Age verification vendor Persona inadvertently exposed a frontend system on a US government-authorized server, revealing extensive surveillance capabilities.
The exposed code revealed the system performs 269 distinct biometric and identity verification checks, including screening against identity watchlists and adverse media sources, raising significant privacy concerns.
The exposed code has since been removed.
Vulnerability Details
Affected Product: Persona Age Verification and Identity Screening Platform
Exploitation Status: Publicly accessible files discovered by researchers.
Risk & Impact
Triage: High. The exposure of code detailing surveillance, watchlist screening, and adverse media checks presents a severe reputational and privacy risk.
Attack Vector: The frontend was exposed to the open internet, allowing researchers to access 2,456 files containing the application's code.
This revealed the system's extensive data collection and screening processes, including facial recognition matching and analysis of IP addresses, browser fingerprints, and government IDs.
Ease of Exploit: Trivial. The files were publicly accessible on the internet without requiring authentication.
Action Plan
Immediate Action: The exposed code has been removed by the vendor.
Workaround: Not applicable, as the issue was a direct exposure by the vendor. Customers should review their data processing agreements with Persona.
Detection: The exposure was identified by security researchers. Organizations using Persona should monitor for any official disclosures from the company regarding potential data impact.
Relevant professional terms
Adverse Media Screening
The process of systematically scanning public sources, such as news articles, social media, and legal databases, to uncover negative information or associations that may signal risk linked to individuals or entities.
Identity Watchlist
A database of individuals and entities that have been identified as posing a potential risk. These lists are often maintained by government or law enforcement agencies and include suspected terrorists, money launderers, fraudsters, or Politically Exposed Persons (PEPs).
CISA has ordered federal agencies to immediately patch a critical vulnerability, CVE-2026-22769, in Dell RecoverPoint for Virtual Machines.
The flaw, which stems from hard-coded credentials, is under active exploitation by state-sponsored actors and allows for complete system takeover.
Vulnerability Details
Affected Product: Dell RecoverPoint for Virtual Machines (versions prior to 6.0.3.1 HF1)
Identifier: CVE-2026-22769
CVSS Score: 10.0 (Critical)
Exploitation Status: Actively Exploited
Risk & Impact
Triage: Immediate patching required. CISA has set a deadline of February 21, 2026, for federal agencies.
Attack Vector: A remote, unauthenticated attacker can use hard-coded credentials to gain root-level access to the underlying operating system.
Ease of Exploit: Trivial. The vulnerability requires no user interaction and can be exploited by an attacker with knowledge of the hard-coded credentials.
Action Plan
Immediate Action: Upgrade to Dell RecoverPoint for Virtual Machines Version 6.0.3.1 HF1 or later.
Workaround: Dell recommends deploying the appliance within a trusted, access-controlled internal network protected by firewalls and network segmentation.
Detection: Threat actors have been observed deploying malware families such as SLAYSTYLE, BRICKSTORM, and GRIMBOLT after successful exploitation.
Organizations should hunt for associated Indicators of Compromise (IOCs).
Relevant professional terms
Known Exploited Vulnerabilities (KEV) Catalog
A list maintained by CISA of vulnerabilities that have been observed being actively exploited in the wild. Federal agencies are required to remediate these vulnerabilities within specified timeframes.
Lateral Movement
A technique used by attackers to move through a network after gaining initial access. In this case, after exploiting the Dell flaw, the threat actor moved laterally to deploy malware and establish persistence.
The University of Mississippi Medical Center (UMMC) suffered a significant ransomware attack, forcing the closure of 34 of its 35 statewide clinics (Jackson Medical Mall dialysis clinic remained open for scheduled emergency appointments) and the cancellation of surgeries and appointments.
The attack crippled IT systems, including the electronic medical records platform, Epic, forcing staff to revert to manual downtime procedures.
Impact Assessment
Operational Impact: 34 of 35 clinic locations were closed, and elective surgeries, procedures, and imaging appointments were canceled. Hospital and emergency services remain active using manual "downtime procedures".
Strategic Takeaway
This incident underscores the extreme vulnerability of the healthcare sector to cyberattacks, where operational disruptions directly impact patient care and safety.
Relevant professional terms
Ransomware
Malicious software designed to block access to a computer system or data, often by encrypting files, until a sum of money is paid.
Downtime Procedures
A set of manual protocols used by an organization to continue critical operations when computer systems or networks are unavailable.
Threat actors are actively exploiting a critical, pre-authentication remote code execution (RCE) vulnerability in BeyondTrust's remote access software.
The campaign leverages the flaw to deploy the SparkRAT and VShell backdoors, enabling full system compromise and data theft.
Key TTPs
Initial Access: Exploiting an OS command injection flaw in the WebSocket handshake process of public-facing applications.
Execution: Using PowerShell and multi-method download cradles (wget, curl) to fetch and run payloads.
Defense Evasion: VShell malware masquerades as legitimate system services, and some attack stages involve fileless memory execution.
Campaign Analysis
This campaign demonstrates the immediate weaponization of critical vulnerabilities in identity and access management platforms. The use of versatile RATs like SparkRAT and stealthy backdoors like VShell allows attackers to quickly pivot from initial access to widespread lateral movement and data exfiltration.
Targeting & Infrastructure
Target Profile: Observed attacks span financial services, healthcare, legal, and technology sectors across the U.S., Europe, and Australia.
Remote Code Execution (RCE): A vulnerability that allows an attacker to execute arbitrary commands on a target system over a network, without prior authorization.
Remote Access Trojan (RAT): Malware that provides an attacker with covert, administrative-level control over an infected computer.
A supply chain attack compromised the popular ‘Cline’ CLI tool on the npm registry, forcing ~4,000 developers to install the legitimate but unauthorized OpenClaw autonomous AI agent.
An attacker used a stolen credential (exfiltrated via prompt-injection cache poisoning) to publish the trojanized version 2.3.0, which was downloaded approximately 4,000 times before being removed.
Key TTPs
Initial Access: An attacker exploited a prompt injection vulnerability to steal a compromised npm publishing token.
Execution: The malicious package used a `postinstall` script in the `package.json` file to automatically install OpenClaw globally onto the developer's system.
Campaign Analysis
This incident highlights the growing trend of weaponizing AI developer tools and CI/CD pipelines for supply chain attacks.
OpenClaw itself is legitimate open-source; the risk is the forced, silent deployment of a prompt-injection-vulnerable agent inside corporate environments. it demonstrates a critical vulnerability in the software ecosystem that could be used to distribute malware widely.
Targeting & Infrastructure
Target Profile: Developers using the 'Cline' command-line interface (CLI) tool who installed or updated version 2.3.0 from the npm registry.
Infrastructure: The attack leveraged the official npm registry to distribute the compromised package.
Relevant Terms
Supply Chain Attack: A cyberattack that targets less-secure elements in an organization's software or hardware supply network to compromise the final product or end user.
Prompt Injection: A technique used to hijack the output of a large language model (LLM) by embedding malicious instructions within an otherwise benign-looking input.
The FBI reports over $20M in losses from 700+ jackpotting incidents in 2025 alone (part of $40.73M total per DOJ indictments).
These attacks are orchestrated by the Venezuelan Tren de Aragua (TdA) syndicate-designated Foreign Terrorist Organization-linking cyber-physical crime directly to terror financing. This surge highlights a growing trend of cyber-physical threats targeting financial infrastructure.
Key Findings
Financial losses from ATM malware exceeded $20 million in 2025 alone.
There were over 700 reported jackpotting incidents last year, out of 1,900 total since 2020.
Attackers gain physical access to ATMs, often using generic keys, to install malware like Ploutus that bypasses standard bank authorization.
The Bottom Line
This trend signifies a critical shift from digital-only heists to physical-world attacks enabled by sophisticated software. Financial institutions must now re-evaluate the physical security and software integrity of their ATM fleets, as they represent an increasingly vulnerable, high-value target for organized cybercrime.
Relevant Terms
ATM Jackpotting: A type of cyberattack where criminals use malware or a physical device to force an ATM to dispense large amounts of cash on demand.
Ploutus: A specific family of advanced malware first seen in 2013, designed to compromise ATMs by exploiting their software and forcing them to dispense cash.
Ukrainian Jailed For Aiding North Korean Infiltrators
Executive Summary
The U.S. Department of Justice sentenced a Ukrainian national to five years in prison for his role in a scheme that supplied stolen U.S. identities to North Korean IT workers, enabling them to fraudulently gain employment at American companies and funnel wages back to the regime.
The Scheme
TTP 1: Selling stolen U.S. identities via a dedicated online platform to overseas IT workers.
TTP 2: Operating U.S.-based "laptop farms" to mask the workers' true location and appear domestic.
TTP 3: Using money service transmitters to bypass traditional banking and transfer illicit earnings to foreign accounts.
The Players
Threat Actor: North Korean State-Sponsored IT Workers
Facilitators Arrested: Oleksandr Didenko
The Consequence
Outcome: Guilty plea to wire fraud conspiracy and aggravated identity theft, resulting in a 60-month prison sentence.
Assets Seized/Forfeited: Agreed to forfeit more than $1.4 million.
Strategic Takeaway
This sentencing highlights a crackdown on the international facilitators who enable North Korea's illicit revenue generation schemes, which directly fund its state objectives.
Relevant Terms
Identity Theft: The fraudulent acquisition and use of a person's private identifying information, usually for financial gain.
Laptop Farm: A collection of computers used to create the appearance that remote workers are operating from a specific domestic location, masking their true international origins.
