An attack campaign targeting organizations in the US, Canada, UK, and Northern Ireland exploits ConnectWise ScreenConnect vulnerabilities. The attack chain begins with a spoofed email containing a malicious .cmd attachment, which executes silently, escalates privileges, disables Windows SmartScreen, and removes the Mark-of-the-Web. It then installs a legitimate Remote Monitoring and Management tool, ScreenConnect, which is abused as a Remote Access Trojan for persistent command-and-control access. The campaign focuses on sectors with high-value data, including government, healthcare, and logistics. The attackers use various techniques to evade detection, including UAC bypass, registry modification, and silent MSI installation. The ScreenConnect client used has a revoked certificate, highlighting the importance of blocking vulnerable software versions and enforcing strict RMM allowlists.
Threat actors have been observed exploiting Net Monitor for Employees Professional and SimpleHelp software in ransomware operations. These legitimate tools were used for remote access, command execution, and persistence. The attackers disguised Net Monitor as Microsoft OneDrive and configured SimpleHelp with cryptocurrency-related keyword triggers. In one case, the attack led to an attempted deployment of Crazy ransomware. The intrusions involved initial access through compromised VPN accounts, followed by the installation of these tools for remote control and monitoring. The shared infrastructure and tactics suggest a single threat actor or group behind these activities, with objectives including cryptocurrency theft and ransomware deployment.
A convincing lookalike of the popular 7-Zip archiver site has been serving a trojanized installer that silently converts victims' machines into residential proxy nodes. The fake site, 7zip[.]com, distributes a functional copy of 7-Zip alongside concealed malware. The malware deploys three components: Uphero.exe (service manager), hero.exe (proxy payload), and hero.dll (supporting library). It establishes persistence through Windows services, manipulates firewall rules, and profiles the host system. The primary function is to enroll infected hosts as residential proxy nodes, allowing third parties to route traffic through victims' IP addresses. This campaign appears to be part of a broader operation with similar tactics used for other fake installers. The malware incorporates multiple evasion techniques and uses encrypted communications.
Between June and December 2025, state-sponsored threat group Lotus Blossom compromised the hosting infrastructure for Notepad++, allowing them to intercept and redirect update traffic. This enabled selective targeting of users primarily in Southeast Asian government, telecommunications and critical infrastructure sectors. Two infection chains were identified - one using Lua script injection to deliver Cobalt Strike and another using DLL side-loading for a Chrysalis backdoor. The campaign affected additional sectors across South America, US, Europe and Southeast Asia including cloud hosting, energy, financial, government, manufacturing and software development. The attack exploited insufficient verification in older versions of the Notepad++ updater to serve malicious installers to targeted victims.
The KRVTZ-NET IDS alert dated 2026-02-12 reports network reconnaissance activity detected via intrusion detection systems, involving scanning from the IPv6 address 2602:80d:1003::11 associated with Censys, an internet-wide scanning service. This activity is classified as low severity and represents automated information gathering rather than an active exploit or vulnerability. No affected products, patches, or known exploits are linked to this event. Although reconnaissance itself does not directly compromise systems, it increases exposure by revealing network configurations and services that could be targeted in future attacks. Organizations with publicly accessible IPv6 infrastructure, especially in Europe, should monitor such scanning as part of their threat intelligence and defense posture. Mitigation involves enhanced monitoring, network segmentation, hardening exposed services, and integrating threat intelligence to anticipate potential threats. The threat is assessed as low severity due to its limited immediate impact and lack of exploitation evidence.
Officials said data will now be classified as one of four categories: “public,” “sensitive,” “confidential” or “restricted.” The post Nevada Unveils New Statewide Data Classification Policy Months After Cyberattack appeared first on SecurityWeek .
CVE-2026-1226 is a high-severity code injection vulnerability (CWE-94) in Schneider Electric's EcoStruxure Building Operation Workstation versions prior to 7.0.2. The flaw arises from improper control over code generation when processing maliciously crafted TGML graphics files, potentially allowing execution of untrusted code. Exploitation requires local access with low privileges and some user interaction, but no authentication is needed beyond local privileges. This vulnerability can severely impact confidentiality, integrity, and availability of building management systems. No known exploits are reported in the wild yet. European organizations using affected Schneider Electric building operation software should prioritize patching and implement strict file validation and access controls. Countries with high adoption of Schneider Electric products and critical infrastructure reliance, such as Germany, France, UK, and the Netherlands, are most at risk. The CVSS score of 7 reflects the significant risk posed by this vulnerability in operational technology environments.
The Conduent data breach affects at least 25 million individuals, up from 10 million estimated a few months ago. The post Conduent Breach Hits Volvo Group: Nearly 17,000 Employees’ Data Exposed appeared first on SecurityWeek .
WSL or “Windows Subsystem Linux”[1] is a feature in the Microsoft Windows ecosystem that allows users to run a real Linux environment directly inside Windows without needing a traditional virtual machine or dual boot setup. The latest version, WSL2, runs a lightweight virtualized Linux kernel for better compatibility and performance, making it especially useful for development, DevOps, and cybersecurity workflows where Linux tooling is essential but Windows remains the primary operating system. It was introduced a few years ago (2016) as part of Windows 10.
Security failures don’t always start with attackers, sometimes they start with missing truth. The post Security in the Dark: Recognizing the Signs of Hidden Information appeared first on SecurityWeek .
After a decade and a half of service, the current certificates will expire, and new ones will be rolled out. The post Microsoft to Refresh Windows Secure Boot Certificates in June 2026 appeared first on SecurityWeek .
Unit 42 discovered a rogue virtual machine used by the cybercrime group Muddled Libra during an incident response investigation. The VM provided insights into the group's operational methods, including reconnaissance, tool downloads, persistence establishment, certificate theft, and interactions with the target's infrastructure. Muddled Libra created the VM after gaining unauthorized access to the target's VMware vSphere environment. The group's tactics involve minimal malware use, preferring to leverage the target's assets. Their attack chain included creating a VM, downloading tools, establishing C2, using stolen certificates, and attempting data exfiltration. The article details the group's activities, tools used, and troubleshooting efforts during the attack.
The KRVTZ-NET IDS alerts dated 2026-02-11 represent network reconnaissance activity detected by an intrusion detection system. The alerts are categorized as low severity and are based on open-source intelligence (OSINT) observations without specific exploit details or affected product versions. No known exploits or patches are associated with this activity, indicating it is likely preliminary scanning or probing rather than an active attack. The threat is primarily informational, highlighting reconnaissance efforts that could precede more targeted attacks. Organizations should monitor for unusual network activity and strengthen detection capabilities to identify potential follow-on threats. Given the lack of specific vulnerabilities or exploits, the immediate risk is low but warrants vigilance. The threat is relevant globally, especially in regions with high network infrastructure usage and strategic importance. Due to the reconnaissance nature and low severity, the suggested severity is low. Defenders should focus on improving network visibility and anomaly detection to mitigate potential escalation.
VoidLink is a Linux C2 framework that generates implant binaries for cloud and enterprise environments. The implant, likely built using an LLM coding agent, demonstrates advanced capabilities including multi-cloud targeting, container awareness, and kernel-level stealth. It fingerprints cloud environments across AWS, GCP, Azure, Alibaba Cloud, and Tencent Cloud, harvesting credentials and detecting container runtimes. The malware includes plugins for container escape and Kubernetes privilege escalation, as well as a kernel-level rootkit that adapts its approach based on the host's kernel version. C2 communications use AES-256-GCM over HTTPS, disguised as normal web traffic. VoidLink highlights the growing concern of LLM-generated implants reducing the skill barrier for producing sophisticated malware.
The SSHStalker Linux botnet has infected approximately 7,000 systems by leveraging traditional mass-compromise techniques. It uses a pipeline that deploys various scanners and malware to propagate and maintain control over infected devices. Although it employs old methods, the botnet remains effective in targeting Linux environments. There are no known exploits in the wild specifically tied to this botnet, and no CVSS score has been assigned. The threat is rated medium severity due to its ability to compromise numerous systems and potentially disrupt operations or facilitate further attacks. European organizations running Linux servers or IoT devices are at risk, especially those with weak SSH credentials or exposed services. Mitigation requires focused hardening of SSH access, continuous monitoring for unusual scanning activity, and rapid incident response to contain infections. Countries with significant Linux infrastructure and high-value targets in technology and finance sectors are more likely to be affected. Given the botnet’s reliance on old techniques, organizations can defend effectively by applying best practices and proactive network hygiene.
