Phobos on DanSec Daily

Cybersecurity Brief – 2026-03-06

Fri, 06 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Wikipedia experienced a security incident involving a self-propagating JavaScript worm that vandalized pages and modified user scripts across multiple Wikimedia wikis.
The FBI arrested a suspect linked to the theft of over $46 million in cryptocurrency from the U.S. Marshals Service. The individual is the son of a U.S. government contractor.
LeakBase, a stolen credential marketplace active since 2021 with 142,000 users, was shut down by law enforcement and suspects were arrested.
Spanish and Ukrainian law enforcement dismantled an online gambling ring that exploited war-displaced Ukrainian women, laundering nearly €4.75 million.
Phobos ransomware administrator Evgenii Ptitsyn, a Russian national, pleaded guilty to wire fraud conspiracy in the US after extradition from South Korea.

Newly Discovered Vulnerabilities

Cisco disclosed two actively exploited vulnerabilities in Catalyst SD-WAN Manager (CVE-2026-20128, CVE-2026-20122), urging immediate upgrades of affected devices.
Cisco released patches for 48 vulnerabilities in their Firewall ASA, Secure FMC, and Secure FTD products, including two critical vulnerabilities rated CVSS 10.0.
A critical vulnerability in the User Registration & Membership plugin for WordPress (installed on over 60,000 sites) is being exploited to create unauthorized admin accounts.
Google’s Threat Intelligence Group reported that 90 zero-day vulnerabilities were exploited in 2025, with nearly half targeting enterprise software and appliances.

Notable Threat Actor Activity

A suspected Iran-linked group, Dust Specter, targeted Iraqi government officials using new malware strains SPLITDROP and GHOSTFORM, delivered by impersonating the Iraqi Ministry of Foreign Affairs.
Russian state-linked APT28 conducted a campaign against Ukrainian entities, deploying two new malware families: BadPaw loader and MeowMeow backdoor.
China-linked APT group UAT-9244 targeted telecommunications providers in South America since 2024, compromising Windows, Linux, and network-edge devices with a new malware toolkit.
Pakistan’s APT36 has adopted AI-driven “vibe-coding” techniques to produce large volumes of low-quality malware, potentially overwhelming defensive measures.
A phishing-as-a-service platform, Tycoon 2FA, known for its ability to bypass MFA, was dismantled following a joint operation by Europol and security vendors.

Trends, Tools, or Tactics of Interest

Messaging platforms are increasingly being abused as vectors for phishing and social engineering attacks, as reported by NCC Group’s Fox-IT.
Spear phishing attacks are on the rise, with attackers using more sophisticated, human-like emails and synthetically generated text to evade detection.
Threat actors are leveraging Bing’s AI-powered search to promote fake GitHub repositories, distributing information-stealing and proxy malware through deceptive OpenClaw installer links.
Attackers are preparing for a post-quantum cryptography era, collecting encrypted data now for potential future decryption once quantum capabilities become available.
Browser security is emerging as a significant blind spot in enterprises, with browsers now functioning as a de facto operating system for modern work, according to Keep Aware’s 2026 State of Browser Security Report.
MFA is not a comprehensive defense against credential abuse in Windows environments, as attackers continue to find ways to bypass or exploit MFA implementations.
Latin America is experiencing twice as many cyberattacks as the United States, attributed to lower cybersecurity maturity in the region.
The use of AI in malware development is increasing, enabling threat actors to scale operations and automate attack delivery.

Regulatory or Policy Developments Affecting the Security Industry

The US Supreme Court is set to decide on the constitutionality of geofence warrants, which allow law enforcement to collect location data from all devices near a crime scene. Google has advocated for these warrants to be struck down.

Cybersecurity Brief – 2026-02-18

Wed, 18 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Eurail confirmed a data breach with millions of user records being offered for sale on cybercrime forums. The full scope of affected individuals is still under investigation.
Poland’s energy sector survived wiper attacks targeting wind and solar infrastructure, as well as a manufacturer and a heating/power plant. Russia-aligned groups are suspected.
Singapore and its four major telecommunications providers successfully fended off a zero-day attack attributed to Chinese hackers.
Microsoft Teams experienced a significant outage affecting users in the United States and Europe, causing delays and access issues.

Newly Discovered Vulnerabilities

A critical zero-day vulnerability (CVE-2026-22769) in Dell RecoverPoint has been exploited since mid-2024 by a Chinese state-backed group (UNC6201).
CISA added four security flaws to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation.
Multiple high- and critical-severity vulnerabilities were discovered in popular Visual Studio Code (VSCode) extensions, exposing over 128 million downloads to potential credential and file theft.
Google released an emergency update for Chrome to patch an actively exploited zero-day allowing code execution via malicious webpages.
Password managers including Bitwarden, LastPass, Dashlane, and 1Password were found vulnerable to vault compromise if a malicious server is present.
Notepad++ enhanced its update security with a new “double-lock” mechanism following a supply-chain compromise.
Research identified widespread exposure of secrets such as API keys in JavaScript front-end code, after scanning 5 million applications.

Notable Threat Actor Activity

Kaspersky uncovered the Keenadu Android backdoor, embedded in device firmware and Google Play apps, with links to major Android botnets. Keenadu enables data exfiltration, remote control, ad fraud, and browser hijacking via supply chain compromise.
Chinese state-backed hackers exploited a Dell zero-day (CVE-2026-22769) for espionage purposes.
A 47-year-old suspect linked to the Phobos ransomware group was arrested in Poland; authorities seized evidence including stolen credentials and server access data.
ClickFix campaigns are abusing DNS lookup commands to deliver ModeloRAT malware, adapting to bypass recent security defenses.
SmartLoader attacks are distributing a trojanized Oura MCP server to deploy StealC infostealer malware.

Trends, Tools, or Tactics of Interest

Attackers are increasingly abusing legitimate DKIM-signed emails (DKIM replay attacks) to bypass security filters and deliver scams, leveraging trusted invoice and notification templates.
Sophisticated phishing campaigns are bypassing Microsoft 365 multi-factor authentication (MFA) protections.
Remote Monitoring and Management (RMM) software is being widely abused by threat actors for stealth, persistence, and operational efficiency, often replacing traditional malware.
AI-powered assistants (including Copilot and Grok) with web access are being demonstrated as potential command-and-control (C2) proxies for malware operations.
Attackers are exploiting API vulnerabilities at greater scale and speed, with AI-driven systems amplifying potential impact.
The use of AI and context-aware tools is accelerating security operations, especially in cloud breach investigations and SOC workflows.
Three new threat groups began targeting industrial control systems (ICS/OT) in 2025, according to Dragos.
Hobbyist coding error led to the exposure of live camera feeds, microphones, and floor plans from thousands of vacuum robots, highlighting risks in IoT device security.

Regulatory or Policy Developments

Spain’s courts ordered NordVPN and ProtonVPN to block access to 16 websites facilitating illegal LaLiga football match streaming.
Ireland’s Data Protection Commission opened a formal investigation into X (formerly Twitter) over the use of its Grok AI tool to generate sexual images, focusing on data protection and regulatory compliance.