Cybersecurity Brief – 2026-02-24

Tue, 24 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Optimizely, a New York-based ad tech company, confirmed a data breach following a voice phishing (vishing) attack that led to unauthorised access to customer data.
Vanta Diagnostics (formerly Vikor Scientific), a US healthcare diagnostics firm, reported a data breach affecting 140,000 individuals, attributed to the Everest ransomware group.
The University of Mississippi Medical Center was forced to close all clinics and cancel elective procedures following a ransomware attack.
PayPal disclosed that an application error led to a data breach, exposing customer personal information for nearly six months and resulting in fraudulent transactions.
France’s Ministry of Economy disclosed a data breach, as noted in Check Point Research’s latest threat intelligence bulletin.

Two recently patched vulnerabilities in RoundCube Webmail are being actively exploited in the wild, including an XSS flaw via animate tags in SVG documents.
Researchers identified multiple security vulnerabilities in Android mental health apps with a combined 14.7 million installs, potentially exposing sensitive medical information.
Microsoft is investigating a bug in the classic Outlook desktop client that causes the mouse pointer to disappear for some users.
Supply chain attacks continue to be observed in the npm ecosystem, with at least 19 malicious npm packages actively harvesting cryptocurrency keys, CI secrets, and API tokens.
Researchers reported ongoing malware campaigns using malicious JPEG files with embedded payloads to deliver MSI installers.

APT28 (Russia-linked) has been attributed to a new campaign targeting Western and Central European entities using webhook-based macro malware.
The Iranian state-sponsored group MuddyWater deployed new malware strains in attacks against organizations in the Middle East and Africa.
The Everest ransomware group claimed responsibility for the Vanta Diagnostics breach.
A Russian-speaking hacker used generative AI to compromise over 600 FortiGate firewalls, targeting credentials and backups for potential ransomware operations.
Autonomous AI agents have been leveraged in a new class of supply chain attack targeting crypto wallets.
The Shai-Hulud-like npm supply chain campaign is actively spreading through malicious packages.
Spanish authorities arrested four alleged members of the Anonymous Fenix hacktivist group for DDoS attacks against government and political websites.
A Romanian hacker pleaded guilty to selling access to a US state government network.
Oleksandr Didenko, a Ukrainian national, was sentenced in the US for selling stolen identities to North Korean IT workers for use on freelance platforms.

There is a surge in ATM jackpotting attacks, with losses exceeding $20 million in 2025; attackers continue to use longstanding tools and tactics.
Cryptojacking campaigns are deploying bespoke XMRig miners using pirated software bundles, leveraging BYOVD (Bring Your Own Vulnerable Driver) exploits and time-based logic bombs for lateral movement.
Threat actors are increasingly using AI, including generative AI, to automate and scale attacks against exposed infrastructure, such as FortiGate firewalls.
Supply chain attacks remain prevalent, with npm and Docker ecosystems being active targets for malware distribution and credential harvesting.
Exposed endpoints and internal APIs in LLM (Large Language Model) infrastructure present new attack surfaces for organizations adopting AI technologies.
Ongoing campaigns use vishing (voice phishing) and deepfake audio to compromise organisations, as highlighted by the Optimizely breach and industry analysis of AI-generated voice threats.
Attackers are exploiting the persistent reuse of trust via stolen tokens and compromised devices, bypassing traditional identity-based security controls.
Malicious actors are using typosquatting (e.g., fake Huorong security site) to distribute remote access trojans such as ValleyRAT.

CISA has ordered US federal agencies to patch actively exploited RoundCube Webmail vulnerabilities within three weeks.
The arrest of hacktivists and cybercriminals in Spain, the US, and Romania demonstrates ongoing law enforcement efforts targeting cybercrime and hacktivism.