Isometric network nodes depicting global cyber vulnerabilities and exploits.

Daily Cybersecurity News - February 26, 2026

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

February 26, 2026 4:00 PM 5 min read

Cisco Zero-Day Enables Total Takeover

Critical

Executive Summary

A critical authentication bypass zero-day vulnerability, CVE-2026-20127, is being actively exploited in Cisco Catalyst SD-WAN solutions. This flaw allows unauthenticated, remote attackers to gain administrative privileges, leading to potential full network compromise.

Vulnerability Details

Affected Product: Cisco Catalyst SD-WAN Controller and Manager for On-Prem and Cloud-Hosted deployments in versions prior to 20.9.8.2, 20.12.5.3, 20.12.6.1, 20.15.4.2, and 20.18.2.1.
Identifier: CVE-2026-20127
CVSS Score: 10.0 (Critical).
Exploitation Status: Actively Exploited.

Risk & Impact

Triage: Immediate patching is required.
Attack Vector: An unauthenticated, remote attacker can send crafted requests to an affected system, exploiting a flaw in the peering authentication mechanism to gain administrative access. This allows for manipulation of the SD-WAN fabric configuration, insertion of rogue devices, and unauthorized control of network traffic.
Ease of Exploit: A sophisticated threat actor (tracked as UAT-8616) has been exploiting this vulnerability since at least 2023, indicating a readily available exploit for skilled adversaries.

Action Plan

Immediate Action: Upgrade to a patched software version immediately.
Workaround: No workarounds are available to address this vulnerability.
Detection: Hunt for unauthorized control connection peering events in logs, unexpected software downgrades/upgrades, and log entries in /var/log/auth.log showing accepted public keys from unknown IP addresses.

Relevant professional terms

Zero-Day Vulnerability: A flaw in software or hardware that is unknown to the party responsible for patching it. When exploited by attackers, it is called a zero-day attack.
Authentication Bypass: A vulnerability that allows an attacker to circumvent a system's authentication measures and gain unauthorized access to protected resources or functionalities.

Source: Tenable

Fake Coding Tests Backdoor Developers

Executive Summary

A coordinated campaign is targeting software developers with malicious repositories disguised as Next.js job interview coding tests. The goal is to achieve remote code execution on the developer's machine to exfiltrate data and deploy additional payloads.

Key TTPs

Initial Access: Social engineering through job-themed lures and malicious repositories on platforms like Bitbucket.
Execution: Malicious JavaScript is executed in-memory via multiple triggers, including VS Code's "folderOpen" task automation or by running `npm run dev`.
Defense Evasion: The malware executes filelessly (in-memory) to reduce on-disk artifacts and uses obfuscated code within seemingly legitimate libraries.

Campaign Analysis

This campaign exploits routine developer workflows, turning standard actions like opening a project or running a development server into an attack vector. The ultimate objective is to compromise developer systems, which often hold high-value assets like source code, credentials, and access to cloud infrastructure.

Targeting & Infrastructure

Target Profile: Software developers, specifically those using the Next.js framework.
Infrastructure: Malicious repositories hosted on Bitbucket and payload delivery via legitimate services like Vercel.

Relevant Terms

C2 (Command and Control): The server infrastructure that attackers use to send commands to and receive data from a compromised device.
In-Memory Execution: A technique where malicious code is run directly from a computer's RAM, avoiding writing files to the hard disk to evade detection by security software.

Source: BleepingComputer

Chinese Spies Infiltrate Global Telecoms

Executive Summary

A suspected China-nexus espionage group, UNC2814, conducted a global campaign targeting telecommunications and government organizations. The actor utilized a novel backdoor called GRIDTIDE to abuse legitimate SaaS platforms and conceal malicious command-and-control traffic.

Key TTPs

Initial Access: The specific vector is unknown, but the group historically exploits flaws in web servers and edge systems.
Execution: Deployed the GRIDTIDE backdoor using a "nohup" command to ensure it runs even after the user session is closed.
Defense Evasion: Abused legitimate Google Sheets API functionality to disguise command-and-control (C2) traffic, making it appear as benign SaaS activity.

Campaign Analysis

This campaign showcases the actor's sophistication in using "living-off-the-land" techniques by repurposing legitimate SaaS services to evade detection. The operation, which impacted 53 organizations in 42 countries, was significant enough to warrant a coordinated disruption by Google and its partners.

Targeting & Infrastructure

Target Profile: Telecommunications providers and government organizations across Africa, Asia, and the Americas.
Infrastructure: Leveraged Google Sheets and Google Cloud Projects for command and control, hiding within legitimate API traffic.

Relevant Terms

C2 (Command and Control): The infrastructure (servers and software) used by attackers to communicate with and control compromised devices.
Backdoor: A type of malware that bypasses normal authentication procedures to grant an attacker remote access to a compromised system.

Source: BleepingComputer

Imposter Package Pilfers API Keys

Executive Summary

A malicious NuGet package, "StripeApi.Net," impersonated the official Stripe.net library to steal API tokens from developers. The threat actors used typosquatting to trick developers in the financial sector into installing the fraudulent package.

Key TTPs

Initial Access: Relied on typosquatting, publishing a similarly named package to the NuGet gallery to deceive developers.
Execution: Malicious code was inserted into a critical initialization method, which executed upon use and exfiltrated API tokens to an attacker-controlled database.
Defense Evasion: The package masqueraded as the legitimate Stripe.net library by using the same icon, similar documentation, and artificially inflated download counts to appear trustworthy.

Campaign Analysis

This campaign highlights the persistent threat of software supply chain attacks targeting developers. By subtly modifying a legitimate, widely-used library, attackers can effectively steal sensitive credentials from unsuspecting victims.

Targeting & Infrastructure

Target Profile: Developers and organizations within the financial sector using Microsoft's .NET platform to integrate Stripe's payment services.
Infrastructure: The public NuGet package repository was used to host the malicious library.

Relevant Terms

NuGet Gallery: The central package repository used by .NET developers to find and download reusable code libraries.
Typosquatting: A social engineering attack that targets users who incorrectly type a URL or, in this case, a package name, leading them to a malicious asset.

Source: The Hacker News

US Sanctions Russian Exploit Pipeline

Executive Summary

The U.S. Treasury and State Departments sanctioned a Russian exploit brokerage, Operation Zero, for acquiring and selling stolen U.S. government cyber tools. This action marks the first use of the Protecting American Intellectual Property Act to sanction foreign exploit brokers.

The Scheme

TTP 1: Acquired at least eight zero-day exploits stolen by a U.S. defense contractor executive.
TTP 2: Offered multi-million dollar bounties for vulnerabilities in common operating systems and messaging apps.
TTP 3: Resold stolen tools to unauthorized users and sought to sell exploits to foreign intelligence agencies in non-NATO countries.

The Players

Threat Actor: Operation Zero (aka Matrix LLC)
Facilitators Sanctioned: Sergey Sergeyevich Zelenyuk, Marina Evgenyevna Vasanovich, Oleg Vyacheslavovich Kucherov, and Azizjon Makhmudovich Mamashoyev.
Insider Sentenced:Peter Williams, a former defense contractor executive, was sentenced to over seven years in prison.

The Consequence

Outcome: U.S. sanctions imposed on seven individuals and entities; one U.S. contractor executive sentenced to 87 months.
Assets Seized/Forfeited: Illicit proceeds including properties and jewelry from the insider, who was paid approximately $1.3 million in cryptocurrency.

Strategic Takeaway

This action signals a more aggressive U.S. stance against the grey market for zero-day vulnerabilities, directly targeting the financial networks that support state and criminal cyber operations.

Relevant Terms

Zero-Day Exploit: A cyberattack vector that takes advantage of a software vulnerability unknown to the software vendor, meaning they have had "zero days" to create a patch.
Exploit Broker: An individual or company that buys and sells information about software vulnerabilities, often acting as an intermediary between security researchers and government agencies or other entities.

Source: SecurityWeek