The Daily Index — Thursday, February 12, 2026

ATTACKS & VULNERABILITIES

TLDR InfoSec

SOMEONE'S ATTACKING SOLARWINDS WHD TO STEAL HIGH-PRIVILEGE CREDENTIALS - BUT WE DON'T KNOW WHO OR HOW

Unknown threat actors exploited vulnerable SolarWinds Web Help Desk instances in December 2025 to gain initial access, with Microsoft unable to confirm whether the attacks leveraged CVE-2025-40551 (9.8 CVSS deserialization RCE), CVE-2025-40536 (8.1 CVSS auth bypass), or CVE-2025-26399 (9.8 CVSS command execution). Post-exploitation activity included BITS abuse for payload delivery, installation of Zoho ManageEngine RMM for persistence, LSASS credential dumping via DLL sideloading, and DCSync attacks to extract domain controller password data. Organizations should immediately patch WHD, remove public access to admin paths, scan for unauthorized RMM tools such as ToolsIQ.exe, and rotate service and admin account credentials accessible from WHD.

theregister.com · 4 min

TLDR InfoSec

CLAWHAVOC: 341 MALICIOUS CLAWED SKILLS FOUND BY THE BOT THEY WERE TARGETING

Koi Security's threat hunting agent analyzed skills being offered on OpenClaw's ClawHub marketplace and discovered that 341/2857 of them were malicious. Most malicious extensions follow a similar pattern: the prerequisites instruct the agent to download and execute a file containing a malicious payload that installs the AMOS stealer. The post also highlights a few unique skills that download other payloads or hide their stealers and backdoors within the code itself.

koi.ai · 4 min

TLDR InfoSec

THE RANSOMWARE FRANCHISE WARS: HOW FALLING PAYMENTS ARE SPAWNING A NEW GENERATION OF CYBERCRIME CARTELS

The collapses of Black Basta and LockBit have triggered a violent restructuring of the RaaS ecosystem, with new entrants like DragonForce operating as vertically integrated "cartels" that embed access broker marketplaces directly into affiliate panels, compressing the window between initial access and ransomware deployment to hours. A parallel commoditization of EDR evasion tools, including BYOVD-based killers exploiting a still-valid 2006 Microsoft-signed driver, has collapsed the barrier to entry so that even low-budget operators can defeat enterprise security stacks. Defenders should prioritize enabling Microsoft's opt-in Vulnerable Driver Blocklist, monitor access broker marketplaces for organizational exposure, and shift threat intelligence from tracking ransomware brands to tracking persistent infrastructure indicators like shared SSH fingerprints and certificate reuse.

flare.io · 14 min

TLDR InfoSec

VOIDLINK: DISSECTING AN AI-GENERATED C2 IMPLANT

VoidLink is a Zig-based Linux C2 implant that bears strong indicators of LLM-generated code — including structured "Phase X:" labels, verbose debug logging, and documentation patterns left in the production binary — demonstrating how AI coding agents are lowering the barrier to producing functional, multi-cloud malware. The implant fingerprints AWS, GCP, Azure, Alibaba Cloud, and Tencent Cloud environments, harvests credentials from environment variables and metadata APIs, performs container escape via Docker/Kubernetes plugins, and deploys an adaptive kernel-level rootkit that selects eBPF, LKM, or LD_PRELOAD stealth based on host kernel version. Defenders should monitor for unauthorized cloud metadata API queries from workloads, audit Kubernetes service account token access, and treat verbose or structured debug artifacts in captured malware as potential indicators of AI-assisted development requiring adjusted threat modeling.

ontinue.com · 10 min

TLDR InfoSec

WHEN MFA WASN'T ENOUGH: A REAL AITM INCIDENT REVIEW

Attackers have shifted from credential theft to stealing authentication tokens for initial access. In one incident that the author observed, an attacker successfully stole an authentication token via an attacker-in-the-middle (AitM) Microsoft 365 proxy, but couldn't achieve their goals due to rapid detection and response. In a second incident, the attacker was unable to steal a token because the organization utilized FIDO2 security keys, so the authentication attempt through the AitM proxy failed.

links.tldrnewsletter.com · 6 min

TLDR InfoSec

together →

Summary unavailable

links.tldrnewsletter.com

TLDR InfoSec

UNC1069 TARGETS CRYPTOCURRENCY SECTOR WITH NEW TOOLING AND AI-ENABLED SOCIAL ENGINEERING

Mandiant attributed an intrusion against a FinTech entity to UNC1069, a DPRK-nexus financially motivated threat actor that leveraged a compromised Telegram account, a spoofed Zoom meeting with a reported deepfake video, and a ClickFix attack to deploy seven malware families on a macOS device — including new tools SILENCELIFT, DEEPBREATH, and CHROMEPUSH. The attack chain progressed from the WAVESHAPER backdoor through the HYPERCALL downloader to deploy HIDDENCALL for hands-on keyboard access, while DEEPBREATH bypassed macOS TCC protections to steal Keychain credentials, browser data, and Telegram sessions, and CHROMEPUSH installed a malicious Chrome extension for keylogging and cookie theft. The investigation highlights UNC1069's expanding use of GenAI tools like Gemini and GPT-4o for social engineering, alongside a significant tooling refresh targeting cryptocurrency startups, software developers, and venture capital firms.

cloud.google.com · 15 min

TLDR InfoSec

MICROSOFT ROLLS OUT NEW SECURE BOOT CERTIFICATES BEFORE JUNE EXPIRATION

The certificates that Microsoft uses for Secure Boot are set to expire in June 2026 after 15 years of use. Users who have automatic updates enabled will receive the new updates automatically. Admins can deploy the new certificates via registry keys, Group Policy, or Windows Configuration System (WinCS). Windows 10 users who are not enrolled in extended security updates will not receive the new certificates.

bleepingcomputer.com · 2 min

TLDR InfoSec

REYNOLDS RANSOMWARE EMBEDS BYOVD DRIVER TO DISABLE EDR SECURITY TOOLS

Reynolds ransomware bundles a vulnerable NsecSoft NSecKrnl driver (CVE-2025-68947, CVSS 5.7) directly in its payload to terminate EDR processes from CrowdStrike, Sophos, Symantec, Palo Alto Cortex XDR, and Avast before encrypting files, eliminating the need for a separate BYOVD deployment step. Symantec and Carbon Black researchers noted a suspicious side-loaded loader on the target network weeks before ransomware execution, followed by deployment of the GotoHTTP remote access tool for persistent access. The article also covers broader ransomware developments, including LockBit 5.0's shift to ChaCha20 encryption with wiper capabilities, Interlock's use of a gaming driver zero-day (CVE-2025-61155) for BYOVD attacks, and ransomware actors increasingly targeting misconfigured AWS S3 buckets.

thehackernews.com · 5 min

TLDR InfoSec

PRIDE MONTH PHISHING TARGETS EMPLOYEES VIA TRUSTED EMAIL SERVICES

A phishing campaign leveraging Pride Month and diversity themes has expanded from 504 to 4,768 targeted organisations across multiple countries.

hackread.com · 2 min

TLDR InfoSec

CISA RELEASES GUIDE TO HELP CRITICAL INFRASTRUCTURE USERS ADOPT MORE SECURE COMMUNICATION

"Barriers to Secure OT Communications: Why Johnny Can't Authenticate" is a guide that addresses the cost, complexity, latency, and interoperability barriers preventing critical infrastructure operators from adopting secure industrial protocols.

cisa.gov · 2 min

TLDR InfoSec

FALLOUT FROM LATEST IVANTI ZERO-DAYS SPREADS TO NEARLY 100 VICTIMS

Exploitation of Ivanti EPMM zero-days CVE-2026-1281 and CVE-2026-1340 (both CVSS 9.8) has reached 86 confirmed compromised instances.

cyberscoop.com · 3 min