Good morning. This is your security briefing for Monday, February 09, 2026, covering four critical developments in the threat landscape. All attribution is by the article authors. All article analysis is automated.
Microsoft reports that threat actors are actively exploiting internet-exposed SolarWinds Web Help Desk instances to achieve unauthenticated remote code execution. The exploitation enables initial access to victim networks, lateral movement, and potential complete domain compromise, placing organizations running unpatched WHD instances at severe risk.
Defused Cyber has identified a sophisticated attack campaign where attackers are exploiting two CVEs in Ivanti Endpoint Manager Mobile to plant dormant in-memory backdoors. Active since February 4th, the campaign uses a Java class loader technique that remains inactive until triggered by a specific parameter, suggesting Initial Access Broker tactics for establishing persistent footholds.
Mandiant reports that North Korean threat actor UNC1069 has targeted the cryptocurrency and DeFi sectors using AI-generated video lures and compromised Telegram accounts for sophisticated social engineering. The group deployed seven unique malware families designed to harvest credentials, browser data, and session tokens, targeting cryptocurrency startups, software developers, venture capital firms, and centralized exchanges.
The Cyber Security Agency of Singapore and Infocomm Media Development Authority report that Advanced Persistent Threat actor UNC3886 targeted Singapore's four major telecommunications operators using zero-day exploits and rootkits. Operation CYBER GUARDIAN, an 11-month multi-agency response involving over 100 cyber defenders, successfully detected and disrupted the attacks, with unauthorized access confirmed but no evidence of sensitive customer data exfiltration found.
That concludes today's briefing.