RECAP

February 2026

All months
0incidents investigated
28entered active exploitation · 2 used by ransomware
21ransomware victims · 21 in Brazil
8active groups
4,632new vulnerabilities · 417 critical

What we investigated

Each case with its confidence seal and verdict — not rumors.

No records this month.

What actually came under attack

Vulnerabilities added to CISA's KEV catalog during the month: confirmed active exploitation.

CVE-2026-1731 ⚠
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)
CRITICAL · 9.9 · EPSS 94%
CVE-2026-24423 ⚠
SmarterTools SmarterMail
CRITICAL · 9.3 · EPSS 88%
CVE-2025-49113
Roundcube Webmail
CRITICAL · 9.9 · EPSS 99%
CVE-2025-11953
React Native Community CLI
CRITICAL · 9.8 · EPSS 94%
CVE-2020-7796
Synacor Zimbra Collaboration Suite
CRITICAL · 9.8 · EPSS 94%
CVE-2026-20127
Cisco Catalyst SD-WAN Controller and Manager
CRITICAL · 10.0 · EPSS 88%
CVE-2025-64328
Sangoma FreePBX
HIGH · 8.6 · EPSS 85%
CVE-2025-40551
SolarWinds Web Help Desk
CRITICAL · 9.8 · EPSS 84%
CVE-2024-43468
Microsoft Configuration Manager
CRITICAL · 9.8 · EPSS 81%
CVE-2008-0015
Microsoft Windows
HIGH · 8.8 · EPSS 77%
CVE-2025-40536
SolarWinds Web Help Desk
HIGH · 8.1 · EPSS 74%
CVE-2026-21510
Microsoft Windows
HIGH · 8.8 · EPSS 61%
CVE-2026-2441
Google Chromium
HIGH · 8.8 · EPSS 55%
CVE-2019-19006
Sangoma FreePBX
CRITICAL · 9.8 · EPSS 55%
CVE-2021-22175
GitLab GitLab
MEDIUM · 6.8 · EPSS 53%
CVE-2021-39935
GitLab Community and Enterprise Editions
MEDIUM · 6.8 · EPSS 36%
CVE-2025-68461
Roundcube Webmail
HIGH · 7.2 · EPSS 27%
CVE-2026-21513
Microsoft Windows
HIGH · 8.8 · EPSS 16%
CVE-2026-22769
Dell RecoverPoint for Virtual Machines (RP4VMs)
CRITICAL · 10.0 · EPSS 14%
CVE-2022-20775
Cisco SD-WAN
HIGH · 7.8 · EPSS 12%
CVE-2026-25108
Soliton Systems K.K FileZen
HIGH · 8.7 · EPSS 5%
CVE-2026-21525
Microsoft Windows
MEDIUM · 6.2 · EPSS 5%
CVE-2026-21533
Microsoft Windows
HIGH · 7.8 · EPSS 4%
CVE-2026-21519
Microsoft Windows
HIGH · 7.8 · EPSS 3%
CVE-2024-7694
TeamT5 ThreatSonar Anti-Ransomware
HIGH · 7.2 · EPSS 2%
CVE-2025-15556
Notepad++ Notepad++
HIGH · 7.7 · EPSS 2%
CVE-2026-20700
Apple Multiple Products
HIGH · 7.8 · EPSS 2%
CVE-2026-21514
Microsoft Office
HIGH · 7.8 · EPSS 2%

Who attacked most

lockbit57 (7 BR)
thegentlemen5 (5 BR)
vect4 (4 BR)
clop1 (1 BR)
nightspire1 (1 BR)
incransom1 (1 BR)
qilin1 (1 BR)
spacebears1 (1 BR)

Victims in Brazil

Organizations listed on extortion sites. Appearing there is the criminal's CLAIM, not a confirmation.

Fundao Para
thegentlemen · Government & Defense · 27 Feb 2026
brassuco.com.br
lockbit5 · Agriculture and Food Production · 26 Feb 2026
Empresa de Transportes Via Pajuçara Ltda.
incransom · Transportation · 26 Feb 2026
Del Rey
vect · Professional Services · 25 Feb 2026
brassuco.com.br
lockbit5 · Agriculture and Food Production · 24 Feb 2026
MB Contabilidade
vect · Professional Services · 24 Feb 2026
Grupo Progresso
thegentlemen · Agriculture and Food Production · 18 Feb 2026
Sitran MG
spacebears · Professional Services · 15 Feb 2026
Auvo
vect · Technology · 13 Feb 2026
Was Madeiras
vect · Manufacturing · 13 Feb 2026
Agis Civil Engineering Construction
thegentlemen · Manufacturing · 10 Feb 2026
UniFil
thegentlemen · Education · 10 Feb 2026
Fgf Colleges & Universities
thegentlemen · Education · 10 Feb 2026
CENTINELA.COM.BR
clop · Professional Services · 07 Feb 2026
Fico Ferragens Indústria e Comércio Ltda
nightspire · Manufacturing · 07 Feb 2026
grupoferrosider.com.br
lockbit5 · Manufacturing · 06 Feb 2026
kenta.com.br
lockbit5 · Technology · 04 Feb 2026
guarnera.com.br
lockbit5 · Business Services · 04 Feb 2026
gruposelpe.com.br
lockbit5 · Business Services · 04 Feb 2026
fastindustria.com.br
lockbit5 · Manufacturing · 04 Feb 2026
Share