Black Arrow Cyber Threat Intelligence Briefing 06 February 2026

8 Feb

Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Executive Summary

A new evolving business threat has come to the fore, caused by autonomous AI assistants such as OpenClaw (aka Clawdbot and Moltbot), with significant and developing cyber risk considerations. In our summaries below, we also give details of other developing attack methods, including voicemail alerts and fake PDFs. AI, as predicted, is also escalating the dangers of phishing emails and is a concern for 75% of cyber professionals.

We also look at how employees and supply chains represent significant security weaknesses and how to address them, further underlining why cyber security is not a technology subject but instead requires coordinated risk management across the business.

To address these risks, leadership teams need to ensure their cyber knowledge comes from impartial experts, to take greater command of the risks and avoid the same blind spots as their control providers across people, operations and technology. Contact us to discuss how to achieve this in a proportionate manner.

Top Cyber Stories of the Last Week

From Clawdbot to OpenClaw: This Viral AI Agent Is Evolving Fast – and It’s Nightmare Fuel for Security Pros

OpenClaw, a fast growing open source personal AI assistant, shows how quickly AI tools could reshape cyber risk. It can connect to everyday apps like WhatsApp, email and calendars, and needs broad permissions to take actions on a user’s behalf. That access creates new routes for cyber attack, including fake downloads and scams, malicious add-ons, unsafe settings that leak passwords or access keys, and hidden instructions that trick the AI into harmful actions. Despite 34 recent security fixes, leaders should treat autonomous assistants as high risk until governance and controls mature.

https://www.zdnet.com/article/clawdbot-moltbot-openclaw-security-nightmare/

Why Moltbook Changes the Enterprise Security Conversation

A new risk is emerging as artificial intelligence agents begin talking to each other on social platforms such as Moltbook, often without ongoing human oversight. Once an employee sets an agent in motion, it can continue reading and posting online for long periods, creating a largely invisible route for sensitive information to leak, including source code, customer data, or internal project details. There is also an inbound threat where agents may absorb harmful instructions or links posted by others, influencing behaviour and decisions. Organisations should consider blocking such platforms by default, with tightly governed exceptions where needed.

https://securityboulevard.com/2026/02/why-moltbook-changes-the-enterprise-security-conversation/

Beware of Weaponised Voicemail Messages Granting Hackers Remote Access to Your System

A new “Voicemail Trap” campaign is using fake voicemail notifications to trick staff into handing criminals remote access to their devices. The messages often impersonate trusted financial organisations and direct recipients to convincing, bank themed websites. Victims are told to download an “audio update” to hear the message, but the file is a script that silently installs legitimate remote management software, allowing attackers persistent access to steal data or deploy further malware. Researchers observed 86 websites linked to this activity on 12 January 2026. Leaders should reinforce click caution and block untrusted download prompts.

https://cybersecuritynews.com/beware-of-weaponized-voicemail-messages/

Open the Wrong “PDF” and Attackers Gain Remote Access to Your PC

A phishing campaign known as DEAD#VAX is tricking staff into opening what looks like a normal PDF invoice or purchase order, but is actually a virtual hard disk file. When opened, Windows mounts it as a new drive and runs a hidden script that installs AsyncRAT, giving attackers remote access and the ability to monitor and control the PC. Because the malicious code runs in memory and hides inside trusted Microsoft processes, it can be harder for security tools and later investigation to spot. This can lead to password theft, data exposure, and a foothold into wider networks.

https://www.malwarebytes.com/blog/news/2026/02/open-the-wrong-pdf-and-attackers-gain-remote-access-to-your-pc

AI Drives Doubling of Phishing Attacks in a Year

Cofense reports that security filters intercepted one phishing email every 19 seconds in 2025, more than double the rate in 2024. It warns that criminals are using AI to create faster, more convincing scams, including messages written in near flawless local languages. Nearly one in five phishing emails now relies on conversation alone, a tactic often linked to business email compromise, where attackers impersonate trusted contacts to trick staff into making payments or sharing sensitive information. Cofense also saw a 105% rise in remote access tools abuse and a 204% increase in phishing emails delivering malware.

https://www.infosecurity-magazine.com/news/ai-double-volume-phishing-attacks/

Nitrogen Ransomware Is So Broken Even the Crooks Can’t Unlock Your Files

Researchers at Coveware have found that the Nitrogen ransomware group has a serious flaw in its file unlocking tool, meaning victims may be unable to recover data even if they pay. The issue affects attacks against VMware ESXi, a common virtualisation platform used to run servers, where the malware encrypts files using a corrupted key that cannot be matched to any working unlock code. Active since 2023 and extorting organisations since around September 2024, Nitrogen is not the most prolific group, but this bug turns its attacks into purely destructive cyber crime.

https://www.theregister.com/2026/02/04/nitrogen_ransomware_broken_decryptor/

The Human Layer of Security: Why People Are Still the Weakest Link in 2026

Despite major investment in tools and automation, people remain the primary cause of cyber security incidents. Gartner expects human error and social engineering, where criminals trick staff into unsafe actions, to drive 85% of data breaches by 2026, and Verizon links roughly two thirds of incidents to mistakes or misuse of login details. Threat actors are increasingly using AI to scale deception, with CrowdStrike’s 2025 report showing 79% of intrusions were malware-free and voice phishing rising 442%. Leaders should prioritise stronger day-to-day security habits, not just annual training, so staff become a resilient first line of defence.

https://securityboulevard.com/2026/02/the-human-layer-of-security-why-people-are-still-the-weakest-link-in-2026/

What Is Cyber Risk Management and Why It Is Important for Businesses?

Cyber risk management is how organisations identify, understand and reduce the risks that come with using digital systems, networks and data. It is a continuous process, not a one-off exercise, because threats evolve as technology and working practices change. Effective cyber risk management considers people, processes and technology together, covering areas such as staff awareness, access controls, software updates, backups and monitoring. With around 39% of UK businesses reporting a cyber security breach or cyber attack in the last year, this approach helps reduce financial loss, disruption and reputational harm, while supporting compliance and stakeholder trust.

https://www.theglobalrecruiter.com/what-is-cyber-risk-management-and-why-it-is-important-for-businesses/

The Growing Cyber Risk in Interconnected Supply Chains

Supply chains are now a major driver of cyber risk across the UK, as disruption can spread quickly beyond a single organisation. Jaguar Land Rover, M&S, Heathrow and the Co-op were among hundreds impacted last year, with reported losses in the hundreds of millions, affecting thousands of suppliers, partners and customers. Human error contributes to over 60% of breaches, while attackers increasingly use convincing impersonation techniques to trick staff. Leaders can reduce exposure by setting clear security expectations for third parties, investing in staff training, and strengthening business continuity so essential services can keep running during disruption.

https://www.techuk.org/resource/the-growing-cyber-risk-in-interconnected-supply-chains.html

Over 75 Percent of Cyber Security Professionals Worry About AI Agent Risks

A survey of more than 1,500 cyber security professionals found that 73% say AI-powered threats are already significantly affecting their organisation, yet nearly half feel unprepared, even as 92% report major upgrades to defences. While 96% say AI improves the speed and efficiency of their work, concerns remain around data exposure (61%), regulatory breaches (56%) and misuse of AI tools (51%). Only 37% have a formal policy for deploying AI securely, highlighting that oversight of AI agents, including who and what they can access, is now a board-level issue.

https://betanews.com/article/over-75-percent-of-cybersecurity-professionals-worry-about-ai-agent-risks/

Experts Show How Major UK Food Crisis Might Occur

A new study involving 39 experts from institutions including Anglia Ruskin University and the University of York warns that shocks such as extreme weather, a cyber attack or war could quickly disrupt the UK’s just-in-time food supply networks, driving price spikes and shortages. The report argues these pressures would hit low-income households hardest, increasing food insecurity and raising the risk of fraud, black market sales and illness, with worst case outcomes including social unrest. It recommends improving energy security, diversifying supply chains and supporting more resilient diets, alongside better cross-government planning.

https://www.aru.ac.uk/news/experts-show-how-major-uk-food-crisis-might-occur

Governance, Risk and Compliance

The Human Layer of Security: Why People are Still the Weakest Link in 2026 - Security Boulevard

Global tech spending is skyrocketing, and European firms are doubling down on investment | IT Pro

Novel Cyber Expectations for 2026 Reveal a Grab Bag of Risk

Why boards should be obsessed with their most 'boring' systems | CyberScoop

What is cyber risk management and why it is important for businesses? | The Global Recruiter

Is A Cybersecurity Boom On The Horizon KPMG Survey Shows Surge In Cybersecurity Investment As AI Threats Redefine Risk

Threats

Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Cyber Warfare and Cyber Espionage

Cyberspy Group Hacked Governments and Critical Infrastructure in 37 Countries - SecurityWeek

UK government must get its hands dirty on security, report says | Computer Weekly

Cyber Terrorism: A New Threat To World Security – OpEd – Eurasia Review

Cyber Insights 2026: Cyberwar and Rising Nation State Threats - SecurityWeek

Cybersecurity planning keeps moving toward whole-of-society models - Help Net Security

UK warns of rising Russian, Chinese activity in High North

Nation State Actors

How does cyberthreat attribution help in practice?

Cybersecurity planning keeps moving toward whole-of-society models - Help Net Security

China

Cyberspy Group Hacked Governments and Critical Infrastructure in 37 Countries - SecurityWeek

Notepad++ Supply Chain Hack Conducted by China via Hosting Provider - SecurityWeek

FUD on the line as telcos contemplate the cost of quitting Chinese kit | Euractiv

UK warns of rising Russian, Chinese activity in High North

China-Linked UAT-8099 Targets IIS Servers in Asia with BadIIS SEO Malware

China carries out further executions of Myanmar scam centre suspects | Crime News | Al Jazeera

Chinese organized crime networks moved $16 billion in crypto in 2025, according to report

Russia

Fancy Bear Exploits Microsoft Office Flaw in Ukraine, EU Cyber-Attacks - Infosecurity Magazine

Russian Hackers Weaponize Microsoft Office Bug in Just 3 Days

Russian ship anchors over trans-Atlantic cables in Bristol Channel

Pro-Russian group Noname057(16) launched DDoS attacks on Milano Cortina 2026 Winter Olympics

ICS Devices Bricked Following Russia-Linked Intrusion Into Polish Power Grid - SecurityWeek

Poland traces December cyberattacks on 30 energy sites to Russian spy agency - Euromaidan Press

UK warns of rising Russian, Chinese activity in High North

North Korea

Labyrinth Chollima Evolves into Three North Korean Hacking Groups - Infosecurity Magazine

Iran

Infy Hackers Resume Operations with New C2 Servers After Iran Internet Blackout Ends

Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence

Cybersecurity planning keeps moving toward whole-of-society models - Help Net Security

Tools and Controls

Attackers Use Legitimate Forensic Driver to Disable Endpoint Security, Huntress Warns - IT Security Guru

Is A Cybersecurity Boom On The Horizon KPMG Survey Shows Surge In Cybersecurity Investment As AI Threats Redefine Risk

IPE - Are printers and mobile devices your Achilles heel?

Attackers Use Windows Screensavers to Drop Malware, RMM Tools

Open-source attacks move through normal development workflows - Help Net Security

The Human Layer of Security: Why People are Still the Weakest Link in 2026 - Security Boulevard

Navigating the AI Revolution in Cybersecurity: Risks, Rewards, and Evolving Roles - Security Boulevard

Cyber Threat Actor Group, Nitrogen, Unveils New Countermeasure in Ransom Negotiations | Dinsmore & Shohl LLP - JDSupra

Global tech spending is skyrocketing, and European firms are doubling down on investment | IT Pro

Open-source AI pentesting tools are getting uncomfortably good - Help Net Security

We moved fast and broke things. It’s time for a change. | CyberScoop

eScan Antivirus Delivers Malware in Supply Chain Attack - SecurityWeek

Rising Risk of Compromised Credentials in AD - Security Boulevard

Onboarding new AI hires calls for context engineering - here's your 3-step action plan | ZDNET

Smartphones Now Involved in Nearly Every Police Investigation - Infosecurity Magazine

Holiday Hits: Hackers Love to Strike When Defenders Are Away

AIs Are Getting Better at Finding and Exploiting Security Vulnerabilities - Schneier on Security

AI May Supplant Pen Testers, But Trust Is Not There Yet

What Are Risk Sciences? A New Framework for Understanding Risk and Uncertainty | Newswise

Why boards should be obsessed with their most 'boring' systems | CyberScoop

Reports Published in the Last Week

Cybercriminals' Key Attack Vector is 'Trust', VIPRE's Q4 2025 Email Threat Report Reveals

Other News

Experts show how major UK food crisis might occur - ARU

UK government must get its hands dirty on security, report says | Computer Weekly

Dark Patterns Undermine Security, One Click at a Time

DOJ releases details alleged talented hacker working for Jeffrey Epstein

Advice firms' lack of focus on cybersecurity 'worrying'

Want To Know What Keeps Your Clients Up At Night? Spoiler Alert: It’s Cybersecurity And AI - Above the Law

Energy infrastructure cyberattacks are suddenly in fashion • The Register

FBI Launches Operation Winter SHIELD in Effort to Advance Cyber Resilience Across Critical Sectors | Alston & Bird - JDSupra

Vulnerability Management

We moved fast and broke things. It’s time for a change. | CyberScoop

EU’s answer to CVE solves dependency issue, adds fragmentation risks | CSO Online

AIs Are Getting Better at Finding and Exploiting Security Vulnerabilities - Schneier on Security

Claude Opus 4.6 Finds 500+ High-Severity Flaws Across Major Open-Source Libraries

Vulnerabilities

Russian Hackers Weaponize Microsoft Office Bug in Just 3 Days

CVE-2025-22225 in VMware ESXi now used in active ransomware attacks

Microsoft 365 Outlook Add-ins Weaponized to Exfiltrate Sensitive Email Data Without Leaving Traces

Microsoft fixes Outlook bug blocking access to encrypted emails

Cisco, F5 Patch High-Severity Vulnerabilities - SecurityWeek

Threat actors hijack web traffic after exploiting React2Shell vulnerability | CSO Online

Critical SmarterMail Vulnerability Exploited in Ransomware Attacks - SecurityWeek

Ivanti’s EPMM is under active attack, thanks to two critical zero-days | CyberScoop

CISA flags critical SolarWinds RCE flaw as exploited in attacks

SQL Injection Flaw Affects 40,000 WordPress Sites - Infosecurity Magazine

Malicious Commands in GitHub Codespaces Enable RCE - Infosecurity Magazine

Microsoft to disable NTLM by default in future Windows releases

Critical React Native Vulnerability Exploited in the Wild - SecurityWeek

Critical n8n Flaw CVE-2026-25049 Enables System Command Execution via Malicious Workflows

Vulnerabilities Allowed Full Compromise of Google Looker Instances - SecurityWeek

Sector Specific

Industry specific threat intelligence reports are available.

· Automotive

· Construction

· Critical National Infrastructure (CNI)

· Defence & Space

· Education & Academia

· Energy & Utilities

· Estate Agencies

· Financial Services

· FinTech

· Food & Agriculture

· Gaming & Gambling

· Government & Public Sector (including Law Enforcement)

· Health/Medical/Pharma

· Hotels & Hospitality

· Insurance

· Legal

· Manufacturing

· Maritime & Shipping

· Oil, Gas & Mining

· OT, ICS, IIoT, SCADA & Cyber-Physical Systems

· Retail & eCommerce

· Small and Medium Sized Businesses (SMBs)

· Startups

· Telecoms

· Third Sector & Charities

· Transport & Aviation

· Web3

Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to external articles are provided for general interest and awareness only. Linking to or reposting external content does not constitute endorsement of or by any organisation, service, or product. We do not control and are not responsible for the content, security, or availability of external websites or links. Full credit is given to the original authors and sources. E&OE.

Black Arrow Admin

Black Arrow Cyber Threat Intelligence Briefing 06 February 2026

Executive Summary

Top Cyber Stories of the Last Week

From Clawdbot to OpenClaw: This Viral AI Agent Is Evolving Fast – and It’s Nightmare Fuel for Security Pros

Why Moltbook Changes the Enterprise Security Conversation

Beware of Weaponised Voicemail Messages Granting Hackers Remote Access to Your System

Open the Wrong “PDF” and Attackers Gain Remote Access to Your PC

AI Drives Doubling of Phishing Attacks in a Year

Nitrogen Ransomware Is So Broken Even the Crooks Can’t Unlock Your Files

The Human Layer of Security: Why People Are Still the Weakest Link in 2026

What Is Cyber Risk Management and Why It Is Important for Businesses?

The Growing Cyber Risk in Interconnected Supply Chains

Over 75 Percent of Cyber Security Professionals Worry About AI Agent Risks

Experts Show How Major UK Food Crisis Might Occur

Governance, Risk and Compliance

Threats

Ransomware, Extortion and Destructive Attacks

Ransomware Victims

Phishing & Email Based Attacks

Other Social Engineering

2FA/MFA

Artificial Intelligence

Bots/Botnets

Careers, Roles, Skills, Working in Cyber and Information Security

Cloud/SaaS

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

Cyber Crime, Organised Crime & Criminal Actors

Data Breaches/Leaks

Data Protection

Data/Digital Sovereignty

Denial of Service/DoS/DDoS

Fraud, Scams and Financial Crime

Identity and Access Management

Insider Risk and Insider Threats

Law Enforcement Action and Take Downs

Linux and Open Source

Malware

Mobile

Models, Frameworks and Standards

Passwords, Credential Stuffing & Brute Force Attacks

Regulations, Fines and Legislation

Social Media

Supply Chain and Third Parties

Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Cyber Warfare and Cyber Espionage

Nation State Actors

China

Russia

North Korea

Iran

Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence

Tools and Controls

Reports Published in the Last Week

Other News

Vulnerability Management

Vulnerabilities

Sector Specific

Black Arrow Cyber Threat Intelligence Briefing 30 January 2026