Loading story…
Hackmageddon published a 1–15 February 2026 cyber-attacks timeline, summarizing publicly reported incidents and categorizing the period’s activity (e.g., cybercrime vs. espionage and malware prevalence). The post is a high-level digest intended to track notable attacks over a defined time window rather than provide deep technical details on a single incident.
SANS NewsBites (Vol. XXVIII, Issue 12) similarly aggregates multiple security items from mid-February 2026, including discussion of a Google Chrome 0-day patch, reporting on infostealer activity targeting OpenClaw configurations, and broader research topics such as 64-bit malware trends, cloud password manager security comparisons, and TURN server security threats. Both items function as multi-topic roundups rather than coverage of one specific breach or vulnerability, so they do not converge on a single discrete event.
See which actors are running it and whether you're in range.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two weekly “roundup” articles summarized a broad set of security developments rather than a single incident. Reported items included **data breaches** (e.g., PayPal, SpyX, California Cryobank), **active exploitation of multiple vulnerabilities** (including a **Google Chrome 0-day** and critical issues in products such as *BeyondTrust*, *Ivanti EPMM*, *Splunk Enterprise*, and *Windows Admin Center*), and **ransomware activity** (e.g., **Hellcat** reportedly breaching Ascom’s ticketing infrastructure and exfiltrating ~44GB of data). The digest also highlighted availability risk via a reported **Cloudflare** global outage attributed to a cascading password-rotation failure. The week-in-review content also mixed security news with interviews and tool/project updates, including discussion of the evolving CISO role amid **agentic AI**, the release of *REMnux v8* (malware analysis distro) with AI integration, and commentary on “harvest now, decrypt later” **quantum** risk. It additionally referenced separate security headlines such as a **firmware-level Android backdoor** on tablets and a **Dell zero-day** reportedly exploited since 2024, but did not provide a unified, single-event narrative across the items.
Jun 29, 2026
February 2026 security reporting highlighted both macro-level incident trends and a set of high-risk, actively exploited vulnerabilities requiring rapid remediation. Hackmageddon’s February 2026 cyberattacks statistics roundup reported a threat landscape dominated by **malware (33%)**, followed by **ransomware (20%)** and **account takeovers (8%)**, based on a curated set of publicly reported events. Recorded Future’s Insikt Group reported a **43% month-over-month decrease** in “high-impact” vulnerabilities (13 in February vs. 23 in January), but emphasized that all 13 carried a **Very Critical** risk score and were **actively exploited**. The report noted **Microsoft** accounted for **6 of 13** vulnerabilities (and that these were added to **CISA KEV** the same day), described a suspected China-nexus **Lotus Blossom** supply-chain compromise of *Notepad++* updates via `CVE-2025-15556` to deliver **Cobalt Strike** and the **Chrysalis** backdoor, and stated **APT28** exploited an **MSHTML** flaw (`CVE-2026-21513`) using malicious Windows Shortcut files; it also flagged that multiple issues had public proof-of-concept exploits and referenced a critical **BeyondTrust Remote Support** OS command injection affecting versions **25.3.1 and earlier**.
Jun 29, 2026
Multiple weekly cybersecurity roundups and newsletters highlighted a mix of policy, threat, and vulnerability developments rather than a single discrete incident. UK government messaging featured prominently, including a campaign urging businesses to “lock the door” against cyber criminals and publication of longitudinal survey results indicating most organizations continue to experience cyber incidents (with reported rates in the 70–80% range across businesses and charities). Separately, commentary from European security circles emphasized growing calls for **offensive cyber capabilities** (“strike back”) amid concerns about Russian aggression and sabotage activity across Europe, including references to cyber operations targeting critical infrastructure. Threat reporting in the same period emphasized escalating **nation-state and proxy activity** against critical infrastructure and the defense industrial base, citing research that espionage groups (including those linked to China, Russia, and North Korea) have compromised organizations by exploiting **zero-day vulnerabilities in edge devices** (e.g., VPNs and gateways). Additional reporting pointed to newly identified OT-focused threat groups (e.g., **Sylvanite**, **Azurite**, **Pyroxene**) and a broad set of emerging technical risks and product/security changes, including discussion of an **OpenSSL RCE** risk, **Foxit 0-days**, and analysis of **LockBit 5.0** ransomware techniques (e.g., ETW tampering, process hollowing, log clearing) alongside Android platform security changes (e.g., deprecating cleartext traffic defaults and adding HPKE support).
Jun 29, 2026