Daily Briefing for 02.20.26

Top stories.

• Dutch intelligence warns of escalating Russian cyber operations.
• Cyberattack shuts down the University of Mississippi Medical Center.
• PromptSpy Android malware uses generative AI in its execution flow.
• Nigerian national sentenced in the US for hacking tax preparation firms.

Dutch intelligence warns of escalating Russian cyber operations.

Intelligence agencies in the Netherlands have warned that Russia is escalating hybrid operations, including cyberattacks, sabotage, and covert influence campaigns, in preparation for a prolonged confrontation with the West, the Record reports. A joint assessment by the Dutch General Intelligence and Security Service (AIVD) and the Military Intelligence and Security Service (MIVD) stated, "Russia has not only proven capable of absorbing the substantial losses in Ukraine but has even expanded and reformed its armed forces. Furthermore, the Russian armed forces are preparing for the possibility of a conflict with NATO and are carrying out various activities to test the West’s willingness to escalate."

While a direct conflict between Russia and NATO remains unlikely, the agencies say hybrid operations allow Russia to influence and disrupt Western affairs while staying below the threshold of full-scale war.

Cyberattack shuts down the University of Mississippi Medical Center.

The University of Mississippi Medical Center (UMMC) sustained a cyberattack affecting access to its electronic medical records system, Epic, leading to widespread clinic closures and appointment cancellations across the state, the Mississippi Free Press reports. UMMC said in a Facebook post yesterday, "[A]ll UMMC clinic locations statewide are closed. Outpatient and ambulatory surgeries/procedures and imaging appointments are cancelled and will be rescheduled. Hospital services are continuing for our patients using downtime procedures."

According to the Clarion Ledger, UMMC officials have confirmed that the incident was a ransomware attack. The timeline for recovery is unclear, and the medical system is working to determine whether financial or health data were stolen.

PromptSpy Android malware uses generative AI in its execution flow.

ESET describes "PromptSpy," the first known case of Android malware to use generative AI in its execution flow. The malware abuses Google's Gemini to carry out "context-aware user interface manipulation." ESET explains, "Gemini is used to analyze the current screen and provide PromptSpy with step-by-step instructions on how to ensure the malicious app remains pinned in the recent apps list, thus preventing it from being easily swiped away or killed by the system. The AI model and prompt are predefined in the code and cannot be changed. Since Android malware often relies on UI navigation, leveraging generative AI enables the threat actors to adapt to more or less any device, layout, or OS version, which can greatly expand the pool of potential victims."

Nigerian national sentenced in the US for hacking tax preparation firms.

A Nigerian national has been sentenced in the US to eight years in prison for hacking tax preparation firms and filing phony tax returns, requesting over $8 million in refunds, BleepingComputer reports. 37-year-old Matthew Abiodun Akande had been living in Mexico before being arrested in October 2024 at London's Heathrow Airport and extradited to the United States. Akande and his co-conspirators successfully stole approximately $1.3 million.

The US Justice Department explains, "Akande caused fraudulent phishing emails to be sent to five Massachusetts tax preparation firms. The emails purported to be from a prospective client seeking the tax preparation firms’ services but in truth were used to trick the firms into downloading remote access trojan malicious software, including malware known as Warzone RAT. Akande used the RAT malware to obtain the PII and prior year tax information of the tax preparation firms’ clients, which Akande then used to cause fraudulent tax returns to be filed seeking refunds. The tax returns directed that the fraudulent tax refunds be deposited in bank accounts opened by coconspirators in the United States."