eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Notepad++ Updater Hijacked by State-Sponsored Hackers
Bottom Line: Notepad++ disclosed that a Chinese state-sponsored threat actor had compromised its hosting provider's infrastructure. Over a six-month period, the updater was abused, redirecting select targets to attacker-controlled servers hosting malicious updates.
On February 2nd, 2026, the maintainer of Notepad++, a popular opensource text editor, disclosed that the tools’ hosting provider had been breached, and some users were delivered malicious updates in a supply chain type attack. The hosting provider was compromised from June 2025 to September, with the threat actor maintaining access to internal Notepad++ services until December. According to Rapid7 researchers, the compromise was used to enable highly targeted attacks, with specific Notepad++ users receiving a malicious update delivering tools including Cobalt Strike and a previously undocumented backdoor malware tracked as Chrysalis. The Chrysalis backdoor enables stealthy persistent access, information theft, and communication with Command and Control (C2) servers.
Researchers from Kaspersky reported three unique infection chains associated with this supply chain campaign. From July to August, the company observed threat actors performing reconnaissance activity and delivering a Metasploit downloader that resulted in deployment of Cobalt Strike. In September, the threat actors began collecting additional reconnaissance information and altered infrastructure associated with Metasploit and Cobalt Strike. The final infection chain was observed in October and shifted payloads to the Chrysalis backdoor.
The Notepad++ disclosure stated that the activity was likely associated with a “Chinese state-sponsored group”. Researchers from Rapid7 provided additional information and directly attributed the campaign to the known Chinese state-sponsored APT group Lotus Blossom (aka. Raspberry Typhoon, Billbug). The group is considered to be sophisticated, operating since 2009, with notable attacks against both governments and private industries. Information on the group’s victim targeting via Notepad++ remains limited; victims have been identified in the Philippines, Vietnam, El Salvador, and Australia, and include governments, financial organizations, and IT service providers.
eSentire Threat Intelligence Analysis:
The prevalence of Notepad++ across both geographic regions and industries makes any attack via the software extremely concerning. While this campaign had the potential to impact millions of devices, this scale was not observed. Instead, Lotus Blossom chose to specifically target a limited number of users or organizations. The select targeting strongly suggests that the goal of activity is espionage related. By only targeting specific organizations, Lotus Blossum limited the likelihood of detection, which partially explains why this activity was not disclosed for more than six months.
Following discovery of this campaign, Notepad++ switched hosting providers, specifically noting “stronger security practices” of the new provider. Additionally, Notepad++ version 8.9.1 was released, which includes relevant security enhancements. While the text editor itself was not compromised, users are still strongly encouraged to update to the most recent release.
The eSentire Threat Response Unit (TRU) became aware of limited reports of malicious activity associated with the update function of Notepad++ in November 2025. While details were minimal at the time, behavioural threat hunts were performed for suspicious update behavior, and a new Endpoint detection was created. When more details became available in February 2026, eSentire carried out customer wide threat hunts for known Indicators of Compromise (IoCs), as well as adding known IP addresses to the eSentire Global Block List. The eSentire Threat Intelligence team continues to track this topic for additional details and detection opportunities.
SolarWinds Web Help Desk Vulnerability Exploited (CVE-2025-40551)
Bottom Line: A vulnerability within SolarWinds Web Help Desk is confirmed to be under active exploitation. As Proof-of-Concept exploit code is also available, organizations should apply relevant security patches as soon as possible.
On February 3rd, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE‑2025‑40551, a critical vulnerability affecting SolarWinds Web Help Desk (WHD), to its Known Exploited Vulnerabilities (KEV) catalog. This vulnerability has a CVSS score of 9.8, and it can allow unauthenticated attackers to achieve Remote Code Execution (RCE) on vulnerable systems. On January 28th, 2026, SolarWinds disclosed this issue and released a secure version of the product (WHD 2026.1) on the same day.
CVE‑2025‑40551 is an untrusted data deserialization vulnerability in SolarWinds Web Help Desk that enables unauthenticated attackers to execute arbitrary commands on the host. The flaw arises when the application processes serialized data without enforcing appropriate trust boundaries, which allows a malicious actor to craft payloads that lead to code execution. The vulnerability affects versions prior to WHD 2026.1 and is considered critical as a detailed public Proof‑of‑Concept (PoC) exploit was released shortly after disclosure.
Research indicates that CVE‑2025‑40551 can be used as part of a chained attack involving additional vulnerabilities in WHD. Horizon3.ai demonstrated that attackers can first obtain an authenticated session with elevated privileges via CVE‑2025‑40537, then enable the upload of files to a newly created component via CVE‑2025‑40536, and finally leverage CVE‑2025‑40551 to upload and execute a malicious Java object, resulting in remote code execution.
While CVE-2025-40551 is the only issue of the three listed in CISA’s KEV catalog, PoC chaining illustrates how attackers can operationalize the flaw to achieve system compromise. At this time, it is unclear whether adversaries are exploiting the supporting flaws or leveraging alternate exploitation paths to reach the deserialization condition. U.S. federal agencies are required to complete remediation no later than February 6th, 2026, further emphasizing the severity and urgency associated with this flaw.
On February 6th and 8th, Microsoft and Huntress both released reports outlining recent campaigns targeting vulnerabilities in unpatched SolarWinds Web Help Desk (WHD) instances.
eSentire Threat Intelligence Analysis:
Successful exploitation of CVE‑2025‑40551 can allow attackers to fully compromise the WHD systems. Because WHD often integrates with directories, ticketing data, and other internal systems, the compromise could expose sensitive operational information and facilitate lateral movement across the network. In the worst case, the vulnerability could be leveraged as an entry point for ransomware operators or Advanced Persistent Threat (APT) actors, potentially leading to business disruption and data exposure. Organizations should upgrade all SolarWinds Web Help Desk instances to version 2026.1 after completing a business impact review. The upgrade should be prioritized for any externally accessible or business‑critical WHD instances. If there is any suspicion of exploitation, organizations should review WHD logs for evidence of compromise. The review should include session logs to identify access using default client accounts and any invocation of restricted functionality. Administrators should also examine logs for JSON‑RPC errors and for anomalous but whitelisted payloads that may indicate the upload of malicious Java objects.
In environments where a chained exploit is suspected, security teams should look for the creation of new LoginPref components consistent with CVE‑2025‑40537, unexpected file uploads consistent with CVE‑2025‑40536, and any artifacts associated with the execution of serialized payloads through CVE‑2025‑40551. If Indicators of Compromise (IoCs) are discovered, defenders should isolate affected systems and initiate incident response procedures, including credential rotation and an assessment of lateral movement.
The eSentire Threat Intelligence team published a security advisory addressing CVE-2025-40551 on February 4th, 2026, and eSentire’s Managed Vulnerability Service (MVS) has plugins in place to assist in identifying vulnerable assets. eSentire MDR for Network includes detections to identify attempts to exploit this vulnerability, and customer wide threat hunts have been performed. The Threat Intelligence team is actively tracking this topic for additional details and detection opportunities.
2026 Winter Olympics Targeted by Russian Hacktivists
Bottom Line: Politically motivated cyberattacks have been identified targeting organizations associated with the 2026 Olympic Games. Organizations that are directly or indirectly involved in the games should evaluate the increased risk of targeting by both financially and ideologically motivated groups.
In the days leading up to the opening ceremony for the 2026 Winter Olympics, Italian government officials confirmed that a cyberattack against websites linked to the Olympics had been prevented, which they attributed to Russia. The attack involved a Distributed Denial-of-Service (DDoS) against 120 websites that are associated with the Olympic Games, including foreign ministry offices, hotels in the host town of Cortina d'Ampezzo, and websites linked to the Games themselves. Italian politician Antonio Tajani indicated that the reported attacks had been prevented, while also claiming that they were “actions of Russian origin”.
Following the attacks, the group NoName057(16) claimed responsibility on their Telegram channel, stating that the “pro-Ukrainian course of the Italian government leads to the fact that support for Ukrainian terrorists is punishable by our DDoS missiles on websites”. NoName057(16) is a pro-Russian hacktivist group that formed in 2022 and has a history of performing DDoS attacks against websites owned by governments and organizations within NATO-allied countries that are “perceived as hostile to Russian geopolitical interests”.
eSentire Threat Intelligence Analysis:
Within an advisory published by CISA on pro-Russian hacktivist groups, they provide information on NoName057(16), indicating that the group formed as a covert project within the Center for the Study and Network Monitoring of the Youth Environment (CISM). CISA indicates that CISM was established on “behalf of the Kremlin” and was used to develop NoName057(16)'s proprietary DDoS tool, DDoSia, pay for the group’s infrastructure, serve as administrators for the groups Telegram channels, and select its DDoS targets. NoName057(16) has also been identified as working with other pro-Russian hacktivist groups, including the Cyber Army of Russia Reborn (CARR), a group established by the Russian General Staff Main Intelligence Directorate (GRU). Russia's employing of non-state actors within their campaigns are likely attempts to hinder the attribution of attacks to the Russian state, while maintaining plausible deniability and strategic ambiguity to reduce escalatory responses.
Russia has a history of targeting the Olympic Games over the past 10 years, through campaigns conducted by both pro-Russian hacktivist and APT groups. One example involves the Russian-linked APT28 (Fancy Bear) gaining access to the World Anti-Doping Agency's (WADA) Anti-Doping Administration and Management System (ADAMS) database to access athlete medical data relating to the 2016 Summer Olympics in Rio, following Russia's doping scandal. During the 2018 Winter Olympics in South Korea, the group APT44 (Sandworm) utilized a phishing campaign to target members of the organizing committee, which was used to deploy the wiper malware Olympic Destroyer to disrupt the games. During the 2024 Summer Olympics in Paris, the Russian-aligned groups Storm-1679 and Storm-1099 conducted misinformation campaigns to spread fear and deter attendance. In their analysis on this topic, Palo Alto suggests that Russia's targeting of the Olympics began following bans due to the doping scandal in 2016, and continues due to ongoing bans as a result of Russia's invasion of Ukraine.
However, Russia-aligned threat actors are not the only groups that target the Olympic Games with cyberattacks, as major international sporting events are often seen as prime targets for all types of attackers. This is due in part to the large crowds they draw from around the world, high-stakes and time-sensitive scheduled events, and stressors which can be abused by social engineering techniques. In 2024, the Canadian Centre for Cyber Security (CCCS) published an advisory on this topic, stating that both financially motivated and state-sponsored attacks target international sporting events, such as the Olympics. Organizations around these types of events experience an influx of business, leading to a higher amount of sensitive data being stored, which can be desirable for threat actors to steal and sell on underground markets. Hacktivist groups may use the opportunity provided by these events to conduct attacks and promote their message, ensuring it is seen by a wider audience, while state-sponsored attackers may use these events to conduct cyber-espionage campaigns against high-profile individuals.
To protect against these threats, individuals attending the 2026 Olympic Games, and organizations that are sponsoring or involved with them, should remain on heightened alert and increase monitoring for possible attacks. Organizations should conduct Phishing and Security Awareness Training (PSAT) to educate users on how to identify and report malicious content and ensure that all externally facing devices are fully up to date on patches.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
