Ankura CTIX FLASH Update – February 6, 2026

Malware Activity

Understanding Recent Cyber Threats Targeting Servers and Security Systems

Recent cybersecurity reports reveal that hackers are cleverly exploiting vulnerabilities in popular server management tools like NGINX and Baota Panel to redirect website traffic without detection. They inject malicious configurations into server files, especially targeting sites with Asian domains and government or educational sites, allowing them to secretly gather data or gain control over traffic. These attackers often use sophisticated scripts to maintain long-term access, making their activities hard to spot with regular security checks. Additionally, cybercriminals are exploiting outdated drivers, such as a revoked EnCase kernel driver, to disable security tools and bypass endpoint protections. They use fake updates and stolen VPN credentials to gain deep system access, aiming to kill security processes and stay hidden. CTIX analysts will continue to report on the