Unit 42 discovered a rogue virtual machine used by the cybercrime group Muddled Libra during an incident response investigation. The VM provided insights into the group's operational methods, including reconnaissance, tool downloads, persistence establishment, certificate theft, and interactions with the target's infrastructure. Muddled Libra created the VM after gaining unauthorized access to the target's VMware vSphere environment. The group's tactics involve minimal malware use, preferring to leverage the target's assets. Their attack chain included creating a VM, downloading tools, establishing C2, using stolen certificates, and attempting data exfiltration. The article details the group's activities, tools used, and troubleshooting efforts during the attack.
The KRVTZ-NET IDS alerts dated 2026-02-11 represent network reconnaissance activity detected by an intrusion detection system. The alerts are categorized as low severity and are based on open-source intelligence (OSINT) observations without specific exploit details or affected product versions. No known exploits or patches are associated with this activity, indicating it is likely preliminary scanning or probing rather than an active attack. The threat is primarily informational, highlighting reconnaissance efforts that could precede more targeted attacks. Organizations should monitor for unusual network activity and strengthen detection capabilities to identify potential follow-on threats. Given the lack of specific vulnerabilities or exploits, the immediate risk is low but warrants vigilance. The threat is relevant globally, especially in regions with high network infrastructure usage and strategic importance. Due to the reconnaissance nature and low severity, the suggested severity is low. Defenders should focus on improving network visibility and anomaly detection to mitigate potential escalation.
VoidLink is a Linux C2 framework that generates implant binaries for cloud and enterprise environments. The implant, likely built using an LLM coding agent, demonstrates advanced capabilities including multi-cloud targeting, container awareness, and kernel-level stealth. It fingerprints cloud environments across AWS, GCP, Azure, Alibaba Cloud, and Tencent Cloud, harvesting credentials and detecting container runtimes. The malware includes plugins for container escape and Kubernetes privilege escalation, as well as a kernel-level rootkit that adapts its approach based on the host's kernel version. C2 communications use AES-256-GCM over HTTPS, disguised as normal web traffic. VoidLink highlights the growing concern of LLM-generated implants reducing the skill barrier for producing sophisticated malware.
The SSHStalker Linux botnet has infected approximately 7,000 systems by leveraging traditional mass-compromise techniques. It uses a pipeline that deploys various scanners and malware to propagate and maintain control over infected devices. Although it employs old methods, the botnet remains effective in targeting Linux environments. There are no known exploits in the wild specifically tied to this botnet, and no CVSS score has been assigned. The threat is rated medium severity due to its ability to compromise numerous systems and potentially disrupt operations or facilitate further attacks. European organizations running Linux servers or IoT devices are at risk, especially those with weak SSH credentials or exposed services. Mitigation requires focused hardening of SSH access, continuous monitoring for unusual scanning activity, and rapid incident response to contain infections. Countries with significant Linux infrastructure and high-value targets in technology and finance sectors are more likely to be affected. Given the botnet’s reliance on old techniques, organizations can defend effectively by applying best practices and proactive network hygiene.
China-linked UNC3886 targeted all four major telecom providers, but did not disrupt services or access customer information. The post Singapore: Rootkits, Zero-Day Used in Chinese Attack on Major Telecom Firms appeared first on SecurityWeek .
Quantickle is a browser-based tool designed for creating visual representations of threat research. The post RSAC Releases Quantickle Open Source Threat Intelligence Visualization Tool appeared first on SecurityWeek .
CVE-2025-13064 is a medium severity vulnerability in Axis Communications AB's AXIS Camera Station Pro version 6. It involves a server-side injection caused by an uncaught exception (CWE-248) that allows a malicious administrator, using a tampered client, to inject and execute malicious scripts on the server. The vulnerability requires high privileges (admin access) and no user interaction. Exploitation impacts availability but not confidentiality or integrity, and no known exploits are currently in the wild. The attack vector is remote and requires an authenticated attacker using a compromised client. European organizations using AXIS Camera Station Pro for video surveillance could face service disruptions if exploited. Mitigation involves ensuring client integrity, restricting admin client usage, and monitoring for anomalous server behavior. Countries with high adoption of Axis surveillance products and critical infrastructure reliance on video monitoring, such as Germany, France, the UK, and the Netherlands, are most likely affected. Given the limited impact scope and exploitation complexity, the severity is medium.
CVE-2026-23684 is a race condition vulnerability in SAP Commerce Cloud affecting versions HY_COM 2205, COM_CLOUD 2211, and 2211-JDK21. The flaw allows an attacker to manipulate product entries in a shopping cart, potentially causing erroneous product values to be checked out. This vulnerability impacts data integrity but does not affect confidentiality or availability. Exploitation requires no privileges or user interaction but has a high attack complexity. No known exploits are currently in the wild. The CVSS score is 5.9, indicating a medium severity. European organizations using SAP Commerce Cloud for e-commerce operations could face financial discrepancies and transactional errors if exploited. Mitigation involves applying vendor patches once available, implementing strict concurrency controls, and monitoring transaction logs for anomalies. Countries with significant SAP Commerce Cloud deployments and strong e-commerce sectors, such as Germany, the UK, France, and the Netherlands, are most likely to be affected.
The KRVTZ-NET IDS alerts dated 2026-02-10 represent network reconnaissance activity detected by an intrusion detection system. These alerts are categorized as low severity and are derived from open-source intelligence (OSINT) feeds, indicating observation-level data rather than confirmed exploitation. No specific affected products or versions are identified, and no patches or known exploits exist for this activity. The alerts primarily signify reconnaissance efforts, which are often preliminary steps in an attack chain. European organizations should be aware that such reconnaissance can precede more targeted attacks, though the current threat level is low. Mitigation should focus on enhancing network monitoring and anomaly detection to identify and respond to reconnaissance attempts promptly. Countries with significant internet infrastructure and critical industries may be more likely to observe such activity. Given the low severity and lack of exploitation, the suggested severity is low. Defenders should treat these alerts as early warnings and maintain vigilance against potential escalation.
CVE-2026-25885 is a critical improper authorization vulnerability in PolarLearn versions prior to 0-PRERELEASE-16. It allows unauthenticated attackers to connect to the group chat WebSocket endpoint and subscribe to or send messages in any group chat by supplying a group UUID. This flaw enables attackers to inject unauthorized messages that are stored persistently, not just displayed temporarily, leading to potential misinformation, disruption, or data integrity issues. The vulnerability requires no authentication or user interaction and can be exploited remotely over the network. The CVSS 4.0 base score is 10, reflecting its critical severity due to full network exploitability and high impact on confidentiality, integrity, and availability. European organizations using PolarLearn for educational or collaborative purposes are at risk of unauthorized data manipulation and privacy breaches. Mitigation involves upgrading to versions beyond 0-PRERELEASE-16 once available or implementing strict access controls and WebSocket authentication proxies. Countries with significant adoption of PolarLearn or similar open-source educational platforms, such as the Netherlands, Germany, France, and the UK, are most likely to be affected. Given the critical nature and ease of exploitation, immediate attention is required to prevent abuse and maintain trust in collaborative learning environments.
North Korean threat actor UNC1069 has evolved its tactics to target the cryptocurrency and decentralized finance sectors. In a recent intrusion, they deployed seven unique malware families, including new tools SILENCELIFT, DEEPBREATH, and CHROMEPUSH, designed to capture host and victim data. The attack utilized social engineering involving a compromised Telegram account, fake Zoom meeting, and reported AI-generated video. UNC1069 has shifted from spear-phishing to targeting Web3 industry entities like centralized exchanges, software developers, and venture capital firms. The intrusion demonstrated sophisticated techniques to bypass macOS security features and harvest credentials, browser data, and cryptocurrency information. This marks a significant expansion in UNC1069's capabilities and highlights their focus on financial theft and fueling future social engineering campaigns.
GuLoader, a malware downloader active since 2019, primarily delivers RATs and information stealers. It employs sophisticated anti-analysis techniques, including polymorphic code for dynamic constant construction and complex exception-based control flow obfuscation. The malware has evolved to handle multiple exception types, making tracing its execution flow challenging. GuLoader uses dynamic hashing, encrypted strings, and stack-based string encryption to conceal critical information. It often hosts payloads on trusted cloud services to bypass reputation-based detection. The malware's consistent development and updating of anti-analysis techniques suggest it will remain a significant threat in the future.
A recent supply chain attack targeting EmEditor users has been uncovered, involving watering hole tactics. The investigation reveals multiple domains masquerading as EmEditor-related sites, all registered through NameSilo LLC in December 2025. The domains resolve to various IP addresses, with some changes observed in February 2026. Additional domains with similar patterns were discovered, along with peculiar HTTP header behavior. A potential early stage of the campaign was identified, sharing similar characteristics with the initial report. The attackers continued their activities even after exposure, utilizing PowerShell scripts and various domains for command and control purposes. The analysis provides a comprehensive list of indicators, including domain names, IP addresses, and file hashes associated with the attack.
As only data exfiltration for extortion no longer delivers ROI, ransomware gangs may increasingly encrypting data for additional leverage. The post Ransomware Groups May Pivot Back to Encryption as Data Theft Tactics Falter appeared first on SecurityWeek .
Romania’s national oil pipeline operator, Conpet, experienced a cyberattack that disrupted its IT systems and took its website offline, although operational technology systems controlling the pipeline remained unaffected. The attack highlights the risk to critical infrastructure organizations from cyber threats targeting their IT environments. No known exploits are currently active in the wild, and the severity is assessed as medium. The incident underscores the importance of securing IT systems that support critical infrastructure to prevent operational disruptions and reputational damage. European organizations in the energy sector should be vigilant and enhance their cyber defenses accordingly.
SmarterTools says customers were impacted after hackers compromised a data center used for quality control testing. The post SmarterTools Hit by Ransomware via Vulnerability in Its Own Product appeared first on SecurityWeek .
A recent investigation reveals that the APT-C-28 (ScarCruft) group has expanded its targets to include the cryptocurrency industry. The group employs sophisticated phishing tactics, using LNK files disguised as PDFs to lure victims with investment proposals ranging from $1-3 million. Upon execution, a multi-stage payload deployment occurs, ultimately installing MiradorShell v2.0 to gain system control. The attack chain involves file downloads, decryption, and the creation of scheduled tasks for persistence. MiradorShell, an AutoIt-based backdoor, connects to a command and control server, offering reverse shell capabilities, file management, remote program execution, and victim fingerprinting. The malware employs various evasion techniques, including inline library files and direct API calls.
