Cyber Threat Brief - 2026-02-13

Generated: 2026-02-13 | Sources: 40 articles from 17 feeds

Critical Alerts

• CISA Adds Four Vulnerabilities to KEV Catalog, Including Actively Exploited Microsoft SCCM Flaw (CVE-2024-43468)
• CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog based on confirmed active exploitation: CVE-2024-43468 (Microsoft Configuration Manager SQL injection, CVSS 9.8), CVE-2025-15556 (Notepad++ code integrity bypass), CVE-2025-40536 (SolarWinds Web Help Desk security control bypass), and CVE-2026-20700 (Apple buffer overflow). CVE-2024-43468 is the most urgent for Windows/AD shops: it allows unauthenticated remote code execution against SCCM/ConfigMgr servers and has an EPSS score of 0.86 (99th percentile). Microsoft patched this in October 2024, but exploitation is now confirmed in the wild.
• Action: Verify your ConfigMgr environment is patched to the October 2024 update immediately. Federal agencies have a March 5 deadline. Also patch SolarWinds Web Help Desk (KEV due Feb 15, EPSS 0.28/96th percentile) and update Notepad++ installations.

• Sources: CISA KEV | The Register | BleepingComputer | The Hacker News

• BeyondTrust Remote Support/PRA RCE Being Exploited in the Wild (CVE-2026-1731, CVSS 9.9)

• A critical pre-authentication RCE vulnerability in BeyondTrust Remote Support (versions 25.3.1 and earlier) and Privileged Remote Access (versions 24.3.4 and earlier) is now being actively exploited. watchTowr observed in-the-wild exploitation across global sensors within 24 hours of PoC publication. Attackers abuse the get_portal_info endpoint to extract the x-ns-company value, then establish a WebSocket channel for code execution. EPSS is 0.04 (89th percentile).
• Action: Patch BeyondTrust RS and PRA immediately. If you use BeyondTrust for remote support, check for indicators of compromise in your WebSocket logs and review access to the get_portal_info endpoint.

• Sources: The Hacker News | BleepingComputer | SecurityWeek

• Apple Zero-Day Actively Exploited (CVE-2026-20700)

• Apple disclosed its first actively exploited zero-day of 2026, a memory corruption vulnerability in iOS. The flaw was used in "an extremely sophisticated attack against specific targeted individuals" on devices running iOS versions before iOS 26. CISA added it to KEV with a March 5 remediation deadline.
• Action: Ensure all managed Apple devices are updated to the latest iOS/iPadOS. This is a targeted attack, but the patch is available and should be deployed across all endpoints.
• Source: Cyberscoop

Vulnerability Disclosures

• Siemens Issues Multiple ICS Advisories
• Siemens released advisories for SINEC NMS (CVE-2026-25655, CVE-2026-25656, local privilege escalation via DLL loading), NX (CVE-2026-22923/22924/22925, file parsing buffer overflows leading to code execution), Solid Edge (CVE-2025-40936, OOB read in IGS parser), Siveillance Video (CVE-2025-0836, Webhooks API privilege escalation), and Polarion (CVE-2025-40587, stored XSS, CVSS 7.6). Most affect critical infrastructure sectors worldwide.
• Action: Review Siemens advisories if you run any of these products. Update SINEC NMS to V4.0 SP2, NX to V2512+, and Solid Edge to V226.00 Update 03.

• Sources: SINEC NMS | NX | Solid Edge | Siveillance | Polarion

• Airleader Master RCE via Unrestricted File Upload (CVE-2026-1358, CVSS 9.8)

• Airleader Master versions 6.381 and prior have an unrestricted file upload vulnerability that allows unauthenticated remote code execution. Affects critical infrastructure sectors including energy, healthcare, and water/wastewater.
• Action: Check if Airleader Master is deployed in your environment and update past version 6.381.

• Source: CISA ICS Advisory

• Hitachi Energy SuprOS Default Credentials (CVE-2025-7740)

• Default credentials vulnerability in Hitachi Energy SuprOS versions 9.2.1 and below. Affects energy, transportation, and government sectors.
• Action: Remove default accounts and change root passwords per SuprOS Secure Deployment Guidelines chapter 4.3.

• Source: CISA ICS Advisory

• Windows LNK Shortcut Spoofing Techniques Disclosed

• Security researcher Wietze Beukema disclosed four new LNK shortcut manipulation techniques at Wild West Hackin' Fest that allow attackers to hide malicious targets from users inspecting file properties. The techniques exploit inconsistencies in how Windows Explorer handles conflicting target paths in LNK binary structures. Microsoft classified these as "not vulnerabilities" and assigned CVE-2025-9491 with no immediate fix planned.
• Action: Reinforce user training about LNK files from untrusted sources. Consider blocking LNK files in email gateways if not already.
• Source: BleepingComputer

Ransomware & Extortion

• Ransomware Operators Abusing Employee Monitoring Software ("Bossware")
• Huntress observed two intrusions in late January and early February where threat actors chained Net Monitor for Employees Professional with SimpleHelp RMM to blend into corporate networks and attempt ransomware deployment. The attackers were ultimately unsuccessful, but the tactic of using legitimate employee monitoring tools to evade detection is a significant evolution. This is directly relevant to MSPs and SMBs that deploy monitoring or RMM software.
• Action: Audit your RMM and employee monitoring tool deployments. Ensure SimpleHelp and Net Monitor are patched to latest versions, restrict admin access, and monitor for unauthorized installations.

• Source: The Register

• Qilin Ransomware Hits Romania's Oil Pipeline Operator Conpet

• The Qilin ransomware gang stole data from Romania's national oil pipeline operator Conpet S.A. The attackers breached corporate IT infrastructure and claim to have exfiltrated nearly 1TB of documents. Operations remained unaffected. The investigation with Romania's DNSC is ongoing.
• Action: Qilin continues to target critical infrastructure. Ensure your backup and segmentation strategies account for data exfiltration scenarios.
• Source: BleepingComputer

Business & Infrastructure Threats

• 30+ Malicious Chrome Extensions Disguised as AI Chatbots Steal API Keys and Emails
• Over 30 malicious Chrome extensions installed by at least 260,000 users impersonate AI assistants (Claude, ChatGPT, Gemini, Grok) while stealing API keys, email messages, and personal data. All 32 extensions share the same codebase and communicate with infrastructure at tapnetic[.]pro. Many remain on the Chrome Web Store. A separate extension ("CL Suite") specifically targets Meta Business Suite and Facebook Business Manager, exfiltrating TOTP codes and contact lists.
• Action: Audit Chrome extensions across managed endpoints. Block tapnetic[.]pro. Enforce extension allowlists via Chrome Enterprise policies.

• Sources: The Register | The Hacker News

• North Korean Lazarus Group Runs Fake Recruiter Campaign via npm/PyPI ("Graphalgo")

• North Korean threat actors are targeting JavaScript and Python developers with fake job recruitment campaigns. They create fraudulent blockchain/crypto companies, post job listings on LinkedIn and Reddit, then deliver coding challenges containing malicious npm and PyPI packages. Researchers found 192 malicious packages that deploy a remote access trojan. The campaign has been active since at least May 2025.
• Action: Warn development teams about unsolicited coding challenges. Audit npm and PyPI dependencies. Use lockfiles and dependency scanning.

• Sources: BleepingComputer | The Hacker News

• Claude AI Artifacts Abused in ClickFix Campaigns Targeting macOS

• Threat actors are abusing publicly shared Claude artifacts and Google Ads to deliver infostealer malware to macOS users via ClickFix social engineering. Over 10,000 users have accessed the malicious content. The artifacts contain instructions that trick users into running terminal commands.
• Action: Train users on ClickFix social engineering tactics. Monitor for unusual terminal command execution on macOS endpoints.

• Source: BleepingComputer

• Dutch Telecom Odido Breached, 6.2 Million Customers Exposed

• The Netherlands' largest mobile operator Odido confirmed attackers breached its customer contact system, exposing names, addresses, phone numbers, dates of birth, bank account numbers, and ID document details for 6.2 million customers. Passwords and call data were not affected. The breach was detected February 7-8.
• Action: Reinforces the importance of access controls on customer-facing CRM/contact systems, particularly IP allow-listing and bulk download restrictions.

• Sources: The Register | BleepingComputer

• QR Code Phishing Evolving with Deep Links and Direct APK Downloads

• Unit 42 documented QR code abuse using URL shorteners to disguise destinations, in-app deep links to steal credentials, and direct APK downloads to bypass app store security. QR codes exploit the weaker controls of personal mobile devices to bypass organizational security.
• Action: Include QR code risks in security awareness training. Consider mobile threat defense solutions for BYOD environments.
• Source: Unit 42

Windows / AD Security

• Microsoft SCCM/ConfigMgr SQL Injection Now Actively Exploited (CVE-2024-43468)

• Covered in Critical Alerts above. This is the top priority for Windows/AD environments today. The CVSS 9.8 SQL injection allows unauthenticated RCE against ConfigMgr servers. Patched October 2024, now confirmed exploited. EPSS 0.86 (99th percentile).

• Copilot Studio Agent Security: Top 10 Risks

• Microsoft published guidance on the ten most common security risks in Copilot Studio agent deployments: over-broad sharing, unauthenticated access, weak orchestration controls, and misconfigured AI workflows. Maps each risk to detections and mitigations using Microsoft Defender.
• Action: If your organization uses Copilot Studio, review Microsoft's guidance and audit agent configurations for oversharing and authentication gaps.

• Source: Microsoft Security Blog

• Microsoft Fixes Family Safety Bug Blocking Chrome

• Microsoft resolved a known issue where Family Safety parental controls blocked Google Chrome and other browsers from launching on Windows 10 22H2 and Windows 11 22H2+. The bug persisted for 8 months since June 2025. Fix is rolling out automatically.
• Source: BleepingComputer

General Security News

• State-Backed Actors Using Gemini AI for Reconnaissance
• Google reported North Korean group UNC2970 and actors from China, Iran, and Russia are using Gemini AI to profile targets, synthesize OSINT, and support campaign planning against the defense industrial base. The targeting includes cybersecurity and defense companies, mapping technical roles and salary information for social engineering.

• Sources: The Hacker News (UNC2970) | The Hacker News (DIB)

• npm Authentication Overhaul Post-Sha1-Hulud

• npm completed a major authentication overhaul in December 2025 to reduce supply-chain attacks, replacing long-lived classic tokens. While a solid step forward, npm remains susceptible to malware packages. Organizations should still use dependency scanning and lockfiles.

• Source: The Hacker News

• LVMH Brands Fined $25M for SaaS Security Failures

• South Korea fined Louis Vuitton ($16.4M), Dior ($9.4M), and Tiffany ($1.85M) for failing to secure cloud-based customer management platforms. ShinyHunters exploited missing IP restrictions and authentication controls to breach SaaS tools and expose 5.5 million customer records. SaaS adoption does not transfer security responsibility to the vendor.

• Source: BleepingComputer

• Gartner Warns Misconfigured AI in Cyber-Physical Systems Could Cause G20-Level Outages by 2028

• Gartner predicts that misconfigured AI embedded in national infrastructure could shut down critical services in a major economy as soon as 2028. The warning focuses on rapid AI adoption in cyber-physical systems without adequate testing and validation.
• Source: The Register

Trends & Context

Today's feed is dominated by long-overdue exploitation of known vulnerabilities. The Microsoft ConfigMgr flaw (CVE-2024-43468) was patched 16 months ago but is only now hitting KEV, reinforcing that patching delays create compounding risk. BeyondTrust exploitation within 24 hours of PoC release shows the shrinking window between disclosure and active attacks for internet-facing remote access tools. The abuse of legitimate RMM and employee monitoring software by ransomware operators is a growing blind spot for organizations that trust their own tooling implicitly; audit your remote access and monitoring deployments with the same rigor you apply to external attack surface.