Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Human Risk Management and Security Awareness Training

A notable statistic continues to shape the cybersecurity research landscape: the human element remains involved in roughly 60% of all confirmed breaches. That’s according to the 2025 Verizon Data Breach Investigations Report (DBIR), which found that social engineering actions like phishing, pretexting, and credential misuse are consistently intertwined with today’s most common attack paths, even when they are not the first visible technical vector.

Update: Arctic Wolf Observes Threat Campaign Targeting BeyondTrust Remote Support Following CVE-2026-1731 PoC Availability

Since our previous security bulletin, Arctic Wolf has observed malicious activities in the wild tied to suspected exploitation of CVE-2026-1731 of self-hosted BeyondTrust Remote Support and Privileged Remote Access deployments. We are sharing threat intelligence related to this activity to help defenders protect against this campaign. CVE-2026-1731 allows unauthenticated remote threat actors to execute operating system commands in the context of the site user via specially crafted requests.

From Operations to Policy: Contributing to the Global Fight Against Ransomware

Today, the government of Canada issued a statement announcing that Arctic Wolf will continue to co-chair the Counter Ransomware Initiative Public-Private Sector Advisory Panel in 2026, alongside Public Safety Canada and BlackBerry. The panel will also include member organizations such as Ensign InfoSecurity, the Institute for Security and Technology, Microsoft, Palo Alto Networks, and the Royal United Service Institute.

CVE-2026-21643: Critical SQL Injection in FortiClientEMS

On February 6, 2026, Fortinet released fixes for a critical vulnerability in FortiClientEMS, tracked as CVE-2026-21643. The flaw arises from improper neutralization of special elements used in SQL commands in the FortiClientEMS GUI (web interface) that can allow an unauthenticated remote threat actor to execute unauthorized code or commands.

CVE-2026-1731: Unauthenticated OS Command Injection Vulnerability in BeyondTrust Remote Support and Privileged Remote Access

On February 6, 2026, BeyondTrust released fixes for a critical vulnerability affecting BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA), tracked as CVE‑2026‑1731. This vulnerability allows unauthenticated remote threat actors to execute operating system commands in the context of the site user via specially crafted requests.

What Are Insider Threats?

Cybersecurity isn’t only about defending against external attackers. Some of the most damaging risks come from within an organization. These are known as insider threats. An insider threat occurs when someone with authorized access—whether intentionally malicious or simply negligent—compromises systems, exposes data, or undermines security controls. This can result in data breaches, financial loss, regulatory issues, and long‑term reputational damage.

What Is Phishing?

Phishing remains one of the most widespread and damaging cyber threats facing organizations today. Attackers craft deceptive messages designed to trick users into revealing credentials, financial information, or installing malware. To make matters worse, the tactics continue to evolve. Originating in the mid‑1990s, phishing has grown into a sophisticated weapon. Modern attackers now use AI, social media intelligence, and high‑quality impersonation techniques to create convincing campaigns that are harder than ever to detect.

The Role of Artificial Intelligence in Zero Trust Cybersecurity Frameworks

Artificial intelligence (AI) is no longer an experimental capability in cybersecurity; it is foundational to modern security operations. Organizations are operating in environments defined by cloud-first infrastructure, remote and hybrid workforces, SaaS sprawl, and identity-centric attack patterns. At the same time, threat actors increasingly rely on automation and AI to accelerate reconnaissance, credential abuse, and post-compromise activity.

Notepad++ Publishes Full Details of 2025 Compromise

On February 2, 2026, the Notepad++ open source project disclosed new details about a supply chain compromise that impacted its update delivery infrastructure between June and December 2025. The attack was attributed to state-sponsored threat actors with links to China. In this campaign, the threat actors had gained access to a third-party hosting provider used by Notepad++ to distribute updates.