Feb 20, 2026 - This weekly report highlights significant cyber security incidents, evolving attack trends, critical CVEs and exploits, key risks for organizations, and practical recommendations to bolster defenses.

Current cyber security incidents


This week witnessed a surge in high-impact ransomware campaigns targeting critical infrastructure and manufacturing sectors across North America and Europe. Notably, the LockBit group announced a new encryption module dubbed "LockBit NX," which incorporates advanced cryptographic routines designed to evade detection by conventional endpoint security solutions. Simultaneously, a supply chain breach affecting a major managed service provider led to secondary infections in over a dozen small-to-medium enterprises, underscoring the persistent supply chain threat.

In the cloud environment, security teams reported a series of credential-stuffing attacks on popular document collaboration platforms. Attackers leveraged automated bots and breached password databases to gain unauthorized access to corporate accounts. Several organizations experienced data leakage before account owners detected the intrusions, illustrating the need for continuous monitoring and rapid incident response capabilities.

Current attack methods and trends


Phishing remains the dominant initial access vector, but recent campaigns have refined their social engineering lures using generative AI to craft highly personalized messages. Analysts observed a spike in deepfake-based voice phishing calls targeting financial executives, aiming to manipulate wire transfers. Concurrently, supply chain attacks have evolved into multi-stage operations: initial infiltration through vulnerable third-party software, lateral movement via stolen credentials, and final payload delivery using living-off-the-land tactics.

Cloud misconfigurations and exposed administrative interfaces are increasingly exploited by both cybercriminals and state-aligned actors. In particular, misconfigured S3 buckets and unsecured Kubernetes dashboards allowed mass exfiltration of sensitive data from cloud-native environments. Attackers also leveraged stolen API keys to spin up rogue compute instances for cryptomining operations, driving up costs and masking illicit activities.

Important CVEs and exploits (selection)


CVE-2023-54784 (Atlassian Confluence): A critical template injection vulnerability in Confluence Server and Data Center that enables remote code execution. Public exploit code emerged this week, and widespread scans indicate active exploitation in the wild.

CVE-2024-29592 (Microsoft Exchange ProxyNotShell): An elevation-of-privilege flaw within Exchange Server’s proxy functionality. Although Microsoft released patches in April, unpatched servers continue to be scanned and exploited by ransomware gangs.

CVE-2024-21860 (Windows DCOM): A zero-day vulnerability in the Distributed Component Object Model on Windows Server. Attackers are chaining this to achieve domain-level compromise in hybrid environments. Patches are now available, and immediate application is advised.

CVE-2024-3016 (Zoho ManageEngine ADSelfService Plus): A pre-authentication RCE bug in ManageEngine’s password management tool. Exploitation kits have been incorporated into popular exploit frameworks, raising the urgency for patch deployment.

Greatest risks for companies


Ransomware remains the most acute financial and operational risk, with evolving RaaS ecosystems lowering the barrier to entry for novice threat actors. The growing adoption of remote work and cloud services expands the attack surface, increasing the likelihood of misconfigurations and compromised credentials. Insider threats, both malicious and accidental, persist as a significant vector for data exfiltration and system tampering.

From a strategic standpoint, supply chain and third-party risks present systemic vulnerabilities that can amplify the impact of a single compromise across multiple organizations. Furthermore, the rapid integration of AI-driven tools into business processes introduces new risks around data poisoning, model inversion, and adversarial manipulation, which have yet to be fully addressed by existing security frameworks.

Recommendations


Organizations should implement a layered defense strategy combining strong patch management, robust identity and access controls, and continuous monitoring of cloud and on-premises environments. Enforce multi-factor authentication across all critical systems and routinely rotate service and API keys. Conduct regular tabletop exercises to refine incident response procedures and test defenses against the latest ransomware and supply chain attack scenarios. Invest in advanced threat hunting capabilities to detect living-off-the-land techniques and anomalous AI-driven phishing attempts, and engage in information-sharing communities to stay abreast of emerging threats.

By prioritizing proactive vulnerability management, continuous security awareness training, and cross-functional collaboration between IT, security, and business units, organizations can significantly reduce their exposure to the evolving threat landscape and improve resilience against sophisticated cyber attacks.