> InfoSec News Nuggets 02/02/2026

Here’s how we disrupted a massive, malicious proxy network Google says it disrupted IPIDEA, a large malicious residential proxy network used by criminals to route traffic and hide activity. It also notes added protections in Android via Play Protect and shared research with partners to prevent reconstitution.   Critical Ivanti Endpoint Manager Mobile (EPMM) zero-day exploited in the wild (CVE-2026-1281 & CVE-2026-1340) Ivanti disclosed two critical code injection issues in EPMM, with vendor-indicated exploitation prior to disclosure. Rapid7 includes version ranges, emergency patch guidance, and a quick hunting lead for suspicious requests to the affected endpoints.   APTs, Cybercriminals Widely Exploiting WinRAR Vulnerability Multiple state-sponsored threat actors and cybercrime groups have been exploiting a WinRAR vulnerability in attacks over the past six months, Google Threat Intelligence Group (GTIG) warns. Tracked as CVE-2025-8088, the high-severity bug was patched on July 30, after being exploited in the wild as a zero-day by the Russia-linked hacking group named RomCom (also known as Storm-0978, Tropical Scorpius, and UNC2596). The issue is described as a path traversal flaw in WinRAR for Windows that can be abused for arbitrary code execution using crafted archive files.   Nearly 800,000 Telnet servers exposed to remote attacks Internet security watchdog Shadowserver tracks nearly 800,000 IP addresses with Telnet fingerprints amid ongoing attacks exploiting a critical authentication bypass vulnerability in the GNU InetUtils telnetd server. The security flaw (CVE-2026-24061) already has a proof-of-concept exploit, impacts GNU InetUtils versions 1.9.3 (released in 2015) through 2.7, and was patched in version 2.8 (released on January 20). “The telnetd server invokes /usr/bin/login (normally running as root) passing the value of the USER environment variable received from the client as the last parameter,” explained open-source contributor Simon Josefsson, who reported it.   Privileged File System Vulnerability Present in a SCADA System Unit 42 details CVE-2025-0921 in ICONICS Suite, describing how unnecessary privileges in services can be misused to corrupt critical binaries and disrupt integrity and availability. It also points to the vendor advisory and workaround that addresses multiple reported issues.   Maybe CISA should take its own advice about insider threats hmmm? The Register highlights the risk of sensitive data being pasted into public AI tools, using a CISA-related example to underline insider threat and data handling basics. This is a good prompt to revisit “approved AI tools only” messaging and DLP guardrails around browser-based AI access. The post InfoSec News Nuggets 02/02/2026 appeared first on AboutDFIR - The Definitive Compendium Project.