Category: Cyber Security News

Cybersecurity News | Daily Recap [07 Feb 2026]

Daily Recap, BridgePay confirms a ransomware attack that knocked core payment systems offline, causing a nationwide outage and forcing some merchants to accept cash while the FBI and agencies investigate. Attacks span academia and government, including Spain’s Ministry of Science data leaks linked to GordonFreeman and BabLock/Femwar02 that took La Sapienza offline, affecting about 112,500 students, plus AI-enabled threat discussions and privacy concerns around surveillance tools.
#BridgePay #BabLock

Read More
New tool blocks imposter attacks disguised as safe commands

Tirith is a new open-source, cross-platform tool that detects and blocks homoglyph and other deceptive attacks in command-line environments by analyzing URLs in pasted or typed commands and preventing their execution. It hooks into shells like zsh, bash, fish, and PowerShell to inspect commands locally with sub-millisecond overhead, offering byte-level Unicode inspection and offline auditing without sending telemetry. #Tirith #PowerShell

Read More
CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA

CISA has added two actively exploited vulnerabilities—CVE-2025-11953 in the React Native Community CLI and CVE-2026-24423 in SmarterTools SmarterMail—to its Known Exploited Vulnerabilities Catalog. While BOD 22-01 mandates remediation only for FCEB agencies, CISA urges all organizations to prioritize timely patching and vulnerability management to reduce exposure. #CVE-2025-11953 #CVE-2026-24423…

Read More
OpenClaw Integrates VirusTotal Scanning to Detect Malicious ClawHub Skills

OpenClaw has partnered with VirusTotal to scan every skill uploaded to the ClawHub marketplace using SHA-256 hashing and VirusTotal Code Insight, automatically approving benign skills, flagging suspicious ones, and blocking malicious downloads while re-scanning active skills daily. Researchers and vendors warn the measure is not a silver bullet amid widespread misconfigurations,…

Read More
Romania’s Oil Pipeline Operator Hacked: How an Infostealer Infection Paved the Way for Qilin’s Ransomware Attack

Conpet, Romania’s national oil pipeline operator, confirmed a major cyberattack after the Qilin ransomware group claimed to have stolen nearly 1TB of sensitive data. Hudson Rock traced the breach to a single Infostealer infection on an IT employee’s personal computer on January 11, 2026, which leaked credentials (including WSUS and Cacti access) that enabled a likely full network takeover. #Qilin #Infostealer #Conpet #WSUS

Read More
State actor targets 155 countries in ‘Shadow Campaigns’ espionage op

A state-sponsored threat actor tracked as TGR-STA-1030/UNC6619 conducted global espionage operations called “Shadow Campaigns,” compromising at least 70 government and critical infrastructure organizations across 37 countries and conducting reconnaissance against entities in 155 countries. The group used tailored phishing with Mega.nz-hosted archives, the Diaoyu loader (delivering Cobalt Strike and VShell), multiple exploit chains, and a custom eBPF Linux rootkit named ShadowGuard to evade detection and maintain persistent access. #TGR-STA-1030 #ShadowGuard

Read More
China-Linked DKnife AitM Framework Targets Routers for Traffic Hijacking, Malware Delivery

Researchers uncovered DKnife, a Linux-based gateway-monitoring and adversary-in-the-middle framework used by China-nexus actors since at least 2019 to perform deep packet inspection, manipulate traffic, and deliver malware via compromised routers and edge devices. The modular toolkit hijacks binary and Android update downloads to deploy backdoors like ShadowPad and DarkNimbus and harvests…

Read More
German Agencies Warn of Signal Phishing Targeting Politicians, Military, Journalists

Germany’s BfV and BSI warned of a likely state‑sponsored campaign using Signal phishing to trick high‑value targets in politics, the military, diplomacy, and investigative journalism into surrendering verification codes or scanning malicious QR codes. Attackers impersonate Signal Support or a chatbot to register or link devices, enabling message interception and contact‑list…

Read More
Organizations Urged to Replace Discontinued Edge Devices

US and UK agencies warned that discontinued edge devices — including firewalls, routers, switches, load balancers, IoT devices, and wireless access points — pose significant security risks because they no longer receive security updates. CISA’s Binding Operational Directive 26-02 requires federal agencies to inventory, update, and decommission end-of-support (EOS) edge devices…

Read More
Germany warns of Signal account hijacking targeting senior figures

Germany’s domestic intelligence agencies warn that suspected state-sponsored actors are conducting phishing attacks via messaging apps like Signal to target politicians, military officers, diplomats, and investigative journalists across Germany and Europe. The attackers exploit legitimate features—tricking victims into sharing PINs or scanning QR codes to pair attacker-controlled devices or perform full account takeovers, prompting an advisory from the BfV and BSI. #Signal #WhatsApp #Sandworm #GhostPairing #BfV #BSI #CERT-UA

Read More
Payments platform BridgePay confirms ransomware attack behind outage

BridgePay Network Solutions suffered a ransomware attack that knocked core payment systems offline, causing a nationwide outage and forcing some merchants to accept cash-only. The company has engaged the FBI, U.S. Secret Service, and external forensic teams, reported no evidence so far of usable payment card data exposure, and is working to restore services across BridgeComm, PayGuardian, MyBridgePay, PathwayLink and hosted payment pages. #BridgePay #BridgeComm #PayGuardian #MyBridgePay #PathwayLink #LightspeedCommerce #ThriftTrac #CityOfPalmBay

Read More
In Other News: Record DDoS, Epstein’s Hacker, ESET Product Vulnerabilities

This roundup condenses notable cybersecurity developments that include espionage, large-scale DDoS activity, AI-driven intrusions, vulnerability disclosures, and consumer data breaches. This week’s highlights include the conviction of former Google engineer Linwei Ding for stealing AI trade secrets, Cloudflare reporting a record 31.4 Tbps DDoS attack, an LLM-assisted AWS admin takeover observed…

Read More