In today’s cybersecurity news…
Ukraine tightens controls on Starlink terminals
Ukraine introduced a mandatory whitelist for Starlink terminals, disconnecting any unverified devices, after confirming Russian forces are using Starlink-equipped drones for real-time control. Officials say the move, implemented with SpaceX, is meant to stop Russian UAVs that are harder to jam or intercept, with added restrictions limiting terminal use to stationary or low-speed operation. More than 50,000 Starlink terminals are active in Ukraine, and authorities say the measure is currently the only way to prevent Russian exploitation of the network. (The Record)
VMware ESXi flaw now exploited
CISA said Wednesday that ransomware groups are now exploiting a high-severity VMware ESXi sandbox escape flaw which Broadcom patched in March 2025 after it was used as a zero-day. The bug lets attackers with VMX-level privileges write to the kernel and escape a virtual machine, and has been linked to earlier sophisticated attacks attributed to Chinese-speaking threat actors. CISA has added the flaw to its Known Exploited Vulnerabilities catalog and is urging immediate patching. (BleepingComputer)
SolarWinds Web Help Desk bug under attack
Attackers are actively exploiting a critical SolarWinds Web Help Desk flaw just days after it was patched, prompting CISA to give federal agencies a three-day deadline to apply fixes. The 9.8-rated untrusted deserialization bug allows unauthenticated remote code execution and affects SolarWinds Web Help Desk versions prior to 2026.1 which was released January 28th. SolarWinds says it hasn’t seen widespread exploitation but is urging customers to patch immediately. (The Register)
US used cyber weapons to disrupt Iranian air defenses
Recorded Future News’ sources say the U.S. used cyber weapons to disable Iranian air defense systems during 2025 airstrikes on nuclear sites at Fordo, Natanz, and Isfahan, preventing Iran from launching surface-to-air missiles at U.S. aircraft. Officials claim Cyber Command, backed by NSA intelligence, targeted upstream network nodes rather than hardened facilities, marking one of the most sophisticated cyber operations against Iran to date. (The Record)
Huge thanks to our sponsor, Strike48
Hayete Gallot back to run cybersecurity at Microsoft
Microsoft is bringing back former executive Hayete Gallot to run cybersecurity while current security chief Charlie Bell moves into a new role focused on engineering quality. Gallot returns after a stint at Google Cloud and will serve as an executive vice president, reporting to CEO Satya Nadella. Charlie Bell joined Microsoft from AWS in 2021. (CNBC)
Microsoft develops scanner to detect backdoors
In other Microsoft news, the company says it’s developed a lightweight scanner to detect backdoors in open-weight large language models, using three behavioral signals to flag poisoned models with a low false-positive rate. The tool can identify trigger-based “sleeper agent” behavior without retraining the model or knowing the backdoor in advance. It needs access to model files and doesn’t work on proprietary systems. Microsoft says this is part of a broader push to integrate AI-specific threats like data poisoning into its secure development processes. (The Hacker News)
Epstein files leak sensitive data, victim info, and credentials
U.S. authorities have retracted thousands of records tied to the Jeffrey Epstein files, after inadequate redactions exposed sensitive data, affecting around 100 victims. This was first noted by AP News on February 2nd. The leaks included photos, names, emails, banking details, Social Security numbers, and, in some cases, full credit card information. Cybernews now reports the release exposed multiple passwords, some reportedly still valid, for accounts including Outlook, Gmail, Yahoo, LinkedIn, and Apple ID. (Security Magazine)
SystemBC found active across infected systems
Researchers at Silent Push say the SystemBC botnet is still active and linked to more than 10,000 infected IP addresses worldwide, often appearing early in intrusion chains that later lead to ransomware attacks. The proxy malware was first seen in 2019 and turns compromised systems into SOCKS5 relays and has been found lingering for weeks or months, largely on data center infrastructure, with infections concentrated in the U.S. Researchers also identified a previously undocumented Linux-focused variant with no antivirus detections and found compromised systems tied to government websites in Burkina Faso and Vietnam. (Infosecurity Magazine)