomware breach by the Warlock gang, who exploited vulnerabilities in SmarterMail. The attack compromised internal systems but did not impact business applications or customer account data.
A security researcher discovered an exposed database for the Chat & Ask AI app, leaking 300 million messages linked to 25 million users due to a Firebase misconfiguration.
Two Connecticut men were charged in the US for defrauding FanDuel and other gambling sites of $3 million using the stolen identities of approximately 3,000 individuals.
Malicious actors are deploying fake 7-Zip download sites, infecting home PCs and converting them into residential proxy nodes.
Romania’s national oil pipeline operator, Conpet, was targeted in a cyberattack, as reported in Check Point’s weekly threat intelligence bulletin.

Fortinet patched a critical SQL injection vulnerability (CVE pending) in FortiClientEMS that could allow unauthenticated attackers to execute arbitrary code.
BeyondTrust released updates for a critical pre-authentication remote code execution vulnerability in its Remote Support (RS) and Privileged Remote Access (PRA) products. The flaw allows unauthenticated attackers to execute arbitrary code.
SolarWinds Web Help Desk (WHD) vulnerabilities have been exploited as zero-days since December 2025, enabling remote code execution on exposed servers. Attackers have used these flaws to deploy legitimate tools, such as Velociraptor, for post-exploitation activities.
SmarterMail vulnerabilities were exploited by the Warlock ransomware gang to breach SmarterTools’ network.

UNC3886, a China-linked APT, conducted a coordinated cyber espionage campaign against Singapore’s telecommunications sector, leveraging sophisticated tactics to breach multiple major providers.
Bloody Wolf threat actor targeted Uzbekistan and Russia in a spear-phishing campaign delivering NetSupport RAT for remote access.
TeamPCP orchestrated a large-scale campaign compromising cloud-native environments through automated worm-like attacks on exposed services, establishing criminal infrastructure for further exploitation.
The Warlock ransomware group exploited SmarterMail vulnerabilities to breach SmarterTools.
Attackers are exploiting SolarWinds WHD vulnerabilities to gain initial access and deploy forensics and DFIR tools for lateral movement.
Ransomware groups, notably those distributing “Reynolds” ransomware, are embedding vulnerable drivers (BYOVD - Bring Your Own Vulnerable Driver) with their payloads to facilitate defense evasion.

Ransomware groups are reportedly pivoting back to encryption-based extortion as data theft-only tactics yield diminishing returns.
Attackers are leveraging targeted wordlists derived from public organizational language (using tools such as CeWL) to improve password guessing success rates, without employing AI.
Malicious RTF documents exploiting CVE-2026-21509, attributed to APT28, are in active use for initial access.
Fake software distribution sites, such as those mimicking 7-Zip, are being used to covertly turn victim PCs into proxy infrastructure.
Automated exploitation of cloud infrastructure is being used at scale (TeamPCP) to build botnets and criminal infrastructure.
The use of legitimate digital forensics tools (e.g., Velociraptor) by attackers post-exploitation is increasing, complicating detection and response.
YARA-X 1.13.0 was released, offering improvements and bugfixes for threat hunting.
RSAC released Quantickle, an open-source browser-based threat intelligence visualization tool.
New research (KEVology) and tools are available to help security teams interpret and prioritise CISA KEV catalog vulnerabilities more effectively.

Initial requirements of the EU AI Act come into effect this month (February 2026), beginning with compliance around banned activities.