Threat Intelligence Debrief 2 Feb 2026

Summary & highlights

Microsoft NTLM Phase-Out: Detection & Migration Guidance. Global HYIP Investment Scam Campaign - 4,200+ Fake Trading Platforms. Microsoft NTLM Deprecation - Enterprise Migration Planning Required.

Highlights

TL-2026-0005 — Malicious Chrome Extensions: Affiliate Hijacking & ChatGPT Token Theft Campaign
TL-2026-0006 — Automated MongoDB Extortion Campaign Targeting Exposed Instances
TL-2026-0007 — UAT-8099 (China) BadIIS Malware Campaign Targeting IIS Servers for SEO Fraud
TL-2026-0008 — OpenClaw CVE-2026-25253: One-Click RCE via Token Exfiltration
TL-2026-0010 — Microsoft Office Zero-Day CVE-2026-21509: OLE Security Bypass Under Active Exploitation

Theme of the day

credential-theft
social-engineering
cwe-306
cwe-287
cwe-345

Threats published

47 threat lines in the 2026-02-02 debrief, most severe first. Each links to its full profile.

Static Tundra (Dragonfly/Energetic Bear) ICS Attacks on Polish Energy InfrastructureCRITICAL2026-02-02
ShinyHunters SSO Vishing Campaign - Cloud Data Theft via Social EngineeringCRITICAL2026-02-02
Static Tundra ICS Attacks on Polish Energy Infrastructure with DynoWiperCRITICAL2026-02-02
SolarWinds Access Rights Manager (ARM) Systemic Deserialization RCE — 17 CVEs, 6 Unauth SYSTEM RCE, Access Control ParadoxCRITICAL2026-02-02
GuptiMiner — North Korean (Kimsuky/APT43) Supply Chain Attack Hijacking eScan Antivirus HTTP Updates via AitMCRITICAL2026-02-02
Static Tundra Attacks on Polish Energy Infrastructure - 30+ Wind and Solar FarmsCRITICAL2026-02-02
eScan Antivirus Supply Chain Attack - Update Server CompromiseCRITICAL2026-02-02
CVE-2026-21509: Russian Hackers Exploit Microsoft Office Vulnerability Against UkraineCRITICAL2026-02-02
CVE-2026-25253: OpenClaw One-Click RCE via Malicious LinkCRITICAL2026-02-02
Malicious Chrome Extensions: Affiliate Hijacking & ChatGPT Token Theft CampaignHIGH2026-02-02
Automated MongoDB Extortion Campaign Targeting Exposed InstancesHIGH2026-02-02
UAT-8099 (China) BadIIS Malware Campaign Targeting IIS Servers for SEO FraudHIGH2026-02-02
OpenClaw CVE-2026-25253: One-Click RCE via Token ExfiltrationHIGH2026-02-02
Microsoft Office Zero-Day CVE-2026-21509: OLE Security Bypass Under Active ExploitationHIGH2026-02-02
LLMJacking: 175,000 Exposed Ollama AI Servers Targeted for AbuseHIGH2026-02-02
Malicious Chrome Extensions: Affiliate Hijacking and ChatGPT Token Theft CampaignHIGH2026-02-02
Malicious OpenClaw/MoltBot Skills - 230+ Supply Chain PackagesHIGH2026-02-02
CVE-2026-21509 - Microsoft Office Security Feature Bypass (CISA KEV)HIGH2026-02-02
MongoDB Data Extortion Campaign - 1,400+ Databases RansackedHIGH2026-02-02
GlassWorm VS Code Extension Supply Chain Attack - Open VSX HijackHIGH2026-02-02
Hugging Face Abused for Android Malware Distribution - Credential Stealer CampaignHIGH2026-02-02
ShinyHunters Extortion Campaign - Evolved Vishing and SSO Credential TheftHIGH2026-02-02
GlassWorm macOS Attack via Compromised OpenVSX ExtensionsHIGH2026-02-02
SLSH Extortion Group - Swatting and Executive Harassment TacticsHIGH2026-02-02
MongoDB Database Extortion Campaign - 1,400+ Instances RansackedHIGH2026-02-02
Microsoft NTLM Deprecation - Three-Stage Phase-Out PlanHIGH2026-02-02
IPIDEA Residential Proxy Botnet Disruption by GoogleHIGH2026-02-02
Malicious OpenClaw/MoltBot Skills - 230+ Password-Stealing PackagesHIGH2026-02-02
ShinyHunters-Branded Extortion Campaign Expands with Vishing & SSO AttacksHIGH2026-02-02
175,000 Exposed Ollama LLM Hosts Enable AI Model AbuseHIGH2026-02-02
Cyber Insights 2026: AI-Powered Malware and Attack EvolutionHIGH2026-02-02
BaBlock/Rorschach Ransomware Hits Sapienza University of Rome — Femwar02 Affiliate First Appearance, Fastest Encryption (4m30s), DLL Sideloading via Cortex XDR, Direct Syscalls EDR Evasion, Autonomous AD GPO Propagation, 122K Students Affected, Millions-Euro RansomHIGH2026-02-02
Microsoft NTLM Phase-Out: Detection & Migration GuidanceMEDIUM2026-02-02
Global HYIP Investment Scam Campaign - 4,200+ Fake Trading PlatformsMEDIUM2026-02-02
Microsoft NTLM Deprecation - Enterprise Migration Planning RequiredMEDIUM2026-02-02
175,000 Exposed Ollama Hosts Enabling LLM AbuseMEDIUM2026-02-02
Cloud Storage Payment Scam Campaign - Fake Renewal PhishingMEDIUM2026-02-02
Record $158 Billion Illicit Cryptocurrency Flows in 2025MEDIUM2026-02-02
NationStates Gaming Platform Data BreachMEDIUM2026-02-02
Panera Bread Data Breach - 5.1 Million Accounts ExposedMEDIUM2026-02-02
White House Revokes Biden-Era Software Security MemorandumsMEDIUM2026-02-02
Google Slides Presentation Abuse for Phishing and Malware DeliveryMEDIUM2026-02-02
Anthropic API Scanning Campaign - Targeting Self-Hosted LLM InfrastructureMEDIUM2026-02-02
Global Surge in HYIP (High-Yield Investment Platform) ScamsMEDIUM2026-02-02
White House Revokes Biden-Era Software Security MemorandumsMEDIUM2026-02-02
Active Scanning for Exposed Anthropic API EndpointsMEDIUM2026-02-02
Japan-Britain Cybersecurity Cooperation Agreement Amid China ConcernsLOW2026-02-02

Techniques observed

214 MITRE ATT&CK and ATLAS techniques appear across the day’s reports.

Threat actors

12 named threat actors across the reports.

crazzynoob (dominant — 98% of attacks)
UAT-8099
Hecker
10Xprofit / Unknown
ShinyHunters
GlassWorm
Scattered Lapsus ShinyHunters (SLSH)
IPIDEA Operators / Multiple Criminal Groups (550+)
Femwar02 (BaBlock/Rorschach affiliate)
Static Tundra
Kimsuky
Russian State-Sponsored

Nation-state attribution

China
North Korea (partial)
United States
China (referenced threat)
Russia
France
North Korea

Severity breakdown

critical9
high23
medium14
low1

Indicator & detection coverage

Counts only: the indicator values and detection rule text behind them are tiered.

2228 indicators of compromise · Red and above. Compare plans

behavioral 1301
network 580
host 277
file 61
email 6
financial 3

728 new detection rules (100% of the day’s threats covered) · Blue and above. Compare plans

Daily Intelligence Briefing — Monday, February 2, 2026