Critical Zero-Days in Confluence & Exchange, "MidasTouch" Ransomware Hits Hospitals, and "SandViper" APT Targets US Defense
Summary
This cybersecurity brief for February 22-23, 2026, covers a wave of critical threats. Atlassian and Microsoft rushed patches for actively exploited zero-days in Confluence (CVE-2026-22515) and a critical flaw in Exchange Server (CVE-2026-21445). A new ransomware strain, "MidasTouch," crippled a major US hospital chain, while CISA warned of the "SandViper" APT targeting the defense sector. Other major incidents include a supply chain attack on the "EasyUtil-JS" NPM package and a massive data breach at payment processor "GlobalPay" exposing 20 million credit cards.
Today New Articles
Critical Confluence Zero-Day (CVE-2026-22515) Actively Exploited to Deploy LockBit Ransomware
Atlassian has issued an emergency patch for a critical remote code execution (RCE) zero-day, CVE-2026-22515 (CVSS 9.8), affecting Confluence Data Center and Server. The vulnerability is being actively exploited by threat actors, including a group named 'Cerber...
CISA Warns of North Korean "SandViper" APT Espionage Campaign Targeting US Defense Sector
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), along with the FBI and NSA, has issued a joint advisory detailing a sophisticated cyber-espionage campaign by "SandViper," a North Korean state-sponsored APT group. The campaign targets the U.S....
GlobalPay Supply Chain Attack Exposes 20 Million Credit Cards; ShinyHunters Claims Responsibility
GlobalPay, a major payment processor, has suffered a massive data breach exposing the credit card details and personal information of approximately 20 million individuals. The breach was the result of a supply chain attack, where a compromised third-party soft...
New "ChronoLeap" Infostealer Bypasses MFA Using System Time Manipulation
Security researchers at Zscaler have discovered "ChronoLeap," a new information-stealing malware with a novel technique to bypass multi-factor authentication (MFA). The malware uses a Browser-in-the-Browser (BitB) attack to steal credentials, then manipulates...
Scattered Spider Launches Massive Tax-Season Phishing Campaign Impersonating IRS, HMRC, and CRA
A large-scale phishing campaign attributed to the cybercrime group "Scattered Spider" is targeting taxpayers in the United States, United Kingdom, and Canada. The attackers are using convincing emails and SMS messages that impersonate the IRS, HMRC, and CRA, l...
Microsoft Issues Emergency Patch for Critical Exchange Privilege Escalation Flaw (CVE-2026-21445)
Microsoft has released an emergency, out-of-band security update for a critical privilege escalation vulnerability in Microsoft Exchange Server 2016 and 2019. The flaw, tracked as CVE-2026-21445 with a CVSS score of 9.1, could allow an attacker with a standard...
Global Police Operation "Cyber-Surge" Dismantles "LabHost" Phishing-as-a-Service Empire
A massive international law enforcement operation, codenamed "Cyber-Surge," has successfully dismantled "LabHost," a notorious Phishing-as-a-Service (PhaaS) platform. Led by Europol and involving 19 countries, the operation resulted in 37 arrests and the seizu...
US Treasury Sanctions Crypto Mixers VortexCash and Cyclone for Laundering Ransomware Proceeds
The U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) has sanctioned two major cryptocurrency mixing services, VortexCash and Cyclone. The action was taken due to their extensive use by threat actors, including the North Korean Lazarus...
"VoltSchemer" Attack Can Manipulate EV Charging and Destabilize Power Grids
Researchers have demonstrated a new attack method, "VoltSchemer," that exploits vulnerabilities in the Combined Charging System (CCS) standard for electric vehicles (EVs). By injecting malicious signals into the communication line between the vehicle and charg...