Cybersecurity Brief – 2026-03-05

Thu, 05 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

LexisNexis has confirmed a data breach after hackers leaked files containing approximately 400,000 personal information records. Attackers claim to have stolen 2GB of data.
The University of Mississippi Medical Center (UMMC) resumed operations after a ransomware attack that disrupted access to electronic medical records and IT systems for nine days.
LeakBase, one of the largest online cybercrime forums for trading stolen data and cybercrime tools, was seized by the FBI and Europol. Data of 142,000 members was reportedly obtained.
Customers of restaurants using the HungerRush POS platform received mass extortion emails from a threat actor threatening to leak restaurant and customer data.
A significant increase in hacktivist DDoS attacks was recorded, with 149 attacks affecting 110 organisations in 16 countries, following coordinated military action in the Middle East.

Newly Discovered Vulnerabilities

Google patched 129 Android vulnerabilities, including a high-severity, actively exploited flaw in a Qualcomm component affecting Android devices.
The FreeScout helpdesk platform is affected by a maximum severity vulnerability (“Mail2Shell”) enabling unauthenticated, zero-click remote code execution on mail servers.
Cisco released patches for two maximum-severity vulnerabilities in Secure Firewall Management Center (FMC) software, which could allow remote attackers to gain root access.
VMware Aria Operations is being actively exploited via a command injection vulnerability, allowing attackers broad access to cloud environments.
Fake Laravel PHP packages on Packagist were found to deploy a cross-platform remote access trojan (RAT) affecting Windows, macOS, and Linux systems.

Notable Threat Actor Activity

The Coruna (CryptoWaters) iOS exploit kit, originally linked to Russian state actors, is now being used by multiple threat actors for targeted espionage and financially motivated attacks, including crypto theft. The kit leverages 23 exploits across five exploit chains, targeting iOS 13.0 to 17.2.1.
APT41-linked “Silver Dragon” group has been targeting government entities in Europe and Southeast Asia, using phishing for initial access and legitimate network services for command and control, including Cobalt Strike and Google Drive.
Attackers are abusing OAuth’s built-in redirect mechanisms to send users from legitimate Microsoft or Google login pages to phishing or malware sites.
XWorm malware continues to circulate with evolving delivery techniques, indicating ongoing adaptation by threat actors.
A brute force attack on RDP led to the discovery of a geo-distributed VPN-linked infrastructure supporting ransomware-as-a-service operations.

Trends, Tools, or Tactics of Interest

Mobile malware continues to evolve, with notable threats in 2025 including preinstalled Android backdoors (Keenadu, Triada), spyware trojans, the Kimwolf IoT botnet, and Mamont banking trojans.
Phishing attacks have surged 400% year over year, with corporate users increasingly targeted. Recent campaigns include SMS-based tax scams (e.g., TurboTax) and sophisticated phishing targeting LastPass users with fake support emails.
Managed Detection and Response (MDR) is highlighted as a critical tool for protecting educational institutions, which remain under-resourced but heavily targeted.
Attackers are increasingly leveraging pirated software as a vector for malware delivery, turning employees seeking free software into unwitting malware distributors.
Abuse of OAuth redirection and phishing-as-a-service platforms such as Tycoon 2FA (now dismantled) demonstrate continued innovation in phishing tactics.

Regulatory or Policy Developments Affecting the Security Industry

Europol coordinated the takedown of the Tycoon 2FA phishing-as-a-service platform, which had enabled adversary-in-the-middle credential harvesting attacks at scale, reportedly targeting over 500,000 organisations monthly.
Zurich Insurance announced the acquisition of Beazley in an $11 billion deal, positioning Zurich as a leader in the cyberinsurance market, pending regulatory approval.
Google will move Chrome to a two-week release cycle starting September 2026.
A new RFP template for AI usage control and AI governance has been released, reflecting increased focus and budget allocation for AI security in enterprises.
Reports regarding a potential UK ban on VPNs have been described as exaggerated, with technical and legal feasibility questioned.

Cybersecurity Brief – 2026-03-04

Wed, 04 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

AkzoNobel, a multinational paint company, confirmed a cyberattack that breached the network of one of its U.S. sites.
LexisNexis Legal & Professional confirmed a data breach involving unauthorized access to customer and business information, with stolen files leaked by attackers.
Cloud Imperium Games (developer of Star Citizen) disclosed a breach in January affecting systems containing user personal data.
The University of Hawaii Cancer Center reported a ransomware attack in August 2025 that compromised personal and health data of nearly 1.2 million individuals.
Amazon confirmed that drone strikes damaged three AWS data centers in the United Arab Emirates and one in Bahrain, resulting in significant outages.
Facebook experienced a worldwide outage, rendering accounts inaccessible for a period.
Interpol, with support from private threat hunters, dismantled an African cybercrime syndicate, resulting in 574 arrests and the recovery of over $3 million.

Newly Discovered Vulnerabilities

VMware Aria Operations (CVE-2026-22719): A remote code execution vulnerability is being actively exploited in the wild. CISA has added it to the Known Exploited Vulnerabilities catalog.
Android/Qualcomm Zero-Day (CVE-2026-21385): An actively exploited high-severity memory corruption flaw in Qualcomm display components was patched in the latest Android update.
MS-Agent AI Framework: A vulnerability in Microsoft’s AI framework allows attackers to achieve full system compromise through improper input sanitization, exploitable via the Shell tool.
Chrome Extension Flaw: A now-patched vulnerability allowed Chrome extensions to inherit Gemini’s camera, microphone, and file access permissions.
AirSnitch Wi-Fi Attack: Researchers disclosed a Wi-Fi vulnerability (“AirSnitch”) that allows nearby attackers to intercept sensitive data and perform machine-in-the-middle attacks, demonstrating that Wi-Fi client isolation may not provide adequate protection.
Honeywell IQ4 Building Controllers: Dispute over the impact of vulnerabilities in internet-exposed building management controllers, with researchers claiming thousands are at risk.
CrushFTP: Ongoing brute-force scans reported against CrushFTP instances, which have a history of serious vulnerabilities.

Notable Threat Actor Activity

Fake IT Support/Havoc C2: Threat actors are using fake tech support spam to deploy customized Havoc command-and-control (C2) frameworks inside organizations, enabling data exfiltration and persistence.
OAuth Redirect Abuse: Microsoft warned of phishing campaigns abusing OAuth URL redirection and error flows to bypass email and browser phishing protections, delivering malware to government targets.
Starkiller Phishing Suite: A new phishing toolkit, Starkiller, uses adversary-in-the-middle (AitM) reverse proxy techniques to bypass multi-factor authentication.
Compromised Site Management Panels: Sale of compromised cPanel credentials is surging in cybercrime markets, facilitating plug-and-play phishing and scam operations.
Pro-Iranian Cyber Activity: Increased hacktivist campaigns and cyberattacks attributed to pro-Iranian actors in response to US-Israeli military actions, with an emphasis on causing economic and physical disruption.
Iranian Targeting of IP Cameras: Iranian-linked cyber operations are targeting IP cameras in conjunction with physical warfare in the Middle East.
Silver Dragon: A Chinese-aligned threat group, “Silver Dragon,” is targeting organizations in Southeast Asia and Europe, demonstrating operational links to broader campaigns.
AI-Driven FortiGate Attacks: Threat actors are leveraging the open-source CyberStrikeAI platform in AI-assisted attacks targeting Fortinet FortiGate appliances across 55 countries.
Coruna iPhone Hacking Toolkit: A sophisticated iPhone exploitation toolkit, believed to have originated from a US government contract, is now in the hands of foreign spies and criminals and has likely compromised tens of thousands of devices.

Trends, Tools, or Tactics of Interest

RMM Tool Phishing: Fake video meeting invites are being used to trick users into installing remote monitoring and management (RMM) tools, enabling unauthorized access.
AI Agent and Identity Risks: The rise of Model Context Protocol (MCP) and AI agents is introducing new, unmanaged workload identities, increasing the complexity of identity management and potential attack surfaces.
Quantum Threat to RSA: Recent developments indicate quantum decryption of RSA may be achievable sooner than previously expected, raising concerns over the security of current cryptographic standards.
AI in Security Testing: The deployment of open-source, AI-native security testing platforms is being observed in active cyberattacks, particularly against network appliances.
cPanel Marketplaces: The commoditization of compromised site management credentials is enabling scalable, automated phishing attacks.
Wi-Fi Client Isolation Limitations: AirSnitch research demonstrates that Wi-Fi client isolation may not prevent interception or manipulation of sensitive data.
Vehicle Tire Pressure Sensors: Research shows tire pressure sensors can leak data enabling silent tracking of vehicles.
Journalistic Operations in Censored Environments: Journalists in Iran are relying on satellite communications and encrypted apps to circumvent internet blackouts.

Regulatory or Policy Developments

CISA Action: The addition of VMware Aria Operations CVE-2026-22719 to CISA’s Known Exploited Vulnerabilities catalog mandates urgent mitigation for US federal agencies and highlights the vulnerability’s significance.
Pentagon AI Procurement: The US Department of Defense has dropped Anthropic AI from certain projects over security risks, with OpenAI taking over, reflecting ongoing scrutiny of AI model integration in sensitive environments.
Google Chrome Release Cycle: Google Chrome will move to a two-week release cycle, enabling faster deployment of security patches and features.

Silver Dragon on DanSec Daily

Cybersecurity Brief – 2026-03-05

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Cybersecurity Brief – 2026-03-04

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments