La Sapienza University Ransomware Attack: A 2026 Case StudyLa Sapienza University Ransomware Attack: A 2026 Case Study
In early February 2026, La Sapienza University in Rome, one of Europe's largest educational institutions, experienced a significant cyberattack attributed to the pro-Russian group Femwar02. The attackers deployed the BabLock (also known as Rorschach) ransomware, leading to the encryption of critical data and the disruption of numerous IT services. In response, the university proactively shut down its network systems to safeguard data integrity and initiated restoration efforts with the assistance of Italy's National Cybersecurity Agency. ([techcrunch.com](https://techcrunch.com/2026/02/05/one-of-europes-largest-universities-knocked-offline-for-days-after-cyberattack/?utm_source=openai))
This incident underscores the escalating threat of sophisticated ransomware attacks targeting educational institutions, highlighting the urgent need for enhanced cybersecurity measures and preparedness within the sector.
High impact
Kill Chain
ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Spain's Ministry of Science 2026 Data Breach: A Wake-Up Call for Government Cybersecurity
In early February 2026, Spain's Ministry of Science, Innovation, and Universities experienced a significant cybersecurity incident. A threat actor known as 'GordonFreeman' claimed to have exploited an Insecure Direct Object Reference (IDOR) vulnerability, combined with leaked credentials, to gain full administrative access to the ministry's systems. The attacker allegedly exfiltrated sensitive data, including personal records, email addresses, enrollment applications, and official documents. In response, the ministry partially shut down its IT systems, affecting various services for researchers, universities, and students, and suspended all ongoing administrative procedures to assess and mitigate the breach. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/spains-ministry-of-science-shuts-down-systems-after-breach-claims/?utm_source=openai))
This incident underscores the critical importance of robust access controls and vulnerability management within governmental institutions. The exploitation of an IDOR vulnerability highlights the need for comprehensive security assessments and prompt remediation of identified weaknesses. Additionally, the breach serves as a reminder of the persistent threats posed by cyber actors targeting sensitive governmental data, emphasizing the necessity for continuous monitoring and incident response preparedness.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Infy APT 2026: Iranian State-Sponsored Cyber Espionage Resurfaces
In early 2026, the Iranian state-sponsored Advanced Persistent Threat (APT) group known as Infy, or 'Prince of Persia,' resumed operations following a period of inactivity during Iran's internet blackout in January. The group deployed updated versions of their malware tools, Foudre and Tonnerre, to target entities across Iran, Iraq, Turkey, India, Canada, and Europe. Notably, Infy utilized a new command-and-control (C2) infrastructure, incorporating both HTTP and Telegram for communication, and exploited a 1-day vulnerability in WinRAR to deliver their payloads. This resurgence underscores Infy's continued commitment to cyber espionage activities aligned with Tehran's strategic interests. ([thehackernews.com](https://thehackernews.com/2026/02/infy-hackers-resume-operations-with-new.html?utm_source=openai))
The re-emergence of Infy highlights the persistent threat posed by state-sponsored cyber actors who continuously evolve their tactics to evade detection. Organizations, especially those in the targeted regions, must remain vigilant and enhance their cybersecurity measures to defend against such sophisticated threats.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Windows Screensaver Malware Attack 2026: A New Vector for Remote Access Exploitation
In early February 2026, cybersecurity researchers identified a spear-phishing campaign exploiting Windows screensaver files (.scr) to deploy remote access tools (RATs) on corporate networks. Attackers sent business-themed phishing emails containing links to download files disguised as routine documents, which were actually malicious screensaver files. When executed, these files installed legitimate remote monitoring and management (RMM) tools, such as SimpleHelp, providing attackers with persistent remote access to compromised systems. This method allowed adversaries to bypass traditional security controls, as screensaver files are often overlooked as potential threats. The campaign underscores the evolving tactics of threat actors who leverage unconventional file types and legitimate software to infiltrate networks, emphasizing the need for organizations to reassess and strengthen their security postures against such sophisticated social engineering attacks.
Medium impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
CISA's 2025 KEV Catalog Expansion: A Wake-Up Call for Cybersecurity
In 2025, the Cybersecurity and Infrastructure Security Agency (CISA) expanded its Known Exploited Vulnerabilities (KEV) catalog by 245 entries, marking a 20% increase and bringing the total to 1,484 vulnerabilities. Notably, 24 of these newly added vulnerabilities were actively exploited in ransomware attacks, targeting products from vendors such as Microsoft, Apple, and Oracle. This surge underscores the escalating threat landscape where attackers rapidly exploit both new and legacy vulnerabilities.
The inclusion of older vulnerabilities, some dating back to 2007, highlights the persistent risk posed by unpatched systems. The rapid weaponization of these vulnerabilities by threat actors emphasizes the critical need for organizations to prioritize timely patching and robust vulnerability management practices to mitigate potential breaches and operational disruptions.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
DragonForce Ransomware Cartel: A New Era of Cyber Threats in 2025
In March 2025, the DragonForce ransomware group rebranded itself as a cartel, allowing affiliates to create their own brands while utilizing DragonForce's infrastructure and tools. This strategic shift led to increased collaboration among ransomware groups, notably with LockBit and Qilin, aiming to consolidate power and enhance operational effectiveness. The cartel model facilitated larger, more coordinated ransomware campaigns, employing advanced tactics such as double extortion, exploitation of known vulnerabilities, and the use of sophisticated tools like Cobalt Strike and Mimikatz. This evolution resulted in a significant uptick in ransomware incidents, impacting various sectors globally, including government entities, retail operations, manufacturing companies, and construction firms. The formation of such cartels underscores a concerning trend in the cyber threat landscape, where ransomware groups are increasingly collaborating to amplify their reach and impact. This development necessitates heightened vigilance and adaptive defense strategies from organizations to mitigate the evolving threats posed by these alliances.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Iranian Cyber Espionage Intensifies: Middle East Expatriates Targeted in 2026
In early 2026, Iranian state-sponsored cyber actors intensified their espionage activities targeting Middle Eastern expatriates, Syrians, and Israelis. Utilizing sophisticated social engineering techniques, these actors created credible fake personas on multiple platforms, engaging targets over extended periods to build trust. Once rapport was established, they employed spear-phishing campaigns, often delivering malicious links or documents under the guise of legitimate communications. These operations aimed to steal sensitive information, monitor communications, and track the movements of individuals of interest. The impact of these campaigns has been significant, compromising personal and professional data, and posing threats to the safety and privacy of the targeted individuals. The use of advanced social engineering tactics underscores the evolving nature of cyber threats emanating from state-sponsored actors. This incident highlights the urgent need for heightened vigilance and robust cybersecurity measures, especially for individuals and organizations operating in or related to the Middle East. The increasing sophistication of these attacks, coupled with their targeted nature, reflects a broader trend of state actors leveraging cyber capabilities for intelligence gathering and influence operations.
Medium impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Phishing Campaign 2026: Malformed URLs Bypass Security Measures
In early February 2026, a sophisticated phishing campaign emerged, utilizing malformed URLs to bypass traditional email security measures. Attackers embedded URLs with irregular parameter structures in phishing emails, leading recipients to malicious websites. This technique effectively evaded detection systems that rely on standard URL parsing and validation, thereby increasing the likelihood of successful credential theft and malware distribution. The campaign underscores the evolving tactics of cybercriminals in circumventing established security protocols. The resurgence of such techniques highlights the need for organizations to continuously adapt their security strategies. As attackers refine their methods to exploit weaknesses in URL parsing and detection, it becomes imperative for security systems to incorporate advanced analysis capabilities to identify and mitigate these sophisticated threats.
Medium impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Salt Typhoon 2025: Unveiling the Global Espionage Campaign
In 2025, the Chinese state-sponsored cyber group known as Salt Typhoon orchestrated a sophisticated global espionage campaign, compromising government and critical infrastructure across 37 countries and conducting reconnaissance in 155 nations. The attackers exploited unpatched vulnerabilities in networking equipment, including those from Ivanti, Palo Alto, and Cisco, to gain initial access. Once inside, they established persistent access by modifying access control lists, creating privileged accounts, and enabling remote management on unusual high ports. This allowed them to monitor communications, harvest administrator credentials, and exfiltrate sensitive data through covert tunnels, all while remaining undetected for extended periods. The campaign's targets included telecommunications networks, government systems, transportation hubs, lodging networks, and military infrastructure, enabling continuous surveillance of individuals, communications, and movements globally. ([forbes.com](https://www.forbes.com/sites/emilsayegh/2025/08/30/us-and-allies-declare-salt-typhoon-hack-a-national-defense-crisis/?utm_source=openai))
The Salt Typhoon campaign underscores the escalating threat posed by state-sponsored cyber actors and the vulnerabilities within critical infrastructure. The attackers' ability to exploit known vulnerabilities and maintain long-term access highlights the urgent need for organizations to prioritize timely patching, robust access controls, and comprehensive monitoring to detect and mitigate such sophisticated threats.
Critical impact
Kill Chain
ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Notepad++ Supply Chain Attack: A Wake-Up Call for Software Security
Between June and December 2025, Notepad++, a widely used text editor, was compromised through a sophisticated supply chain attack attributed to Chinese state-sponsored hackers. The attackers infiltrated the hosting provider's infrastructure, allowing them to intercept and redirect update traffic to malicious servers. This enabled the delivery of backdoored versions of Notepad++ to selected users, primarily targeting sectors such as government, telecommunications, and critical infrastructure. The breach was identified in early February 2026, prompting immediate security enhancements and advisories for users to update to version 8.9.1 or later.
This incident underscores the escalating threat of supply chain attacks, where adversaries exploit trusted software distribution channels to infiltrate target systems. Organizations are urged to reassess and fortify their software update mechanisms, implement stringent verification processes, and remain vigilant against such sophisticated attack vectors.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Amaranth Dragon's 2025 Exploitation of WinRAR Vulnerability: A Cybersecurity Wake-Up Call
In August 2025, the cyberespionage group Amaranth Dragon, linked to China's APT41, exploited the CVE-2025-8088 vulnerability in WinRAR to target government and law enforcement agencies across Southeast Asia. By crafting malicious RAR archives, they leveraged the vulnerability to place encrypted payloads in the Windows Startup folder, ensuring persistence upon system reboot. These attacks were characterized by the use of legitimate tools combined with the custom Amaranth Loader, which retrieved payloads from command-and-control servers concealed behind Cloudflare infrastructure, enhancing stealth and targeting precision.
The continued exploitation of CVE-2025-8088 by multiple threat actors underscores the critical need for organizations to promptly update software and implement robust security measures. Despite the release of WinRAR version 7.13, which addresses this flaw, many systems remain vulnerable due to delayed patching and user unawareness, highlighting a significant gap in cybersecurity defenses.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
EDR Killer Tool Exploits EnCase Driver: A Wake-Up Call for Cybersecurity
In early February 2026, cybersecurity researchers identified a sophisticated attack where threat actors utilized a legitimate but revoked EnCase kernel driver to disable endpoint detection and response (EDR) tools. The attackers gained initial access through compromised SonicWall SSL VPN credentials, exploiting the absence of multi-factor authentication. Once inside, they deployed a custom EDR killer tool disguised as a firmware update utility, which installed the 'EnPortv.sys' driver—a component of the EnCase forensic software. This driver, despite its certificate being revoked, was accepted by Windows due to the operating system's handling of driver signatures. The malware leveraged the driver's kernel-mode capabilities to terminate 59 security processes, effectively neutralizing the system's defenses. The attack was halted before ransomware deployment, but it underscores the critical need for robust access controls and vigilant monitoring of security infrastructure.
This incident highlights a growing trend where attackers exploit vulnerable or outdated drivers to disable security mechanisms, a technique known as 'Bring Your Own Vulnerable Driver' (BYOVD). The persistence of such methods, despite existing security measures, emphasizes the necessity for organizations to implement comprehensive defense strategies, including regular updates to security protocols and the enforcement of multi-factor authentication across all access points.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
