Good morning. This is your security briefing for Wednesday, February 25, 2026, covering 11 articles analyzed overnight. All attribution is by the article authors. All article analysis is automated.
We have a critical security alert. CVE-2026-20127, a authentication bypass in Cisco Catalyst SD, has been added to the CISA Known Exploited Vulnerabilities catalog.
InfoGuard AG reports that security researchers have demonstrated how attackers with local administrator privileges can abuse Palo Alto Networks Cortex XDR's Live Terminal feature as a Command and Control channel. The technique exploits legitimate EDR functionality through cross-tenant access or custom WebSocket server implementation, allowing attackers to execute commands while appearing as legitimate EDR activity and bypassing traditional detection methods.
According to Jeanette Miller-Osborn, the Scattered Lapsus$ Hunters alliance is actively recruiting women on Telegram to conduct vishing attacks, offering $500 to $1,000 per call with pre-written scripts to impersonate help desk staff. The group, known for breaching major organizations like Google, Cisco, and Salesforce, is employing sophisticated social engineering tactics including MFA bypass techniques such as SIM swapping and MFA fatigue bombing.
Have I Been Squatted reports that Diesel Vortex, a Russian-led cybercrime group, conducted sophisticated phishing campaigns targeting freight and logistics platforms in the US and EU between September 2025 and February 2026. The group employed dual-domain phishing schemes with iframe-based credential harvesting, typosquatting domains, and Telegram-controlled real-time operations to steal credentials from platforms including DAT Truckstop, Penske Logistics, and Timocom.
CYJAX researchers Ethan Spiteri, Adam Price, and Joe Wrieden report on the OCRFix campaign, a multi-stage malware operation using typosquatting to impersonate Tesseract OCR software. The campaign employs ClickFix for obfuscation and EtherHiding to conceal C2 addresses on the BNB Smart Chain TestNet, with the malware establishing persistence, disabling Windows Defender, and capable of data exfiltration.
The Internet Security Research Group reports that Internet scanning tools interacting with misconfigured Caddy or autocert On-Demand TLS features created a feedback loop generating excessive certificate requests for unusually long domain names. Let's Encrypt implemented heuristics to block these patterns, and defenders should restrict On-Demand TLS configurations or use wildcard certificates to prevent resource abuse.
Google Threat Intelligence Group and Mandiant disrupted GRIDTIDE, a global cyber espionage campaign attributed to UNC2814, a PRC-nexus threat group active since 2017. The attackers deployed a novel backdoor that abuses Google Sheets API for command-and-control, targeting telecommunications and government organizations across 42 countries to exfiltrate PII and conduct surveillance.
Genians reports on MuddyWater APT group, linked to Iran's Ministry of Intelligence and Security, conducting sustained cyberattacks targeting Middle Eastern government agencies, defense organizations, and critical infrastructure. The group uses spear-phishing with malicious HTML files, exploits legitimate RMM tools like Syncro and Atera, and leverages cloud storage services for long-term infiltration and intelligence gathering.
Splintersfury introduces AutoPiff, an automated framework for detecting silent security fixes in Windows kernel driver patches using semantic analysis, YAML rules, and Ghidra decompilation. The tool addresses the challenge of vendors releasing security patches without CVEs, enabling vulnerability researchers and defenders to identify unannounced fixes through patch differencing and reachability analysis.
The National Cyber Security Centre warns that malicious threat actors are actively exploiting Cisco Catalyst SD-WAN devices globally by adding rogue peers to gain root access and establish persistent control over critical network infrastructure. Organizations with internet-exposed management interfaces face the highest risk, and the NCSC urges immediate investigation, system updates, and implementation of hardening measures.
TechCrunch reports that fintech company Marquis filed a lawsuit against SonicWall alleging that a vulnerability in SonicWall's firewall backup API allowed attackers to access backup files containing firewall configurations and emergency passcodes by exploiting predictable serial numbers. The compromised authentication data enabled a ransomware attack resulting in the theft of sensitive PII affecting at least 400,000 individuals, and SonicWall later confirmed all customer firewall backup files were stolen.
The Royal United Services Institute article by Dr. Gareth Mott proposes a policy shift where UK private sector cybersecurity firms would be deputised to conduct law enforcement counter-cybercrime operations on behalf of the state. The proposal addresses resource limitations in UK law enforcement by granting private entities specific legal powers to investigate and disrupt cybercriminal activities, requiring new legal frameworks and oversight mechanisms.
That concludes today's briefing.