The SSHStalker Linux botnet has infected approximately 7,000 systems by leveraging traditional mass-compromise techniques. It uses a pipeline that deploys various scanners and malware to propagate and maintain control over infected devices. Although it employs old methods, the botnet remains effective in targeting Linux environments. There are no known exploits in the wild specifically tied to this botnet, and no CVSS score has been assigned. The threat is rated medium severity due to its ability to compromise numerous systems and potentially disrupt operations or facilitate further attacks. European organizations running Linux servers or IoT devices are at risk, especially those with weak SSH credentials or exposed services. Mitigation requires focused hardening of SSH access, continuous monitoring for unusual scanning activity, and rapid incident response to contain infections. Countries with significant Linux infrastructure and high-value targets in technology and finance sectors are more likely to be affected. Given the botnet’s reliance on old techniques, organizations can defend effectively by applying best practices and proactive network hygiene.
China-linked UNC3886 targeted all four major telecom providers, but did not disrupt services or access customer information. The post Singapore: Rootkits, Zero-Day Used in Chinese Attack on Major Telecom Firms appeared first on SecurityWeek .
The KRVTZ-NET IDS alerts dated 2026-02-10 represent network reconnaissance activity detected by an intrusion detection system. These alerts are categorized as low severity and are derived from open-source intelligence (OSINT) feeds, indicating observation-level data rather than confirmed exploitation. No specific affected products or versions are identified, and no patches or known exploits exist for this activity. The alerts primarily signify reconnaissance efforts, which are often preliminary steps in an attack chain. European organizations should be aware that such reconnaissance can precede more targeted attacks, though the current threat level is low. Mitigation should focus on enhancing network monitoring and anomaly detection to identify and respond to reconnaissance attempts promptly. Countries with significant internet infrastructure and critical industries may be more likely to observe such activity. Given the low severity and lack of exploitation, the suggested severity is low. Defenders should treat these alerts as early warnings and maintain vigilance against potential escalation.
GuLoader, a malware downloader active since 2019, primarily delivers RATs and information stealers. It employs sophisticated anti-analysis techniques, including polymorphic code for dynamic constant construction and complex exception-based control flow obfuscation. The malware has evolved to handle multiple exception types, making tracing its execution flow challenging. GuLoader uses dynamic hashing, encrypted strings, and stack-based string encryption to conceal critical information. It often hosts payloads on trusted cloud services to bypass reputation-based detection. The malware's consistent development and updating of anti-analysis techniques suggest it will remain a significant threat in the future.
As only data exfiltration for extortion no longer delivers ROI, ransomware gangs may increasingly encrypting data for additional leverage. The post Ransomware Groups May Pivot Back to Encryption as Data Theft Tactics Falter appeared first on SecurityWeek .
Romania’s national oil pipeline operator, Conpet, experienced a cyberattack that disrupted its IT systems and took its website offline, although operational technology systems controlling the pipeline remained unaffected. The attack highlights the risk to critical infrastructure organizations from cyber threats targeting their IT environments. No known exploits are currently active in the wild, and the severity is assessed as medium. The incident underscores the importance of securing IT systems that support critical infrastructure to prevent operational disruptions and reputational damage. European organizations in the energy sector should be vigilant and enhance their cyber defenses accordingly.
SmarterTools says customers were impacted after hackers compromised a data center used for quality control testing. The post SmarterTools Hit by Ransomware via Vulnerability in Its Own Product appeared first on SecurityWeek .
The KEV list is useful but largely misunderstood. KEVology explains what it is, and how best to use it. The post New Paper and Tool Help Security Teams Move Beyond Blind Reliance on CISA’s KEV Catalog appeared first on SecurityWeek .
Edge devices that are no longer supported have been targeted in attacks by state-sponsored hackers, the US says. The post Organizations Urged to Replace Discontinued Edge Devices appeared first on SecurityWeek .
Other noteworthy stories that might have slipped under the radar: AT&T and Verizon response to Salt Typhoon, AI agents solve security challenges, man arrested in Poland for DDos Attacks. The post In Other News: Record DDoS, Epstein’s Hacker, ESET Product Vulnerabilities appeared first on SecurityWeek .
Cisco Talos uncovered 'DKnife', a sophisticated gateway-monitoring and adversary-in-the-middle (AitM) framework comprising seven Linux-based implants. Used since 2019, DKnife performs deep-packet inspection, traffic manipulation, and malware delivery via routers and edge devices. It targets various devices, including PCs, mobile devices, and IoT, delivering ShadowPad and DarkNimbus backdoors. The framework primarily targets Chinese-speaking users, with evidence suggesting China-nexus threat actors as operators. DKnife's capabilities include DNS hijacking, Android application update hijacking, Windows binary hijacking, anti-virus traffic disruption, and user activity monitoring. A link to the WizardNet campaign was also discovered, indicating a shared development or operational lineage.
A new evolution in the ClickFix campaign, dubbed CrashFix, has been identified. This variant deliberately crashes victims' browsers and uses social engineering to lure users into executing malicious commands. The attack begins with a malicious ad redirecting users to install a harmful browser extension impersonating a legitimate ad blocker. The payload causes delayed browser issues and presents a fake security warning. It misuses the Windows utility finger.exe to execute malicious commands and downloads additional payloads, including a Python-based Remote Access Trojan (RAT). The RAT, named ModeloRAT, establishes persistence and performs extensive reconnaissance. The campaign targets domain-joined systems and employs multiple obfuscation techniques to evade detection.
SystemBC is a malware strain that has recently infected over 10,000 devices despite previous law enforcement efforts to dismantle its infrastructure. It is primarily known for deploying ransomware and other malicious payloads, as well as using compromised machines to proxy traffic, which can facilitate further attacks or anonymize threat actor activities. The malware's persistence and ability to evade takedown attempts highlight its resilience and ongoing threat. Although no specific affected software versions or exploits are detailed, the infection scale and functionality suggest a significant risk to organizations. The threat is rated medium severity due to its impact on confidentiality and availability, moderate ease of exploitation, and broad infection scope. European organizations, especially those with extensive networked environments, could face operational disruptions and data breaches. Mitigation requires focused network monitoring, blocking known proxy traffic patterns, and rapid incident response to infected hosts. Countries with high technology adoption and critical infrastructure are more likely targets. Defenders should prioritize detection of SystemBC-related traffic and strengthen endpoint protections to prevent initial infection and lateral movement.
The Cyberspy Group is an advanced persistent threat (APT) actor that has conducted cyber espionage operations targeting governments and critical infrastructure across 37 countries. Although Palo Alto Networks has not officially attributed this group, evidence suggests a likely connection to China. The campaign involves sophisticated intrusion techniques aimed at compromising sensitive governmental and infrastructure systems, potentially leading to significant confidentiality and operational impacts. No specific affected software versions or vulnerabilities have been disclosed, and no known exploits are currently reported in the wild. The threat is assessed as critical due to the broad scope, high-value targets, and potential for severe disruption. European organizations, especially those involved in government and critical infrastructure sectors, face heightened risk. Mitigation requires enhanced network monitoring, threat intelligence sharing, and rigorous access controls tailored to detect and prevent APT intrusions. Countries with significant government and critical infrastructure digital footprints, such as Germany, France, the UK, Italy, and the Netherlands, are most likely to be affected given their strategic importance and historical targeting patterns. The threat's complexity and stealthy nature necessitate proactive defense measures beyond standard patching and antivirus solutions.
A malicious email attachment containing a . bat script is delivering a multi-stage malware payload designed to steal data via a Chrome injector. The initial script is a fork of publicly available GitHub code but includes obfuscated Base64-encoded payloads executed through PowerShell. The payload fetches additional components from a compromised website, including a . NET program that establishes persistence via scheduled tasks and communicates with a Telegram-based command and control (C2) server. This malware, identified as XWorm V7.x, uses sophisticated obfuscation and evasion techniques to avoid detection. It targets Windows systems and aims to steal sensitive information silently. The attack does not require user interaction beyond opening the malicious attachment and does not currently have known widespread exploitation but poses a medium risk. European organizations using Windows and Chrome browsers are potential targets, especially those with less mature email security controls.
In early February 2026, an intrusion was detected where threat actors exploited compromised SonicWall SSLVPN credentials for initial network access. The attackers deployed an EDR killer utilizing a legitimate but revoked EnCase forensic driver to terminate security processes from kernel mode. This technique, known as Bring Your Own Vulnerable Driver (BYOVD), bypasses Windows Driver Signature Enforcement. The attack was halted before ransomware deployment, but it highlights the growing trend of weaponizing signed, legitimate drivers to disable endpoint security. The intrusion involved aggressive network reconnaissance, deployment of a sophisticated EDR killer with an encoded kernel driver payload, and attempts to establish persistence. The case underscores the importance of multi-factor authentication, VPN log monitoring, and implementing Microsoft's recommended driver block rules.
A shadow DNS network and HTTP-based traffic distribution system (TDS) hosted in Aeza International, a sanctioned bulletproof hosting company, has been discovered. The system compromises routers, altering their DNS settings to use shadow resolvers. These resolvers selectively modify responses, directing users to malicious content. The TDS incorporates a clever DNS trick to evade detection by security groups. The system, operational since mid-2022, appears to be run by a financially motivated actor in affiliate marketing. It has the potential to interfere with devices on the network, alter DNS records, and conduct adversary-in-the-middle operations. The threat actor's ability to control DNS resolution poses significant risks beyond delivering unwanted advertising.
A new hacking group called Punishing Owl has emerged, targeting Russian critical infrastructure. Their first attack on December 12, 2025, compromised a Russian state security agency, leaking internal documents. The group used DNS manipulation, created fake subdomains, and sent phishing emails to the victim's partners. They employed a PowerShell stealer called ZipWhisper to exfiltrate browser data. Punishing Owl's attacks are politically motivated and focus exclusively on Russian targets, including government agencies, scientific institutions, and IT organizations. The group has established a presence on cybercriminal forums and social media, likely operating from Kazakhstan. Experts predict this group will continue to be a persistent threat in the Russian cyberspace.
While both cyberwar and cyberwarfare will increase through 2026, cyberwarfare is likely to increase more dramatically. We hope it will never boil over – but we should be aware of the possibility and its consequences. The post Cyber Insights 2026: Cyberwar and Rising Nation State Threats appeared first on SecurityWeek .
The article details a sophisticated supply chain attack on Notepad++ that occurred from July to October 2025. Attackers compromised the update infrastructure, deploying various malicious payloads through three distinct infection chains. The attack targeted individuals and organizations in Vietnam, El Salvador, Australia, and the Philippines. The infection methods evolved over time, using NSIS installers, Metasploit downloaders, and Cobalt Strike Beacons. The attackers employed clever techniques to evade detection, including the abuse of legitimate software and the use of multiple C2 servers. The article provides a comprehensive timeline of the attack, describes the different execution chains, and offers guidance on detecting traces of the attack.
