Cyber Threat Briefing

DELTA — CHANGES SINCE LAST BRIEFING

• 3 new CRITICAL CVEs (OpenS100, Glory RBG-100, YayMail) with CVSS ≥9.6
• 4 new KEV entries including Microsoft Windows Video ActiveX (CVE-2008-0015) and BeyondTrust OS Command Injection (CVE-2026-1731)
• New QakBot C2 infrastructure detected: 178.62.3.223:443 (offline status)
• 15+ HIGH-severity CVEs added, including IBM DataStage, Softland FBackup, and WordPress plugins

THREAT LEVEL ASSESSMENT

The current threat landscape is rated HIGH due to concurrent emergence of multiple CRITICAL CVEs (CVSS ≥9.6) and active exploitation of KEVs in critical infrastructure. High-severity vulnerabilities in widely used platforms (WordPress, IBM, Windows) compound risks, while QakBot C2 activity signals escalating malware campaigns. Patch Tuesday updates and KEV remediation deadlines add urgency.

CRITICAL VULNERABILITIES

ACTIVE EXPLOITS & KEV

MALWARE & THREAT ACTORS

QakBot (Feodo Tracker C2: 178.62.3.223:443) — New offline C2 infrastructure detected. Exploits unpatched Windows and industrial control systems. Associated with recent Kimwolf botnet campaigns disrupting I2P networks.

CYBER NEWS DIGEST

[CISA Alerts] Honeywell CCTV and Delta Electronics ASDA-Soft vulnerabilities enable camera feed hijacking and buffer overflow attacks, with remediation deadlines by March 2026.

[Microsoft Patch Tuesday] February 2026 updates address 50+ flaws including six zero-days, prioritizing Windows kernel and Azure DevOps exploits.

[Krebs on Security] Kimwolf botnet infects 2M+ IoT devices, forcing DDoS participation and local network reconnaissance via compromised firmware.

[Notepad++ Security] "Double-lock" update mechanism deployed to prevent supply-chain attacks after CVE-2025-15556 exploitation by Chinese state-backed actors.

[Siemens Industrial KEVs] SINEC OS and Polarion XCED vulnerabilities enable remote code execution in energy and manufacturing systems — urgent patching advised.

[Dark Reading] RMM abuse rises as hackers leverage trusted platforms for persistent network infiltration, bypassing traditional malware detection.