The KRVTZ-NET IDS alerts dated 2026-02-10 represent network reconnaissance activity detected by an intrusion detection system. These alerts are categorized as low severity and are derived from open-source intelligence (OSINT) feeds, indicating observation-level data rather than confirmed exploitation. No specific affected products or versions are identified, and no patches or known exploits exist for this activity. The alerts primarily signify reconnaissance efforts, which are often preliminary steps in an attack chain. European organizations should be aware that such reconnaissance can precede more targeted attacks, though the current threat level is low. Mitigation should focus on enhancing network monitoring and anomaly detection to identify and respond to reconnaissance attempts promptly. Countries with significant internet infrastructure and critical industries may be more likely to observe such activity. Given the low severity and lack of exploitation, the suggested severity is low. Defenders should treat these alerts as early warnings and maintain vigilance against potential escalation.
GuLoader, a malware downloader active since 2019, primarily delivers RATs and information stealers. It employs sophisticated anti-analysis techniques, including polymorphic code for dynamic constant construction and complex exception-based control flow obfuscation. The malware has evolved to handle multiple exception types, making tracing its execution flow challenging. GuLoader uses dynamic hashing, encrypted strings, and stack-based string encryption to conceal critical information. It often hosts payloads on trusted cloud services to bypass reputation-based detection. The malware's consistent development and updating of anti-analysis techniques suggest it will remain a significant threat in the future.
A recent supply chain attack targeting EmEditor users has been uncovered, involving watering hole tactics. The investigation reveals multiple domains masquerading as EmEditor-related sites, all registered through NameSilo LLC in December 2025. The domains resolve to various IP addresses, with some changes observed in February 2026. Additional domains with similar patterns were discovered, along with peculiar HTTP header behavior. A potential early stage of the campaign was identified, sharing similar characteristics with the initial report. The attackers continued their activities even after exposure, utilizing PowerShell scripts and various domains for command and control purposes. The analysis provides a comprehensive list of indicators, including domain names, IP addresses, and file hashes associated with the attack.
As only data exfiltration for extortion no longer delivers ROI, ransomware gangs may increasingly encrypting data for additional leverage. The post Ransomware Groups May Pivot Back to Encryption as Data Theft Tactics Falter appeared first on SecurityWeek .
Romania’s national oil pipeline operator, Conpet, experienced a cyberattack that disrupted its IT systems and took its website offline, although operational technology systems controlling the pipeline remained unaffected. The attack highlights the risk to critical infrastructure organizations from cyber threats targeting their IT environments. No known exploits are currently active in the wild, and the severity is assessed as medium. The incident underscores the importance of securing IT systems that support critical infrastructure to prevent operational disruptions and reputational damage. European organizations in the energy sector should be vigilant and enhance their cyber defenses accordingly.
SmarterTools says customers were impacted after hackers compromised a data center used for quality control testing. The post SmarterTools Hit by Ransomware via Vulnerability in Its Own Product appeared first on SecurityWeek .
The KEV list is useful but largely misunderstood. KEVology explains what it is, and how best to use it. The post New Paper and Tool Help Security Teams Move Beyond Blind Reliance on CISA’s KEV Catalog appeared first on SecurityWeek .
The signs of a cyberattack were identified on systems EU's main executive body uses for mobile device management. The post European Commission Investigating Cyberattack appeared first on SecurityWeek .
The KRVTZ-NET IDS alerts from February 9, 2026, report reconnaissance and scanning activities targeting network infrastructure, especially Fortigate VPN devices and submission services. The activity includes brute force attempts from IP 152.32.151.39 and exploitation attempts of CVE-2023-27997 from IP 2001:470:1:332::148. Some attackers use Google Webcrawler user-agent spoofing to evade detection. No active exploitation or ransomware campaigns are currently reported, but these reconnaissance actions could lead to more serious attacks. European organizations using Fortigate VPNs are particularly at risk. The threat is assessed as low severity but could impact confidentiality and integrity if unmitigated. Recommended mitigations include proactive patching, enhanced monitoring, multi-factor authentication, and network segmentation.
Edge devices that are no longer supported have been targeted in attacks by state-sponsored hackers, the US says. The post Organizations Urged to Replace Discontinued Edge Devices appeared first on SecurityWeek .
Potential breach at Flickr exposes usernames, email addresses, IP addresses, and activity data. The post Flickr Security Incident Tied to Third-Party Email System appeared first on SecurityWeek .
Used since at least 2019, DKnife has been targeting the desktop, mobile, and IoT devices of Chinese users. The post ‘DKnife’ Implant Used by Chinese Threat Actor for Adversary-in-the-Middle Attacks appeared first on SecurityWeek .
CISA updated 59 KEV entries in 2025 to specify that the vulnerabilities have been exploited in ransomware attacks. The post Concerns Raised Over CISA’s Silent Ransomware Updates in KEV Catalog appeared first on SecurityWeek .
Cisco Talos uncovered 'DKnife', a sophisticated gateway-monitoring and adversary-in-the-middle (AitM) framework comprising seven Linux-based implants. Used since 2019, DKnife performs deep-packet inspection, traffic manipulation, and malware delivery via routers and edge devices. It targets various devices, including PCs, mobile devices, and IoT, delivering ShadowPad and DarkNimbus backdoors. The framework primarily targets Chinese-speaking users, with evidence suggesting China-nexus threat actors as operators. DKnife's capabilities include DNS hijacking, Android application update hijacking, Windows binary hijacking, anti-virus traffic disruption, and user activity monitoring. A link to the WizardNet campaign was also discovered, indicating a shared development or operational lineage.
A new evolution in the ClickFix campaign, dubbed CrashFix, has been identified. This variant deliberately crashes victims' browsers and uses social engineering to lure users into executing malicious commands. The attack begins with a malicious ad redirecting users to install a harmful browser extension impersonating a legitimate ad blocker. The payload causes delayed browser issues and presents a fake security warning. It misuses the Windows utility finger.exe to execute malicious commands and downloads additional payloads, including a Python-based Remote Access Trojan (RAT). The RAT, named ModeloRAT, establishes persistence and performs extensive reconnaissance. The campaign targets domain-joined systems and employs multiple obfuscation techniques to evade detection.
The hacker claims to have stolen nearly 700,000 Substack user records, including email addresses and phone numbers. The post Substack Discloses Security Incident After Hacker Leaks Data appeared first on SecurityWeek .
