Daily Cybersecurity News – February 6, 2026

A critical unauthenticated remote code execution (RCE) vulnerability, identified as CVE-2026-24423, in SmarterTools SmarterMail is being actively exploited in ransomware attacks. The flaw allows attackers to take control of email servers by sending malicious HTTP requests, prompting an urgent warning from CISA for immediate patching.

Spain's Ministry of Science, Innovation, and Universities shut down its IT systems following a claimed cyberattack, disrupting administrative procedures and online services for citizens, researchers, and companies. A threat actor has claimed responsibility and alleges the theft of sensitive data.

This incident highlights the critical risk of combined vulnerabilities, where a common web application flaw was reportedly leveraged with compromised credentials to achieve high-level system access.

La Sapienza University in Rome, one of Europe's largest universities, suffered a major ransomware attack that forced it to shut down its entire IT network. The incident caused widespread operational disruption, impacting systems like email and the main website.

This attack highlights the severe operational risk that ransomware poses to large academic institutions, which often have complex networks and valuable data.

Ransomware operators are abusing virtual machines (VMs) from ISPsystem, a legitimate infrastructure provider, to host and deliver malicious payloads at scale. This tactic, observed in campaigns like 'WantToCry,' allows attackers to use legitimate infrastructure for stealthy operations.

This campaign highlights a trend of threat actors leveraging legitimate services and bulletproof hosting providers to build resilient and hard-to-trace infrastructure. The use of default VM templates creates a digital fingerprint that ironically exposes the scale of the malicious operations.

Threat actors are exploiting a legitimate, signed (but revoked) kernel driver from the EnCase forensic tool to disable Endpoint Detection and Response (EDR) and other security products. This "Bring Your Own Vulnerable Driver" (BYOVD) attack allows adversaries to gain kernel-level access and neutralize defenses before deploying ransomware or other malware.

This incident highlights a critical gap in Windows' Driver Signature Enforcement, which still loads the driver despite its certificate being revoked over a decade ago. The weaponization of trusted, albeit outdated, software demonstrates a persistent trend of attackers abusing legitimate tools to bypass modern security controls.

This week's threats reveal a focus on the human element, highlighted by a former Google engineer's conviction for AI espionage and threat actors using voice phishing (vishing) to bypass Single Sign-On (SSO) protections for SaaS application theft.

The convergence of insider threats and sophisticated social engineering demonstrates that technical access controls like SSO and MFA are insufficient on their own. Security leaders must prioritize a defense-in-depth strategy that combines stringent employee vetting with continuous, context-aware security training and anomaly detection to counter attacks targeting the human layer.

The FBI was unable to extract data from a Washington Post reporter's iPhone during a raid due to Apple's Lockdown Mode being enabled. This occurred as part of an investigation into a government contractor accused of leaking classified information.

Commercially available, high-security features on personal devices can effectively prevent data extraction, even by federal law enforcement forensic teams.