Cyber Threat Brief — February 19, 2026

Five significant threats emerged in the last 24 hours: a critical VoIP vulnerability with Metasploit exploit, a China-nexus zero-day campaign targeting Dell RecoverPoint, a new pre-installed Android backdoor rivaling Triada, an Iranian cyberespionage operation using protest lures, and an evolution in DPRK’s fake job campaign now surgically tampering with MetaMask wallets.

1. CVE-2026-2329 — Grandstream GXP1600 VoIP Pre-Auth RCE (CVSS 9.3)

What’s New

Rapid7 dropped a full technical analysis and working Metasploit module for an unauthenticated stack buffer overflow in Grandstream VoIP phones. Exploit enables root-level RCE, credential extraction, and silent eavesdropping via SIP proxy hijacking.

Technical Details

Field	Value
CVE	CVE-2026-2329
CVSS	9.3 (Critical, CVSSv4)
Affected	GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, GXP1630 — firmware < 1.0.7.81
Exploit	Public Metasploit module available
Attack Vector	Network, no authentication required
Root Cause	Stack buffer overflow in `/cgi-bin/api.values.get` endpoint (colon-delimited identifier parsing)

Why it matters: VoIP phones rarely get patched and often sit on internal networks without EDR. The eavesdropping capability via SIP proxy manipulation makes this particularly dangerous for enterprises and government targets.

Exploitation technique: Attackers chain multiple overflows by using colon-delimited identifiers to write null bytes at precise stack locations, bypassing NX via ROP chains. No PIE, no stack canaries.

TTPs

Tactic	Technique	Observable
Initial Access	T1190 - Exploit Public-Facing Application	HTTP POST to `/cgi-bin/api.values.get` with oversized request parameter
Execution	T1059 - Command and Script Interpreter	ROP chain executes system() for arbitrary OS commands
Credential Access	T1552.001 - Credentials In Files	Post-exploitation module dumps SIP credentials, local accounts
Collection	T1123 - Audio Capture	SIP proxy hijacking for call interception

Detection Opportunities

Network: HTTP POST to /cgi-bin/api.values.get with unusually large request body (>64 bytes per identifier)
Network: Outbound SIP traffic to unexpected proxy servers
Endpoint: Processes spawned by gs_web binary on VoIP appliances

# Sample detection for network traffic
index=network sourcetype=stream:http uri_path="/cgi-bin/api.values.get" 
| where len(form_data) > 256
| stats count by src_ip, dest_ip

Log Sources

Web proxy logs capturing HTTP traffic to VoIP devices
SIP CDR/signaling logs for proxy changes
Network flow data for internal-to-VoIP traffic patterns

Detection Coverage

Source	Status
Sigma	❌ Gap — No VoIP-specific rules
Splunk ESCU	❌ Gap — No coverage
Elastic	❌ Gap — No coverage

Priority Action: Patch to firmware 1.0.7.81; segment VoIP infrastructure; monitor for HTTP exploitation patterns against phone management interfaces.

Sources

Rapid7 Blog — CVE-2026-2329 Technical Analysis — Published Feb 18, 2026
Metasploit Module PR

2. CVE-2026-22769 — Dell RecoverPoint Zero-Day Exploited by China-Nexus UNC6201 (CVSS 10.0)

What’s New

Google Mandiant disclosed a critical hardcoded credential vulnerability in Dell RecoverPoint for VMs that UNC6201 (China-nexus) has been exploiting since mid-2024. CISA added to KEV on Feb 18 with 3-day remediation deadline (Feb 21). Threat actor uses “Ghost NICs” for lateral movement and deployed new GRIMBOLT backdoor to replace BRICKSTORM.

Technical Details

Field	Value
CVE	CVE-2026-22769
CVSS	10.0 (Critical)
Affected	Dell RecoverPoint for VMs < 6.0.3.1 HF1
Exploit	Actively exploited since mid-2024
Attack Vector	Network — hardcoded Tomcat admin credentials
Attribution	UNC6201 (China-nexus, overlaps with UNC5221/Warp Panda)

Root cause: Default “admin” credentials for Apache Tomcat Manager allow unauthenticated attackers to deploy web shells via /manager/text/deploy.

New malware introduced:

SLAYSTYLE: Web shell deployed via Tomcat Manager
GRIMBOLT: Native AOT-compiled C# backdoor replacing BRICKSTORM (harder to reverse engineer)

TTPs

Tactic	Technique	Observable
Initial Access	T1078.001 - Default Credentials	Tomcat Manager authentication with hardcoded creds
Persistence	T1505.003 - Web Shell	SLAYSTYLE web shell deployment
Execution	T1059.003 - Windows Command Shell	Commands via web shell as root
Defense Evasion	T1036.005 - Match Legitimate Name	GRIMBOLT blends with system native files
Lateral Movement	T1021.001 - Remote Desktop Protocol	”Ghost NICs” — temporary virtual network interfaces

Detection Opportunities

# Web shell deployment via Tomcat Manager
index=web sourcetype=tomcat_access uri_path="/manager/text/deploy*" 
| stats count by src_ip, war_filename

# Ghost NIC detection on VMware infrastructure
index=vsphere sourcetype=vmware:events event_type="VirtualNicCreated" 
| eval lifetime=_time - nic_creation_time
| where lifetime < 300 
| stats count by vm_name, nic_name

Log Sources

Tomcat access/manager logs
VMware vCenter events (NIC creation/deletion)
Network flow for unusual lateral movement from backup appliances
EDR on endpoints receiving connections from RecoverPoint systems

Detection Coverage

Source	Status
Sigma	⚠️ Partial — Generic web shell rules may detect
Splunk ESCU	❌ Gap — No RecoverPoint-specific rules
Elastic	❌ Gap — No coverage

Priority Action: Patch immediately; hunt for SLAYSTYLE/GRIMBOLT IOCs; review Tomcat Manager access logs dating back to mid-2024; check for temporary NIC creation patterns in VMware environments.

Sources

Google Mandiant — UNC6201 Exploiting Dell RecoverPoint Zero-Day — Published Feb 18, 2026
Dell Security Advisory DSA-2026-079 — Published Feb 17, 2026
CISA KEV Addition — Added Feb 18, 2026

3. Keenadu — Android Backdoor Preinstalled in Firmware (Triada-Level Threat)

What’s New

Kaspersky discovered Keenadu, a sophisticated Android backdoor embedded in device firmware during the build process. Comparable to Triada/BADBOX in scope, it injects into Zygote to infect every app at launch. Over 13,000 devices infected. Found in firmware OTA updates and even Google Play apps (300K+ downloads).

Technical Details

Field	Value
Malware Family	Keenadu
Platform	Android
Distribution	Firmware supply chain (Alldocube tablets), OTA updates, Google Play trojanized apps
Persistence	Embedded in `libandroid_runtime.so`, injected into Zygote process
C2 Payload Delay	~2.5 months dormant before payload retrieval
Scale	13,000+ devices (Russia, Japan, Germany, Brazil, Netherlands)

Infection chain:

Malicious static library linked into libandroid_runtime.so during firmware build
Modified logging function decrypts RC4-encrypted payload
Payload injects into Zygote → every app inherits the backdoor
AKClient/AKServer architecture for modular payload delivery
Modules downloaded from AWS, verified with MD5/DSA signatures

Plugins identified:

Loader module: Targets Amazon, SHEIN, Temu apps; installs hidden APKs
Clicker modules: Inject into YouTube, Facebook for ad fraud
Chrome module: Steals search queries, hijacks results
Nova clicker: Advanced ad interaction
Telegram module: Unknown functionality
Spyware dropper: Additional payload delivery

TTPs

Tactic	Technique	Observable
Initial Access	T1195.002 - Compromise Software Supply Chain	Firmware modified during manufacturing
Persistence	T1398 - Boot or Logon Initialization Scripts	`libandroid_runtime.so` modification
Defense Evasion	T1480.001 - Environmental Keying	Avoids Chinese locale, devices without Google services
Collection	T1417 - Input Capture	Keylogging, credential theft
Exfiltration	T1567 - Exfiltration Over Web Service	AWS-hosted C2 infrastructure

Detection Opportunities

Mobile: Unusual network traffic to AWS from system processes during first 2.5 months
Mobile: Apps requesting permissions inconsistent with their function
Network: Communication patterns matching ad fraud clicker behavior
Firmware: Hash mismatches in libandroid_runtime.so

Log Sources

Mobile Device Management (MDM) telemetry
Network traffic analysis for Android devices
Google Play Protect signals
App store behavior analytics

Detection Coverage

Source	Status
Sigma	❌ Not applicable (Android)
Splunk ESCU	❌ Gap — No Android-specific rules
Elastic	❌ Not applicable (Android)
Google Play Protect	⚠️ Some variants detected

Priority Action: Audit Android device supply chains; verify firmware integrity for Alldocube and similar budget tablet brands; monitor for unusual AWS-bound traffic from mobile devices.

Sources

Kaspersky SecureList — Keenadu Analysis — Published Feb 18, 2026
Security Affairs Coverage — Published Feb 18, 2026

4. CRESCENTHARVEST — Iranian Cyberespionage Campaign Targeting Protest Supporters

What’s New

Acronis TRU uncovered CRESCENTHARVEST, a cyberespionage campaign targeting Farsi-speaking Iran protest supporters. Uses politically-themed lures with legitimate protest footage bundled with malicious LNK files. Deploys a dual-purpose RAT/stealer with Chrome app-bound encryption bypass capabilities.

Technical Details

Field	Value
Campaign	CRESCENTHARVEST
Attribution	Suspected Iranian-aligned APT (low confidence)
Targets	Iran protest supporters, journalists, activists
Distribution	Archives with protest videos/images + malicious LNK files
Malware Type	RAT + Info-stealer hybrid
C2	servicelog-information[.]com (VEESP-LV, Latvia)

Kill chain:

Victim receives archive with protest-themed content
LNK files masquerade as video/image files
LNK spawns conhost.exe → cmd.exe → PowerShell
PowerShell extracts ZIP from LNK, writes to %TEMP%
DLL sideloading via signed Google Software Reporter Tool
urtcbased140d_d.dll + version.dll loaded

Key capability — Chrome app-bound encryption bypass:

Interacts with Chrome’s COM-based elevation mechanisms
Recovers decrypted app_bound_encrypted_key from Local State
Exfiltrates via named pipe to second module

TTPs

Tactic	Technique	Observable
Initial Access	T1566.001 - Spearphishing Attachment	Protest-themed archives with LNK files
Execution	T1204.002 - Malicious File	LNK files disguised as media
Persistence	T1053.005 - Scheduled Task	Task triggered on NetworkProfile events
Defense Evasion	T1574.002 - DLL Side-Loading	Google Software Reporter Tool sideloading
Credential Access	T1555.003 - Credentials from Web Browsers	Chrome credential/cookie theft
Collection	T1056.001 - Keylogging	Global keyboard hook via KeyboardEvent export

Detection Opportunities

title: CRESCENTHARVEST LNK Execution Chain
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith: '\conhost.exe'
    Image|endswith: '\cmd.exe'
  condition: selection

# Chrome app-bound encryption access
index=endpoint process_name="software_reporter_tool.exe" 
| join sid [search index=endpoint file_path="*\\Local State" action=read]
| stats count by host, user

Log Sources

Windows Event Logs (Process Creation 4688, Scheduled Tasks 4698)
Sysmon (Process Creation, File Creation, DLL Loading)
EDR telemetry for COM object interactions
Network traffic to C2 domain

Detection Coverage

Source	Status
Sigma	⚠️ Partial — Generic DLL sideloading rules
Splunk ESCU	✅ Multiple rules for browser credential theft, LNK execution
Elastic	⚠️ Partial — Scheduled task persistence rules

Priority Action: Hunt for software_reporter_tool.exe execution outside of Chrome context; monitor for LNK files with unusually large sizes; alert on scheduled tasks bound to NetworkProfile events.

Sources

Acronis TRU — CRESCENTHARVEST Analysis — Published Feb 18, 2026
GBHackers Coverage — Published Feb 18, 2026

IOCs:

Domain: servicelog-information[.]com
Hosting: VEESP-LV (Latvia), intermittent Cloudflare proxying

5. Contagious Interview — DPRK Campaign Now Surgically Tampering with MetaMask Wallets

What’s New

The DPRK-linked “Contagious Interview” campaign (fake job recruiters) has evolved to surgically tamper with MetaMask browser extensions, replacing legitimate installations with trojanized versions that steal wallet credentials in real-time. New research details the multi-stage chain from fake NPM packages to wallet takeover.

Technical Details

Field	Value
Campaign	Contagious Interview
Attribution	DPRK-linked (high confidence)
Target	Developers in cryptocurrency, Web3, AI
Malware	BeaverTail, InvisibleFerret
Goal	Credential theft + live crypto fund theft

Attack chain:

Fake recruiter contacts target with “technical test” project
Victim runs trojanized NPM package
JS loader obtains C2, downloads next-stage payload
Payloads written to VS Code directory, npm dependencies installed
test.js → p.js (file exfil) + n.js (backdoor) + InvisibleFerret (Python RAT)
“ssh_mmc” command deploys MetaMask tampering script (y.js)
Trojanized MetaMask (background-2.js) hooks submitPassword()
Master password + encrypted vault exfiltrated on every unlock

MetaMask tampering technique:

Enumerates Chromium browser profiles
Locates MetaMask extension storage
Downloads malicious extension archive from C2
Replaces legitimate MetaMask directory
Updates Chrome Secure Preferences with recalculated HMAC-SHA256 MACs
Browser accepts tampered extension without warning

TTPs

Tactic	Technique	Observable
Initial Access	T1566.003 - Spearphishing via Service	LinkedIn/Discord job recruitment
Execution	T1059.007 - JavaScript	Malicious NPM package execution
Persistence	T1176 - Browser Extensions	Trojanized MetaMask replacement
Credential Access	T1555.003 - Credentials from Web Browsers	MetaMask vault/password exfiltration
Collection	T1119 - Automated Collection	Keyword-based file discovery (seed, mnemonic, wallet, metamask)

Detection Opportunities

# MetaMask extension directory modification
index=endpoint (file_path="*\\Extensions\\*metamask*" OR file_path="*/.config/chromium/*/Extensions/*metamask*")
action IN (create, modify, delete)
| stats count by host, user, file_path

title: Suspicious NPM Package Execution in VS Code Directory
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\node.exe'
    CurrentDirectory|contains: '.vscode'
  condition: selection

Log Sources

EDR: Process creation for node.exe, file modifications in browser extension directories
Browser extension inventory monitoring
Network traffic to C2 IP addresses

Detection Coverage

Source	Status
Sigma	✅ Telegram API access, browser credential theft rules exist
Splunk ESCU	✅ Download Files Using Telegram, browser credential access
Elastic	⚠️ Partial — Generic credential access rules

Priority Action: Monitor for Chrome extension directory modifications outside of normal browser update processes; alert on node.exe execution from .vscode directories; educate developers about fake job interview attacks.

Sources

Sp4rk Research — Contagious Interview MetaMask Analysis — Published Feb 18, 2026
GBHackers Coverage — Published Feb 18, 2026

IOCs:

Type	Value
C2	45.43.11.248:1244
C2	45.43.11.200:1244
C2	67.203.7.205:1244
C2	202.163.147.124:1248
C2	145.59.1.45:1244
C2	66.235.28.238:1249
C2	66.235.168.238:1244
Hash	800ffb10a79370991c5c918f572fe192 (poker_top.tar.gz)
Hash	8e6db10b5acc15c2cc54592e3dd49bf7 (users.js)
Hash	d423bf6b18662aed88ddd69c72b4e116 (background-2.js)

6. Threat Intelligence Report Highlights

Nozomi Networks OT/IoT Security Report (Feb 2026)

Key findings relevant to detection engineers:

70% of ransomware activity targets English-speaking countries (US 40%, Canada + UK 30%)
Scattered Spider accounted for 42.9% of all actor-related alerts in H2 2025
68% of wireless networks lack Management Frame Protection despite modern encryption
98% rely on PSK authentication — enterprise-grade 802.1X adoption at only 2%
Transportation was most targeted industry, followed by manufacturing and public sector
Discovery tactics most common in public sector attacks (reconnaissance phase)

Detection implication: Expect increased China, Iran, and Russia-linked activity in 2026. Monitor for wireless network reconnaissance and focus on OT/IoT visibility gaps.

Sources

Nozomi Networks Labs OT/IoT Security Report — Published Feb 19, 2026

Summary: Detection Coverage Gaps

Threat	Detection Gap	Priority
CVE-2026-2329 (Grandstream VoIP)	No VoIP exploitation rules	High — public exploit
CVE-2026-22769 (Dell RecoverPoint)	No Tomcat Manager/RecoverPoint rules	Critical — active exploitation
Keenadu	Android supply chain — limited visibility	Medium — requires MDM/mobile security
CRESCENTHARVEST	Partial coverage via existing rules	Medium — enhance LNK/sideloading rules
Contagious Interview	Partial coverage	High — add browser extension monitoring

Published: February 19, 2026 05:00 PST