Good morning. This is your security briefing for Wednesday, February 11, 2026, covering 14 articles analyzed overnight. All attribution is by the article authors. All article analysis is automated.
The FBI has launched Operation Winter SHIELD, a cyber resilience campaign designed to transform organizations from passive targets into active cybersecurity partners. The initiative provides ten critical actions based on recent FBI investigations and observed adversary tactics, targeting organizations across various industry sectors.
According to reports from Malwarebytes and researcher Luke Acha, a malicious campaign is distributing fake 7-Zip installers through the typosquatting domain 7zip.com. The malware, known as upStage Proxy, transforms infected home PCs into residential proxy nodes, allowing attackers to route malicious traffic through victims' IP addresses for fraud, web scraping, or money laundering, while employing VM detection and anti-debugging evasion techniques.
ReliaQuest reports that the Storm-2603 threat actor group is exploiting CVE-2026-23760 in SmarterMail email servers to deploy Warlock ransomware. Attackers bypass authentication to gain administrative access, exploit the Volume Mount feature for code execution, and maintain persistence using legitimate tools like Velociraptor while downloading payloads from cloud platforms.
Microsoft has disclosed CVE-2026-21511, an Outlook spoofing vulnerability with a CVSS score of 7.5 that exploits deserialization of untrusted data. Attackers can trigger NTLM authentication attempts via specially crafted emails through the Preview Pane, potentially leading to credential disclosure across multiple Microsoft products including Office 2019 through 2024, Microsoft 365 Apps, and SharePoint Server versions.
Flare's research team has discovered SSHStalker, a new Linux botnet that combines traditional IRC command-and-control techniques with modern automated compromise methods. The botnet targets older and forgotten Linux infrastructure running outdated software, particularly systems with Linux 2.6.x-era kernels vulnerable to 2009-2010 exploits, for cryptocurrency mining and AWS credential harvesting.
According to Simo Kohonen at Defused Cyber, a threat actor leveraged Starlink satellite internet to deploy webshells into Ivanti EPMM systems by running 119 exploits through 119 different residential IP addresses. The attack demonstrates sophisticated infrastructure abuse using satellite internet and residential proxies to evade detection and achieve unauthorized system access.
Researcher Sh3llf1r3 has released details on ColdWer, a Cobalt Strike Beacon Object File that exploits WerFaultSecure.exe to freeze EDR and antivirus processes and dump LSASS memory by bypassing Protected Process Light protections. The tool requires Administrator or SYSTEM privileges and is ineffective against EDRs with kernel-mode self-protection, though on Windows 8.1 it enables raw unencrypted LSASS dumps for credential theft.
Cobalt Strike researchers have released Eden, a Proof of Concept User-Defined Reflective Loader built with the Crystal Palace framework. It combines Raphael Mudge's page streaming technique with a modular call gate called Draugr to demonstrate rapid development of custom loaders, though it intentionally lacks OPSEC features and uses RWX memory that makes it vulnerable to YARA detection.
Peter Gabaldon has disclosed a persistence method on FortiGate devices that allowed threat actors to gain remote, unauthenticated read-only access to the root filesystem by manipulating a symbolic link in the VPN-SSL service. The exploit redirected the migadmin lang custom symlink to the root directory, enabling access to sensitive files including configurations and SSH keys across FortiOS versions 7.4, 7.2, 7.0, and 6.4 until patches were released.
Will Thomas reports that Chinese state-sponsored APT group UNC3886 infiltrated all four major telecommunications operators in Singapore between July 2025 and February 2026. The attackers used a zero-day exploit to bypass perimeter firewalls, deployed rootkits for stealth, and leveraged Operational Relay Box networks constructed from compromised IoT devices and routers to evade detection while exfiltrating technical and network-related data.
According to Eugenio Benincasa at Natto Thoughts, China's Tianfu Cup hacking competition resumed in January 2026 under Ministry of Public Security control, introducing AI-assisted vulnerability discovery and exploitation as a central focus. The shift from commercial to state oversight, combined with decreased transparency in vulnerability disclosure, suggests China may be retaining discovered exploits for state use rather than public disclosure.
Fabian Bader at Cloudbrothers has demonstrated how to automate Microsoft Defender XDR data extraction by running XDRInternals as a GitHub Action workflow. The implementation uses passkey-based authentication within Entra ID to enable continuous monitoring and data collection without manual intervention for security professionals managing Microsoft Defender XDR environments.
Security researcher iss4cf0ng has released dotNetPELoader, a C# tool that loads x86 and x64 PE files directly into memory with relocation and import resolving capabilities. The tool addresses a gap in C#-based PE loaders supporting both architectures and can be used for fileless execution, presenting risks for malware deployment and evasion of file-based detection systems.
That concludes today's briefing.