Loading story…
February 2026 security reporting highlighted both macro-level incident trends and a set of high-risk, actively exploited vulnerabilities requiring rapid remediation. Hackmageddon’s February 2026 cyberattacks statistics roundup reported a threat landscape dominated by malware (33%), followed by ransomware (20%) and account takeovers (8%), based on a curated set of publicly reported events.
Recorded Future’s Insikt Group reported a 43% month-over-month decrease in “high-impact” vulnerabilities (13 in February vs. 23 in January), but emphasized that all 13 carried a Very Critical risk score and were actively exploited. The report noted Microsoft accounted for 6 of 13 vulnerabilities (and that these were added to CISA KEV the same day), described a suspected China-nexus Lotus Blossom supply-chain compromise of Notepad++ updates via CVE-2025-15556 to deliver Cobalt Strike and the Chrysalis backdoor, and stated APT28 exploited an MSHTML flaw (CVE-2026-21513) using malicious Windows Shortcut files; it also flagged that multiple issues had public proof-of-concept exploits and referenced a critical BeyondTrust Remote Support OS command injection affecting versions 25.3.1 and earlier.
See which actors are running it and whether you're in range.
8 events from the most recent confirmed update back to the earliest known activity.
On March 12, 2026, Recorded Future's Insikt Group published a report on the February 2026 CVE landscape. The report emphasized that although the number of actively exploited high-impact flaws fell from January, the month's vulnerabilities remained highly dangerous.
On March 12, 2026, Hackmageddon published its February 2026 cyber attack statistics page, summarizing the month's attack trends and linking to the first- and second-half February timelines. The fragment also contextualized the data with prior monthly statistics posts.
Recorded Future reported that UNC6201 exploited CVE-2026-22769 affecting Dell RecoverPoint for VMs in February 2026. The case was included among the month's actively exploited, high-impact vulnerabilities requiring immediate remediation.
Recorded Future identified APT28 as exploiting CVE-2026-21513 through malicious .lnk files during February 2026. The activity was cited as one of the month's notable examples of named threat actor exploitation.
Recorded Future highlighted Lotus Blossom's supply-chain compromise of Notepad++ through CVE-2025-15556. Attackers abused the WinGUp update mechanism to deliver Cobalt Strike Beacon and the Chrysalis backdoor, prompting urgent upgrade and threat-hunting guidance.
Recorded Future reported that 13 actively exploited high-impact vulnerabilities were identified in February 2026, down 43% from 23 in January. Despite the lower count, all 13 were rated 'Very Critical' and included five flaws enabling remote code execution.
A referenced Hackmageddon timeline for 1-15 February 2026 stated that 96 cyber attack events were collected during the first half of the month. Malware was identified as the dominant threat category in that period.
Hackmageddon's January 2026 statistics post reported that 178 cyber attack events were collected and analyzed for the month. The post said cyber crime was the leading motivation among those incidents.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple weekly threat roundups and research posts reported a mix of active exploitation, new malware tradecraft, and breach claims. Ukraine’s CERT reported **APT28** rapidly weaponized a Microsoft Office zero-day (**CVE-2026-21509**) within roughly a day of Microsoft’s disclosure, using spearphishing emails with malicious DOC lures to deliver **Covenant** backdoors against Ukrainian government targets and EU-related entities. Separately, researchers described **ShadowHS**, a stealthy **fileless Linux** post-exploitation framework that runs in-memory (e.g., via `memfd`-style execution), uses encrypted multi-stage loading (AES-256-CBC), fingerprints defensive tooling (including major EDR agents), and retains operator-driven capabilities such as credential theft, lateral movement, and covert tunneling for exfiltration. Other reporting highlighted incident and exposure claims and defensive takeaways. Check Point described a **supply-chain compromise** affecting *eScan* (MicroWorld Technologies) in which malicious updates were pushed through the legitimate updater, prompting an emergency shutdown of global update services; it also noted **Crunchbase** confirmed a breach affecting **2M+ records** claimed by **ShinyHunters**, and cited extortion/leak claims involving **Qilin** (Tulsa International Airport) and **WorldLeaks** (Nike). Google’s legal/technical disruption of the **IPIDEA** residential proxy network was also cited as reducing available proxy nodes by millions and cutting off C2 domains used to route attacker traffic. Additional coverage described a phishing chain using a fake DHL invoice to abuse a signed Java utility via **DLL sideloading** (malicious `jli.dll`) and **process hollowing** into `AddInProcess32.exe` to run **Phantom Stealer**; detection-engineering updates emphasized new rules for Windows defense-evasion (e.g., tampering with Credential Guard/HVCI, disabling AMSI and the vulnerable driver blocklist) and expanded Kubernetes and Linux post-exploitation detections.
Jun 29, 2026
A weekly threat-intelligence roundup highlighted **Microsoft’s January Patch Tuesday** release addressing **112 vulnerabilities** across Windows and *Microsoft Edge*, spanning multiple classes including elevation of privilege, remote code execution, and information disclosure. The same briefing reported active interest in **CVE-2025-64155**, a **critical FortiSIEM** vulnerability, with observed exploitation activity against honeypot environments following an out-of-band alert from Kroll Threat Intelligence—an indicator of likely broader scanning and attempted exploitation. The update also covered multiple threat developments: Check Point research described **VOIDLINK**, a Linux-focused malware framework (implants/rootkits/loaders) designed for long-term access, including in cloud environments; **North Korean-linked KTA082 (Kimsuky/APT43)** was reported using **QR-code phishing (“quishing”)** to target government, education, and think tanks; and **Iran-linked KTA060 (MuddyWater)** was associated with development of the **RUSTYWATER RAT**. Separately, detection-engineering updates noted new and refined rules for **OAuth/Entra ID consent phishing** patterns (including *ConsentFix*-style authorization flows), correlations between Entra ID risk events and privileged actions (e.g., PIM elevation/device-code auth), Windows persistence/defense-evasion behaviors (e.g., scheduled tasks by unsigned executables, Chrome security feature tampering), and updated YARA/behavioral detections for malware families (e.g., **Agent Tesla**, **MintsLoader**) and **Cobalt Strike** TTPs; the briefing also referenced a leak of a database purportedly containing ~**324,000 BreachForums** user records posted to `shinyhunte[.]rs`.
Jun 29, 2026
The items provided are **editorial roundups/newsletters** aggregating multiple, unrelated security stories rather than reporting a single discrete incident. Across the roundups, recurring high-priority themes include **actively exploited vulnerabilities** (e.g., Microsoft Office zero-day `CVE-2026-21509`, Fortinet SSO authentication bypass `CVE-2026-24858`, and a critical SmarterMail code-execution flaw), plus broader reporting on exploitation activity (e.g., nation-state and criminal use of a WinRAR flaw) and supply-chain/package-manager risk (e.g., “PackageGate” bypass issues affecting NPM/PNPM/VLT/Bun). These are not marketing/event promotions, but they are **not a cohesive single event**; they function as curated link collections. The roundups also surface operational threat activity, including reporting that **Poland faced disruptive/wiper-style attacks against energy-related systems** in late December 2025 (targeting combined heat and power plants and renewable-energy management systems), and multiple malware/campaign writeups (e.g., KONNI using AI to generate PowerShell backdoors, Android trojan delivery via Hugging Face hosting, and other multi-stage Windows malware and extension-based abuse). For CISOs, the actionable takeaway is to treat the referenced **KEV-listed and in-the-wild exploited** issues as patch/mitigation priorities while monitoring energy-sector TTPs and malware delivery trends highlighted in the linked research.
Jun 29, 2026