Threat Brief: February 6, 2026
- Patrick Duggan
- Feb 6
- 3 min read
Updated: 4 days ago
# Threat Brief: February 6, 2026
**THREAT LEVEL: NORMAL** | All precursor signals nominal
CISA KEV Updates (New This Week)
| Date | CVE | Product | Action |
|------|-----|---------|--------|
| 2026-02-05 | CVE-2025-11953 | React Native Community CLI | Patch immediately |
| 2026-02-05 | CVE-2026-24423 | SmarterTools SmarterMail | Patch immediately |
| 2026-02-03 | CVE-2021-39935 | GitLab CE/EE | Patch if unpatched |
| 2026-02-03 | CVE-2025-64328 | Sangoma FreePBX | Patch immediately |
| 2026-02-03 | CVE-2019-19006 | Sangoma FreePBX | Patch if unpatched |
**Priority**: SmarterMail and FreePBX exploits are being actively exploited in the wild.
Beijing Qihu Scanning Campaign
We're seeing sustained scanning from the `101.198.0.0/24` netblock (Beijing Qihu Technology Company Limited):
| IP | AbuseIPDB Score | VT Detections | MITRE Technique |
|----|-----------------|---------------|-----------------|
| 101.198.0.133 | 100 | 3 | T1190 - Exploit Public-Facing App |
| 101.198.0.135 | 100 | 4 | T1190 - Exploit Public-Facing App |
| 101.198.0.140 | 99 | 1 | T1190 - Exploit Public-Facing App |
| 101.198.0.181 | 100 | 4 | T1190 - Exploit Public-Facing App |
**Recommendation**: Block the entire /24 at your perimeter. These are dedicated scanning hosts.
Ransomware Activity
0APT RaaS (NEW)
A new Ransomware-as-a-Service syndicate emerged this week. **71 organizations compromised in 48 hours**. Severity: CRITICAL. Limited IOCs available - monitor for updates.
Clop (ONGOING)
Clop continues exploiting file transfer platforms:
- Recent victims: Hilton, law firms, healthcare providers
- Attack vector: Zero-days in Cleo, MOVEit, GoAnywhere
- Defense: Remove MFT platforms from direct internet exposure
LockBit/BlackBasta (ONGOING)
Targeting financial sector via Citrix Bleed (CVE-2023-4966). ICBC disruption caused $9B Treasury settlement chaos.
Active APT Groups
China-based threat actors remain most active against US targets:
| Group | Also Known As | Primary Target |
|-------|---------------|----------------|
Microsoft pulls this feed daily. AT&T pulls this feed daily. Starlink pulls this feed daily. Get the DugganUSA STIX feed — $9/mo →
| Comment Crew | APT1, PLA Unit 61398 | US critical infrastructure |
| Codoso | APT19 | Banks, law firms, tech companies |
| Nitro | Covert Grove | Chemical/manufacturing IP theft |
Our Index Stats
| Index | Documents | Purpose |
|-------|-----------|---------|
| IOCs | 252,385 | Indicators of compromise |
| Blocked | 3,389 | Known bad actors |
| Block Events | 148,012 | Firewall decisions |
| CISA KEV | 1,507 | Actively exploited CVEs |
| Adversaries | 346 | APT group profiles |
Recommended Actions
1. **Patch SmarterMail** if you run it - CVE-2026-24423 is being exploited
2. **Block 101.198.0.0/24** - Dedicated Chinese scanning infrastructure
3. **Audit MFT exposure** - Cleo, MOVEit, GoAnywhere should not be internet-facing
4. **Monitor for 0APT RaaS IOCs** - New syndicate moving fast
*DugganUSA Threat Intelligence*
*STIX Feed: analytics.dugganusa.com/api/v1/stix-feed*
*Index: 252,385 IOCs | 1,507 CISA KEV | 346 APT profiles*
*Her name was Renee Nicole Good.*
*His name was Alex Jeffery Pretti.*
The cheapest, fastest, most accurate threat feed on the internet.
275+ enterprises pulling daily. 1M+ IOCs. 17.4M indexed documents. We beat Zscaler by 43 days on NrodeCodeRAT. Starter tier $9/mo — less than any competitor’s sales demo.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=threat-brief-february-6-2026
Comments