February 2026: Enterprise Vulnerabilities and Expanding Attack Surfaces
February 2026 highlighted how persistent exploitation of enterprise infrastructure continues to enable ransomware, espionage, and large-scale credential theft across global environments.
The month was defined by several high-impact developments:
Sustained exploitation of VMware ESXi and SmarterMail vulnerabilities enabling ransomware deployment and remote code execution across enterprise infrastructure.
Continued evolution of LockBit 5.0 and related ransomware campaigns targeting Windows, Linux, and virtualised ESXi environments with multi-platform frameworks.
Growing reliance on social engineering techniques such as ClickFix execution chains, phishing attachments, and malicious command execution workflows.
Expansion of mobile spyware threats, including the cross-platform ZeroDayRAT surveillance toolkit and firmware-level Android malware persistence.
Escalating supply chain compromises through malicious developer packages, cryptocurrency ecosystem attacks, and large-scale Chrome extension data harvesting.
Source: CyberSecBrief Monthly Briefing