SOC GoulashAlright team, it's been a busy 24 hours in the cyber world with significant updates on actively exploited zero-days, new threat actor tradecraft, major data breaches, and shifts in privacy regulations. Let's dive in:
Apple Patches Actively Exploited Zero-Day in dyld โ ๏ธ
- Apple has patched CVE-2026-20700, a memory corruption zero-day in dyld (Dynamic Link Editor), affecting all iOS versions since 1.0.
- This flaw was actively exploited in "extremely sophisticated attacks" against targeted individuals, allowing arbitrary code execution with memory write capability.
- The vulnerability is linked to previous WebKit and ANGLE flaws, potentially enabling "zero-click" or "one-click" exploits, and is suspected to be leveraged by commercial surveillance spyware.
๐ฐ The Hacker News | https://thehackernews.com/2026/02/apple-fixes-exploited-zero-day.html
๐ต๐ผ The Register | https://go.theregister.com/feed/www.theregister.com/2026/02/12/apple_ios_263/
Ivanti EPMM Zero-Day Exploits Dominated by Single Bulletproof IP ๐ก๏ธ
- A staggering 83% of exploitation attempts for Ivanti EPMM zero-day CVE-2026-1281 (unauthenticated RCE) originate from a single IP (193.24.123.42) on PROSPERO bulletproof hosting infrastructure.
- This IP is simultaneously exploiting other unrelated CVEs (Oracle WebLogic, GNU InetUtils telnetd, GLPI) using diverse user agents, indicative of automated tooling.
- Attackers are deploying "sleeper shells" and using OAST callbacks to verify exploitability before deploying payloads, a common tactic for initial access brokers. Organisations with internet-facing MDM should assume compromise and apply patches immediately.
๐ฐ The Hacker News | https://thehackernews.com/2026/02/83-of-ivanti-epmm-exploits-linked-to.html
Major Data Breaches Hit Dutch Telecom and Senegalese Government ๐จ
- Dutch mobile provider Odido suffered a cyberattack on 7 February, resulting in the theft of personal information for 6.2 million customers, including names, bank account numbers, addresses, and IDs. The breach was traced to a compromised customer contact system.
- In Senegal, the "The Green Blood Group" ransomware outfit breached the Directorate of File Automation (DAF), exfiltrating biometric data and immigration records for most of the adult population. A second government-adjacent entity, Sรฉnรฉgal Numรฉrique SA, was also attacked.
- These incidents highlight a critical lack of cybersecurity maturity, particularly in Senegal, where digital ambition has outpaced defensive capabilities, leading to widespread fraud risks and potential systemic mistrust in digital government initiatives.
๐๏ธ The Record | https://therecord.media/dutch-telecom-giant-announces-data-breach
๐ Dark Reading | https://www.darkreading.com/cyberattacks-data-breaches/hackers-breach-senegal-national-biometric-database
Nation-State Hackers Weaponising Gemini AI for Recon and Malware ๐ค
- Google reports that sophisticated state-backed threat actors from North Korea (UNC2970/Lazarus Group), China (Temp.HEX, APT31, APT41, UNC795), and Iran (APT42) are increasingly using Gemini AI.
- These groups leverage Gemini for open-source intelligence (OSINT) gathering, profiling high-value targets, vulnerability analysis, code generation, and crafting highly convincing social engineering lures.
- New malware like HONESTCUE is also emerging, which uses Gemini's API to dynamically generate C# source code for its second-stage functionality, bypassing traditional detection methods.
๐ฐ The Hacker News | https://thehackernews.com/2026/02/google-reports-state-backed-hackers.html
๐๏ธ The Record | https://therecord.media/nation-state-hackers-using-gemini-for-malicious-campaigns
Ransomware Actors Adopt Bossware for Stealthy Operations ๐ต๐ผ
- Threat actors are now repurposing legitimate employee monitoring software, or "bossware," to blend into corporate networks and facilitate ransomware deployment.
- Huntress observed incidents where "Net Monitor for Employees Professional" was chained with RMM SimpleHelp for reconnaissance, tooling delivery, and attempted ransomware deployment (Crazy ransomware/VoidCrypt).
- This tactic leverages legitimate signed binaries to evade detection, effectively turning employee monitoring tools into fully functional remote access trojans (RATs). Organisations should audit third-party RMM and monitoring tools and monitor for unusual process execution.
๐ต๐ผ The Register | https://go.theregister.com/feed/www.theregister.com/2026/02/12/ransomware_slingers_bossware/
0APT Ransomware Group: More Bluster Than Bite (For Now) ๐ฅ
- A new ransomware group, 0APT, emerged claiming around 200 victims within its first week, though researchers found no evidence to substantiate these claims, suggesting a likely hoax to gain recognition and attract affiliates.
- Despite the fabricated victim counts, 0APT's ransomware binaries are cryptographically strong and fully operational, posing a genuine threat if they secure legitimate initial access.
- This highlights the competitive and often deceptive nature of the ransomware-as-a-service landscape, where groups use inflated claims to establish a presence.
๐คซ CyberScoop | https://cyberscoop.com/0apt-ransomware-group-hoax-technical-capabilities/
Chrome Extensions Exfiltrating Browsing History to Data Brokers ๐
- A security researcher identified 287 Chrome extensions, with an estimated 37.4 million installations, that are allegedly exfiltrating users' browsing history data to data brokers like Similarweb.
- Many of these extensions appear harmless but request access to sensitive browsing data without clear justification, often obscuring these practices in their privacy policies.
- This underscores the "you are the product" model for free software and the urgent need for users to be aware of the risks and for more robust safeguards against malicious extensions.
๐ต๐ผ The Register | https://go.theregister.com/feed/www.theregister.com/2026/02/11/security_researcher_287_chrome_extensions_data_leak/
Supply Chain Attacks Fuel a "Self-Reinforcing" Cybercrime Economy โ๏ธ
- Group-IB reports that supply chain attacks are becoming industrialised, creating a "self-reinforcing" ecosystem where breaches, credential theft, and ransomware are interconnected.
- Attackers exploit inherited access to customers, with AI-assisted tools accelerating vulnerability scanning across vendors, CI/CD pipelines, and browser extension marketplaces.
- There's a growing shift towards identity attacks, where criminals impersonate genuine users to evade detection, making HR, CRM, ERP, and MSP platforms high-priority targets due to their broad access.
๐ต๐ผ The Register | https://go.theregister.com/feed/www.theregister.com/2026/02/12/supply_chain_attacks/
Disney Fined $2.75 Million for Data Privacy Violations; FTC Pushes Age Verification โ๏ธ
- Disney has been fined $2.75 million by the California Attorney General for making it excessively difficult for consumers to opt out of data sharing and sales under the California Consumer Privacy Act (CCPA). This is the largest fine ever levied under the CCPA.
- Separately, FTC officials are now actively endorsing age verification technology, planning a policy statement and potential COPPA rule amendment to clarify its use without violating child privacy regulations.
- This FTC stance is seen as a "major landmark" that will accelerate the global implementation of age verification, addressing industry concerns and encouraging broader adoption to protect minors online.
๐๏ธ The Record | https://therecord.media/california-fines-disney-data-privacy
๐๏ธ The Record | https://therecord.media/ftc-push-for-age-verification-a-major-landmark-for-implementation
US Seeks Coordinated Cyber Partnerships; Russia Blocks WhatsApp ๐
- The US National Cyber Director, Sean Cairncross, emphasised the need for deeper cyber cooperation with allies and the private sector to send a "coordinated, strategic message" to adversaries and change their "risk calculus."
- Meanwhile, Russia attempted a full block of WhatsApp to compel users to switch to its state-backed Max messaging platform, citing Meta's non-compliance with Russian law. This involved removing WhatsApp's domain records from Russia's National Domain Name System, making it inaccessible without a VPN.
- These events highlight contrasting approaches to national cybersecurity and digital sovereignty, with the US advocating for a "clean tech stack" rooted in allied systems, while Russia tightens control over foreign platforms.
๐๏ธ The Record | https://therecord.media/us-wants-cyber-partnerships-to-send-message-to-adversaries
๐๏ธ The Record | https://therecord.media/whatsapp-russia-blocked-state
CISA Warns of Significant Impact from DHS Funding Lapse ๐
- Acting CISA Director Madhu Gottumukkala testified that another Department of Homeland Security (DHS) funding lapse would severely hamper CISA's ability to respond to threats, offer services, and develop new capabilities.
- While 888 of CISA's 2,341 employees would be "excepted" (working without pay), strategic planning, development of new technical capabilities, and completion of key regulations like those stemming from CIRCIA would halt.
- This underscores the critical risk to national cybersecurity when government shutdowns occur, as adversaries do not pause their operations.
๐คซ CyberScoop | https://cyberscoop.com/cisa-shutdown-impact-dhs-funding-testimony/
#CyberSecurity #ThreatIntelligence #ZeroDay #Vulnerability #Ransomware #APT #NationState #AI #DataBreach #DataPrivacy #IncidentResponse #InfoSec #CyberAttack #Malware #SupplyChainSecurity
DysruptionHub
sayzard
RootShell
FIRST.org
Jim Guckin
The DFIR Report
