February 2026 saw a rise in advanced cyber threats affecting businesses in many industries. Analysts from ANY.RUN studied several major attacks and revealed new malware families and evolving attack methods.
From fast ransomware that can encrypt entire systems in minutes to remote access trojans that went completely undetected, the threat landscape this month shows that security teams must stay alert.
Key Points for Security Teams
- Two new ransomware families, GREENBLOOD and BQTLock, were discovered. Both can disrupt business operations quickly and combine encryption with data theft.
- Two new remote access trojans (RATs), Moonrise and Karsto, had zero detections on VirusTotal when they were first analyzed. This shows how traditional detection methods are struggling to keep up with real threats.
- Attackers used thread-hijacking phishing, inserting themselves into real email conversations between executives and delivering credential-stealing attacks with the EvilProxy phishing kit.
- Phishing infrastructure is now often hosted on trusted cloud platforms such as Microsoft Azure, Google Firebase, and Cloudflare, making simple URL reputation checks much less reliable.
1. New Malware With No Existing Signatures
In February 2026, analysts identified four new malware families: two ransomware strains and two remote access trojans. These threats either avoided detection completely or gave defenders very little time to respond.
GREENBLOOD Ransomware
GREENBLOOD is a new ransomware written in Go. It is designed to work quickly and quietly. Besides encrypting files, it also deletes evidence and threatens to leak stolen data.
Key observations:
- Uses ChaCha8 encryption, allowing systems to be locked within minutes.
- Attempts to delete its own executable, making forensic investigation harder.
- Uses a TOR-based leak site to pressure victims into paying.
Because it can encrypt systems so quickly, organizations may only have a very small window to stop the attack.
BQTLock Ransomware
BQTLock takes a more stealthy approach. Instead of causing immediate damage, it hides inside trusted Windows processes and prepares the system before launching the main attack.
The attack chain observed includes:
- Injecting the Remcos payload into
explorer.exe. - Bypassing User Account Control using
fodhelper.exe. - Creating autorun persistence so the malware survives reboot.
After gaining higher privileges, the malware begins stealing credentials and capturing screenshots. What starts as a quiet infection can quickly become a full security breach.
Moonrise RAT
Moonrise is a newly discovered Go-based remote access trojan. When analysts first examined it, the sample had no signatures and was not even submitted to VirusTotal.
Despite being undetected, it has powerful capabilities:
- Stealing stored passwords and browser data
- Executing remote commands and running files
- Maintaining persistence after system reboots
- Monitoring users through screen capture, webcam access, microphone recording, and keylogging
Because it operates silently, attackers can stay inside a network for long periods before being detected.
Karsto RAT
Karsto is another RAT discovered in February with zero detections at the time of discovery.
It is designed to profile the victim’s environment first, then decide which attack modules to activate.
Key behaviors include:
- Checking the victim’s external IP using
api.ipify.org - Communicating with its command-and-control server using disguised network traffic
- Stealing credentials and authentication tokens
- Logging keystrokes and clipboard data
- Capturing screenshots, webcam activity, and audio
Karsto highlights an important lesson: waiting for antivirus signatures is no longer enough. Behavior-based analysis is often the only way to detect these threats early.
2. New Phishing Tactics
Besides new malware, February 2026 also showed major changes in phishing techniques. Attackers are moving away from obvious phishing emails and instead using highly targeted campaigns.
Thread-Hijack Phishing
In one campaign, attackers hijacked an ongoing email thread between company executives. They likely compromised a contractor’s mailbox that was already part of the conversation.
The attacker replied within the same thread and sent a link that looked like a legitimate Microsoft login page.
The attack chain included:
- A phishing link sent inside a real conversation
- A Cloudflare Turnstile anti-bot page
- A phishing page protected by Turnstile
- The EvilProxy adversary-in-the-middle toolkit
This setup allowed attackers to capture Microsoft credentials and session tokens in real time.
Because the email came from a real conversation with trusted participants, traditional email security systems had very few warning signs to detect.
If successful, these attacks can give attackers access to:
- Executive communications
- Financial approval systems
- Corporate cloud environments
Phishing Hosted on Trusted Cloud Platforms
Another important trend is that phishing kits are now hosted on legitimate infrastructure, including:
- Microsoft Azure Blob Storage
- Google Firebase Storage
- AWS CloudFront
- Cloudflare CDN
Because these services use trusted certificates and well-known network ranges, blocking them based on reputation is difficult.
Three of the most active phishing kits using this approach are:
- Tycoon2FA – often hosted on Microsoft Azure
- Sneaky2FA – commonly hosted on Google Firebase and focused on corporate accounts
- EvilProxy – used in executive account takeover campaigns
This shift creates a serious challenge for defenders who rely mainly on domain reputation and blocklists.
Tycoon 2FA Phishing-as-a-Service
Tycoon 2FA is one of the most active phishing platforms designed to bypass multi-factor authentication.
It works by intercepting session cookies during login, allowing attackers to access accounts even when MFA is enabled.
Recent observations include:
- New URL patterns linked to the platform
- Increased phishing domains using unusual TLDs like .biz.id, .beer, and .bar
Because Tycoon 2FA is sold as a Phishing-as-a-Service (PhaaS) platform, even low-skill attackers can launch large-scale campaigns.
What This Means for Security Teams
The threats seen in February 2026 show several important trends:
- Speed matters. GREENBLOOD can encrypt systems in minutes, and BQTLock quietly prepares systems before launching its attack.
- Static detection is not enough. Moonrise and Karsto operated without any antivirus signatures.
- Trusted infrastructure can be abused. Phishing pages hosted on Azure or Firebase look legitimate to many security tools.
To stay protected, organizations need tools that can:
- Safely analyze suspicious links and follow the full redirect chain
- Detect ransomware behavior before it spreads in production systems
- Identify command-and-control traffic from RATs that bypass signature-based detection
