SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals
SEC595Cyber Defense, Artificial Intelligence
SANS Community Benefits
Connect, learn, and share with other cybersecurity professionals
Top of the News
Patch Now: Hardcoded Creds Exploited in Dell RecoverPoint for VMs
On February 17, 2026, Dell and Google published security advisories warning customers that a maximum-severity flaw in Dell RecoverPoint for Virtual Machines (RP4VMs) is under active exploitation by a state-sponsored threat actor. CVE-2026-22769, CVSS score 10.0, allows an unauthenticated remote attacker to access the underlying operating system and gain root-level persistence due to a hardcoded credential in RP4VMs prior to version 6.0.3.1 HF1. The flaw was added to the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog (CISA KEV) the following day, with a three-day patch deadline of February 21 for government agencies. Mandiant and Google Threat Intelligence Group (GTIG) have observed exploitation of this vulnerability going back as far as 2024 "to move laterally, maintain persistent access, and deploy malware including SLAYSTYLE, BRICKSTORM, and a novel backdoor tracked as GRIMBOLT." The threat actor, suspected to be PRC-backed, is known to target edge appliances such as VPN concentrators for initial access. Mandiant discovered the hardcoded default credentials for the admin user while analyzing Apache Tomcat Manager configuration files during an investigation of compromised Dell RP4VMs actively communicating with a known command-and-control (C2) server. Dell instructs users to remediate by upgrading to RecoverPoint for Virtual Machines 6.0.3.1 HF1, first migrating from 5.3 SP4 P1 to 6.0 SP3 if needed. Dell provides instructions to run their remediation script as an alternative, also noting that "other Dell products, including RecoverPoint Classic (both physical and virtual appliances), are not affected by CVE-2026-22796." Mandiant's advisory offers forensic artifacts, indicators of compromise, and YARA rules for threat hunters and incident responders.
Editor's Notes
- Slide 1 of 5
Can’t be clearer than “Patch now.” If you’re relying on this application to protect you from ransomware or just relying on it at all, this is one of those Tier0 emergency issues. RecoverPoint, which I’ve never heard of, sounds like a Replication system like Veeam. These systems are typically used for disaster recovery, and increasingly for protection against ransomware. The fact that there is a hardcoded credential that could allow attackers to destroy these backups is not good.
- Slide 2 of 5
This vulnerability was exploited several months before a patch was made available. “Patch Now” isn’t sufficient, but “assume compromise” should be the right response to any exposed systems.
- Slide 3 of 5
Hardcoded credentials that can be exploited remotely… who needs their morning caffeine? Get the patch out now. And ask your suppliers how they are ensuring they have no hardcoded or default credentials. Then make sure your developers are doing the same.
- Slide 4 of 5
This one is worth testimony in front of a Congressional committee by Dell management on why Dell allowed Dell RecoverPoint for VMs to ship with a hardcoded admin password embedded in the code. This is kind of like parachutes being shipped in “open on impact” mode.
- Slide 5 of 5
Ugh, another hardcoded secret found and exploited. Yes, one can understand why they were used to begin with: convenience, legacy reasons, ease of maintenance, etc. That said, they are a well know security risk and DELL should have known better. OWASP has an excellent resource on secrets management as part of its Cheat Sheet Series. Use it.
Slide 1 of 0- Slide 1 of 5
RCE Vulnerability in Grandstream VoIP Phones
A critical unauthenticated stack-based buffer overflow vulnerability (CVE-2026-2329) affects all six models of Grandstream Networks' GXP1600 series VoIP phones. The vulnerability could be exploited by sending a maliciously crafted request to a vulnerable device to achieve remote code execution with root privileges, allowing attackers to take control of vulnerable devices. The issue was discovered by researchers at Rapid7 who note that "the vulnerability is present in the device's web-based API service, and is accessible in a default configuration." Rapid7 reached out to Grandstream on January 6, 2026, and Grandstream released the patched firmware on February 2, 2026. The vulnerability affects firmware versions 1.0.7.79 and earlier, so users are urged to update to version 1.0.7.81 or newer.
Editor's Notes
- Slide 1 of 3
Unauthenticated RCE with root privileges via the Web API. That could ruin your day. Did you catch that there are Metasploit modules which perform the exploit? Apply the update then look to see if you need the web interface enabled. If you do, limit access.
- Slide 2 of 3
Airgap your phone devices. They are generally not the most hardened systems, and they have no business on your general network. Now, with that said, I did talk to someone the other day who informed me that in their business, they are considering removing almost all phones and reverting to generic cellphone usage, and maybe having a few phones in the office in case. How often do people use office phones in 2026?
- Slide 3 of 3
Do we really need all this gratuitous functionality in single-use appliances? If it is there, it will end up in botnets. This may be a space where doing the right thing is harder than doing the wrong thing.
Slide 1 of 0- Slide 1 of 3
Microsoft Discloses WAC Privilege Elevation Patched in 2025
Microsoft has published a security advisory disclosing a high-severity flaw in Windows Admin Center (WAC), a browser-based tool allowing IT administrators to locally manage servers, clusters, and PCs. CVE-2026-26119, CVSS score 8.8, allows an authorized attacker to elevate privileges over a network due to improper authentication in WAC before version 2511. Security researcher Andrea Pierini discovered CVE-2026-26119 in July 2025, and in December Microsoft released WAC 2511, patching the flaw without yet publicly disclosing it. Users who have already updated to version 2511 do not need to take further action, but as of February 10 Microsoft has "updated the high availability deployment script and the associated documentation" for any users who have yet to update.
Editor's Notes
- Slide 1 of 4
Silently fixing a security flaw isn’t terribly transparent. It appears the fix was released before the CVE was created, further complicating the analysis and prioritization. Before we give Microsoft a hard time, make sure your WAC is on 2511. Double check your HA environment as the scripts and documentation are new while the update was released in December.
- Slide 2 of 4
In my opinion, it isn’t clear why this was released as an “out of band” patch. Usually, Microsoft only patches vulnerabilities like this if they are already exploited or if an exploit has been made public. Neither is the case for this vulnerability, according to Microsoft. We will see if more details become available, but I guess we may see an exploit soon.
- Slide 3 of 4
Do people use WAC? I’m not a day-to-day server admin anymore on the Windows Side and I’m also not someone who has taken the latest Windows Server Certifications to understand what they are pushing in 2026. I do know that Azure Arc is being promoted but I’ve never seen WAC in a test or engagement. I would be curious to hear from someone who does use it.
- Slide 4 of 4
The problem of security at Microsoft is not all in the legacy code but also in the culture. However well intentioned, changing priorities so ingrained in the culture of an organization the size of Microsoft may take yet a generation. Culture is part of the identity of large institutions and is highly resistant to change. Hope is not a tactic, let alone a strategy.
Slide 1 of 0- Slide 1 of 4
The Rest of the Week's News
Germany's State Railway System Website and App Disrupted by DDoS Attack
Deutsche Bahn, Germany's state-owned railway company, suffered a distributed denial-of-service (DDoS) attack earlier this week. The incident disrupted services for several hours on Tuesday, February 17. The attack affected Deutsche Bahn's website, Bahn.de, and the organization's mobile app, DB Navigator; during the disruption, customers were unable to access train information or purchase tickets online. The company declined to "speculat[e] regarding the background of the attack," and says they "are in close contact with the federal authorities." Deutsche Bahn says the app and website are no longer disrupted as of the morning of Wednesday, February 18.
Editor's Notes
- Slide 1 of 3
Not every disruptive attack needs to touch control systems to be effective. If you take down ticketing and schedule visibility for a national rail operator, you create real-world friction immediately. This is also a classic reminder that availability is often the easiest lever for attackers to pull. Attackers do not need deep network access or exotic malware to overwhelm public-facing infrastructure and create disruption at scale.
- Slide 2 of 3
Some press coverage noted that the site was implemented in AWS, and suggested that AWS may not be the right environment. Properly implemented cloud architectures can defend against very large DDoS attacks. But not all cloud architectures are properly implemented. To whoever attacked the site: Please don’t do so on the few days a year I have to use it (as I had to this time).
- Slide 3 of 3
DDoS attacks, while largely a nuisance, still happen and can be pulled off by relatively unsophisticated attackers. Make sure that your services are protected. It’s easy to overlook in the heat of deployment and really has to be SOP for anything internet-facing. Don’t forget to check your service providers; don’t assume it’s included or what level of protection they provide. Trust but verify.
Slide 1 of 0- Slide 1 of 3
Android Tablet Backdoor Baked into Firmware
Researchers at Kaspersky are warning that over 13,700 Android devices worldwide are infected by a new variety of backdoor malware, first disclosed in 2025 and dubbed "Keenadu," that is embedded in the firmware of several device brands. The only brand openly named by Kaspersky is Alldocube, and tablets appear to be the devices primarily targeted, with malware either introduced into libandroid_runtime.so during development or added via over-the-air (OTA) firmware updates; "in all cases ... the firmware files carry valid digital signatures." Malicious apps for smart cameras were another distribution vector, and accumulated over 300,000 downloads before being removed from the Google Play store. "A copy of the backdoor is loaded into the address space of every app upon launch" and may be built directly into critical system utilities such as facial recognition and the launcher app. The backdoor grants attackers "virtually unrestricted control over the victim's device," and exploitation has included conducting ad fraud, hijacking browsers and search engines, monitoring app installations, and sometimes adding items to online shopping carts. The researchers recommend reinstalling clean firmware from a trusted source, but note that the safest option is replacing the device.
Editor's Notes
- Slide 1 of 4
This is a supply chain compromise. The malware is inserted during the device build process. It was marketed as an advertising support feature. Because of where it’s located, conventional Android security tools cannot remove it. Step one: grab the IoCs from Kaspersky and see if you have impacted devices. Next, figure out remediation. While you may be able to resolve this issue by installing updated firmware, the better plan is to replace the device, as it’s not clear if and when the OEMs will address the flaw. You may wish to re-evaluate your approved device suppliers while you’re at it; this should introduce new questions you’ll want answered.
- Slide 2 of 4
That’s an oddly low and precise number to report. 13,700 is a small fraction of the hundreds of millions of devices. I think what makes this story interesting is that it’s part of a supply chain attack. In the last few years, we’ve seen stories of Android TVs that are used for pirating and watching movies illegally that have backdoors. Those are obvious targets; these go back to the more traditional supply chain, where the backdoor is in a legitimate system. It’s also interesting that as we make desktop/server environments harder to break into, attackers may resort to this to gain access.
- Slide 3 of 4
Firmware attacks have been around for years, with BlackLotus garnering much attention in 2023. Increasingly firmware is developed by third parties and used by multiple product vendors. Unfortunately, sometimes you get more than you paid for with low-cost products. In this case the safest and perhaps only option is to replace the device as the researchers recommend.
- Slide 4 of 4
This is a continuing problem with lower-end Android devices. They are often “certified pre-pwn3d” to make up for missing retail margins.
Slide 1 of 0- Slide 1 of 4
French National Bank Account Database Breached
France's Economy Ministry says that a hacker used credentials stolen from a civil servant to access a national bank account database, compromising details of 1.2 million accounts. The compromised data include account holder names, account numbers, and tax identification numbers. The National Bank Accounts File (FICOBA) holds information on all French bank accounts; the database contains information on more than 80 million individuals. The intruders reportedly had access to the database since late January; the incident was disclosed on Wednesday, February 18. The Directorate General of Public Finances (DGFiP), which operates FICOBA, says individuals whose accounts were compromised will receive notifications over the next few days.
Editor's Notes
- Slide 1 of 3
The database is widely used by tax, customs, and law enforcement agencies to detect fraud, tax evasion, and judicial enforcement. While the database itself doesn’t provide access to the accounts, the information included is sufficient to complete many types of transactions. I’m speculating this was a case of missing or ineffective MFA. Make sure your MFA is using best practices and newer options like passkeys. Actively work to sunset phone call and SMS based verification.
- Slide 2 of 3
Credential theft has been increasing over the last few years. It provides the adversary easy access from which to move laterally and gain persistence. Use of multi-factor authentication is a critical defense against credential compromise and is always recommended.
- Slide 3 of 3
The use of reusable credentials in such an application, in this day and age, can only be described as shameful. Late notification is hardly a remedy. We continue to see the use of reusable credentials within the enterprise while the adoption of optional strong authentication by the public is encouraging. The only thing inconvenient about passwordless authentication is the change. Just for example, passkeys are so much more secure and convenient that Microsoft is going all in for customers. One hopes that they are also doing it for associates.
Slide 1 of 0- Slide 1 of 3
Phobos Ransomware Suspect Arrested in Poland
Polish authorities from the country's Central Bureau for Combating Cybercrime (CBZC) have arrested an individual in connection with the Phobos ransomware group. The man was arrested following a raid of his apartment, where officers discovered devices containing account credentials, payment card data, server IP addresses, and other information that could be used to launch cyberattacks, including ransomware. The man allegedly contacted the Phobos ransomware group through encrypted messaging. He "was charged with the crime of creating, acquiring, and sharing computer programs used to unlawfully obtain information, including data enabling unauthorized access to information stored in a computer system (Article 269b § 1 of the Penal Code)" and could face up to five years in prison.
Editor's Notes
The CBZC is taking cybercrime seriously. This arrest ties back to Europol’s ongoing Operation Aether targeting the 8Base Ransomware group, which has ties to Phobos. 8Base infrastructure was dismantled a year ago. It’s great to see law enforcement agencies working across borders to successfully shutdown cybercrime.
African Cybercrime Crackdown Operation Supported by INTERPOL
Authorities in 16 African countries have arrested 651 people and recovered more than US $4.3 million in fraudulently obtained funds during a two-month international operation dubbed Operation Red Card 2.0. The operation, which ran from December 8, 2025 through January 30, 2026, "targeted the infrastructure and actors behind high-yield investment scams, mobile money fraud and fraudulent mobile loan applications." In all, the schemes were responsible for more than US $45 million in losses. Authorities seized thousands of devices and took down infrastructure related to scams and fraud schemes that employed phishing, identity theft, social engineering, and infiltration of the internal platform of a major telecommunications provider through compromised staff login credentials. INTERPOL provided support for Operation Red Card 2.0 "through critical intelligence sharing, real-time information exchange and capacity-building activities, including training on digital forensic tools." INTERPOL notes that the operation was conducted under the African Joint Operation against Cybercrime (AFJOC), an initiative funded by the UK’s Foreign, Commonwealth & Development Office.
Editor's Notes
- Slide 1 of 2
One thing to remember is the campaigns used multiple methods to entice victims. For example, the fraudulent investment scams used a $50 lure with promises of high returns. The trick is to educate people that it’s not just the $50 they’re willing to risk, it’s all the other personal information provided to setup the transaction, which may include ongoing access to payment and financial accounts and information.
- Slide 2 of 2
A nice operation by international law enforcement authorities. Unfortunately, the payouts are still too great and the cost too low, so cyber criminals will regroup to attack another day.
Slide 1 of 0- Slide 1 of 2
KEV Adds Six CVEs to Known Exploited Vulnerability Catalog This Week
The Cybersecurity and Infrastructure Security Agency (CISA) added six flaws to the Known Exploited Vulnerabilities (KEV) catalog this week. The newly-added CVEs are a server-side request forgery (SSRF) Vulnerability in GitLab (CVE-2021-22175); a use-after free vulnerability in Google Chromium CSS (CVE-2026-2441); a remote code execution vulnerability in Microsoft Windows Video ActiveX Control (CVE-2008-0015); an unrestricted upload of file with dangerous type vulnerability in TeamT5 ThreatSonar Anti-Ransomware (CVE-2024-7694); and a server-side request forgery vulnerability in Synacor Zimbra Collaboration Suite (CVE-2020-7796). All six flaws have Federal Civilian Executive Branch (FCEB) agency mitigation deadlines of March 10 or 1. A hard-coded credentials vulnerability in Dell RecoverPoint for Virtual Machines (RP4VMs) (CVE-2026-22769), was added with a three-day FCEB mitigation deadline, and is described in greater detail in its own item in today's NewsBites.
Editor's Notes
Hopefully no surprises here. I’m still thinking, “make sure we got this.” You really don’t want to learn the hard way that you missed one. Maybe a good time to make sure everyone and everything that needs to be actively consuming KEV updates is doing so.