Cyber Threat Brief — February 22, 2026

Audience: Detection Engineers | Window: Feb 21–22, 2026 | Briefs: Index

---

1. AI-Augmented Threat Actor Compromises 600+ FortiGate Devices

What’s New

Amazon’s CISO published an in-depth campaign report today documenting a Russian-speaking financially motivated actor that breached 600+ FortiGate firewalls across 55 countries in just five weeks (Jan 11 – Feb 18, 2026) — aided by generative AI for code development and recon automation.

Technical Details

Field	Value
Threat Actor	Russian-speaking, financially motivated (low-to-medium skill)
Campaign Window	January 11 – February 18, 2026
Targets	600+ FortiGate devices, 55 countries (South Asia, Latin America, West Africa, Northern Europe, Southeast Asia)
Initial Access	Brute-force on exposed mgmt interfaces (no exploits used)
Scanned Ports	443, 8443, 10443, 4443
AI Role	Code generation, recon automation, operational documentation
Secondary Targets	Veeam Backup & Replication servers
Exploitation CVEs	CVE-2019-7192 (QNAP RCE), CVE-2023-27532 / CVE-2024-40711 (Veeam)

What was extracted from breached FortiGates:

• SSL-VPN user credentials (with recoverable passwords)
• Administrative credentials
• Firewall policies and internal network architecture
• IPsec VPN configurations
• Network topology and routing information

AI-fingerprints in attacker tooling (Go/Python):

• Redundant comments that restate function names
• Naive JSON parsing via string matching (not proper deserialization)
• Compatibility shims with empty documentation stubs
• Architecture: simplistic with disproportionate investment in formatting

Post-access recon tool behavior:

• Analyzes routing tables, classifies networks by size
• Port scans via gogo scanner (chainreactors/gogo)
• Identifies SMB hosts and domain controllers
• Uses Nuclei for HTTP service discovery

Credential extraction: Operational docs (in Russian) referenced Meterpreter + Mimikatz for DCSync attacks and NTLM hash extraction from AD. Script DecryptVeeamPasswords.ps1 deployed to extract Veeam credentials before ransomware staging.

TTPs

Tactic	Technique	Observable
Initial Access	T1078.001 - Valid Accounts: Default	Common passwords against FortiGate mgmt interfaces
Initial Access	T1190 - Exploit Public-Facing Application	Mgmt interfaces exposed on non-standard ports
Credential Access	T1110.001 - Brute Force: Password Guessing	Failed/successful auth attempts on ports 443/8443/10443/4443
Collection	T1005 - Data from Local System	FortiGate config file extraction (SSL-VPN creds, firewall policies)
Discovery	T1018 - Remote System Discovery	gogo scanner + routing table analysis
Discovery	T1046 - Network Service Discovery	Nuclei HTTP scanning, SMB host enumeration
Lateral Movement	T1021.002 - SMB/Windows Admin Shares	Post-VPN domain traversal
Credential Access	T1003.006 - DCSync	Meterpreter + Mimikatz against AD
Impact	T1490 - Inhibit System Recovery	Veeam credential theft before ransomware deployment

Detection Opportunities

FortiGate Management Interface:

# Monitor for brute-force auth failures on FortiGate
# Look for rapid auth failures followed by success from same source
# Especially on ports 8443 / 10443 / 4443 (non-standard)

# FortiGate Syslog:
event_id=0101037122 AND action=login AND status=failed -> followed by status=success

AI-generated tool fingerprints in scripts:

# Python/Go scripts with these patterns may indicate AI-assisted tooling:
# - Comments that exactly restate function names
# - String-based JSON parsing (not json.loads)
# - "gogo" scanner usage on internal networks

Veeam targeting:

# PowerShell script detection
CommandLine|contains: "DecryptVeeamPasswords"
ParentImage|endswith: "powershell.exe"

# Veeam credential access
Process accessing: VeeamVssSupport.dll, VeeamDeploymentSvc.exe

DCSync Detection:

# Mimikatz DCSync
EventID: 4662
Properties: {1131f6aa-9c07-11d1-f79f-00c04fc2dcd2}  # DS-Replication-Get-Changes-All
AccountName: (non-DC account)

Log Sources

• FortiGate system/auth event logs (syslog)
• Sysmon Events: 1 (process create), 3 (network), 7 (image load)
• Windows Security: 4625/4624 (auth), 4662 (object access/DCSync)
• EDR: process lineage for PowerShell + credential tools
• Network: connections to external IPs from VPN-accessing hosts
• Veeam: service/access logs

Detection Coverage

Source	Status
Sigma (FortiGate)	✅ FortiGate - VPN SSL Settings Modified, FortiGate - New Local User Created, FortiGate - New Administrator Account Created
Sigma (DCSync)	✅ Multiple Mimikatz/DCSync rules
Sigma (Veeam)	✅ Veeam Backup Servers Credential Dumping Script Execution
Elastic	✅ Newly Observed FortiGate Alert, Potential Veeam Credential Access Command
Splunk ESCU	✅ Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity
Brute-force on non-std ports	❌ Gap — No specific detection for FortiGate brute-force on 8443/10443/4443
gogo scanner internal use	❌ Gap — No detection for chainreactors/gogo on internal networks

Recommendation: Add threshold-based alerting for consecutive FortiGate auth failures from same source IP, specifically targeting non-standard ports.

Sources

• Amazon AWS Security Blog — Published February 21, 2026
• BleepingComputer — Published February 22, 2026

---

2. CVE-2026-27197 — Sentry SAML SSO Bypass (CVSS 9.1)

What’s New

A critical authentication bypass in Sentry’s SAML SSO implementation allows complete account takeover of any user on a Sentry instance — without knowing their credentials. Affects versions spanning over 4 years of releases.

Technical Details

Field	Value
CVE	CVE-2026-27197
CVSS	9.1 (Critical)
Affected	Sentry 21.12.0 – 26.1.0 (self-hosted and Sentry.io)
Fixed	Sentry 26.2.0
Exploit	No public PoC at time of writing
Published	February 21, 2026

Root Cause: Logic flaw in SAML assertion processing across organizational contexts. An attacker with a malicious SAML Identity Provider (IdP) can leverage cross-organization SSO interactions on the same Sentry instance to authenticate as any victim user.

Attack Requirements:

• Network-accessible Sentry instance (no prior auth)
• Either: multi-org Sentry instance, OR attacker has access to modify SSO settings for one org on a shared instance
• Self-hosted instances with SENTRY_SINGLE_ORGANIZATION = False are most exposed

Impact: Full account takeover → access to all error logs, stack traces, source code snippets, environment variables, and secrets surfaced through Sentry integrations.

TTPs

Tactic	Technique	Observable
Initial Access	T1078.004 - Cloud Accounts	SSO login from unexpected IdP
Persistence	T1550.001 - Application Access Token	Sessions created via SAML assertion bypass
Collection	T1213 - Data from Information Repositories	Access to Sentry project errors and source maps

Detection Opportunities

# Sentry audit logs: authentication events from unexpected IdP sources
# Look for: SAML auth events where the requesting org ≠ the authenticated org

# Web server / proxy logs:
POST /auth/sso/ with unusual Assertion consumer URLs

# Anomalous login patterns:
User authenticated to Org-A using IdP registered under Org-B

Immediate Action: Upgrade to Sentry 26.2.0. Workaround: enforce 2FA for all user accounts (mitigates even if attacker completes SAML bypass).

Log Sources

• Sentry audit log (via Sentry API: /api/0/organizations/{org}/audit-logs/)
• Identity provider (IdP) assertion logs
• Web access/proxy logs for /auth/sso/ endpoints
• Cloud SIEM for SaaS Sentry environments

Detection Coverage

Source	Status
Sigma (SAML)	✅ SAML Token Issuer Anomaly, AWS Suspicious SAML Activity
Elastic	❌ No Sentry-specific SAML detection
Splunk ESCU	✅ Ivanti Connect Secure SSRF in SAML Component (tangentially related)
Sentry-specific auth bypass	❌ Gap — No detection rule for cross-org SAML assertion abuse

Sources

• TheHackerWire — CVE-2026-27197 — Published February 21, 2026

---

3. Operation Aether — Phobos Ransomware Affiliate Arrested in Poland

What’s New

Polish police (CBZC) arrested a 47-year-old Phobos ransomware affiliate as part of Operation Aether — a Europol-coordinated international crackdown. Devices seized contained a treasure trove of credentials, CC numbers, and server access data, revealing the infrastructure of an active RaaS operation.

Technical Details

Field	Value
Operation	Operation Aether (Europol-coordinated)
Arrest	47-year-old male, Małopolska region, Poland
Agencies	CBZC (Poland) + Katowice/Kielce units + District Prosecutor, Gliwice
Seized	Credentials, passwords, credit card numbers, server IPs
Communications	Encrypted messaging apps (Phobos contact)
Charges	Art. 269b Polish Criminal Code — hacking tool production/distribution, max 5 years
RaaS Volume	~11% of all ID Ransomware submissions (May–Nov 2024)
Historical Impact	1,000+ victims, $16M+ in ransom payments (DOJ)

Phobos TTPs (for detection context):

• Initial access primarily via RDP brute-force (exposed port 3389)
• Derived from Crysis ransomware family
• Affiliates use stolen credentials / server IPs (as found on seized devices)

TTPs

Tactic	Technique	Observable
Initial Access	T1110.001 - Brute Force: Password Guessing	RDP auth failures from external IPs
Initial Access	T1078 - Valid Accounts	Use of purchased/stolen server credentials
Impact	T1486 - Data Encrypted for Impact	.phobos / .eking file extensions post-encryption
Defense Evasion	T1562 - Impair Defenses	Shadow copy deletion, backup removal

Detection Opportunities

# Detect RDP brute-force (Phobos primary vector)
EventID: 4625
LogonType: 3 or 10
# Threshold: >10 failures from same IP in 5 minutes

# Post-auth: Shadow copy deletion
CommandLine|contains:
  - 'vssadmin delete shadows'
  - 'wmic shadowcopy delete'
  - 'bcdedit /set safeboot'

# File rename monitoring for .phobos/.eking extensions
# (EDR file system telemetry)

Operational note: The arrest provides law enforcement visibility into Phobos infrastructure. Expect potential wave of infrastructure takedowns — IOCs may shift rapidly.

Log Sources

• Windows Security: 4625/4624 (auth failures/successes)
• Sysmon: Event 1 (process create for vssadmin, bcdedit, wmic)
• EDR: File system events for bulk extension changes
• Firewall/network: Inbound RDP traffic from untrusted IPs

Detection Coverage

Source	Status
Sigma	✅ Multiple RDP brute-force, shadow copy deletion rules
Splunk ESCU	✅ Multiple shadow copy, ransomware detonation rules
Elastic	✅ Multiple ransomware detection rules
Phobos-specific	❌ Gap — No Phobos-specific Sigma rules found; detection must rely on behavior (RDP brute-force + encryption + VSS deletion chain)

Sources

• BleepingComputer / PRSOL.CC — Published February 22, 2026
• CBZC (Polish police official)

---

4. Air-Gap-Bridging Cryptominer Worm via USB

What’s New

Security researchers have documented a sophisticated cryptomining campaign capable of crossing air-gapped network boundaries by propagating through infected removable storage devices — masquerading as Windows processes and using kernel-level persistence to mine cryptocurrency indefinitely without user awareness.

Technical Details

Field	Value
Malware Type	Crypto-mining worm
Propagation	USB drives, portable hard disks
Initial Delivery	Pirated software bundles (social engineering)
Process Masquerade	Explorer.exe (fake Windows process)
Air-Gap Technique	WM_DEVICECHANGE / DBT_DEVICEARRIVAL monitoring
Persistence	Kernel-level (system-level techniques)
Goal	Silent, persistent cryptocurrency mining
Attribution	Not publicly attributed

Air-gap crossing mechanism:

1. Malware installed via pirated software bundle on internet-connected machine
2. Monitors Windows device notification events (WM_DEVICECHANGE, DBT_DEVICEARRIVAL)
3. Confirms presence of storage volumes, scans drive letters E–Z
4. Copies payload to removable media via function sub_140014190
5. When infected drive inserted into air-gapped machine → infection continues

Infection chain:

Pirated software → installer → dropper → Explorer.exe fake process
                                       → WM_DEVICECHANGE monitor
                                       → USB payload copier (E-Z drives)
                                       → kernel-level mining component

TTPs

Tactic	Technique	Observable
Initial Access	T1091 - Replication Through Removable Media	Autorun or user-executed payload from USB
Execution	T1036.005 - Masquerading: Match Legitimate Name	Explorer.exe in non-standard path
Persistence	T1543 - Create/Modify System Process	Kernel-level persistence components
Discovery	T1120 - Peripheral Device Discovery	WM_DEVICECHANGE API calls scanning E-Z drive letters
Lateral Movement	T1091 - Replication Through Removable Media	Writing payload to newly connected USB drives
Impact	T1496 - Resource Hijacking	CPU/GPU resources consumed for cryptomining

Detection Opportunities

# Suspicious Explorer.exe from non-standard path
Image|endswith: '\Explorer.exe'
NOT Image: 'C:\Windows\explorer.exe'

# WM_DEVICECHANGE monitoring via PowerShell / suspicious process
CommandLine|contains: 'WM_DEVICECHANGE'
# OR via process creating window messages handlers

# Drive letter enumeration via WMI/API (E-Z scanning pattern)
CommandLine|contains:
  - 'GetDriveType'
  - DriveType: DRIVE_REMOVABLE

# File copy to removable media from non-user process
DestinationDrive: [E-Z]
ParentProcess: (not explorer, not robocopy)

# High CPU usage from masqueraded system process
ProcessName: 'Explorer.exe'
CPUUsage: >70%
ParentImage: NOT 'C:\Windows\System32\userinit.exe'

Log Sources

• Sysmon: Event 11 (file create on removable media), Event 1 (process create with suspicious paths), Event 12/13 (registry for persistence)
• Windows: Event 6416 (new external device recognized)
• EDR: USB insertion events, process tree analysis, CPU telemetry
• AV/EDR: Heuristic detection for process masquerading

Detection Coverage

Source	Status
Sigma	✅ USB Device Plugged, External Disk Drive Or USB Storage Device Was Recognized By The System
Splunk ESCU	✅ Windows Replication Through Removable Media, Windows Process Executed From Removable Media
Elastic	✅ Execution from a Removable Media with Network Connection, New USB Storage Device Mounted
KQL	✅ USB_Data_Exfiltration
Air-gap bridging chain (WM_DEVICECHANGE + write)	❌ Gap — No compound detection for USB monitoring + payload copy chain
Explorer.exe masquerade from non-standard path	✅ Covered by existing process masquerade Sigma rules

Sources

• The420.in — Published February 21, 2026
• News4Hackers — Published February 21, 2026

---

5. D-Link DWR-M960 — 4 Stack Buffer Overflow CVEs with Public Exploits

What’s New

Four separate stack-based buffer overflow vulnerabilities were disclosed today in the D-Link DWR-M960 4G LTE router (version 1.01.07), each carrying CVSS 8.8 and each with a public exploit already available. No patches exist at time of writing — these are unpatched with weaponized PoCs.

Technical Details

Field	Value
CVEs	CVE-2026-2925, CVE-2026-2926, CVE-2026-2927, CVE-2026-2928
CVSS	8.8 (High) each
Affected	D-Link DWR-M960 firmware 1.01.07 only
Auth Required	None (unauthenticated, remote)
Exploit Status	✅ Public exploits available for each CVE
Patch	❌ No patch available
Published	February 22, 2026

Vulnerable endpoints:

CVE	Endpoint	Parameter
CVE-2026-2926	/boafrm/formLteSetup	submit-url → sub_4237AC
CVE-2026-2925	/boafrm/formBridgeVlan	Crafted request
CVE-2026-2927	(additional endpoint)	Oversized input
CVE-2026-2928	(additional endpoint)	Oversized input

Attack pattern: Attacker sends malformed POST with oversized submit-url or similar parameter → stack buffer overflow in compiled C function (sub_XXXXXXXX) → potential arbitrary code execution as root.

TTPs

Tactic	Technique	Observable
Initial Access	T1190 - Exploit Public-Facing Application	Malformed POST requests to /boafrm/form* endpoints
Execution	T1059 - Command and Scripting Interpreter	Shell command execution post-overflow
Discovery	T1046 - Network Service Discovery	Scanning for D-Link web admin ports (80/443/8080)
Persistence	T1542.003 - Bootkit / Firmware	Router firmware modification post-compromise

Detection Opportunities

# Network IDS signature concepts:
# 1. Oversized POST body to /boafrm/formLteSetup or /boafrm/formBridgeVlan
#    Threshold: request body > expected parameter length

# Web server/proxy logs:
POST /boafrm/formLteSetup | body_bytes > 1024

# Shodan/exposure monitoring:
# DWR-M960 devices exposed on internet — proactively identify and segment

# IDS rule concept (Snort/Suricata):
alert http any any -> any any (
  msg:"Potential D-Link DWR-M960 CVE-2026-2926 Exploit Attempt";
  content:"POST"; http_method;
  content:"/boafrm/formLteSetup"; http_uri;
  pcre:"/submit-url=.{512,}/";
  sid:20260222; rev:1;
)

Priority action: Identify all D-Link DWR-M960 devices on the network. Isolate management interfaces. Disable internet-facing admin access until vendor releases a patch. Monitor Shodan for exposure.

Log Sources

• Network IDS/IPS (Snort/Suricata): HTTP POST anomalies
• Web proxy / next-gen firewall logs
• Router syslog (if accessible)
• Network flow data: unexpected connections from routers to external IPs

Detection Coverage

Source	Status
Sigma	❌ No D-Link DWR-M960 specific rules
Splunk ESCU	❌ No specific coverage
Elastic	❌ No specific coverage
Network IDS	❌ Gap — No Snort/Suricata rules published yet for these CVEs

Note: These are too new for rule repositories. Create custom IDS rules based on the endpoint patterns above.

Sources

• TheHackerWire — CVE-2026-2926 — Published February 22, 2026
• TheHackerWire — CVE-2026-2925 — Published February 22, 2026
• TheHackerWire — CVE-2026-2927 — Published February 22, 2026
• TheHackerWire — CVE-2026-2928 — Published February 22, 2026

---

6. Chrome CVE-2026-2441 — Public PoC Released (Update)

Background: Initial coverage in Feb 16 brief. Patch exists: Chrome ≥ 145.0.7632.75 (Win/macOS), ≥ 144.0.7559.75 (Linux).

What’s New

A public proof-of-concept exploit was released today for CVE-2026-2441 (Chrome Blink CSS use-after-free). The PoC documents three distinct trigger paths and includes heap grooming techniques — significantly lowering the barrier to exploitation for this actively-exploited zero-day.

Technical Details

Field	Value
CVE	CVE-2026-2441
CVSS	8.8 (High)
PoC Released	February 22, 2026 (today)
Vulnerability	Use-After-Free in CSSFontFeatureValuesMap (Blink CSS engine)
Root Cause	Iterator raw pointer (aliases_) dangles after HashMap::rehash() during mutation
Confirmed Exploitation	Yes — Google confirmed active in-the-wild exploitation

Three PoC trigger methods:

Method	Technique
entries() Iterator	Mutation loop during iteration causes rehash
for…of Loop	Concurrent delete + heap spray
requestAnimationFrame	Layout recalc mid-iteration

50 @font-feature-values rules used for heap grooming to improve reliability.

Sandbox escape chain: UAF → arbitrary read/write in sandbox → V8 heap leak → ASLR bypass → full compromise (documented as Pegasus-style WebKit chaining pattern).

TTPs

Tactic	Technique	Observable
Initial Access	T1189 - Drive-by Compromise	Page visit triggers PoC (no user interaction beyond visit)
Execution	T1203 - Exploitation for Client Execution	Renderer process UAF → code execution
Defense Evasion	T1055 - Process Injection	Sandbox escape for further compromise
Collection	T1539 - Steal Web Session Cookie	Access to document.cookie, localStorage, IndexedDB

Detection Opportunities

# Renderer crash monitoring (Blink CSS engine):
chrome://crashes for UAF patterns (STATUS_ACCESS_VIOLATION in renderer)

# EDR process monitoring:
# Chrome renderer spawning unexpected child processes (sandbox escape indicator)
ParentImage: '*\chrome.exe'
ChildImage: NOT IN ['nacl_helper', 'gpu-process', 'renderer']

# Proxy/web filter:
# High @font-feature-values rule counts in CSS responses (50+ = suspicious)
# Monitor malvertising domains serving heavy CSS payloads

# Network:
# Chrome renderer → outbound connection (unexpected for renderer process)
ProcessName: '*\chrome.exe'
CommandLine|contains: '--type=renderer'
Network: outbound connection to external IP

Patch status check: Deploy chrome://settings/help version audit across fleet. Prioritize unpatched endpoints — PoC release dramatically increases exploitation risk.

Log Sources

• EDR: Chrome process tree, renderer crash events
• Web proxy: CSS payload inspection (size, @font-feature-values count)
• Chrome Enterprise: Browser version reporting
• Endpoint: chrome://crashes telemetry

Detection Coverage

Source	Status
Sigma	❌ No Chrome renderer UAF specific rule
Elastic	❌ No specific coverage
Splunk ESCU	❌ No specific coverage
Chrome sandbox escape	❌ Gap — Rely on EDR behavioral detection of unexpected child processes

Priority: Verify patch deployment immediately — PoC release makes this time-sensitive.

Sources

• VPNCentral — PoC Released — Published February 22, 2026
• Google Chrome Releases Blog

---

Detection Coverage Summary

Threat	Sigma	Splunk ESCU	Elastic	Critical Gap?
AI-Assisted FortiGate Campaign	✅ Partial	✅ Partial	✅ Partial	FortiGate brute-force on non-std ports
Sentry SAML Bypass (CVE-2026-27197)	⚠️ Generic	⚠️ Generic	❌	Cross-org SAML assertion abuse
Phobos Ransomware	✅ Behavior-based	✅ Behavior-based	✅ Behavior-based	No Phobos-specific IOC rules
Air-Gap USB Cryptominer	✅ Partial	✅ Partial	✅ Partial	WM_DEVICECHANGE + write chain
D-Link DWR-M960 CVEs	❌	❌	❌	All sources — create custom IDS rules
Chrome CVE-2026-2441 PoC	❌	❌	❌	Rely on EDR behavioral detection

---

Brief compiled at 05:00 PST | Next brief: February 23, 2026