A member of the Crazy ransomware gang is abusing legitimate employee monitoring software and the SimpleHelp remote support tool to maintain persistence in corporate networks, evade detection, and prepare for ransomware deployment.

The breaches were observed by researchers at Huntress, who investigated multiple incidents where threat actors deployed Net Monitor for Employees Professional alongside SimpleHelp for remote access to a breached network, while blending in with normal administrative activity.

In one intrusion, attackers installed Net Monitor for Employees Professional using the Windows Installer utility, msiexec.exe, allowing them to deploy the monitoring agent on compromised systems directly from the developer’s site.

Once installed, the tool allowed attackers to remotely view the victim’s desktop, transfer files, and execute commands, effectively providing full interactive access to compromised systems.

The attackers also attempted to enable the local administrator account using this command:

net user administrator /active:yes

For redundant persistence, attackers downloaded and installed the SimpleHelp remote access client via PowerShell commands, using file names similar to the legitimate Visual Studio vshost.exe.

The payload was then executed, allowing attackers to maintain remote access even if the employee monitoring tool was removed.

The SimpleHelp binary was sometimes disguised using filenames that pretended to be related to OneDrive:

C:\ProgramData\OneDriveSvc\OneDriveSvc.exe

The attackers used the monitoring software to execute commands remotely, transfer files, and monitor system activity in real time.

Researchers also observed the attackers disabling Windows Defender by attempting to stop and delete associated services.

In one incident, the hackers configured monitoring rules in SimpleHelp to alert them when devices accessed cryptocurrency wallets or were using remote management tools as they prepared for ransomware deployment and potential cryptocurrency theft.

“The logs show the agent continuously cycling through trigger and reset events for cryptocurrency-related keywords, including wallet services (metamask, exodus, wallet, blockchain), exchanges (binance, bybit, kucoin, bitrue, poloniex, bc.game, noones), blockchain explorers (etherscan, bscscan), and the payment platform payoneer,” explains Huntress.

“Alongside these, the agent also monitored for remote access tool keywords, including RDP, anydesk, ultraview, teamview, and VNC, likely to detect if anyone was actively connecting to the machine.”

The use of multiple remote access tools provided redundancy for the attackers, ensuring they retained access even if one tool was discovered or removed.

While only one incident led to the deployment of Crazy ransomware, Huntress believes the same threat actor is behind both incidents.

“The same filename (vhost.exe) and overlapping C2 infrastructure were reused across both cases, strongly suggesting a single operator or group behind both intrusions,” explains Huntress.

The use of legitimate remote management and monitoring tools has become increasingly common in ransomware intrusions, as these tools allow attackers to blend in with legitimate network traffic.

Huntress warns that organizations should closely monitor for unauthorized installations of remote monitoring and support tools.

Furthermore, as both breaches were enabled through compromised SSL VPN credentials, organizations need to enforce MFA on all remote access services used to access the network.

Modern IT infrastructure moves faster than manual workflows can handle.

In this new Tines guide, learn how your team can reduce hidden manual delays, improve reliability through automated response, and build and scale intelligent workflows on top of tools you already use.

Get the guide

Microsoft has fixed a “remote code execution” vulnerability in Windows 11 Notepad that allowed attackers to execute local or remote programs by tricking users into clicking specially crafted Markdown links, without displaying any Windows security warnings.

With the release of Windows 1.0, Microsoft introduced Notepad, a simple, easy-to-use text editor that, over the years, became popular for quickly jotting notes, reading text files, creating to-do lists, or acting as a code editor.

For those who needed a rich text format (RTF) editor that supported different fonts, sizes, and formatting tools like bold, italics, and lists, you could use Windows Write and later WordPad.

However, with the release of Windows 11, Microsoft decided to discontinue WordPad and remove it from Windows.

Instead, Microsoft rewrote Notepad to modernize it so it could act as both a simple text editor and an RTF editor, adding Markdown support that lets you format text and insert clickable links.

Markdown support means Notepad can open, edit, and save Markdown files (.md), which are plain text files that use simple symbols to format text and represent lists or links.

For example, to bold text or create a clickable link, you would add the following markdown text:

**This is bold text**
[Link to BleepingComputer](https://www.bleepingcomputer.com/)

Microsoft fixes Windows Notepad RCE flaw

As part of the February 2026 Patch Tuesday updates, Microsoft disclosed that it fixed a high-severity Notepad remote code execution flaw tracked as CVE-2026-20841.

“Improper neutralization of special elements used in a command (‘command injection’) in Windows Notepad App allows an unauthorized attacker to execute code over a network,” explains Microsoft’s security bulletin.

Microsoft has attributed the discovery of the flaw to Cristian Papa, Alasdair Gorniak, and Chen, and says it can be exploited by tricking a user into clicking a malicious Markdown link.

“An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files,” explains Microsoft.

“The malicious code would execute in the security context of the user who opened the Markdown file, giving the attacker the same permissions as that user,” continued the Advisory.

The novelty of the flaw quickly drew attention on social media, with cybersecurity researchers quickly figuring out how it worked and how easy it was to exploit.

All someone had to do was create a Markdown file, like test.md, and create file:// links that pointed to executable files or used special URIs like ms-appinstaller://.

If a user opened this Markdown file in Windows 11 Notepad versions 11.2510 and earlier and viewed it in Markdown mode, the above text would appear as a clickable link. If the link is clicked with Ctrl+click,  it would automatically execute the file without Windows displaying a warning to the user.

The execution of the program without a warning is what Microsoft considers to be the remote code execution flaw.

This could potentially allow attackers to create links to files in remote SMB shares that would then be executed without warning.

In BleepingComputer’s tests, Microsoft has now fixed the Windows 11 Notepad flaw by displaying warnings when clicking a link if it does not use the http:// or https:// protocol.

Now, when clicking on all other types of URI links, including file:, ms-settings:, ms-appinstaller, mailto:, and ms-search:, Notepad will display the above dialog.

However, it’s unclear why Microsoft didn’t just prevent non-standard links in the first place, as it is still possible to social engineer users into clicking the ‘Yes’  button on the prompts.

The good news is that Windows 11 will automatically update Notepad via the Microsoft Store, so the flaw will likely have no impact beyond its novelty.

Modern IT infrastructure moves faster than manual workflows can handle.

In this new Tines guide, learn how your team can reduce hidden manual delays, improve reliability through automated response, and build and scale intelligent workflows on top of tools you already use.

Get the guide

Less than a week after Valve admitted that the current shortage (and growing prices) of RAM were affecting its hardware plans, the Steam Deck is completely sold out. The Steam Deck has gone in and out of stock in the past, but as Kotaku notes, the timing does raise the question whether Valve’s RAM issues could also be impacting its Linux handheld.

The 256GB Steam Deck LCD, and both the 512GB and 1TB models of the Steam Deck OLED, are completely sold out on Steam. Valve announced that it was discontinuing the LCD versions of its handheld and selling through its remaining inventory in December 2025, so the fact that the 256GB Steam Deck model is currently sold out isn’t surprising. That both OLED versions are also unavailable at the same time, though, is a bit more unusual.

Engadget has contacted Valve for more information about the availability of the Steam Deck. We’ll update this article if we hear back.

When Valve announced the Steam Machine, Steam Controller and Steam Frame, the company notably left pricing and availability off the table, presumably because tariffs and access to RAM were leaving those details in flux. The company’s announcement last week that the memory and storage shortage had pushed back its plans and would likely impact prices more or less confirmed that. At no point did Valve mention that the Steam Deck would be similarly affected, but maybe it should have.

The rising cost of RAM has already forced other PC makers to adjust the pricing of their computers. Framework announced in January that it was raising the price of its Framework Desktop by as much as $460. Some analysts assume that the memory shortage driven by the AI industry could lead to higher prices and even an economic downturn in the wider PC industry. Ideally, the Steam Deck being out of stock is a temporary issue rather than a sign that Valve is doing something drastic. If things continue as they are, however, changes to the Steam Deck likely won’t be off the table.

Disclaimer: Unless otherwise stated, any opinions expressed below belong solely to the author. All data sourced from Labour Force in Singapore 2025, released last month by the Singapore Ministry of Manpower.

According to the latest data from the Ministry of Manpower, the number of Singaporean workers (citizens and permanent residents) employed full-time and earning an average of S$10,000 per month (in this case, figures provided by MOM exclude employers’ CPF contributions) has gone up by 31,200 people, to 404,900 in just a year.

That’s an impressive jump of 8.3%, on the back of very strong GDP growth, which hit 5% in 2025.

This means that 19.3% (nearly one in five) of locally employed residents make at least S$120,000 annually.

More than a quarter earn six figures per year.

An estimated 26%, or a bit over a quarter of Singaporean workers employed full-time, make S$100,000 or more (around S$8,350 per month).

Who are they? What do they do?

Now, you must be curious what so many people do to earn a good living, so let’s start by counting them up by industry—a list, unsurprisingly, led by financial services.

Breakdown by industry

The second largest, generous employer is the Public Administration, where 20% of workers collect S$10,000 monthly or more from work, followed by Trade, Professional Services and IT.

The tech sector is also second when it comes to the share of all workers making five figures per month, at around 30%, trailing only Financial & Insurance Services, where close to 40% are paid that much.

Breakdown by age

Naturally, your odds of a higher pay increase with age, with the peak falling in your 40s, although there’s almost 100,000 30-year-olds in this category already.

Breakdown by education

As I reported about two weeks ago, university degree holders significantly out-earn all other educational groups, and it’s clearly visible here as well, with over 85% of high-earners having a tertiary degree.

That said, not all is lost if you’re not among them, as there are even a few thousand people who finished their education below secondary level and yet still have well-paying jobs. Statistically, chances are slim, of course, but depending on your situation, academic education might not be a requirement for a successful career.

Breakdown by gender

What is a surprise to nobody is that men significantly outnumber women among high-earners, comprising over 60% of the total. However, before you conclude that this is evidence of a sexist pay gap, it remains true that fewer women climb the career ladder as high as men, and quite a few still choose to put family life first.

Given that more men than women work at any level, we have to correct for this disparity. In their respective groups, 23% of men and around 15% of women are in the S$10,000 per month income bracket, which means there is still a bit of a gap, but not substantial enough considering different choices regarding careers to suggest systemic discrimination.

Either way, as you can see, attractive pay is not so rare in Singapore, and with the right education and the right field, it is drawn by more than just a tiny elite.

What’s more, with a good GDP forecast for 2026 following a strong 2025, we can expect these numbers to continue climbing, with tens of thousands of Singaporeans joining the S$10,000 club each year.

• Read other articles we’ve written on Singapore’s job landscape here.

Featured Image Credit: tang90246/ depositphotos

Apple has released security updates to fix a zero-day vulnerability that was exploited in an “extremely sophisticated attack” targeting specific individuals.

Tracked as CVE-2026-20700, the flaw is an arbitrary code execution vulnerability in dyld, the Dynamic Link Editor used by Apple operating systems, including iOS, iPadOS, macOS, tvOS, watchOS, and visionOS.

Apple’s security bulletin warns that an attacker with memory write capability may be able to execute arbitrary code on affected devices.

Apple says it is aware of reports that the flaw, along with the CVE-2025-14174 and CVE-2025-43529 flaws fixed in December, were exploited in the same incidents.

“An attacker with memory write capability may be able to execute arbitrary code,” reads Apple’s security bulletin.

“Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 and CVE-2025-43529 were also issued in response to this report.”

Apple says Google’s Threat Analysis Group discovered CVE-2026-20700. The company did not provide any further details about how the vulnerability was exploited.

Affected devices include:

• iPhone 11 and later
• iPad Pro 12.9-inch (3rd generation and later)
• iPad Pro 11-inch (1st generation and later)
• iPad Air (3rd generation and later)
• iPad (8th generation and later)
• iPad mini (5th generation and later)
• Mac devices running macOS Tahoe

Apple fixed the vulnerability in iOS 18.7.5, iPadOS 18.7.5, macOS Tahoe 26.3, tvOS 26.3, watchOS 26.3, and visionOS 26.3.

While Apple says the flaw was exploited in targeted attacks, users are advised to install the latest updates to protect their devices.

This is the first Apple zero-day fixed in 2026, with the company fixing seven in 2025.

Modern IT infrastructure moves faster than manual workflows can handle.

In this new Tines guide, learn how your team can reduce hidden manual delays, improve reliability through automated response, and build and scale intelligent workflows on top of tools you already use.

Get the guide

If you’ve ever considered practicing meditation, you might believe you should relax, breathe, and empty your mind of distracting thoughts. Novices tend to think of meditation as the brain at rest, but a new international study concludes that this ancient practice is quite the opposite: Meditation is a state of heightened cerebral activity that profoundly alters brain dynamics.

Researchers from the University of Montreal and Italy’s National Research Council recruited 12 monks of the Thai Forest Tradition at Santacittārāma, a Buddhist monastery outside Rome. In a laboratory in Chieti-Pescara, scientists analyzed the brain activity of these meditation practitioners using magnetoencephalography (MEG), technology capable of recording with great precision the brain’s electrical signals.

The study focused on two classical forms of meditation: Samatha, a technique that focuses on sustained attention to a specific objective, often steady breathing, with the aim of stabilizing the mind and reaching a deep state of calm and concentration, and Vipassana, which is based on equanimous observation of sensations, thoughts, and emotions as they arise in order to develop mental clarity and a deeper understanding of the experience.

“With Samatha, you narrow your field of attention, somewhat like narrowing the beam of a flashlight; with Vipassana, on the contrary, you widen the beam,” explains Karim Jerbi, professor of psychology at the University of Montreal and one of the study’s coauthors. “Both practices actively engage attentional mechanisms. While Vipassana is more challenging for beginners, in mindfulness programs the two techniques are often practiced in alternation.”

The researchers recorded multiple indicators of brain dynamics, including neural oscillations, measures of signal complexity, and parameters related to so-called “criticality,” a concept borrowed from statistical physics that has been applied to neuroscience for 20 years. Criticality describes systems that operate efficiently on the border between order and chaos, and in neuroscience, it is considered a state optimal for processing information in a healthy brain.

“A brain that lacks flexibility adapts poorly, while too much chaos can lead to malfunction, as in epilepsy,” Jerbi explained in a press release. “At the critical point, neural networks are stable enough to transmit information reliably, yet flexible enough to adapt quickly to new situations. This balance optimizes the brain’s processing, learning, and response capacity.”

During the experiment, the monks’ brain activity was recorded by a high-resolution MEG system as they alternated from one type of meditation to the other with brief periods of rest in between. The data were then processed with advanced signal analysis and machine learning tools to extract different indicators of neural complexity and dynamics.

Striking a Balance

Results published in the journal Neuroscience of Consciousness show both forms of meditation increase the complexity of brain signals compared to a brain at rest. This finding suggests the brain in meditation does not simply calm down but rather enters a dynamic state rich with information. At the same time, the researchers observed widespread reductions in certain parameters linked to the global organization of neural activity.

One of the most striking findings in the analysis of the criticality deviation coefficient showed a clear distinction between Samatha and Vipassana. This indicates that, although both practices increase brain complexity, they do so through different dynamic configurations, consistent with their subjective experiences. In other words, Vipassana brings the practitioner closer to the balance of stability and flexibility, while Samatha produces a somewhat more stable and focused state. According to researchers, the closer the brain gets to this critical state of balance, the more responsively and efficiently it functions. This is reflected, for example, in a greater capacity to switch tasks or to store information.

Blizzard announced today that it is introducing the Warlock as a playable character to Diablo II: Resurrected. It brings the first new class in 25 years to this remaster of the original RPG. It’s part of the Reign of the Warlock DLC, which is available today and will run you $25. It also includes some other updates to the base game, including new items and a new pinnacle boss encounter against the Colossal Ancients. For those players who don’t already own the base game, you can also pick up the Infernal Edition of D2R for $40, which includes the new content.

When D2R launched in 2021, it was an impressively faithful recreation of the game that so many Blizzard fans continued to adore over the years. Bringing in a whole new player class is a big win for those players who have stuck with the game in its contemporary era.

If D2R isn’t your jam, though, Warlock is also being added to both Diablo 4 in its upcoming Lord of Hatred expansion this April and to Diablo Immortal. So aside from Diablo 3 not getting much love, just about all fans of the franchise will have a chance to get into the demon-summoning groove. Blizzard’s 30th anniversary showcase video has all the details about what the other Diablo titles have in store during this year.

Blizzard has been keeping the news and updates rolling over the past few weeks in honor of the company’s 35th anniversary. One of the more notable updates came for team hero shooter Overwatch, which lost the 2 in its name, but gained five more heroes in its big update yesterday.