On February 4, 2026, KRVTZ-NET IDS detected network reconnaissance activity targeting Fortigate VPN devices, specifically scanning the /remote/logincheck endpoint associated with CVE-2023-27997. This vulnerability could allow unauthorized access or remote code execution. No active exploitation or payload delivery was observed, and no patches are currently available for this specific alert. The activity is low severity and likely represents early-stage reconnaissance. European organizations using Fortigate VPNs, especially in critical infrastructure and government sectors, should be aware of this scanning activity.
CVE-2026-1632 is a critical vulnerability in RISS SRL's MOMA Seismic Station (version 2.4.2520 and earlier) where the web management interface lacks authentication. This allows unauthenticated attackers to access the device's configuration, extract sensitive data, or remotely reset the device. The vulnerability has a CVSS score of 9.1, indicating high severity with network attack vector, no privileges or user interaction required, and impacts confidentiality and integrity. Although no known exploits are currently reported in the wild, the exposure of critical infrastructure devices like seismic stations poses significant risks. European organizations operating these devices could face operational disruptions and data compromise. Mitigations include network segmentation, restricting access to the management interface, deploying compensating controls such as VPNs or firewalls, and monitoring for unauthorized access. Countries with active seismic monitoring infrastructure and critical geological research facilities, such as Italy, Germany, France, and Spain, are most likely to be affected.
Last week, a new AI agent framework was introduced to automate "live". It targets office work in particular, focusing on messaging and interacting with systems. The tool has gone viral not so much because of its features, which are similar to those of other agent frameworks, but because of a stream of security oversights in its design.
ShinyHunters has claimed the theft of 14 million records from the US bakery-cafe chain’s systems. The post Hackers Leak 5.1 Million Panera Bread Records appeared first on SecurityWeek .
The article details a sophisticated supply chain attack on Notepad++ that occurred from July to October 2025. Attackers compromised the update infrastructure, deploying various malicious payloads through three distinct infection chains. The attack targeted individuals and organizations in Vietnam, El Salvador, Australia, and the Philippines. The infection methods evolved over time, using NSIS installers, Metasploit downloaders, and Cobalt Strike Beacons. The attackers employed clever techniques to evade detection, including the abuse of legitimate software and the use of multiple C2 servers. The article provides a comprehensive timeline of the attack, describes the different execution chains, and offers guidance on detecting traces of the attack.
Rapid7 Labs has uncovered a sophisticated campaign attributed to the Chinese APT group Lotus Blossom, involving a new custom backdoor named Chrysalis. The attack compromised Notepad++ infrastructure to deliver the backdoor. Analysis revealed multiple custom loaders, including one using Microsoft Warbird for obfuscation. The Chrysalis backdoor has extensive capabilities for information gathering, file operations, and remote command execution. Additional artifacts found include Cobalt Strike beacons and Metasploit payloads. The campaign shows Lotus Blossom evolving its tactics, mixing custom and off-the-shelf tools with advanced obfuscation techniques to evade detection.
The KRVTZ-NET IDS alerts from February 3, 2026, report automated reconnaissance activity detected by intrusion detection systems, involving IP addresses linked to Censys, a known internet scanning service. This activity is categorized as reconnaissance in the cyber kill chain and involves scanning HTTP User-Agent strings to gather information about potential targets. No specific vulnerabilities, exploits, or malware are associated with these alerts, and no active exploitation is reported. The severity is low, reflecting the preliminary nature of reconnaissance without direct impact on confidentiality, integrity, or availability. European organizations should treat this as an early warning and maintain vigilance, as reconnaissance can precede targeted attacks. Mitigation involves network monitoring, tuning IDS/IPS to detect scanning patterns, network segmentation, and maintaining asset inventories. No patches or immediate remediation are required. The threat is low severity but warrants continued observation to prevent escalation.
CVE-2026-23997 is a high-severity Stored Cross-Site Scripting (XSS) vulnerability affecting FacturaScripts versions 2025.71 and earlier. The flaw exists in the Observations field within the History view, where user input is rendered without proper HTML entity encoding, allowing attackers to inject and execute arbitrary JavaScript in the browsers of administrators viewing the history. Exploitation requires at least limited privileges to input data and some user interaction to trigger the payload. The vulnerability impacts confidentiality, integrity, and availability by enabling session hijacking, credential theft, or administrative account compromise. No known exploits are currently reported in the wild. European organizations using FacturaScripts for ERP and accounting functions are at risk, especially those with administrators accessing the affected History view. Mitigation requires applying patches once available, implementing strict input validation and output encoding, and restricting access to the History view to trusted users. Countries with significant SME adoption of FacturaScripts, such as Spain, Germany, France, Italy, and the UK, are most likely affected due to market penetration and the strategic importance of ERP systems. Given the CVSS 3.
A sophisticated phishing campaign has been detected that utilizes a multi-stage approach to evade detection. The attack begins with a procurement-themed email containing a PDF attachment. This PDF redirects victims to another PDF hosted on trusted cloud storage, which then leads to a fake Dropbox login page. The attackers exploit trusted platforms and harmless file formats to bypass security measures. The campaign uses social engineering tactics to harvest credentials, which are then exfiltrated to attacker-controlled infrastructure via Telegram. This method proves effective by leveraging legitimate business processes, trusted file types, and reputable cloud services to appear authentic and bypass automated security checks.
Hackers rely on evolved vishing and login harvesting to compromise SSO credentials for unauthorized MFA enrollment. The post ShinyHunters-Branded Extortion Activity Expands, Escalates appeared first on SecurityWeek .
MicroWorld Technologies, the maker of eScan antivirus, experienced a supply-chain compromise where malicious updates were pushed through the legitimate eScan updater. This multi-stage malware establishes persistence on infected systems, enables remote access for attackers, and blocks automatic security mechanisms. Although no known exploits are currently observed in the wild, the threat poses a medium severity risk due to its potential impact on confidentiality, integrity, and availability. European organizations using eScan antivirus are at risk, especially those in countries with higher adoption of this product. The attack leverages trusted update channels, making detection and prevention more challenging. Mitigation requires immediate verification of update integrity, network monitoring for unusual remote access, and enhanced endpoint detection capabilities. Countries with significant use of eScan and strategic sectors reliant on this antivirus are more likely to be targeted. The threat underscores the critical risk of supply-chain attacks in cybersecurity defenses.
Security leaders share how artificial intelligence is changing malware, ransomware, and identity-led intrusions, and how defenses must evolve. The post Cyber Insights 2026: Malware and Cyberattacks in the Age of AI appeared first on SecurityWeek .
Of 3,100 unprotected MongoDB instances, half remain compromised, most of them by a single threat actor. The post Over 1,400 MongoDB Databases Ransacked by Threat Actor appeared first on SecurityWeek .
The next major Windows Server and Windows releases will have the deprecated authentication protocol disabled by default. The post Microsoft Moves Closer to Disabling NTLM appeared first on SecurityWeek .
A Microsoft Teams voice-phishing campaign leveraging Quick Assist, a remote administration tool, was tracked in September 2025. The campaign uses help desk scams to gain initial access, followed by user group enumeration and the execution of a PowerShell script to download a command and control payload. The attack employs AMSI bypass, encrypted communications, and a web-socket remote access trojan. Multiple Microsoft 365 tenants with IT-related subdomains were used, along with various IPs and domains for C2 infrastructure. The campaign shows similarities to Storm-1811 and PhantomCaptcha activities, suggesting a complex cybercrime ecosystem. The attackers' ultimate goal may be ransomware deployment, although observed attempts were successfully blocked.
The likely state-sponsored threat actor had access to the hosting provider for months and targeted only certain Notepad++ customers. The post Notepad++ Supply Chain Hack Conducted by China via Hosting Provider appeared first on SecurityWeek .
