Tracking Threats, Incidents, and Vulnerabilities
Tracking Threats, Incidents, and Vulnerabilities
Ransomware declines as “sleeperware” ascends: Picus Labs' report shows a shift from ransomware to stealthy malware that remains dormant until opportune moments, focusing on data theft rather than system disruption. This change reflects a significant drop in ransomware incidents, prompting new cybersecurity strategies.
https://www.zdnet.com/article/sleeperware-malware-sneaks-waits-ransomware-decline/
Microsoft warns of “AI Recommendation Poisoning,” a technique where malicious data manipulates AI responses, risking trust in AI services. Companies have been embedding hidden prompts in AI links, influencing outputs subtly. This can result in AI providing biased advice on crucial topics like health and finance, often unnoticed by users. Microsoft advises caution with AI-related links, reviewing AI memory, and scanning for manipulation attempts in corporate settings.
https://www.theregister.com/2026/02/12/microsoft_ai_recommendation_poisoning/
Palo Alto Networks refrained from linking China to a recent hacking campaign due to fears of potential retaliation from Beijing. Initially, their report identified a hacking group as connected to China, but this was softened to “state-aligned group operating out of Asia” after concerns emerged, particularly following a Chinese ban on certain cybersecurity software. The company aims to protect its personnel and clients. Experts suggest attribution is complex, highlighting the risks cybersecurity firms face in naming state-sponsored cyber threats.
Google Alerts State-Backed Hackers Using Gemini AI for Attacks
North Korean group UNC2970 exploited Google’s Gemini AI for reconnaissance and cyber espionage, targeting cybersecurity firms. The AI synthesized OSINT for profiling high-value targets, enabling tailored phishing strategies. Other hacker groups, including Chinese and Iranian actors, also misuse Gemini for intelligence gathering and deploying malware. Google emphasizes ongoing efforts to enhance safety systems against AI misuse.
https://thehackernews.com/2026/02/google-reports-state-backed-hackers.html
TLDR: LummaStealer, a prominent info-stealer malware, resurfaces alongside CastleLoader after law enforcement disruptions. It primarily spreads via social engineering tactics, tricking users into executing malware through fake software or media downloads. CastleLoader enhances LummaStealer's distribution, employing in-memory execution and heavy obfuscation. The partnership suggests shared infrastructure between both malware, posing severe privacy risks by harvesting sensitive data like credentials and financial information.
https://www.bitdefender.com/en-us/blog/labs/lummastealer-second-life-castleloader
Kimwolf botnet disrupts I2P, an anonymity network, by overwhelming it with infected devices. Emerged in late 2025, it turns IoT devices into relays for DDoS attacks. Users reported connectivity issues as Kimwolf attempted to escape detection by taking over I2P nodes. This “Sybil attack” compromised the network's integrity, reducing its capacity. Experts believe Kimwolf's operators are experimenting with I2P for stability amid takedown attempts, though botnet numbers are declining due to internal issues and errors.
https://krebsonsecurity.com/2026/02/kimwolf-botnet-swamps-anonymity-network-i2p/
Ransomware attack on BridgePay disrupts U.S. payment systems, forcing businesses, like restaurants, to go cash-only. The company is working with law enforcement but has found no evidence of compromised payment card data. This incident highlights vulnerabilities in centralized payment systems, emphasizing the need for improved cyber resiliency among service providers.
https://www.paymentsjournal.com/the-latest-wave-of-ransomware-attacks-as-widespread-as-possible/
Phishing campaign using legitimate SaaS platforms saw 133,260 emails target over 20,000 organizations. Attackers exploited platform features to send authentic-looking scam emails, bypassing traditional detection methods. Techniques included manipulating user fields to create legitimate notifications from companies like Microsoft and Amazon, urging victims to call attacker-controlled phone numbers instead of clicking links. This trend reflects a strategic shift towards trust-based attacks, highlighting vulnerabilities in widely-used enterprise services and the need for improved detection strategies.
The rise of AI agents, particularly through platforms like OpenClaw and Moltbook, raises concerns about self-replicating ‘prompt worms' that could exploit these agents, spreading harmful instructions and data risks. Potential interventions from API providers could mitigate threats but may alienate users. The urgency for solutions grows as local AI capabilities improve, leading to a future where unregulated AI interactions might create security crises.
DDoS attacks, originating in 1996, remain a persistent problem due to known weaknesses in internet architecture and organizational structures. The growth of the internet has amplified the impact of these attacks, exploiting vulnerabilities in IoT devices and combining network overloads with targeted disruptions to business processes.
https://www.igorslab.de/en/30-years-of-ddos-why-a-structural-problem-persists/
Notepad++ was hijacked by state-sponsored hackers, likely Chinese, compromising update traffic from June to December 2025. The former hosting provider confirmed the server was breached, allowing attackers to redirect Notepad++ updates. All security vulnerabilities were addressed by December 2, 2025, and the site was migrated to a more secure host. Users are advised to download v8.9.1, which includes security enhancements, and manual updates. No specific indicators of compromise were found during the investigation.
https://notepad-plus-plus.org/news/hijacked-incident-info-update/
Notepad++ update servers were compromised by a likely Chinese state-sponsored group from June to December 2025. Attackers intercepted update traffic, redirecting users to malicious binaries due to inadequate validation of update packages. Following the breach, Notepad++ enhanced security measures, including stricter validation processes and plans to implement XMLDSig in future updates to prevent such incidents.
TA584 Cyber Threat Overview: TA584 is a prominent threat actor monitored by Proofpoint, known for rapid innovation in attack strategies. In 2025, it evolved its tactics, employing ClickFix social engineering, targeting various regions, and introducing new malware (Tsundere Bot). This actor showed a significant increase in campaign frequency, tripling monthly attacks by year's end, with a focus on quick campaign turnover and a variety of delivery methods. Its recent approach contrasts earlier patterns, highlighting its adaptability to cybersecurity defenses.
https://www.proofpoint.com/us/blog/threat-insight/cant-stop-wont-stop-ta584-innovates-initial-access
Aisuru botnet set a record with a 31.4 Tbps DDoS attack, targeting telecoms and IT firms. Cloudflare mitigated this “Night Before Christmas” attack, which peaked at 200 million requests per second. The botnet, leveraging compromised devices, continues to increase DDoS incidents, with a 121% rise in attacks over 2025.
AI assistant Clawdbot was renamed Moltbot due to trademark issues, leading to impersonation campaigns. Attackers exploited the transition by creating typosquat domains and a cloned, clean code GitHub repository to mislead users, aiming for potential supply-chain attacks. Despite no immediate malware, the impersonation strategy relies on trust, risking users' API keys and data over time. Users are advised to verify sources and maintain scrutiny during transitions, while maintainers should preemptively secure domains and manage renames carefully.
