Weekly Cyber Update: 13 February 2026

The Cyber Threat Intelligence Briefing is a weekly round-up of the latest cybersecurity news, trends and indicators, curated by our CISO, Nick Harris. Here’s our pick of the top stories, and why you should care

---

Ivanti EPMM exploitation exposes several governments

Several European governments have had employee data compromised in what appears to be a coordinated campaign. The threat actors exploited at least one critical zero-day vulnerability in Ivanti Endpoint Manager Mobile (EPMM), a mobile device management product. The vendor issued patches for two critical zero-days on January 29. The European Commission, Finnish, and Dutch governments all issued statements confirming data breaches on February 6. Potentially compromised information included names, business email addresses, and telephone numbers.

Why it matters

Edge infrastructure, such as Ivanti EPMM, is an increasingly popular target for threat actors. In this case, exposed information could enable threat actors to launch convincing follow-on spear-phishing attacks for deeper system access.

Assured’s recommended action

Follow Ivanti’s instructions to patch the impacted products. Reset any related passwords and update user awareness training to warn of potential spear phishing. Place edge devices behind zero trust network access (ZTNA) gateways.

---

Unpatched zero-click flaw discovered in Claude Desktop Extensions

Researchers have discovered a critical vulnerability in 50 Claude Desktop Extensions (DXT) that could enable remote code execution (RCE) without user interaction. The bug has a CVSS score of 10.0 and could affect more than 10,000 active Claude DXT users, but Anthropic has declined to fix it at this time, citing that it “falls outside our current threat model.”

Why it matters

Anthropic’s Claude chatbot is popular with enterprise users, who may be using it without their IT department’s knowledge. Unlike sandboxed browser extensions, Claude DXTs run with full system privileges, exposing users to greater risk.

Assured’s recommended action

Treat MCP connectors like Claud DXTs as unsafe. Where possible, audit their use across the enterprise and request removal. Block enterprise downloads of the chatbot.

---

Lumma infostealer infections surge

Researchers have observed an increase in LummaStealer (LummaC2) infections driven by social engineering “ClickFix” attacks. Bitdefender saw a significant surge in December and January, with LummaC2 delivered through the CastleLoader malware loader. Users are presented with fake CAPTCHA requests to trick them into executing malicious PowerShell commands.

Why it matters

LummaC2 is designed to steal a range of sensitive data, including credentials and cookies stored in web browsers, cryptocurrency wallet info, documents, session cookies, and 2FA backup codes and tokens. It could enable more serious data breaches and ransomware attacks.

Assured’s recommended action

Put controls in place to prevent users downloading and executing software or media from untrusted sources such as torrent sites. Update security awareness training to include ClickFix techniques. Block traffic to known infostealer C&C servers.

---

NCSC urges critical infrastructure firms to act now amid mounting threats

The National Cyber Security Centre (NCSC) has urged critical national infrastructure (CNI) providers to step up their efforts to improve cyber resilience. The call from the director for national resilience follows a recent sophisticated Russian campaign to sabotage Polish energy infrastructure.

Why it matters

State actors are becoming more emboldened to strike at CNI, especially in countries allied to Ukraine. A serious attack could cause major disruption to infrastructure, and economic, societal and reputational damage.

Assured’s recommended action

The NCSC urges CNI to consult its Cyber Assessment Framework (CAF) to “understand and implement an appropriate, and robust, level of cyber resilience.” It contains useful advice on risk management, identity and access controls, and threat hunting. Separate NCSC advice on mitigating “severe” threats is available here.

---

 

Microsoft patches six zero-day vulnerabilities

Microsoft issued patches for a whopping six actively exploited zero-day vulnerabilities in this month’s Patch Tuesday, three of which had been publicly disclosed. Three of the zero-days (CVE-2026-21510, CVE-2026-21513, CVE-2026-21514) allow attackers to bypass Windows security prompts. Two are elevation-of-privilege bugs (CVE-2026-21533 and CVE-2026-21519), and another (CVE-2026-21525) is a denial-of-service bug.

Why it matters

The zero-days are being actively exploited, making patching an immediate priority. There’s a greater risk of exploitation for those CVEs for which information has been publicly disclosed (CVE-2026-21513, CVE-2026-21510, and CVE-2026-21514).

Assured’s recommended action

No organisation’s exposure to CVEs is the same. Use a risk-based methodology to prioritise patching for those released in this month’s Patch Tuesday (including the zero-days).

---