Feb 6, 2026 - This weekly report summarizes the latest cyber security incidents, emerging attack trends, key CVEs and exploits, and offers actionable guidance for organizations to strengthen their defenses.

Current cyber security incidents


In the past week, high-profile ransomware campaigns have continued to disrupt operations across multiple sectors. The LockBit 3.0 group claimed responsibility for infiltrations at two mid-sized manufacturing firms in Europe, exfiltrating sensitive blueprints and financial records. Meanwhile, a recently disclosed breach at a major U.S. utility provider exposed customer account details and service histories, underscoring the persistent threat to critical infrastructure. The breach exploited a zero-day in a third-party billing application, highlighting that even well-segmented networks remain vulnerable when peripheral systems are overlooked.

Beyond ransomware, cloud-based file transfer services remain in the attacker’s crosshairs. The MOVEit incident continues to unfold, with new victims identified weekly and data from over 1,100 organizations confirmed stolen. Threat actors are now bundling stolen data for double extortion schemes, threatening to auction sensitive information on underground forums. This ongoing campaign demonstrates the importance of rapid patch management and proactive threat hunting in SaaS environments.

Current attack methods and trends


Adversaries are increasingly leveraging AI-driven social engineering to craft personalized phishing lures, using data scraped from public social profiles to tailor messages in real time. These deep-fake voice phishing (vishing) attacks have tricked employees into authorizing fraudulent wire transfers and divulging multi-factor authentication codes. Security teams are reporting a marked increase in “whaling” attempts against C-level executives, with email threads manipulated to appear as ongoing conversations.

On the technical front, supply chain compromises remain a top concern. Attackers are embedding malicious code into open-source libraries, which then propagate into thousands of downstream projects. Recent experiments demonstrated how a single typo-squatted package on a major code repository can give threat actors backdoor access to enterprise development pipelines. Additionally, cryptojacking has surged, with attackers exploiting misconfigured Kubernetes clusters to deploy stealthy mining workloads, impacting cloud budgets and performance.

Important CVEs and exploits (selection)


CVE-2024-20794: A critical unauthenticated RCE in Fortinet FortiManager and FortiAnalyzer that has seen active exploitation in the wild. Patches were released last month, but scans reveal thousands of internet-facing devices remain unpatched.

CVE-2024-23954: Veeam ONE remote code execution vulnerability affecting monitoring servers. Proof-of-concept exploits are circulating, allowing attackers to execute arbitrary commands with SYSTEM privileges.

CVE-2024-21432: An authentication bypass in Oracle WebLogic Server exploited by advanced persistent threat (APT) groups. Reports indicate lateral movement within compromised networks, facilitating data exfiltration over encrypted channels.

CVE-2024-21984: A heap-based buffer overflow in the RDP protocol implementation on Windows Server, enabling remote code execution without user interaction. Microsoft’s advisory warns of adversaries chaining this vulnerability with elevated privilege exploits.

Greatest risks for companies


The confluence of poorly managed third-party software, insufficient network segmentation, and rapid digital transformation projects has expanded attack surfaces to unprecedented levels. Companies relying on legacy systems face heightened exposure, particularly when maintenance windows are infrequent. Simultaneously, the escalation of ransomware double extortion means that even successfully restored backups cannot fully mitigate the threat of data publication.

Insider risk continues to grow as remote work models blur the lines between personal and corporate environments. Weak endpoint controls and unmanaged devices increase the likelihood of credential theft and lateral pivoting. At the executive level, reputational damage from publicized breaches and regulatory fines for non-compliance with data protection laws now carry as much weight as operational disruption or financial loss.

Recommendations


Organizations should adopt a risk-based patch management strategy that prioritizes internet-facing assets and those with known public exploits. Regular threat hunting exercises, focusing on unusual outbound traffic and anomalous authentication patterns, can detect intrusions before significant harm occurs. Implementing zero-trust network segmentation and strict least-privilege controls will limit lateral movement and reduce the blast radius of any compromise.

Employee awareness programs must evolve to address AI-enabled phishing and deep-fake attacks. Simulated exercises that test both email and voice channels can prepare staff for the latest social engineering tactics. Finally, maintaining immutable, offline backups and validating recovery procedures ensures resilience against extortion-driven ransomware schemes. Continuous monitoring of code repositories and supply chain components will help identify malicious dependencies early, preventing compromise at the development stage.