This entry reports a Maltrail Indicator of Compromise (IOC) dated 2026-02-24, classified as malware with medium severity. It is an OSINT observation from the CIRCL OSINT Feed, indicating suspicious network activity. No specific affected versions, exploits in the wild, or patch information are provided. The threat is categorized as medium risk based on available data.
The KRVTZ-NET IDS alert dated February 24, 2026, reports a low-severity reconnaissance event involving access to PHP info pages on web servers from IP address 20.194.25.241. PHP info pages disclose detailed server configuration and environment information that could aid attackers in identifying vulnerabilities. No active exploitation or payload delivery is indicated, and no known exploits or ransomware campaigns are associated with this activity. The alert is sourced from the CIRCL OSINT feed and is based on automated detection without human validation. While the immediate impact is minimal, such reconnaissance can precede more targeted attacks if leveraged by adversaries. The alert highlights the importance of securing web server configurations by disabling or restricting access to phpinfo pages and monitoring for suspicious access attempts. No patches or direct fixes are applicable since this is an observational detection of reconnaissance activity.
A new campaign exploits OpenClaw skills to distribute the Atomic MacOS Stealer (AMOS). This evolution in supply chain attacks manipulates AI agentic workflows to install malware. The campaign spans multiple repositories with hundreds of malicious skills uploaded to ClawHub and SkillsMP. The infection chain begins with a seemingly harmless SKILL.md file that installs a prerequisite, leading to the download of a Mach-O universal binary. This AMOS variant steals extensive data, including credentials, browser data, cryptocurrency wallets, and various user documents. It lacks system persistence but expands its reach by exfiltrating Apple and KeePass keychains. The malware uses sophisticated encryption schemes and targets multiple browsers and cryptocurrency wallets.
The Everest ransomware group has taken credit for a hacker attack on Vikor Scientific, now called Vanta Diagnostics. The post US Healthcare Diagnostic Firm Says 140,000 Affected by Data Breach appeared first on SecurityWeek .
A sophisticated campaign by the Silver Fox APT group has been discovered using a fake version of the popular Chinese antivirus Huorong Security to distribute ValleyRAT, a Remote Access Trojan. The attackers created a convincing lookalike website with a typosquatted domain to trick users into downloading a malicious installer. The malware uses DLL sideloading techniques to deploy a full-featured backdoor with advanced stealth capabilities. It establishes persistence through scheduled tasks, disables Windows Defender, and employs various evasion tactics. Once installed, ValleyRAT provides attackers with extensive control over the victim's system, including keylogging, process injection, and credential theft. The campaign primarily targets Chinese-language systems but may be spreading to other threat actors due to the public leak of the ValleyRAT builder.
In his last two diaries, Xavier discussed recent malware campaigns that download JPEG files with embedded malicious payload[1,2]. At that point in time, I've not come across the malicious “MSI image” myself, but while I was going over malware samples that were caught by one of my customer's e-mail proxies during last week, I found another campaign in which the same technique was used.
Oleksandr Didenko sold the stolen identities of US citizens, allowing North Koreans to get hired using freelance work platforms. The post Ukrainian Gets 5 Years in US Prison for Aiding North Korean IT Fraud appeared first on SecurityWeek .
While this campaign targets crypto wallets and steals money, the methodology has far wider potential that could be used by other attackers. The post Autonomous AI Agents Provide New Class of Supply Chain Attack appeared first on SecurityWeek .
Catalin Dragomir admitted in a US court to selling access to an Oregon state government office’s network. The post Romanian Hacker Pleads Guilty to Selling Access to US State Network appeared first on SecurityWeek .
Threat actors relying on AI have been exploiting exposed ports and weak credentials to take over FortiGate devices. The post Hundreds of FortiGate Firewalls Hacked in AI-Powered Attacks: AWS appeared first on SecurityWeek .
A ransomware attack forced the University of Mississippi Medical Center to close all of its roughly three dozen clinics around the state and cancel elective procedures. The post Mississippi Hospital System Closes All Clinics After Ransomware Attack appeared first on SecurityWeek .
An active supply chain worm campaign, dubbed SANDWORM_MODE, is spreading through typosquatting and AI toolchain poisoning across at least 19 malicious npm packages. The worm exhibits Shai-Hulud characteristics, incorporating GitHub API exfiltration with DNS fallback, hook-based persistence, SSH propagation, and MCP server injection targeting AI coding assistants. It harvests credentials from developer and CI environments, exfiltrates data via multiple channels, and uses stolen identities to propagate. The campaign also includes a weaponized GitHub Action for CI secret harvesting. The worm employs a multi-stage design with obfuscated loaders, time-gated execution, and extensive configuration options. It targets high-traffic developer utilities, crypto tooling, and AI coding tools, posing a significant threat to the software supply chain.
This report analyzes the recent activities of the MuddyWater APT group, which primarily targets organizations in the Middle East. The group employs sophisticated spear-phishing techniques, often impersonating legitimate entities and using malicious documents to gain initial access. Their attacks focus on long-term infiltration and intelligence gathering rather than immediate disruption. The report details several attack cases from 2019 to 2026, highlighting the group's evolving tactics, including the abuse of legitimate remote management tools and the use of Rust-based malware. The analysis emphasizes the importance of endpoint detection and response (EDR) solutions in identifying and mitigating these threats, as traditional perimeter-based security measures prove insufficient against such advanced persistent threats.
PayPal blamed an application error for the exposure of customer personal information for nearly 6 months. The post PayPal Data Breach Led to Fraudulent Transactions appeared first on SecurityWeek .
For the latest discoveries in cyber research for the week of 23rd February, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES France’s Ministry of Economy has disclosed a data breach resulted from an unauthorized access to the national bank account registry FICOBA, impacting information tied to 1.2 million accounts. Exposed data includes names, […] The post 23rd February – Threat Intelligence Report appeared first on Check Point Research .
The KRVTZ-NET IDS alerts from 2026-02-23 report reconnaissance activity targeting Fortigate VPN devices via repeated GET requests to the /remote/logincheck endpoint linked to CVE-2023-27997. This vulnerability allows unauthenticated attackers to bypass authentication and potentially execute arbitrary commands. The alerts also note scanning for hidden environment files and PHP info pages to gather sensitive configuration data. No active exploitation or ransomware campaigns are currently associated with these activities. The threat is considered low severity and represents broad scanning efforts from diverse global sources.
A series of targeted phishing campaigns in Taiwan have been observed disseminating Winos 4.0 (ValleyRat) malware and associated plugins. The attacks exploit local business processes using themes like tax audits and e-invoices. The campaigns employ various techniques including malicious LNK files, DLL sideloading, and Bring Your Own Vulnerable Driver (BYOVD) attacks. The malware utilizes UAC bypassing, driver loading, and process termination to evade detection and disable security software. The attacks are attributed to a subgroup of the Silver Fox APT, showing sophisticated localization and evolving evasion techniques. The campaigns have been active since at least January 2026, using consistent infrastructure and development identifiers.
This entry describes a Maltrail Indicator of Compromise (IOC) dated February 22, 2026, sourced from the CIRCL OSINT feed. It is categorized as malware-related network activity with a medium severity rating. The information is based on open-source intelligence (OSINT) and represents an observation rather than a confirmed exploit or active campaign. No specific affected versions, exploits in the wild, or patches are associated with this IOC. The lack of detailed technical indicators or exploit data limits actionable insights. Organizations should consider this as a medium-risk intelligence input for network monitoring and threat detection. The threat does not currently appear to target specific products or regions. Defenders should remain vigilant but note the absence of immediate exploit evidence.
