Back to Threat Intelligence

Threat Intelligence Report – February 2026

30 days of threat data. 9 critical CVEs. 821,000+ threat events from 95 countries. This is what our sensors picked up across enterprise infrastructure worldwide.

821,791 threat events
6,878 unique attacker IPs
11,584 confirmed exploit attempts
95 countries
226,263 credential stuffing attacks

What we observed

  • Exploitation of Fortinet FortiGate, Ivanti Connect Secure, Citrix NetScaler, and React/Next.js platforms
  • Targeted CVEs: CVE-2025-64446, CVE-2024-55591, CVE-2024-21762, CVE-2025-22457, CVE-2025-0282, CVE-2023-3519, CVE-2025-5777, CVE-2025-7775, CVE-2025-55182
  • High-confidence TTPs: Iranian Go Bot credential stuffing and login brute force, path traversal attacks, unauthorized user creation attempts
  • 3 botnets identified including two Iranian State-Sponsored campaigns (suspected APT35/Charming Kitten)
  • Significant geographic concentration: Slovenia accounts for 27% of all attack traffic, with Netiface LLC as top threat source
  • 918 adversary IPs targeted multiple vulnerability classes (cross-platform threat activity)
  • 100 ransomware victims across 20 groups, with Qilin leading (20 victims)
  • TLS fingerprint intelligence: Monitoring 97 known malware signatures including Tofsee (45 variants)
Loading PDF viewer...