eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
UNC1069 Targets Cryptocurrency Sector with New Tooling and AI-Enabled Social Engineering
Bottom Line: UNC1069—suspected to be linked to North Korea—ran a highly targeted campaign against the cryptocurrency and decentralized finance sectors using social engineering, including a hijacked Telegram account and a fake Zoom meeting reportedly featuring AI-generated video.
On February 9th, 2026, Mandiant released a report on a targeted intrusion campaign attributed to UNC1069, a financially motivated threat actor with connections to North Korea. The campaign targeted a fintech organization in the cryptocurrency and decentralized finance sector. In the latest campaign, UNC1069 initiated contact through a Telegram account belonging to a legitimate cryptocurrency executive that had been compromised. The attacker persuaded the victim to schedule a call through a Calendly link that led to a meeting hosted on a spoofed Zoom domain. During the call, the victim reportedly observed a video of a well-known CEO in the cryptocurrency space, which appeared to be a deepfake.
As part of the deception, the victim was informed of a fabricated technical issue that required troubleshooting. The attackers used the pretext of audio problems to initiate a “ClickFix” technique, in which they instructed the victim to run diagnostic commands on their machine. These actions initiated the download and execution of multiple malware components.
Following execution of the commands, evidence collected by Mandiant indicated that the malicious script led to the deployment of a packed backdoor called WAVESHAPER. WAVESHAPER served as an initial conduit that delivered an additional downloader, HYPERCALL, which in turn delivered a follow-on backdoor tracked as HIDDENCALL.
HYPERCALL also facilitated the deployment of SUGARLOADER and a backdoor called SILENCELIFT that was used for host beaconing and telemetry. The attackers installed CHROMEPUSH through SUGARLOADER to maintain persistence. They configured the payload to ensure it executed at startup, disguising the service as a legitimate Apple updater. Once installed, the malware captured keystrokes, collected cookies, and periodically staged screenshots and keylogging data within user profile directories. DEEPBREATH was used to steal browser data from Chrome, Brave, and Edge, credentials from the user’s Keychain, Telegram session data from two different application version, and Apple Notes database files.
eSentire Threat Intelligence Analysis:
Mandiant has observed UNC1069 leveraging advanced social engineering and malware deployment techniques to target both corporate entities and individuals within the cryptocurrency ecosystem, including software vendors, developers, venture capital firms, and their employees and executives. According to Google Threat Intelligence Group (GTIG), UNC1069 utilizes tools such as Gemini to assist in tooling development, conduct operational research, and support reconnaissance activities. Additionally, Kaspersky recently reported that Bluenoroff, an actor with operational overlap with UNC1069, is leveraging GPT-4o models to manipulate images, further underscoring the broader adoption of generative AI technologies within advanced cyber operations.
Use of AI is enabling threat actors to develop malware that can update or modify its operations in real-time which can be a major challenge for defenders. With new AI models being continuously introduced it is likely that threat actors will continue to harness their capabilities to enhance their attacks. Last year, Google Threat Intelligence Group (GTIG) released a report on Adversarial Misuse of Generative AI. The update highlighted new Artificial Intelligence (AI)-enabled malware actively used by both state-sponsored threat actors and cyber criminals.
Among the notable examples, PROMPTFLUX was identified as an experimental VBScript-based dropper that leverages Gemini through a “Thinking Robot” module to enable obfuscation and just-in-time self-modification. In attacks targeting Ukraine, the Russian state-sponsored actor APT28 deployed PROMPTSTEAL (also known as LAMEHUG), which used Hugging Face to dynamically generate execution commands. GTIG also reported that a China-linked threat actor impersonated a student participating in a Capture-the-Flag (CTF) challenge to bypass Gemini’s safeguards and obtain assistance with phishing, exploitation, and web shell development. Additionally, threat actors were observed monetizing AI-enabled capabilities, including malware development, deepfake generation, and vulnerability exploitation, through underground marketplaces.
eSentire’s Threat Intelligence Team has observed an increase in cases related to DPRK threat actors, where their objective of the operation was to harvest credentials and sensitive application data. Organizations operating in the critical sectors should adopt layered defenses that address social engineering, endpoint compromise, and data exfiltration. Defenders are encouraged to block the identified domains and IPs associated with this campaign. Employees with access to wallets, infrastructure, or signing keys, should receive targeted training that emphasizes the risks of ClickFix-style “troubleshooting” instructions delivered over calls or chats and should follow a strict protocol for verifying identities across out-of-band channels. Following any suspected exposure, organizations must rotate session tokens, API keys, and browser-based credentials, and should audit browser extensions and native messaging hosts across developer devices. For additional insights into how threat actors are operationalizing Large Language Models (LLMs), the eSentire Threat Response Team has published a TRU+ blog and presented on this topic during the February 2026 Threat Intelligence Briefing (TIB).
Microsoft’s February 2026 Patch Tuesday
Bottom Line: During Microsoft's monthly Patch Tuesday release for February 2026, 58 total vulnerabilities were patched, including six zero-day vulnerabilities that are reported to be exploited in the wild.
February 10th, 2026, marked Microsoft's monthly Patch Tuesday release for February 2026. Within this month’s release, Microsoft patched a total of 58 vulnerabilities, including six zero-day vulnerabilities that have been reported to be exploited in the wild. These vulnerabilities include:
- CVE-2026-21510 (CVSS: 8.8): A protection mechanism failure within Windows Shell that can allow an unauthorized attacker to bypass security features over a network
- CVE-2026-21513 (CVSS: 8.8): A protection mechanism failure within the MSHTML Framework that allows unauthorized attackers to bypass security features over a network
- CVE-2026-21514 (CVSS: 7.8): A reliance on untrusted inputs within a security decision in Microsoft Office Word that can allow an unauthorized attacker to bypass a security feature locally
- CVE-2026-21519 (CVSS: 7.8): A type confusion vulnerability in Desktop Window Manager (DWM) that can lead an authorized attacker to elevate privileges locally
- CVE-2026-21525 (CVSS: 6.2): A null pointer dereference vulnerability in Windows Remote Access Connection Manager that can lead an unauthorized attacker to perform Denial-of-Service (DoS) locally
- CVE-2026-21533 (CVSS: 7.8): An improper privilege management vulnerability found in Windows Remote Desktop that can enable an authorized attacker to elevate privileges locally
Within the vulnerability pages for each flaw listed above, Microsoft has indicated that exploitation has been detected but shares no information on the context in which it was seen. Of the outlined flaws, CVE-2026-21510, CVE-2026-21513, and CVE-2026-21514 all enable malicious content to be executed while bypassing security features, but they also all require user interaction, in that an attacker must convince a user to open or execute malicious content for exploitation to occur. CVE-2026-21519 and CVE-2026-21533 are privilege escalation vulnerabilities, while CVE-2026-21525 can lead to DoS. However, all require pre-conditions to be met prior to exploitation, such as an attacker already having local or remote access to a target device.
Another notable vulnerability addressed within the Patch Tuesday release was CVE-2026-20841 (CVSS: 7.8), a command injection flaw in Notepad that can lead to Remote Code Execution (RCE). CVE-2026-20841 also requires user interaction, by convincing a user to click a malicious link contained within a Markdown file, which can result in retrieving and executing additional payloads. At the time of disclosure, Microsoft assessed that exploitation of this flaw was “Less Likely”.
eSentire Threat Intelligence Analysis:
Following Microsoft's Patch Tuesday release, CISA added the six zero-day vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. CISA did not provide any context regarding how the vulnerabilities were exploited, or any confirmation if the observed exploitation is the same as what Microsoft identified.
Microsoft gave credit to CrowdStrike's Advanced Research Team for the discovery of CVE-2026-21533, and Acros Security for reporting CVE-2026-21525. CrowdStrike indicated that the “exploit binary modifies a service configuration key, replacing it with an attacker-controlled key” that could allow an attacker to elevate privileges and add a new user to the Administrator group, but did not attribute the activity to a specific target or group. Acros stated that they found an exploit for CVE-2026-21525 in December 2025 within a public malware repository while searching for an exploit for CVE-2025-59230, a privilege escalation vulnerability in Windows Remote Access Connection Manager. Acros claimed that they don't have any information on the exploit being used, but that the “quality of the combined exploit for both issues suggested professional work”.
The vulnerability identified impacting Notepad, CVE-2026-20841, is notable as it involves malicious URLs contained within Markdown files. Microsoft only recently added Markdown support to Notepad, along with AI-integration with Copilot, evolving the lightweight application into an attack vector that can be abused. At the time of writing, there are unverified reports of publicly available Proof-of-Concept (PoC) exploit code for this vulnerability. The release of PoC exploit code has often been associated with widespread exploitation, as it lowers the barrier of entry for threat actors to make use of it within their attacks. Microsoft indicates that the vulnerability could be abused in social engineering attacks, where a threat actor may attempt to trick a user into opening a malicious Markdown file, and alleged PoC exploit code may increase the likelihood of attacks.
Organizations are urged to apply the Patch Tuesday releases as soon as possible, given that reports indicate exploitation has been identified in the wild. As many of the vulnerabilities outlined require user interaction to exploit, organizations should conduct Phishing and Security Awareness Training (PSAT) to educate users on how to identify and report malicious content, along with ensuring that Endpoint Detection and Response (EDR) solutions are deployed on all assets. eSentire's Managed Vulnerability Service (MVS) has plugins in place for the Notepad vulnerability and the zero-days, except for CVE-2026-21514, which has plugins listed as “Coming Soon”. eSentire's Threat Intelligence team continues to track this topic for additional information and detection opportunities.
Expedition Cloud: Leaked Chinese APT Documents
Bottom Line: Leaked technical documents reviewed by Recorded Future suggest China has been using a covert cyber range—part of a system dubbed “Expedition Cloud”—to rehearse offensive cyber operations against replicas of neighboring countries’ critical infrastructure.
On February 9th, 2026, Recorded Future published reporting on leaked technical documents indicating China has been using a covert cyber range. The materials include source code, training content, and software assets, offering rare pre-operational insight into how attacks could be prepared before deployment, rather than inferred after an intrusion. The range is described as modeling “real network environments” of China’s “main operational opponents” in the South China Sea and Indochina directions, with scenarios spanning power generation, energy transmission, transportation, and even smart home infrastructure.
The documents were reportedly found on an exposed FTP server and appears to have been pulled from a developer device compromised by malware; independent experts assessed the files as highly likely authentic due to their scope, engineering detail, and evidence of iterative development (patching, debugging, work reports). The platform is attributed to CyberPeace (赛宁网安), a firm that publicly touts ties to government and military stakeholders, though the documents do not identify the commissioning state entity.
The system formalizes offensive workflow into distinct “reconnaissance” and “attack” teams and emphasizes repeatability: templated target networks can be continuously attacked under controlled conditions, while comprehensive telemetry (network traffic, host activity, operator actions) is logged so performance can be measured, replayed, and optimized. Analysts cited strict segmentation and treating the simulated environment as “untrusted” as indicators of classified use and sensitive tooling, and they warned that the real value may be the data exhaust—training sets that enable increasingly automated, AI-assisted campaign planning. In context of widely reported Chinese APT patterns—methodical reconnaissance, long dwell times, and scaling tradecraft across many victims—this kind of rehearsal environment would plausibly reduce time-on-target and improve reliability of operations against complex critical-infrastructure networks during heightened geopolitical tension.
eSentire Threat Intelligence Analysis:
The leak detailing the “Expedition Cloud” training platform raises two material concerns for defenders monitoring PRC-linked activity. First, a high-fidelity cyber range purpose-built around critical infrastructure scenarios would materially improve an operator’s ability to rehearse disruption-oriented access and actions-on-objective against power, energy transmission, and transportation environments—reducing operational friction during real-world intrusions. Second, the volume and structure of the platform’s test artifacts could support model training or automation pipelines that enable more autonomous offensive workflows (e.g., accelerating reconnaissance, pathfinding, and execution with reduced human oversight), potentially compressing attack timelines and increasing scale.
While PRC officials routinely deny involvement in offensive cyber operations, external reporting (Recorded Future) assesses high confidence in the authenticity of the leaked files based on their breadth and technical depth. The platform has not been conclusively tied to a single named APT and may be shared across multiple state-aligned intrusion sets. Reporting indicates it appears to have been developed by the China-based company CyberPeace, leaving open whether the customer is a PLA element, Ministry of State Security/Ministry of Public Security components, or multiple buyers. This aligns with external reporting on China’s cyber ecosystem, where state tasking often blends with contractor support and shared capability development across agencies. This ambiguity is consistent with how PRC ecosystem enablers can provide services or tooling that are subsequently leveraged by multiple operational units, complicating attribution while still strengthening overall capability.
From a tradecraft perspective, the leak aligns with long-observed PRC intrusion patterns: disciplined, stealth-forward initial access; extensive internal discovery and mapping; credential acquisition; and controlled lateral movement before transitioning to a planned attack phase. Those methods map directly to the platform’s apparent separation of reconnaissance and attack teams and its emphasis on repeatable procedures—an approach well-suited to complex, high-impact environments. This also tracks with the strategic logic attributed by U.S. authorities to campaigns such as “Volt Typhoon,” where pre-positioning inside critical infrastructure benefits from prior rehearsal to validate pathways, minimize time-on-target during an attack, and enable rapid execution once access is obtained.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
