Good morning. This is your security briefing for Monday, February 23, 2026, covering 9 articles analyzed overnight. All attribution is by the article authors, and all article analysis is automated.
IIJ reports that Chinese APT group UNC6354, linked to Mustang Panda, deployed a new PlugX malware variant in January 2026 targeting government agencies in Southeast Asia. The malware uses a STATICPLUGIN downloader disguised as a browser update, employing sophisticated techniques including DLL sideloading and multi-layered encryption with XOR and RC4 to execute payloads in memory.
Anthropic has identified industrial-scale distillation attacks against its Claude AI models by three laboratories: DeepSeek, Moonshot, and MiniMax. The attackers used over 16 million exchanges from approximately 24,000 fraudulent accounts to illicitly extract capabilities including agentic reasoning and coding functionalities, posing national security risks as distilled models may lack safeguards and could be weaponized for offensive cyber operations.
The DFIR Report documents a case where threat actors exploited CVE-2023-46604 in an internet-facing Apache ActiveMQ server to gain remote code execution, then returned 18 days later through the same unpatched vulnerability to deploy LockBit ransomware. The attackers used Metasploit and Meterpreter for privilege escalation and lateral movement, with modifications to the ransom note suggesting use of a leaked LockBit builder by an independent actor.
Midnight Blue analyzes the escalating threat of destructive bricking attacks targeting operational technology devices in critical infrastructure, documenting incidents including BlackEnergy, AcidRain, Predatory Sparrow, and Fuxnet. Attack methods exploit vulnerabilities and default credentials to deploy malicious firmware or physically damage devices, with the threat landscape expanding as wiper payloads become more accessible to less sophisticated actors.
CYLOQ disclosed CVE-2026-0714, a vulnerability affecting the Moxa UC-1222A Secure Edition embedded device that allows attackers with physical access to sniff LUKS decryption keys from the SPI bus during boot. The vulnerability exploits unencrypted TPM2_NV_Read commands transmitted between the host SoC and the discrete TPM 2.0 chip, enabling complete storage decryption.
Security researcher Sammy Azdoufal discovered a critical vulnerability in DJI Romo robot vacuums that allowed unauthorized remote access to approximately 7,000 devices worldwide, as reported by The Verge. The flaw stemmed from inadequate server-side permission validation, enabling access to live camera feeds, microphones, room mapping data, and device locations without authentication.
Yannick Dixken reports discovering a vulnerability in a sports insurer's portal that allowed unauthorized access to user accounts through predictable numeric IDs and a static default password, exposing personal data of students including minors. The organization responded with legal threats rather than addressing the disclosure through proper coordinated vulnerability disclosure procedures.
PayPal disclosed a cybersecurity incident where a code error in the PayPal Working Capital loan application exposed personally identifiable information of a limited number of customers between July 1 and December 13, 2025. Exposed data included names, email addresses, Social Security numbers, and dates of birth, with PayPal now offering two years of complimentary credit monitoring through Equifax.
Microsoft released HvLoader.efi, an EFI application developed for loading external hypervisor loaders using the TianoCore EDK2 framework. The tool requires proper code signing to function with Secure Boot enabled, ensuring only trusted code executes during the boot process.
That concludes today's briefing.