VulnHub

The FBI has issued a warning about the Handala Hack Group, which has ties to Iran and is targeting Windows users by distributing fake versions of popular messaging apps, WhatsApp and Telegram. These counterfeit applications are designed to spy on users and potentially steal sensitive information. The attackers are using social engineering tactics to trick individuals into downloading the malicious software, which can lead to significant privacy breaches. This situation is particularly concerning as it underscores the risks associated with downloading apps from unofficial sources. Users are advised to only download applications from trusted sources and to remain vigilant about the permissions they grant to software.

Last week, security researchers discovered that ScreenConnect servers were vulnerable to attacks due to misconfigurations, potentially allowing unauthorized access to sensitive data. Additionally, a flaw in Microsoft SharePoint was exploited, putting numerous organizations at risk. This vulnerability could allow attackers to execute malicious code or gain access to restricted information. Both incidents emphasize the need for companies to regularly review their security settings and update their systems to protect against these types of vulnerabilities. With many businesses relying on these platforms, the implications of these security issues could be significant, affecting operational integrity and data confidentiality.

The Cybersecurity and Infrastructure Security Agency (CISA) is advising U.S. organizations to take immediate steps to secure their Microsoft Intune systems. This warning comes after a cyberattack targeted Stryker, a major medical technology company, exploiting vulnerabilities in the Intune endpoint management tool. The breach led to significant disruptions in Stryker's operations, raising concerns about the security of similar systems across various organizations. CISA recommends that users follow Microsoft's security guidance to bolster their defenses against potential attacks. This incident highlights the need for vigilance in managing endpoint systems, particularly in sectors that handle sensitive data.

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about active exploitation of a recently patched vulnerability in SharePoint, identified as CVE-2026-20963. This remote code execution flaw allows attackers to run malicious code on affected systems, posing a significant risk to organizations using the software. Microsoft released a patch for this vulnerability back in January, but the discovery of in-the-wild exploitation suggests that some users may not have applied the update. Organizations using SharePoint should prioritize implementing the latest security updates to protect against potential breaches. Failing to address this vulnerability could lead to unauthorized access and data compromise, making it crucial for companies to stay vigilant and proactive in their cybersecurity practices.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has alerted government agencies about two significant security vulnerabilities affecting the Synacor Zimbra Collaboration Suite (ZCS) and Microsoft Office SharePoint. Both flaws, identified as CVE-2025-66376 and another not specified in the article, have been found to be actively exploited by attackers. The CVE-2025-66376 vulnerability has a CVSS score of 7.2, indicating a moderate to high risk. Organizations using these platforms are urged to apply the necessary patches to protect against potential attacks. The exploitation of these vulnerabilities underscores the need for timely updates and vigilance in cybersecurity practices, especially for government entities.

A new espionage campaign has been detected, targeting Ukrainian entities and believed to be linked to Russian threat actors. This operation utilizes a backdoor known as DRILLAPP and exploits Microsoft Edge's debugging feature to remain stealthy. The campaign was first observed in February 2026 and shows similarities to a previous attack by a group known as Laundry Bear, which also focused on Ukrainian defense forces. This ongoing threat raises concerns about the security of sensitive information within Ukraine, especially as tensions in the region continue to escalate. Cybersecurity experts urge vigilance and prompt action to mitigate the risks posed by such sophisticated attacks.

A new banking malware known as VENON has been discovered, targeting 33 banks in Brazil. This malware is notable for being written in Rust, which differentiates it from other prevalent malware in the region that typically uses Delphi. It specifically aims to steal user credentials by infecting Windows systems. Researchers first identified VENON last month, raising concerns about its potential impact on Brazilian banking customers. This malware represents an evolving threat in the Latin American cybercrime landscape, and users should be vigilant about their online security.

Scammers are exploiting security features from Cloudflare to mask fraudulent Microsoft 365 login pages, making it harder for users to identify phishing attempts. This tactic allows attackers to evade detection by antivirus software and security systems, putting sensitive information at risk. Users of Microsoft 365 should be particularly cautious, as these phishing pages can look very convincing and lead to credential theft. The situation emphasizes the need for individuals and organizations to remain vigilant about email security and to double-check URLs before entering personal information. Cybersecurity experts are urging users to enable multi-factor authentication to add an extra layer of protection against such scams.

A Chinese-speaking cyber actor has reportedly been targeting critical sectors in Asia for several years using a mix of custom malware, open-source tools, and living-off-the-land (LOTL) binaries. This activity appears to be focused on espionage, affecting both Windows and Linux systems. The attackers' tactics, which combine tailored malware with readily available tools, suggest a sophisticated approach aimed at infiltrating sensitive networks. The long-term nature of this threat raises concerns for organizations in the region, as prolonged access could lead to significant data breaches and intelligence gathering. Companies in critical infrastructure sectors need to be vigilant and enhance their cybersecurity measures to defend against these persistent threats.

Despite the widespread implementation of multi-factor authentication (MFA) in organizations, many still fall victim to credential theft. Attackers are exploiting valid usernames and passwords to gain unauthorized access to networks, particularly in Windows environments. The problem isn't with MFA itself, but rather with how comprehensively it is enforced through identity providers like Microsoft Entra ID and Okta. If MFA isn't applied consistently across all access points, attackers can bypass these security measures. This situation emphasizes the need for companies to ensure that MFA is enforced everywhere, not just in select areas, to truly safeguard their systems from credential abuse.

Microsoft has recently patched six zero-day vulnerabilities, which are serious security flaws that attackers can exploit to gain unauthorized access. Users are typically urged to update their systems immediately to protect against such threats. However, some experts are advising caution, suggesting that these patches might cause issues or conflicts with existing software. This situation leaves many users in a challenging position as they weigh the risks of applying the updates against the potential vulnerabilities. It's important for individuals and organizations to assess their specific environments before proceeding with the updates to ensure they don't inadvertently create new problems.

In February 2026, Microsoft addressed over 50 security vulnerabilities during its Patch Tuesday update, including six zero-day flaws that were actively exploited by attackers. Notably, three of these zero-days involve security feature bypasses. One of the vulnerabilities, identified as CVE-2026-21513, impacts the MSHTML/Trident browser engine used in Internet Explorer on Windows, while CVE-2026-21514 affects Microsoft Word. Attackers can exploit these vulnerabilities by tricking users into opening malicious files or links. As these security holes are actively being exploited, users and organizations must apply the updates promptly to protect their systems from potential breaches.