> InfoSec News Nuggets 02/10/2026

Winter Olympics hit by suspected ‘Russian origin’ cyberattack – as one of Europe’s largest universities also reports major cybersecurity incident Italy said it blocked a wave of cyberattacks described as “of Russian origin” targeting systems tied to the Milano Cortina 2026 Winter Olympics, including hotels in Cortina d’Ampezzo. The pro Russian group NoName057(16) claimed the activity and framed it as retaliation for Italy’s support of Ukraine. The same reporting also notes a separate suspected ransomware incident at La Sapienza University that led to precautionary shutdowns and recovery efforts. Treat major events and large public institutions as high risk targets for DDoS and disruptive extortion, and validate comms and continuity plans ahead of peak periods.   Singapore: Rootkits, Zero-Day Used in Chinese Attack on Major Telecom Firms Singapore said a China linked group (UNC3886) targeted all four major telecom providers using rootkits and a zero day, but reported no service disruption and no customer data access. The case highlights sustained interest in telecom core infrastructure as an espionage foothold rather than a smash and grab. For defenders, this is another reminder to monitor for low noise persistence and unusual administrative activity on network and virtualization infrastructure, not just endpoints. It also reinforces the value of hardening identity and privileged access paths that can outlive patching a single bug.   European Commission probes intrusion into staff mobile management backend The European Commission disclosed an intrusion into infrastructure used to manage staff issued mobile devices, detected by CERT EU and contained within hours. The Commission warned that attackers may have accessed some staff names and mobile numbers, while stating no compromise of mobile devices was detected. Mobile device management systems sit close to high privilege controls like policy enforcement, software install, and remote wipe, so they are a high value target even without device takeover. Review MDM exposure, admin access paths, and logging for backend management actions as a distinct control plane.   BT26-02 BeyondTrust published an advisory for CVE-2026-1731, a critical pre authentication remote code execution issue affecting Remote Support and certain Privileged Remote Access versions. The advisory states exploitation could allow OS command execution in the context of the site user, with impact including compromise, data access, and service disruption. BeyondTrust notes SaaS customers were patched as of Feb 2, 2026, and provides guidance for self hosted customers to apply patches or upgrade to fixed versions. If you run these products, confirm versions, apply the specific patches, and validate external exposure.   Ransomware attackers are exploiting critical SmarterMail vulnerability (CVE-2026-24423) CISA flagged CVE-2026-24423 in SmarterMail as exploited in ransomware activity, with the issue enabling remote code execution via the ConnectToHub API in affected builds. The writeup also notes additional critical issues discovered around the same period, reinforcing that patching once may not be sufficient if you are behind on builds. If SmarterMail is in your environment, treat it like an internet facing high risk service even if you believe it is internal, and prioritize upgrades to the latest vendor build plus compensating controls. Watch for unusual outbound connections and post exploitation tooling consistent with mail server footholds.   Payment tech provider for Texas, Florida governments working with FBI to resolve ransomware attack BridgePay Network Solutions reported a ransomware attack causing system wide outages that disrupted payment portals for multiple local governments and businesses. The company said it is working with the FBI and U.S. Secret Service forensic team and does not believe card data was stolen, while restoration work continued. Downstream impact included cities advising residents to use in person payments or checks while online portals were unavailable. This is a good prompt to map payment processing dependencies, define manual fallback procedures, and ensure vendor incident comms channels are in your continuity plan.   AI chat app leak exposes 300 million messages tied to 25 million users A researcher found an exposed database tied to the Chat & Ask AI app, with claims of access to hundreds of millions of messages from tens of millions of users due to a Firebase misconfiguration. The report frames it as a common class of preventable cloud backend exposure where security rules are left open, enabling unauthenticated access to stored data. It also notes the app acts as a wrapper over multiple LLMs, which increases the sensitivity of stored prompts and chat histories. For orgs, this is another reason to treat consumer AI apps as potential data loss paths and to enforce app governance, data minimization, and vendor security validation for any sanctioned tools. The post InfoSec News Nuggets 02/10/2026 appeared first on AboutDFIR - The Definitive Compendium Project.