← Cybersecurity Headlines
Cybersecurity Headlines
Crazy gang abuses employee monitoring tool, Nevada unveils new data classification, Georgia healthcare breach impact grows
00:07:31
Loading summary
Transcript3 lines
- [00:00]
A
From the CISO series. It's Cybersecurity Headlines.
- [00:07]
B
These are the cybersecurity headlines for Thursday, February 12, 2026. I'm Sarah Lane. Crazy gang abuses employee monitoring tool Security researchers at Huntress say a member of the Crazy Ransomware gang is abusing legitimate employee monitoring software and the Simple Help remote support tool to stay inside corporate network, avoid detection and prepare for ransomware attacks. In observed intrusions, the attackers installed Net Monitor for employees to watch screens, transfer files and run commands, while also deploying Simple Help under disguised file names for backup, access and disabling Windows Defender. The attackers monitored systems for cryptocurrency, wallets and remote access tools, and Huntress says both incidents likely came from the same operator using stolen SSL VPN credentials. Nevada unveils new data classification Nevada's IT agency introduced a statewide data classification policy months after a major cyber attack disrupted state systems. Under the new framework, agencies have to label data as public, sensitive, confidential or restricted, with stricter safeguards applied when classification is unclear. Officials say the policy establishes a shared baseline for protecting information and will underpin future cybersecurity measures, including multi factor authentication, as lawmakers continue broader reforms such as creating a state security operations center. Georgia Healthcare breach impacts more than 620,000 A 2025 cyber attack on Georgia based physician group Apollo MD exposed the sensitive data of 626,540 people, according to a new filing with the US Department of Health and Human Services. Hackers were inside the company's systems for two days in May, accessing names, birth dates, addresses, diagnosis, treatment details, insurance data and Social Security numbers. The Chilean ransomware gang claimed responsibility. Cisco Talos says the group published data from about 40 victims per month last year. Microsoft Store Outlook Add in hijacked to steal accounts Researchers at COI Security say a legitimate Outlook scheduling add in called Agree to, which was hijacked after its developer abandoned the project, letting a threat actor take control of its hosted content and turn it into a phishing kit. The malicious version showed a fake Microsoft login page inside Outlook and stole more than 4,000 account credentials along with credit card details and security answers, sending the data to attackers via Telegram. Microsoft has since removed the add in from its marketplace, and researchers say it may be the first malicious Outlook add in discovered there. Huge thanks to our sponsor ThreatLocker. Want Real Zero Trust Training Zero Trust World 2026 delivers hands on labs and workshops that show CISOs exactly how to implement and maintain zero trust in real environments. Join us March 4th through the 6th in Orlando, plus a live CISO series episode on March 6th. Get $200 off with ZTW CISO 26 at ztw.com 0APT ransomware group rises Researchers at Halcyon and GuidePoint Security say the new 0APT ransomware group likely inflated claims of about 200 victims in its first week, with no evidence confirming most of the breaches. Halcyon says the group's victim list appears to be a publicity stunt to attract affiliates, but warns its ransomware code and infrastructure are real and could pose a genuine threat. GuidePoint says the encryptor itself isn't especially advanced and notes the group still needs proven access and lateral movement capabilities to carry out attacks. Devilish devs spawn Chrome Extensions Security researcher Q Continuum identified 287 Chrome extensions and with about 37.4 million total installs that allegedly exfiltrate users browsing histories to more than 30 companies, including SimilarWeb, SEMrush, Alibaba and ByteDance. The study used automated testing to link browsing history with outbound data, finding many extensions requested unnecessary history access while disclosing the collection only vaguely in privacy policies. About 20 million installs were tied to unknown collectors. Windows 11 Notepad flaw lets files execute silently Microsoft fixed a high severity Windows 11 Notepad vulnerability that let attackers execute local or remote programs through malicious markdown links. The flaw let specially crafted links launch files without any Windows security warning, giving attackers the same permissions as the user who clicked them. The February Patch Tuesday update now adds warnings for non standard links and Notepad will update automatically through the Microsoft Store. Joker Opt seller Arrested Dutch Police arrested a 21 year old man suspected of selling access to the Joker Opt phishing tool, part of a three year investigation that dismantled the service last April. Authorities say the phishing as a service platform caused at least $10 million in losses across more than 28,000 attacks in 13 countries by automating calls to victims to capture one time passcodes. The suspect allegedly sold licenses via telegram, and police say dozens of buyers have already been identified and will face charges. Something's wrong with the math in the cybersecurity job market. If there are millions of unfilled jobs out there, why are so many job seekers struggling to even book an interview? That is what we're trying to figure out on the latest episode of Defense In Depth. Look for that episode Cybersecurity's Broken Hiring Process. Wherever you get your podcasts. If you have some thoughts on the news from today or about our show in general, be sure to reach out to us at FeedbackSoc. We would love to hear from you. I am Sarah Lane reporting for the CISO series and we will talk to you tomorrow.
- [07:15]
A
Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.