Chinese APT Compromises Notepad++ Supply Chain; APT28 Exploits Office Zero-Day; Polish Energy Facilities Hit by ICS Attack

Executive Summary

This week's intelligence reveals a significant escalation in nation-state supply chain attacks and critical infrastructure targeting. Three major developments demand immediate attention from infrastructure operators:

Supply Chain Compromise: China-linked threat actor Lotus Blossom maintained persistent access to Notepad++ hosting infrastructure for approximately six months, enabling targeted malware delivery to select users. This represents a sophisticated supply chain attack with potential implications for development environments across critical infrastructure sectors.
Active Exploitation: Russian APT28 (Fancy Bear) is actively exploiting CVE-2026-21509, a newly disclosed Microsoft Office vulnerability, in espionage campaigns targeting Ukraine and EU entities. Organizations should prioritize patching immediately.
ICS Attack on Energy Sector: Polish energy facilities suffered a destructive attack exploiting default ICS credentials, highlighting persistent vulnerabilities in operational technology environments. Poland's CERT has released detailed attribution and technical indicators.
Additional Concerns: Multiple supply chain attacks targeting developer tools (Open VSX, ClawHub/OpenClaw), over 1,400 MongoDB databases ransomed, and the emergence of pure exfiltration ransomware tactics that bypass traditional encryption-based detection.

Microsoft's announcement of NTLM deprecation represents a significant security improvement but will require careful planning for legacy system transitions in critical infrastructure environments.

Threat Landscape

Nation-State Threat Actor Activities

China-Linked Operations

Lotus Blossom/Notepad++ Compromise: Chinese APT group Lotus Blossom has been attributed with medium confidence to a sophisticated supply chain attack on Notepad++. The threat actor compromised the hosting provider's infrastructure, maintaining access for approximately six months and redirecting update traffic to malicious servers for select targets. This targeted approach suggests intelligence collection objectives rather than broad criminal activity.
Sources: SecurityWeek, CyberScoop, The Hacker News
AI Trade Secret Theft: Former Google engineer Linwei Ding was found guilty of stealing AI trade secrets for China, underscoring ongoing concerns about insider threats and intellectual property theft targeting technology companies.
Source: Infosecurity Magazine

Russia-Linked Operations

APT28 Office Zero-Day Exploitation: Ukraine's CERT (CERT-UA) has attributed active exploitation of CVE-2026-21509 to APT28 (also tracked as UAC-0001/Fancy Bear). The campaign, codenamed by researchers, targets Ukrainian and European Union entities with espionage-focused malware. The vulnerability affects multiple Microsoft Office versions and is being exploited via malicious documents.
Sources: The Hacker News, Infosecurity Magazine, Bleeping Computer

International Cooperation

Japan-UK Cybersecurity Partnership: Japan and Britain have agreed to accelerate cooperation on cybersecurity and critical minerals supply chains in response to growing Chinese influence in the region. This partnership may yield enhanced threat intelligence sharing relevant to critical infrastructure protection.
Source: SecurityWeek
Germany-Israel Joint Exercise: Germany and Israel conducted joint training exercises focused on defending against cyberattacks, demonstrating increased international collaboration on critical infrastructure defense.
Source: CSO Online

Ransomware and Cybercriminal Developments

ShinyHunters Extortion Evolution: ShinyHunters-branded extortion activity has expanded and escalated, with threat actors employing evolved vishing (voice phishing) and login harvesting techniques to compromise SSO credentials for unauthorized MFA enrollment. This represents a significant evolution in initial access tactics.
Source: SecurityWeek
Pure Exfiltration Attacks Surge: Security researchers report a significant increase in ransomware attacks that rely solely on data exfiltration without encryption. These attacks are harder to detect in progress, as victims often don't realize they've been compromised until extortion demands arrive.
Source: Security Magazine
MongoDB Database Ransoming: A single threat actor has compromised over 1,400 of approximately 3,100 unprotected MongoDB instances, with half remaining compromised. This campaign highlights the ongoing risk of exposed database infrastructure.
Source: SecurityWeek

Supply Chain Attack Vectors

Open VSX/GlassWorm Campaign: Threat actors compromised a legitimate developer's account on the Open VSX Registry to publish malicious versions of four established VS Code extensions. The GlassWorm malware loader targets macOS systems, stealing passwords, cryptocurrency wallet data, and developer credentials.
Sources: SecurityWeek, The Hacker News, Bleeping Computer
ClawHub/OpenClaw Malicious Skills: Security researchers identified 341 malicious skills across multiple campaigns on ClawHub (the official registry for OpenClaw AI assistant). Over 230 malicious packages were published in less than a week, targeting users with password-stealing malware.
Sources: The Hacker News, Bleeping Computer
eScan Antivirus Compromise: The update infrastructure for eScan antivirus (developed by MicroWorld Technologies) was compromised to deliver multi-stage persistent malware, representing another concerning supply chain attack on security software.
Source: The Hacker News
AI Coding Assistants Data Exfiltration: Two AI coding assistants used by approximately 1.5 million developers have been found to secretly copy code to servers in China, raising significant concerns about intellectual property protection and supply chain security in development environments.
Source: Schneier on Security

Emerging Attack Vectors

OpenClaw RCE Vulnerability: A high-severity security flaw in OpenClaw enables one-click remote code execution through crafted malicious links, creating significant risk for users of this AI assistant platform.
Source: The Hacker News
Android RAT via Hugging Face: Bitdefender discovered a new Android malware campaign using the Hugging Face AI model repository to host malware, demonstrating threat actors' continued abuse of legitimate platforms.
Source: Infosecurity Magazine
PDF/Dropbox Phishing Campaign: A new phishing attack leverages PDFs hosted on Dropbox to bypass email security controls, requiring updated detection capabilities.
Source: CSO Online
Stealthy Windows RAT: Researchers have identified a new Windows RAT capable of holding live conversations with its operators, enabling more dynamic and adaptive attack execution.
Source: CSO Online

Sector-Specific Analysis

Energy Sector

CRITICAL: Polish Energy Facilities Attack

Poland's CERT has published detailed analysis of a destructive attack targeting Polish energy facilities. Key findings include:

Attack Vector: Exploitation of default ICS credentials—a preventable vulnerability that continues to plague operational technology environments
Impact: Destructive in nature, suggesting intent beyond data theft or espionage
Attribution: Poland's CERT has provided attribution details (specific actor not disclosed in available reporting)

Recommended Actions for Energy Sector:

Immediately audit all ICS/SCADA systems for default credentials
Implement network segmentation between IT and OT environments
Review Poland CERT's technical indicators for defensive purposes
Ensure logging and monitoring capabilities cover OT network segments

Source: SecurityWeek

Communications & Information Technology

Supply Chain Security Concerns

This week's multiple supply chain compromises affecting developer tools have significant implications for IT infrastructure:

Notepad++ Compromise: Widely used text editor's update mechanism hijacked for six months; organizations should verify integrity of installed versions and review systems for indicators of compromise
VS Code Extension Ecosystem: GlassWorm malware distributed through compromised Open VSX extensions; development environments require enhanced monitoring
AI Development Tools: Multiple AI coding assistants and platforms compromised, creating risk for organizations using these tools in development pipelines

Microsoft NTLM Deprecation

Microsoft has announced a three-phase approach to disable NTLM authentication by default in upcoming Windows Server and Windows releases, transitioning to Kerberos-based authentication. While this improves security posture, critical infrastructure operators should:

Inventory systems and applications dependent on NTLM authentication
Develop migration plans for legacy systems
Test Kerberos compatibility in non-production environments
Plan for extended transition periods in OT environments where updates are constrained

Sources: SecurityWeek, The Hacker News, CSO Online

Financial Services

Customer Protection Priorities

Security experts have outlined key strategies for banks and financial institutions to defend customers, personnel, and physical assets. Recommendations emphasize integrated physical and cyber security approaches.

Source: Security Magazine

High-Yield Investment Scams

CTM360 reports a global surge in fake high-yield investment platforms (HYIP scams) that promise "guaranteed" returns while operating as Ponzi schemes. These scams scale rapidly through social media and recycled website templates, potentially affecting financial services customers and institutional reputation.

Source: Bleeping Computer

Healthcare & Public Health

No sector-specific incidents reported this period. However, healthcare organizations should note:

The pure exfiltration ransomware trend poses particular risk to healthcare data
Supply chain attacks on development tools may affect healthcare software vendors
APT28's Office exploitation campaign could target healthcare entities with EU/Ukraine connections

Government Facilities

Election Security Concerns

As federal agencies reduce election security support, state Secretaries of State are working to replace cybersecurity services previously provided by CISA and other federal agencies. This transition creates potential gaps in election infrastructure protection.

Source: CyberScoop

Insider Threat Case

A Navy veteran working as a Pentagon contractor has been indicted for allegedly leaking classified information to a reporter, highlighting ongoing insider threat concerns for government facilities and contractors.

Source: Homeland Security Today

Food & Agriculture

Panera Bread Data Breach Update

The Have I Been Pwned service has clarified that the Panera Bread data breach affected 5.1 million accounts, not the previously reported 14 million customers. Organizations in the food service sector should review their data protection practices.

Source: Bleeping Computer

Vulnerability & Mitigation Updates

Critical Vulnerabilities Requiring Immediate Attention

CVE	Affected Product	Severity	Status	Notes
CVE-2026-21509	Microsoft Office (multiple versions)	High	ACTIVELY EXPLOITED	APT28 exploitation confirmed; patch immediately
OpenClaw RCE	OpenClaw AI Assistant	High	Disclosed	One-click RCE via malicious link

Weekly Vulnerability Summary

US-CERT has published the vulnerability summary for the week of January 26, 2026, including multiple high-severity vulnerabilities across various products. Critical infrastructure operators should review the full bulletin for sector-relevant vulnerabilities.

Source: US-CERT Bulletins

NSA Zero Trust Guidelines

The NSA has published new Zero Trust implementation guidelines to help organizations achieve target-level Zero Trust maturity. These guidelines provide practical implementation steps for critical infrastructure environments.

Source: Infosecurity Magazine

Recommended Defensive Measures

Immediate Actions:

Patch Microsoft Office: Apply patches for CVE-2026-21509 across all systems immediately given active APT28 exploitation
Audit ICS Credentials: Following the Polish energy attack, verify no default credentials exist on ICS/SCADA systems
Review Development Tools: Audit VS Code extensions, AI coding assistants, and Notepad++ installations for compromise indicators
MongoDB Security: Ensure all MongoDB instances require authentication and are not exposed to the internet

Strategic Recommendations:

Implement software bill of materials (SBOM) practices to track supply chain dependencies
Enhance monitoring for data exfiltration given the rise in encryption-less ransomware
Begin planning for NTLM deprecation in Windows environments
Review non-human identity management practices as a critical security blind spot

Windows Known Issues

Microsoft has confirmed and addressed several Windows issues:

Shutdown Bug: January update causing shutdown issues affects both Windows 11 and Windows 10 systems with Virtual Secure Mode (VSM) enabled
Password Sign-in Option: Fixed issue causing password sign-in option to disappear from lock screen after August 2025 updates

Sources: Bleeping Computer

Resilience & Continuity Planning

Supply Chain Security Lessons

This week's multiple supply chain compromises offer critical lessons for resilience planning:

Key Takeaways:

Hosting Provider Risk: The Notepad++ compromise occurred through the hosting provider, not the software developer—third-party infrastructure represents significant supply chain risk
Update Mechanism Targeting: Software update mechanisms are high-value targets; consider implementing update verification beyond standard signatures
Developer Tool Exposure: Development environments with access to source code and credentials require enhanced security controls
Targeted vs. Broad Attacks: Nation-state actors may compromise widely-used tools but only target specific victims, making detection more difficult

Recommended Resilience Measures:

Implement network-level monitoring for update traffic anomalies
Maintain offline backups of critical software installers
Establish verification procedures for software updates in critical environments
Develop incident response playbooks specifically for supply chain compromises

Non-Human Identity Management

Security analysts identify non-human identities (service accounts, API keys, machine identities) as a critical security blind spot for 2026. Critical infrastructure operators should:

Inventory all non-human identities across environments
Implement lifecycle management for service accounts and API keys
Apply least-privilege principles to machine identities
Monitor non-human identity usage for anomalies

Source: CSO Online

AI Security Considerations

As AI tools become more prevalent in critical infrastructure operations, security leaders should note:

Agentic AI systems present new security challenges that will intensify in coming months
AI-enhanced malware and attack techniques are evolving rapidly
AI development platforms (Hugging Face, ClawHub) are being abused to host malware
Mozilla's new Firefox controls allowing users to disable AI features may indicate growing privacy/security concerns

Sources: SecurityWeek, CSO Online

Regulatory & Policy Developments

Federal Initiatives

FBI Operation Winter SHIELD

The FBI has launched Operation Winter SHIELD to help organizations strengthen cyber resilience. This initiative provides resources and guidance for improving defensive postures against current threat landscape.

Source: Homeland Security Today

CMMC Compliance

The Cybersecurity Maturity Model Certification (CMMC) continues to set benchmarks for how Department of Defense contractors demonstrate cybersecurity readiness. Security professionals can leverage ISACA resources for CMMC career development and compliance preparation.

Source: Security Magazine

International Developments

Japan-UK Partnership: Enhanced cooperation on cybersecurity and critical minerals supply chains between Japan and the United Kingdom
Germany-Israel Cooperation: Joint cyber defense training exercises demonstrate strengthening international partnerships

Industry Standards

Responsible Disclosure Challenges

Security researchers highlight ongoing challenges with responsible disclosure processes, describing the current state as "unpaid labor." Organizations should review their vulnerability disclosure programs to ensure they appropriately support security researchers.

Source: CSO Online

Training & Resource Spotlight

New Guidelines and Frameworks

NSA Zero Trust Implementation Guidelines: New practical guidance for achieving target-level Zero Trust maturity
Source: Infosecurity Magazine
FBI Operation Winter SHIELD Resources: New resources for organizational cyber resilience
Source: Homeland Security Today

Calls for Papers and Research

Joint Special Operations University: Extended call for papers on special operations and security topics
Source: Homeland Security Today

Professional Development

ISACA CMMC Resources: Guidance for security professionals pursuing CMMC-related career paths
Source: Security Magazine
Risk Culture Development: Guidance on building predictive capabilities within cyber teams through risk culture
Source: CSO Online

Podcasts and Educational Content

Disaster Zone Podcast: Examines emerging trends in emergency management and homeland security
Source: Homeland Security Today
Digital Era Terrorism Podcast: Explores how terrorism has evolved in the digital era
Source: Homeland Security Today

Looking Ahead: Upcoming Events

Workshops and Conferences

NIST Cybersecurity for IoT Workshop: Future Directions
Date: March 31, 2026
Focus: Emerging and future trends for IoT technologies and their implications for IoT cybersecurity, including automation and ubiquitous deployment considerations
Source: NIST Information Technology

Major Events Requiring Security Awareness

FIFA World Cup 2026: Former FBI leader Richard Ryan has been named Security Director, indicating significant security planning underway for this major international event
Source: Homeland Security Today

Threat Periods Requiring Heightened Awareness

Ongoing: APT28 campaign exploiting CVE-2026-21509—heightened vigilance for organizations with Ukraine/EU connections
Ongoing: Supply chain attack activity targeting developer tools—enhanced monitoring recommended for development environments
Ongoing: Pure exfiltration ransomware campaigns—traditional encryption-based detection may miss these attacks

Anticipated Developments

Microsoft NTLM Deprecation: Three-phase rollout beginning with upcoming Windows Server and Windows releases
Election Security Transitions: State-level cybersecurity service development as federal support changes
AI Security Evolution: Continued emergence of AI-related threats and defensive capabilities

Key Intelligence Gaps

The following areas require continued monitoring due to incomplete information:

Full scope of Lotus Blossom targeting through Notepad++ compromise—specific victim profiles not disclosed
Complete technical indicators from Polish energy facility attack—awaiting full CERT report translation
Attribution for eScan antivirus infrastructure compromise
Extent of AI coding assistant data exfiltration to China

This intelligence briefing is compiled from open-source reporting and is intended to support critical infrastructure protection decision-making. Recipients are encouraged to verify information through official channels and report suspicious activity to appropriate authorities.

Report Date: Tuesday, February 03, 2026

Disclaimer

This briefing is generated using AI analysis of public news sources. Always verify critical information through authoritative sources before taking action.