State‑sponsored espionage resurfaces with fresh exploits, while AI‑driven attack tools expand. Record‑breaking DDoS attacks test global bandwidth 🌍 🚀

Good morning, here is your daily cybersecurity and AI threat intelligence roundup for February 5, 2026.

Today's headlines

• Shadow Campaigns group exploits dozens of high‑risk vulnerabilities worldwide.
• Amaranth‑Dragon weaponizes a new zero‑day CVE to target Southeast Asian entities.
• OpenClaw AI super‑agent demonstrates autonomous malware capabilities.
• Cloudflare observes a record 31.4 Tbps DDoS attack, the largest ever recorded.
• Malicious PDFs are being used to silently install remote access trojans.

1️⃣ Global espionage via Shadow Campaigns

Key Points:

• Group exploits a range of CVEs including SAP, Microsoft Exchange, and D‑Link.
• Advanced Threat Prevention blocked over a dozen exploitation attempts in the past year.
• Targets span multiple sectors such as finance, manufacturing, and government.

Description:

Palo Alto Networks Unit 42 uncovered a coordinated espionage operation termed “Shadow Campaigns,” which leverages a suite of vulnerabilities—from SAP Solution Manager privilege escalation to Microsoft Exchange remote code execution—to infiltrate high‑value organizations across the globe. The research details each observed exploit and the defensive measures that mitigated them.

Why It Matters:

The breadth of vulnerabilities used demonstrates the persistent risk of unpatched software. Organizations must accelerate vulnerability management and deploy advanced detection to prevent similar multi‑vector intrusion campaigns.

2️⃣ Amaranth‑Dragon weaponizes new zero‑day

Key Points:

• Exploits CVE‑2025‑8088, a previously undisclosed vulnerability.
• Focused attacks on governmental and telecom infrastructure in Southeast Asia.
• Links to APT‑41 activity suggest a broader nation‑state espionage effort.

Description:

Check Point researchers documented the emergence of Amaranth‑Dragon, a threat actor employing the brand‑new CVE‑2025‑8088 exploit to gain footholds within critical Southeast Asian networks. The campaign combines zero‑day exploitation with sophisticated post‑exploitation tools, targeting both public and private sector entities.

Why It Matters:

Rapid weaponization of a fresh zero‑day highlights the need for proactive threat‑intel sharing and immediate patching strategies to mitigate potential widespread compromise.

 3️⃣ APT36 targets Indian startups with Crimson RAT

Key Points:

• Spear‑phishing emails deliver malicious ISO files containing LNK shortcuts.
• ISO payload drops Crimson RAT, enabling full system surveillance and exfiltration.
• Attack marks a shift toward targeting the startup ecosystem rather than only government assets.

Description:

The ThreatsDay bulletin reported that Pakistan‑aligned APT36 has begun focusing on India's burgeoning startup scene. Attackers send ISO‑based attachments that, once opened, execute a malicious shortcut leading to the deployment of the Crimson RAT, a remote access tool capable of extensive data collection.

Why It Matters:

The campaign underscores the necessity for organizations to enforce strict email filtering, user education, and secure handling of archive files to defend against supply‑chain and development‑environment attacks.

 4️⃣ Publicly available tools reused in incidents

Key Points:

• CISA catalogues open‑source and commercial tools observed in recent attacks.
• Provides guidance for detection, attribution, and reporting of tool‑based activity.
• Encourages coordination with NCCIC for incident reporting and feedback.

Description:

The Cybersecurity and Infrastructure Security Agency (CISA) released an advisory listing publicly available tools that have appeared across multiple cyber incidents worldwide. The report offers actionable advice for defenders to recognize tool signatures and improve incident response processes.

Why It Matters:

Understanding which legitimate tools are being repurposed by adversaries helps security teams fine‑tune detection mechanisms and reduces false positives while enhancing overall threat visibility.

 5️⃣ Sophos CISO tackles fraudulent remote hires

Key Points:

• Threat actors impersonate remote IT contractors to infiltrate networks.
• Key indicators include inconsistent credentials, atypical communication channels, and missing verification steps.
• Sophos released a playbook outlining controls and vetting processes.

Description:

In a Reddit AMA, Sophos CISO Ross McKerchar discussed the growing risk of fake remote IT hires used by threat actors to gain internal access. He highlighted common red flags and shared a downloadable playbook that details mitigation steps for organizations of all sizes.

Why It Matters:

As remote work continues to expand, rigorous hiring and onboarding controls become critical to prevent supply‑chain compromises that can bypass traditional perimeter defenses.

 6️⃣ OpenClaw AI super‑agent analysis

Key Points:

• OpenClaw uses generative AI to modify its code and evade signatures.
• Capable of autonomous lateral movement and credential harvesting.
• CrowdStrike recommends behavior‑based detection and strict AI model monitoring.

Description:

CrowdStrike’s research introduces OpenClaw, an AI‑driven malware framework that can self‑generate new variants, adapt to environments, and conduct autonomous attacks. The blog details its architecture, infection chain, and the challenges it poses to conventional security tools.

Why It Matters:

The emergence of AI‑enabled malware signals a paradigm shift where static defenses become insufficient, prompting a move toward adaptive, behavior‑centric security strategies.

 7️⃣ Record 31.4 Tbps DDoS attack observed

Key Points:

• Attack reached a peak of 31.4 Tbps, the highest ever recorded.
• Multi‑vector techniques combined UDP flood, HTTP GET, and reflection attacks.
• Cloudflare mitigated the traffic using its global network capacity and automated scrubbing.

Description:

Cloudflare’s Q4 2025 DDoS threat report documents an unprecedented 31.4 Tbps assault targeting a major online service. The analysis breaks down the attack composition, the infrastructure used, and the mitigation steps employed to absorb the massive traffic.

Why It Matters:

The scale of the attack highlights the growing need for robust, distributed DDoS protection and underscores the importance of capacity planning for internet‑facing services.

 8️⃣ Check Point 2 Feb threat intel summary

Key Points:

• Rise in AI‑enhanced phishing campaigns leveraging deep‑fake audio.
• New ransomware variants employing file‑less techniques.
• Geopolitical tensions driving increased targeting of energy and logistics sectors.

Description:

Check Point’s February 2 threat intelligence report compiles the most significant incidents observed across the globe in the past week, ranging from AI‑driven phishing to novel ransomware tactics. The report provides actionable indicators of compromise and recommended mitigations.

Why It Matters:

Timely intelligence on emerging attack methods enables security teams to update defenses, refine detection rules, and anticipate threat actor shifts linked to current geopolitical events.

 9️⃣ VMware zero‑trust with vDefend

Key Points:

• vDefend enforces micro‑segmentation and continuous verification in private clouds.
• Lateral movement detection integrates with VMware’s native security stack.
• Case study shows 80 % reduction in breach‑related exposure after deployment.

Description:

VMware’s security blog outlines the vDefend solution that extends zero‑trust principles to private cloud environments through automated policy enforcement and real‑time threat detection. The post includes technical details and a customer success story demonstrating measurable risk reduction.

Why It Matters:

Adopting zero‑trust controls in private clouds mitigates the impact of credential theft and insider threats, aligning with industry best practices for modern hybrid architectures.

 🔟 Malicious PDF delivers remote access trojan

Key Points:

• PDF exploits embedded JavaScript to execute a RAT payload upon opening.
• Payload establishes encrypted C2 channel and provides full system control.
• Recommendation: enforce PDF sandboxing and disable JavaScript in document viewers.

Description:

Malwarebytes analyzed a new campaign where attackers craft PDF files that, when opened, trigger malicious JavaScript to download and install a remote access trojan. The research details the infection chain, the C2 infrastructure, and mitigation strategies.

Why It Matters:

Document‑based attacks remain a prevalent initial access vector; organizations must update endpoint protections and educate users to prevent inadvertent execution of malicious files.

Stay vigilant and keep your defenses up-to-date.