A Glendale man, 36-year-old Davit Avalyan, was sentenced to 57 months in federal prison after pleading guilty to conspiracy to distribute narcotics for his role in a darknet drug trafficking operation that sold cocaine, methamphetamine, MDMA, and ketamine nationwide. The long-running network operated multiple darknet storefronts—including JoyInc, PlanetHollywood, and LaFarmacia—shipped packages via the U.S. Postal Service, and was dismantled by an FBI JCODE-led task force. #DavitAvalyan #JoyInc
Category: Cyber Security News
Palo Alto Networks has entered into a definitive agreement to acquire endpoint security company Koi, in a deal reported by Israeli outlets to be worth about $400 million. The acquisition aims to bring Koi’s agentic endpoint technology into Prisma AIRS and Cortex XDR to expand visibility and control over AI agents,…
CISA warned that a vulnerability in TeamT5’s ThreatSonar Anti-Ransomware (CVE-2024-7694) has been exploited in the wild and was added to the Known Exploited Vulnerabilities catalog. The high-severity arbitrary file-upload flaw was patched in August 2024, but CISA ordered federal agencies to remediate it by March 10 due to the product’s use…
A critical zero-day, CVE-2026-22769, is being actively exploited in Dell RecoverPoint for Virtual Machines to enable unauthenticated attackers to gain root-level persistence via hardcoded Apache Tomcat credentials. Mandiant and GTIG attribute the campaign to Chinese cluster UNC6201, which has deployed SLAYSTYLE web shells and transitioned from BRICKSTORM to the AOT-compiled backdoor…
Two sentences summarizing the content. Threat actors quickly weaponized two Ivanti EPMM zero-days (CVE-2026-1281 and CVE-2026-1340) to achieve unauthenticated remote code execution via a bash arithmetic expansion trick, enabling rapid deployment of web shells and persistent backdoors. Over 4,400 internet-facing EPMM instances were identified across multiple sectors and countries, prompting CISA…
OpenAI rolled out Lockdown Mode and Elevated Risk labels to counter prompt injection attacks by adding deterministic infrastructure controls that prevent data exfiltration regardless of prompt manipulation. The features restrict network interactions for high-risk users and flag network-related capabilities to help administrators and users manage exposure. #OpenAI #LockdownMode…
Critical and high-severity vulnerabilities in popular VSCode extensions could be exploited to steal local files and enable remote code execution across environments with more than 128 million combined downloads. Ox Security disclosed the issues after maintainers failed to respond and warned developers to remove unnecessary extensions, avoid opening untrusted HTML or running localhost servers, and monitor for unexpected configuration changes. #LiveServer #CodeRunner
A Spanish court granted precautionary measures ordering NordVPN and ProtonVPN to block 16 websites that facilitate piracy of football matches, applying restrictions to a dynamic list of IP addresses in Spain with no opportunity for appeal. LaLiga and Telefónica must preserve digital evidence, the court said VPN providers fall under the EU Digital Services Regulation, and both VPNs claim they were not notified and contest the process #NordVPN #ProtonVPN
Kaspersky discovered a sophisticated Android backdoor named Keenadu embedded in device firmware that can silently harvest data and remotely control infected tablets. The backdoor is injected via libandroid_runtime.so into the Zygote process, uses a client-server AKServer/AKClient architecture to load malicious modules, and has been observed in Alldocube firmware and other undisclosed…
AI-enabled web-browsing assistants can be abused as stealthy command-and-control relays that blend attacker communications into legitimate enterprise traffic. Check Point demonstrated this “AI as a C2 proxy” technique against Microsoft Copilot and xAI Grok, warning it can enable AI-assisted malware operations and dynamic, evasive implants. #MicrosoftCopilot #xAIGrok…
Cloud attacks move faster than traditional incident response can handle, with short-lived instances, rotating identities, and expiring logs that can erase evidence in minutes. Automated, context-aware forensics that correlates workload telemetry, identity activity, API operations, network movement, and asset relationships lets teams reconstruct attack timelines in minutes and respond decisively. #ContextAwareForensics…
![Cybersecurity News | Daily Recap [17 Feb 2026]](https://www.hendryadrian.com/tweet/image/DailyRecap.png "Cybersecurity News | Daily Recap [17 Feb 2026]")
Daily Recap, the bulletin highlights Keenadu Android backdoor embedded in firmware and Google Play apps, a Lazarus-linked graphalgo campaign delivering a RAT, and APT28’s MacroMaze operation targeting Western and Central European governments. It also notes Eurail data breaches, Figure’s data exposure after an employee phishing attack, and governance probes like Grok, along with key vulnerabilities such as CVE-2026-2441 and patch guidance for Chrome, as well as passkeys and ISO 27001 considerations. #Keenadu #graphalgo #Lazarus #MacroMaze #Eurail #Figure #Grok #ShinyHunters #CVE20262441 #Phobos #LAPSUS$ #OperationAether #X
A high-risk zero-day vulnerability in Dell RecoverPoint for Virtual Machines (CVE-2026-22769) has been exploited since mid-2024 by a suspected PRC-nexus cluster tracked as UNC6201 to gain footholds in the virtualization layer and deploy backdoors. Researchers report UNC6201 upgraded its toolkit in September 2025 to include an AOT-compiled C# backdoor named GRIMBOLT…
Acronis TRU has identified a targeted cyber espionage campaign called CRESCENTHARVEST that exploits political unrest in Iran to lure dissidents and supporters with protest-themed files and deploy a versatile remote access trojan for surveillance and data theft. The attack uses DLL sideloading via a signed Google executable to load the payload,…
Microsoft is working to resolve an outage that caused delays and prevented some users from accessing Microsoft Teams, affecting meeting joins, sign-ins, and chat messages with inline media. Engineers identified a caching-related configuration change, reverted to a healthy version, and confirmed the impact was remediated after monitoring. #MicrosoftTeams #Microsoft365 #CopilotStudio #MicrosoftEntra