Cybersecurity Brief – 2026-03-19

Thu, 19 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Aura, an identity protection company, confirmed a data breach exposing nearly 900,000 marketing contacts, including names and email addresses.
Marquis, a Texas-based financial services provider, disclosed that a ransomware attack in August 2025 led to the theft of data belonging to 672,000 individuals and operational disruption.
Nordstrom’s email system was abused to send cryptocurrency scam emails to customers from a legitimate company address.
Stryker, a medtech company, continues recovery efforts following a cyberattack attributed to the Iranian-linked Handala group, likely using malware-stolen credentials.

Cisco Secure Firewall Management Center (FMC): CVE-2026-20131, a critical zero-day vulnerability, is being actively exploited by the Interlock ransomware group for remote code execution and root access.
GNU InetUtils telnetd: CVE-2026-32746, a critical unpatched flaw, allows unauthenticated remote attackers to execute arbitrary code as root.
Ubuntu Desktop: CVE-2026-3888, a high-severity vulnerability in default installations (24.04+), allows privilege escalation to root via a systemd cleanup timing exploit.
ConnectWise ScreenConnect: A cryptographic signature verification vulnerability has been patched, which could have allowed unauthorized access and privilege escalation.
Zimbra Collaboration Suite: An XSS vulnerability is being actively exploited; CISA has ordered urgent patching. Microsoft SharePoint is also under active exploitation for a separate flaw.
Claude AI: A trio of vulnerabilities, including prompt injection, exposes Claude users to potential data theft through chained attacks initiated from Google searches.
Apple WebKit: CVE-2026-20643, a vulnerability that could allow sites to access user data, has been patched via a background security update.
IP KVM Devices: Nine critical vulnerabilities across four vendors allow unauthenticated attackers to gain root access and take control of host systems.

Interlock ransomware: Actively exploiting the Cisco FMC zero-day (CVE-2026-20131) in a campaign ongoing since January 2026.
Horabot: New campaign in Mexico identified, involving sophisticated multi-stage malware delivery and targeting financial information.
SideWinder: Espionage group, suspected to be India-linked, expanding operations across Southeast Asia targeting governments, telecom, and critical infrastructure using spear-phishing, old vulnerabilities, and rotating infrastructure.
DPRK IT Worker Network: OFAC sanctioned six individuals and two entities for funding North Korean WMD programs through fraudulent remote IT work.
Iranian-linked Handala group: Attributed to the Stryker breach, leveraging credentials stolen via malware.
Magecart: Ongoing use of novel techniques, such as hiding payloads in EXIF data of third-party favicons, to evade repository scanners and steal payment information.
Darksword iOS Exploit Kit: Used by state-sponsored and criminal actors, this kit chains multiple iOS zero-days to compromise devices for surveillance and data theft, targeting users in Saudi Arabia, Turkey, Malaysia, Ukraine, and reportedly by Russian hackers.
SnappyClient: A new C2 implant targeting cryptocurrency wallets, supporting remote access, data theft, and spyware capabilities.
Shipping-Themed Phishing: Surge in phishing campaigns targeting Middle East and Africa, leveraging shipping themes.

Refund Fraud Economy: Increase in organized refund fraud exploiting major retailers and payment platforms, with methods and tutorials being commercialized.
Fake Shop Networks: Discovery of a network of over 20,000 fake online shops designed to steal payment and personal data.
Font-Rendering Evasion: Researchers demonstrated a method to hide malicious commands from AI assistants using font-rendering tricks.
Scanning Activity: Increased scans for “adminer” and “phpMyAdmin” observed in honeypots.
Shadow AI: SaaS applications are enabling unmonitored AI activity, increasing risk of data exposure and breaches.
Security Tooling: Emergence of autonomous offensive security platforms (e.g., XBOW) and new AI detection/response startups (e.g., Manifold, Native) focused on vulnerability discovery and endpoint security.

OFAC Sanctions: The US Treasury’s OFAC sanctioned individuals and entities tied to North Korean IT worker schemes funding WMD programs.
EU Sanctions: The European Union sanctioned Chinese and Iranian companies and individuals for cyberattacks against EU member states, expanding measures already in place in the US and UK.
CISA Directives: CISA issued emergency directives for US government agencies to patch actively exploited vulnerabilities in Zimbra and SharePoint.