https://blog.dansec.red/actors/kadnap/Recent content in KadNap on DanSec DailyHugoen-gbWed, 11 Mar 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-03-11-cybersecurity-news/Wed, 11 Mar 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-03-11-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Ericsson disclosed a data breach impacting thousands, attributed to a third-party vendor.</li> <li>A suspected breach of the FBI’s wiretap network is under investigation, with concerns about possible nation-state involvement via supply chain compromise.</li> <li>Salesforce confirmed that hundreds of customers have been targeted in a data theft campaign exploiting misconfigured instances.</li> <li>Signal and WhatsApp accounts have been targeted in a phishing campaign, with attackers tricking users into sharing verification codes or linking malicious devices.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>Microsoft released security updates for Windows 10 and 11, addressing 79–93 vulnerabilities (depending on reporting), including two publicly disclosed zero-days. No active exploitation reported for these flaws.</li> <li>Adobe patched 80 vulnerabilities across eight products, including Acrobat Reader, Illustrator, Commerce, and Premiere Pro.</li> <li>SAP issued patches for critical vulnerabilities in FS-QUO (code injection) and NetWeaver (insecure deserialization), both allowing potential arbitrary code execution.</li> <li>Hewlett Packard Enterprise (HPE) patched multiple vulnerabilities in Aruba Networking AOS-CX, including critical flaws that allowed admin password resets and code execution.</li> <li>Google Looker Studio was found to contain nine cross-tenant vulnerabilities (“LeakyLooker”) enabling arbitrary SQL queries and potential data exfiltration.</li> <li>A high-severity Ivanti Endpoint Manager (EPM) vulnerability is now under active exploitation, as flagged by CISA, with U.S. federal agencies ordered to patch within three weeks.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>Russian state-sponsored APT28 (Sednit) has resurfaced with new sophisticated malware, including BEARDSHELL and a customised variant of the open-source Covenant framework, used for long-term espionage against Ukrainian military targets.</li> <li>Russian-speaking threat actors have been targeting HR departments with a new EDR killer malware dubbed “BlackSanta” for over a year, bypassing security controls to facilitate data theft.</li> <li>Iranian MOIS-linked actors are increasingly engaging in cybercrime, leveraging criminal tools and operational models to support state objectives.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>BeatBanker, a newly identified Android Trojan, is targeting Brazilian users by impersonating government and Google Play Store apps. It combines banking credential theft with cryptocurrency mining capabilities and has also been observed posing as a Starlink app.</li> <li>KadNap malware is infecting over 14,000 edge devices, primarily Asus routers, to create a stealth proxy botnet for malicious traffic.</li> <li>Five malicious Rust crates were discovered on crates.io, masquerading as time-related utilities but designed to exfiltrate developer secrets from .env files, including via CI/CD pipeline compromise.</li> <li>A new “Zombie ZIP” technique enables malware to evade detection by hiding payloads in specially crafted compressed files, bypassing antivirus and EDR solutions.</li> <li>Attackers are increasingly using geometry-based techniques to mimic human interaction and evade sandbox detection, with 80% of top attacker techniques now focused on evasion and persistence.</li> <li>Credential stuffing attacks, fuelled by combolists and infostealer malware, accounted for 22% of breaches in 2025, driving large-scale enterprise account takeover.</li> <li>Overly permissive Salesforce cloud configurations are being actively targeted, exposing client data through misconfigured guest user access.</li> <li>FortiGate Next-Generation Firewall appliances are being abused as entry points in campaigns aimed at stealing service account credentials.</li> <li>AI-powered security tools are gaining traction, with new platforms launched for DLP (Jazz), IT/OT security (Kai), and red teaming (Armadin). OpenAI introduced Codex Security, an AI-based vulnerability scanner that has already identified hundreds of critical issues.</li> </ul> <h2 id="regulatory-or-policy-developments">Regulatory or Policy Developments</h2> <ul> <li>CISA mandated that U.S. federal agencies patch the actively exploited Ivanti EPM vulnerability within three weeks.</li> <li>Microsoft announced that hotpatch security updates will be enabled by default for eligible Windows devices managed via Intune and Microsoft Graph API starting May 2026.</li> <li>Microsoft is rolling out phishing-resistant Windows sign-ins using Entra passkeys and Windows Hello.</li> <li>The U.S. Department of Homeland Security removed privacy officers who objected to the mislabelling of government records, raising concerns over transparency and privacy compliance.</li> </ul>