In February, cybersecurity was marked by high-profile hacks, AI exploitation, and ransomware campaigns that exposed vulnerabilities across governments, enterprises, and critical infrastructure.
From espionage to financial scams, this month underscores that attackers are rapidly evolving, making vigilance more crucial than ever.
Cybercrime Breaking News
- North Korea’s Lazarus Group launched financially motivated ransomware attacks.
- State-aligned hackers deployed new malware to spy on protest supporters.
- Misconfigured AI agents and plugins led to mass credential and data theft.
Cybersecurity Justice & Regulation
- INTERPOL arrested hundreds in Africa for online investment scams.
- Courts sentenced spyware executives for illegally spying on journalists and officials.
- The U.S. DoJ seized $61 million in cryptocurrency tied to global fraud networks.
Explore February’s top cybercrime incidents, justice actions, and lessons for protecting your digital assets.
Cybercrime Breaking News
North Korea’s Lazarus Group has been observed deploying Medusa ransomware in financially-motivated attacks on institutions in the Middle East and the U.S., using additional malware and tactics to bypass security defenses.
Hackers from Russia’s military intelligence–linked APT28 are exploiting a newly patched high-severity Microsoft Office flaw (CVE-2026-21509) to target government bodies in Ukraine and across the EU with malware-laced phishing documents.
Hackers believed to be aligned with Tehran are targeting supporters of Iran’s anti-government protests in a new espionage campaign, distributing protest-themed files that deploy a previously undocumented malware strain dubbed CRESCENTHARVEST to steal credentials and sensitive data.
The EU and Dutch government confirmed cyber attacks exploiting two critical Ivanti EPMM zero-days (CVE-2026-1281 and CVE-2026-1340), exposing staff names, emails, and phone numbers while national agencies rushed to contain the breaches.
- More than 500,000 VKontakte accounts were hijacked through malicious Google Chrome extensions disguised as VK customization tools, allowing a threat actor known as “2vk” to silently manipulate user settings, force group subscriptions, and maintain persistent access.
- Suspected Chinese state-sponsored hackers compromised Notepad++’s hosting infrastructure to selectively intercept and redirect update traffic to malicious servers, in a supply-chain attack that persisted from June to December 2025 despite not exploiting the editor’s source code itself.
- Substack has warned users that email addresses, phone numbers, and other metadata were exposed in a February breach after a hacker claimed on the dark web to have stolen data on roughly 700,000 accounts. However, no passwords or payment details were compromised.
- A Russian-linked cybercriminal group, Diesel Vortex, targeted freight and logistics companies across the U.S. and Europe for five months, stealing over 1,600 login credentials and intercepting shipments, with Armenian-speaking operators also involved; researchers exposed the group’s full infrastructure, including phishing code, internal communications, and organizational structure.
- Leading Japanese semiconductor test equipment supplier Advantest Corporation said it is responding to a ransomware attack after detecting unauthorized access to parts of its network, isolating affected systems, and launching an investigation with external cybersecurity experts.
Cyberwar between Russia and Ukraine: Updates
Russia is scrambling for workarounds after Ukraine introduced a national verification system that blocks unregistered Starlink terminals, disrupting Moscow’s battlefield communications and drone operations and prompting warnings from Kyiv that Russian operatives are trying to recruit civilians to illegally restore access.
Cybersecurity and AI
OpenClaw, the open-source AI agent, was widely exploited in early 2026 after hackers accessed misconfigured installations, using prompt injections and malicious skills to steal API keys, private data, and execute commands with full system privileges, highlighting severe security flaws in the agent’s default setup.
A Russian-speaking threat actor used commercial generative AI tools to compromise over 600 Fortinet FortiGate firewalls across 55+ countries, exploiting weak credentials and exposed management ports rather than technical vulnerabilities, with AI automating attack plans, scripts, and post-breach operations.
Microsoft 365 Copilot Chat briefly accessed and summarized some users’ confidential emails by mistake, prompting a fix while highlighting risks of rapidly deployed AI tools.
Cybersecurity Justice
Google has disrupted a China-linked cyberespionage campaign by UNC2814, which targeted telecoms and government organizations in 42 countries using a backdoor called Gridtide and cloud tools like Google Sheets to hide its activity.
A Greek court sentenced four executives of a spyware company to eight years in prison for illegally using Predator software to spy on journalists, politicians, and officials, delivering a major blow to the firm and highlighting risks of commercial spyware abuse.
INTERPOL’s Operation Red Card 2.0 led to 651 arrests across 16 African countries, recovering over $4.3 million and dismantling networks behind investment scams, mobile money fraud, and fake loan apps.
A 29-year-old Ukrainian man was sentenced to five years in prison for helping North Korean IT workers use stolen American identities to secure jobs at dozens of U.S. companies.
Polish police arrested a 47-year-old man in the Małopolska region for alleged involvement with the Phobos ransomware gang, which targeted over 1,000 organizations worldwide, as part of a coordinated investigation including Europol’s Operation Aether and international law enforcement partners.
Dutch police have arrested a 21-year-old in Dordrecht for allegedly selling the JokerOTP bot, used to bypass two-factor authentication.
FinTech Updates
The decentralized finance platform Step Finance is shutting down after a January hack resulted in a $40 million theft from its treasury, with only partial recovery of assets and no viable path to continue operations.
North Korean hackers linked to UNC1069 targeted a cryptocurrency executive with a fake Zoom meeting and ClickFix malware, deploying multiple custom tools to steal credentials and sensitive data, according to Mandiant.
The U.S. Department of Justice seized $61 million in Tether linked to “pig butchering” crypto scams, in which victims were romantically manipulated into investing in fake trading platforms, with their funds then laundered through multiple wallets.
A dual national of China and St. Kitts and Nevis was sentenced in absentia to 20 years in a U.S. federal court for laundering $73 million through an international cryptocurrency scam after fleeing the country in December 2025.
Cybersecurity News Across The Globe
- A malicious actor breached part of France’s National Bank Accounts File (FICOBA), a database operated by the Direction générale des Finances publiques that records bank account details for millions of people, after impersonating a civil servant to access personal data, including names, addresses, and account numbers, authorities said.
- Italy said it neutralized roughly 120 Russia-linked DDoS attacks claimed by NoName057(16) targeting diplomatic sites and infrastructure tied to the 2026 Winter Olympics in Cortina d’Ampezzo and Milan, as authorities also probe suspected sabotage on rail lines near Bologna and along routes to Milan that disrupted travel during the Games’ opening days.
- The Norwegian Police Security Service said in its 2026 annual threat assessment that the country was impacted by the China-linked Salt Typhoon operation, which exploited vulnerable network devices in Norwegian organizations.
- Hackers accessed a compromised customer contact system at Dutch telecom provider Odido, stealing personal data belonging to up to 6.2 million people – including names, addresses, bank account numbers, and ID details – though the company said no passwords, call logs, or billing information were exposed.
- Polish authorities have detained a civilian employee of the Ministry of National Defense in Warsaw on espionage charges, accusing him of spying for Russian and Belarusian intelligence services.
- Romania’s oil pipeline operator, Conpet, confirmed a cyber attack that disrupted parts of its IT infrastructure and website, after the Qilin gang claimed to have stolen nearly 1TB of company data. Pipeline operations were not affected.
- Singapore said all four of its major telcos – M1, SIMBA Telecom, Singtel, and StarHub – were targeted in a deliberate, months-long China-linked cyberespionage campaign by UNC3886, which exploited a zero-day and advanced persistence tools, prompting the government to launch Operation Cyber Guardian, its largest coordinated incident response effort to date.
Want to find out more about:
- Why Most Cyber Breaches Go Undetected for Months
- Continuous Validation in Regulated Sectors
- The Risk Window Between Pentests: When Validation Falls Behind Change
AMATAS will continue to monitor this space and deliver salient information regularly.
Stay tuned for our next report and if you are interested in any of our privacy and cybersecurity services, please do reach out through our website www.amatas.com or by e-mailing office@amatas.com.
As always – be vigilant, stay alert, and think twice.
