The Cyber Byte - 5 February 2026

Recent intelligence highlights a surge in sophisticated attacks, including a multi-stage supply chain compromise of the Notepad++ text editor and an AI-assisted cloud intrusion that achieved administrative privileges in under 10 minutes [1, 7]. State-sponsored actors like Mustang Panda and Ricochet Chollima continue to deploy targeted espionage campaigns using advanced social engineering and custom malware [4, 5]. The disclosure of critical vulnerabilities in widely used software like Google Chrome and TP-Link routers, alongside advanced credential theft techniques targeting Active Directory, underscores the immediate and varied risks facing organizations globally [2, 3, 6].

Significant Cyber Incidents and Articles of Interest

• Notepad++ Supply Chain Compromise: The popular text editor Notepad++ had its update infrastructure compromised between June and December 2025, leading to the distribution of malicious updates to a targeted set of users. The attackers, who retained access until December 2025, targeted individuals and organizations in the government, financial, and IT sectors across the Philippines, Vietnam, El Salvador, and Australia. Over four months, from July to October 2025, the threat actors utilized at least three distinct and rotating infection chains, deploying payloads such as Cobalt Strike Beacons and the Chrysalis backdoor. Techniques included abusing an old vulnerability in ProShow software, leveraging Lua scripts for execution, and DLL sideloading, demonstrating a skilled and persistent effort to maintain their access and compromise high-profile targets through a trusted software channel [1].

• AI-Assisted AWS Cloud Intrusion: In a notable cloud operation, a threat actor infiltrated an AWS environment and escalated privileges to an administrative level in just eight minutes, with strong indicators of AI-assisted execution. Initial access was gained via valid credentials found in a public S3 bucket. The attacker then used privilege escalation through Lambda function code injection, moved laterally across 19 unique AWS principals, abused Amazon Bedrock for "LLMjacking," and attempted to provision high-cost GPU instances for resource abuse. Evidence pointing to the use of Large Language Models (LLMs) includes Serbian code comments, hallucinated AWS account IDs in enumeration attempts, and the rapid generation of complex, malicious scripts. This incident signals an evolution in cloud attack methodologies, where AI can significantly accelerate the attack lifecycle from initial access to full compromise [7].

• Advanced Active Directory Credential Theft: A recent analysis detailed a multi-stage attack focused on stealing the "crown jewels" of an enterprise network: the Active Directory database (NTDS.dit). Adversaries were observed using legitimate remote administration tools like PsExec to gain access to a domain controller. Once on the system, they leveraged the built-in vssadmin utility to create a Volume Shadow Copy, allowing them to copy the locked NTDS.dit file. This file, containing the password hashes for every account in the domain, enables offline password cracking and can lead to a complete organizational compromise. This incident highlights the necessity of correlating endpoint and network telemetry to detect adversaries who "live off the land" by abusing legitimate system tools to steal an organization's entire identity infrastructure [2].

• High-Severity Google Chrome Vulnerabilities: Google released a security update for its Chrome browser (version 144.0.7559.132/.133) on February 3, 2026, to address two high-severity vulnerabilities. The first, CVE-2026-1861, is a heap buffer overflow in the libvpx video processing library, while the second, CVE-2026-1862, is a type confusion flaw in the V8 JavaScript engine. Both vulnerabilities could be exploited by a remote attacker through specially crafted web content to execute arbitrary code or cause a system crash. While Google has not reported active exploitation, the widespread use of Chrome makes these flaws a significant risk, and users are strongly urged to apply the update immediately [3].

• Critical TP-Link Router Vulnerabilities: Multiple critical authenticated command injection vulnerabilities were disclosed in the TP-Link Archer BE230 v1.2 Wi-Fi router. In total, nine distinct flaws (CVEs) were identified in the router's firmware, affecting web interfaces, VPN modules, and configuration management functions. An attacker with administrative credentials could execute arbitrary OS commands and gain complete control over the device. While eight of the nine flaws require adjacent network access, one (CVE-2026-22229) can be exploited remotely by importing a malicious configuration file. TP-Link has released a patched firmware version (1.2.4 Build 20251218) to address these high-severity vulnerabilities [6].

Threat Actor Activity

• Mustang Panda (aka HoneyMyte): The China-linked APT group Mustang Panda conducted a targeted espionage campaign between late December 2025 and mid-January 2026, aimed at government officials and international diplomats in Asia and Eastern Europe. The group used spear-phishing emails containing lures disguised as official U.S. diplomatic briefings to build credibility. The attack chain involved DLL search-order hijacking to load DOPLUGS, a downloader variant of the PlugX surveillance tool. The malware then utilized PowerShell for follow-on activities and employed custom encryption to evade detection [5].

• Ricochet Chollima (Operation: ToyBox Story): Attributed to the North Korean APT group Ricochet Chollima, this campaign targeted activists focused on North Korea. The attack began with spear-phishing emails containing Dropbox links to ZIP archives. These archives held malicious LNK files disguised with legitimate-looking icons and names. The LNK file executed PowerShell commands to initiate a multi-stage infection, ultimately using the Dropbox API for C2 communications and data exfiltration. The lures impersonated South Korean think tanks and referenced timely topics, such as North Korean soldiers in Russia, to entice victims [4].

• PhantomVAI Loader Operators: Multiple threat actors are leveraging the PhantomVAI loader in worldwide campaigns, suggesting a loader-as-a-service model. The loader is a modular .NET tool that uses a publicly available process hollowing utility named Mandark to inject various payloads, including RATs like Remcos and XWorm, and stealers such as DarkCloud and SmokeLoader. The loader frequently masquerades as a legitimate tool, most often as Microsoft.Win32.TaskScheduler.dll. The presence of Portuguese strings in the code suggests a possible Brazilian or Portuguese origin for the developer [8].

Unattributed Actors

• Notepad++ Attackers: A skilled and persistent group compromised the Notepad++ update server to deliver targeted malware. One of their infection chains involved a DLL sideloading technique commonly used by Chinese-speaking threat actors. They deployed Cobalt Strike, the Chrysalis backdoor, and used the temp.sh file-sharing service for initial reconnaissance exfiltration [1].

• AI-Assisted Cloud Intruder: An operator, possibly of Serbian origin, based on code comments, demonstrated advanced capabilities in an AI-assisted attack against an AWS environment. The actor utilized sophisticated TTPs, including Lambda function code injection for privilege escalation, extensive lateral movement, and LLMjacking via Amazon Bedrock. Defense evasion was achieved through IP rotation and role chaining [7].

Indicators to Watch

New Malware and Tools:

• PhantomVAI Loader: A modular .NET loader using a process hollowing utility called Mandark to inject payloads. It often masquerades as Microsoft.Win32.TaskScheduler.dll (version 2.11.0.0) and delivers a variety of malware, including Remcos, XWorm, AsyncRAT, and DarkCloud [8].

• DOPLUGS: A downloader variant of the PlugX RAT used by Mustang Panda. It is loaded via DLL search-order hijacking and uses PowerShell for subsequent actions [5].

• Chrysalis Backdoor: Deployed in the Notepad++ supply chain attack, this backdoor was delivered via a DLL sideloading technique common among Chinese-speaking threat actors [1].

Emerging Campaigns and Trends:

• Diplomatic Lures: Be cautious of unexpected emails with attachments claiming to be diplomatic briefings or policy summaries, a tactic used by Mustang Panda to target government officials [5].

• Abuse of Cloud Services for C2: Threat actors like Ricochet Chollima are increasingly using legitimate services like the Dropbox API for command and control, blending malicious traffic with normal network activity to evade detection [4].

Suspicious Infrastructure and Behavior Patterns:

• NSIS Installers and temp.sh Traffic: Monitor for executions of NSIS installers creating %localappdata%\Temp\ns.tmp directories, and for network traffic to temp.sh. These were key indicators in the Notepad++ supply chain attack for initial compromise and data exfiltration [1].

• NTDS.dit Extraction Activity: Security teams should monitor for the use of vssadmin to create Volume Shadow Copies, especially on domain controllers, followed by access to the NTDS.dit file. Correlating this activity with remote administration tools like PsExec is a strong indicator of Active Directory credential theft [2].

• Anomalous Cloud Activity: In AWS environments, defenders should watch for rapid resource enumeration across multiple services, suspicious updates to Lambda function code, and attempts to invoke unused or marketplace-based Amazon Bedrock models. These behaviors were indicative of the recent AI-assisted intrusion [7].

• PhantomVAI Loader Indicators: The public YARA rule MAL_NET_Katz_Stealer_Loader_May25 is effective at detecting PhantomVAI. Key strings to monitor for include ExecutarMetodoVAI, VirtualMachineDetector, caminhovbs, and nomedoarquivo [8].