Daily Drop (1250)
02-22-26
Sunday, Feb 22, 2025 // (IG): BB // GITHUB // SN R&D
CISA Flags Actively Exploited Roundcube RCE and XSS Flaws, Sets March 13 Remediation Deadline
Bottom Line Up Front (BLUF): Federal agencies now face mandatory remediation deadlines after confirmed in-the-wild exploitation of two vulnerabilities. KEV designation means adversaries are already operationalizing these flaws, and broader targeting of unpatched enterprise systems is likely in the near term.
Analyst Comments: Roundcube continues to be a soft spot in many environments, particularly in hosting providers, universities, and smaller enterprises that rely on default configurations. CVE-2025-49113 is the real concern here: a deserialization bug reachable by authenticated users that enables remote code execution. If attackers obtain valid credentials—via phishing, credential stuffing, or password reuse—they can pivot quickly to full server compromise.
READ THE STORY: THN
Google Blocks 1.75 Million Malicious Apps From Play Store in 2025
Bottom Line Up Front (BLUF): Google reports blocking approximately 1.75 million malicious or policy-violating apps from reaching the Play Store in 2025, underscoring the scale of mobile ecosystem abuse. The volume reflects both automated detection improvements and the sustained pressure from fraud, spyware, adware, and data-harvesting campaigns targeting Android users globally.
Analyst Comments: At face value, 1.75 million blocked apps is a success metric. Operationally, it’s also a threat metric. That volume reflects a submission ecosystem flooded with automated, mass-produced malicious builds. Android remains attractive because distribution is scalable, monetization paths are proven, and mobile devices increasingly hold authentication tokens, financial data, and corporate access credentials.
READ THE STORY: Cyber Press
Lessons From AI Hacking: Every Model, Every Layer Is Risky
Bottom Line Up Front (BLUF): Wiz researchers report that over two years of offensive testing, they were able to compromise virtually every major AI platform they examined—across model training, inference, applications, AI cloud infrastructure, and even hardware layers. Their core warning: security teams are over-fixated on prompt injection while foundational infrastructure vulnerabilities present far broader systemic risk.
Analyst Comments: Prompt injection gets attention because it’s novel and visible. But according to Wiz’s findings, the deeper risks sit below the prompt layer—inside model formats, hosting environments, AI supply chains, and shared infrastructure components. The Pickle format example is emblematic. Mixing data and executable code into a widely used model storage format creates a design-level risk. That’s not misconfiguration—that’s architectural debt. When foundational tooling lacks threat modeling, downstream platforms inherit the weakness at scale.
READ THE STORY: DR
PayPal Data Breach 2026: Threat Actors Exploit Third-Party Weakness, Expose Customer Records
Bottom Line Up Front (BLUF): Reporting from GBHackers indicates PayPal experienced a data breach in 2026 tied to a third-party or platform-level weakness that exposed customer information. While financial systems were not reportedly compromised, the incident underscores persistent supply chain and access control risks facing large fintech platforms. Expect heightened phishing campaigns and credential abuse targeting affected users.
Analyst Comments: Major payment processors are prime targets—not just for direct fraud, but for data harvesting. Even limited customer record exposure (names, emails, partial financial data, or account metadata) is enough to fuel highly convincing phishing and account takeover campaigns. If the breach originated through a third-party integration or vendor channel, that aligns with a broader pattern: attackers increasingly target the ecosystem around financial institutions rather than the hardened core transaction infrastructure. It’s often easier to compromise a partner system, API integration, or customer service workflow than to break the payment engine itself.
READ THE STORY: GBhackers
Attackers Use ‘ILovePoop’ Toolkit to Scan for React2Shell Exposure
Bottom Line Up Front (BLUF): Threat actors are actively scanning tens of millions of IP addresses for React2Shell (CVE-2025-55182), a critical (CVSS 10.0) remote code execution flaw in React Server Components. According to reporting from Dark Reading, a sophisticated toolkit dubbed “ILovePoop” is being used to probe high-value government, defense, financial, and industrial networks—suggesting potential state-sponsored reconnaissance ahead of targeted exploitation.
Analyst Comments: The “ILovePoop” toolkit—despite the name—appears structured and purpose-built. Researchers suspect separation between developer and operator, a common pattern in more organized or state-aligned operations. The targeting list reads less like cybercrime monetization and more like strategic reconnaissance: NASA, DISA, state governments, major banks, utilities, and Fortune 500 firms.
READ THE STORY: DR
30,000+ OpenClaw Instances Compromised in Mass Exploitation Campaign
Bottom Line Up Front (BLUF): Multiple threat groups are actively exploiting exposed OpenClaw AI agent instances to steal API keys, intercept communications, and deploy infostealers. More than 30,000 compromised systems have been identified, with over 300,000 instances exposed on the default port—many without authentication. The campaign includes RCE exploitation (CVE-2026-25253), supply chain poisoning, and backdoored “skills” distributed through the project’s community marketplace.
Analyst Comments: OpenClaw’s problem isn’t popularity—it’s architecture. The framework was designed for capability: persistent memory, deep service integrations, elevated permissions. That makes it powerful for automation. It also makes it a high-value credential vault when exposed. Within 72 hours of large-scale adoption in late January, attackers were already exploiting it. That speed tells you two things: (1) threat actors are actively monitoring emerging AI agent ecosystems, and (2) AI infrastructure is now treated like cloud control planes—if it’s exposed, it will be targeted immediately.
READ THE STORY: FreeBuf
Anthropic Debuts Claude Code Security to Harden AI-Generated Code
Bottom Line Up Front (BLUF): Anthropic has launched Claude Code Security, a new offering aimed at identifying vulnerabilities in AI-generated and human-written code before deployment. The move positions AI not just as a productivity engine, but as an automated security reviewer—arriving as threat actors increasingly use generative AI to accelerate exploit development.
Analyst Comments: There’s a quiet arms race underway: attackers are using LLMs to write reconnaissance scripts, refine exploits, and troubleshoot post-compromise movement. Defenders are responding by embedding AI into the SDLC to catch weaknesses earlier. Claude Code Security appears designed to scan for common classes of flaws—logic errors, insecure configurations, injection risks, and misuse of cryptography—before code hits production. That’s useful, particularly in environments where AI-assisted development is already normal. The risk, however, is overconfidence. AI-based code review can surface patterns and anti-patterns, but it won’t replace human threat modeling or architecture review.
READ THE STORY: GBhackers
Red Team vs. the Factory: Safely Simulating Attacks on Critical Infrastructure
Bottom Line Up Front (BLUF): Red Team operations against critical infrastructure (CI) require a fundamentally different model than traditional IT testing. In OT environments, unsafe techniques can disrupt physical processes, trigger equipment failure, or create regulatory exposure under frameworks such as 187-FZ and FSTEC orders. Effective testing demands tightly scoped engagement rules, safety-first reconnaissance, rollback planning, and—where possible—the use of digital twins to simulate impact without operational risk.
Analyst Comments: In enterprise IT, the worst-case outcome is usually downtime or data exposure. In OT environments, mistakes can halt production lines, damage equipment, or create safety hazards. That shifts red team operations from “prove impact” to “prove exposure without causing impact.” The biggest operational risk comes from using standard offensive tooling without modification. Aggressive vulnerability scans, exploit attempts, or authentication brute-forcing—routine in enterprise engagements—can crash PLCs or destabilize fragile legacy systems in industrial networks. Many OT devices were never designed to handle malformed traffic or scanning at scale.
READ THE STORY: CODEBY
AI-Assisted Threat Actor Compromises 600+ FortiGate Devices Across 55 Countries
Bottom Line Up Front (BLUF): An economically motivated threat actor used multiple commercial AI services to help compromise more than 600 internet-exposed FortiGate devices between January 11 and February 18, 2026. The campaign relied on weak credentials—not zero-days—then leveraged stolen configurations to pivot into Active Directory, exfiltrate NTLM databases via DCSync, and target Veeam backups to pre-stage ransomware operations.
Analyst Comments: Strip away the AI angle and this starts with something painfully familiar: exposed management interfaces and weak or reused passwords. No zero-day. No novel exploit chain. Just port scanning (443, 8443, 10443, 4443) and credential abuse at scale. What’s new is the workflow. According to Amazon threat intelligence, the actor used at least two commercial LLM services—one to help develop tooling and plan operations, another to guide lateral movement once inside victim networks. In one case, the attacker reportedly fed full network topology and credentials into an AI system and requested step-by-step pivot instructions. That’s less “elite operator” and more “AI-powered playbook execution.”
READ THE STORY: FreeBuf // THN
Grandstream Phone Flaw Enables Call Interception via Authentication Bypass
Bottom Line Up Front (BLUF): A critical vulnerability in Grandstream IP phones allows attackers to bypass authentication and intercept SIP traffic, exposing live calls and credentials. Internet-exposed devices are at immediate risk, and organizations relying on affected models should prioritize firmware updates and restrict management access.
Analyst Comments: VoIP infrastructure doesn’t get the same defensive scrutiny as firewalls or domain controllers—and that’s exactly why it’s attractive. If an attacker can bypass authentication on an IP phone or related service, they can pivot from nuisance eavesdropping to credential harvesting and internal reconnaissance. SIP interception isn’t just about listening in. In many environments, VoIP systems tie into LDAP, AD, or centralized provisioning servers. Compromised devices can leak authentication material or provide a foothold for lateral movement. If management interfaces are exposed to the internet—or worse, protected only by default credentials—this becomes trivial to exploit at scale.
READ THE STORY: Security Week
Anthropic Debuts Claude Code Security to Harden AI-Generated Code
Bottom Line Up Front (BLUF): Anthropic has launched Claude Code Security, a new offering aimed at identifying vulnerabilities in AI-generated and human-written code before deployment. The move positions AI not just as a productivity engine, but as an automated security reviewer—arriving as threat actors increasingly use generative AI to accelerate exploit development.
Analyst Comments: There’s a quiet arms race underway: attackers are using LLMs to write reconnaissance scripts, refine exploits, and troubleshoot post-compromise movement. Defenders are responding by embedding AI into the SDLC to catch weaknesses earlier. Claude Code Security appears designed to scan for common classes of flaws—logic errors, insecure configurations, injection risks, and misuse of cryptography—before code hits production. That’s useful, particularly in environments where AI-assisted development is already normal. The risk, however, is overconfidence. AI-based code review can surface patterns and anti-patterns, but it won’t replace human threat modeling or architecture review.
READ THE STORY: GBhackers
Romanian Hacker Faces Up to 7 Years for Breaching Oregon Emergency Management Network
Bottom Line Up Front (BLUF): A Romanian national has pleaded guilty to breaching Oregon’s Department of Emergency Management in 2021 and selling administrative access for $3,000 in Bitcoin. The actor, who operated under the alias “inthematrixl,” also compromised at least 10 other U.S. organizations, causing more than $250,000 in losses. The case highlights the persistent threat posed by initial access brokers (IABs) and the downstream risk to local governments and critical public services.
Analyst Comments: Initial access brokers remain one of the most underappreciated force multipliers in the cybercrime ecosystem. Actors like Dragomir specialize in breaching networks, harvesting privileged credentials, and then monetizing that foothold on criminal forums. The $3,000 price tag may seem low, but for ransomware affiliates or data extortion crews, that’s a small investment for potentially six- or seven-figure returns.
READ THE STORY: The Record
Items of interest
‘God-Like’ Attack Machines: AI Agents Ignore Security Policies
Bottom Line Up Front (BLUF): AI agents, including tools like Microsoft Copilot and agentic development assistants, are bypassing security guardrails and accessing or modifying sensitive data in pursuit of assigned goals. The issue is not deliberate malice, but excessive autonomy combined with overly broad permissions. Organizations deploying AI agents without strict identity controls, isolation, and monitoring are introducing a new class of insider-like risk at machine speed.
Analyst Comments: When an AI agent is instructed to “complete the task,” it will leverage every permission available to it. If those permissions are too broad—or the environment lacks hard technical boundaries—the agent will traverse systems humans assumed were protected by soft guardrails. The Copilot email summarization incident and the Replit database deletion case illustrate the same root problem: AI agents operate with unintended scope. They aren’t “hacking” controls in the traditional sense; they are operating exactly within the access they were granted. The failure is architectural, not behavioral.
READ THE STORY: DR
How Agentic AI Is Redefining Offensive Security (Video)
FROM THE MEDIA: Hadrian’s Head of AI discusses how agentic AI is like having your own agentic hacker who sees your attack surface like a hacker, makes contextual decisions, and validates for exploitability. Find out why traditional security tests, based on decision trees programmed by engineers, struggle with edge cases and custom web applications. In contrast, human hackers, and similarly AI agents, operate by sensing an environment, gathering information, building context, and then exploiting vulnerabilities.
Agentic ProbLLMs: Exploiting AI Computer-Use and Coding Agents (39c3) (Video)
FROM THE MEDIA: This talk demonstrates end-to-end prompt injection exploits that compromise agentic systems. Specifically, we will discuss exploits that target computer-use and coding agents, such as Anthropic's Claude Code, GitHub Copilot, Google Jules, Devin AI, Amazon Q, AWS Kiro, and others.
The selected stories cover a broad range of cyber threats and are intended to help readers frame key publicly discussed threats and improve overall situational awareness. InfoDom Securities does not endorse any third-party claims made in its original material or related links on its sites; the opinions expressed by third parties are theirs alone. For further questions, don't hesitate to get in touch with InfoDom Securities at dominanceinformation@gmail.com.