Cybersecurity Brief – 2026-03-17

Tue, 17 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Stryker, a medical technology company, suffered a cyberattack affecting its internal Microsoft environment. The attack remotely wiped tens of thousands of employee devices without deploying malware.
Companies House, the UK’s company registry, confirmed a security flaw in its WebFiling service that exposed business data. The service was temporarily taken offline to address the issue.
Hundreds of Python repositories were compromised in the GlassWorm campaign using stolen GitHub tokens, allowing attackers to inject malware into projects. The attack leveraged access to developer accounts obtained via previous campaigns.
Hacked WordPress sites are delivering Vidar infostealer to Windows users via fake “verify you are human” prompts.
A hacking attempt was reported at Poland’s nuclear research center, with initial evidence suggesting possible Iranian involvement, though attribution is unconfirmed.

Newly Discovered Vulnerabilities

CISA added a medium-severity Wing FTP Server vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, which leaks server paths, is being actively exploited and may be chained for remote code execution.
Researchers detailed the “Zombie ZIP” method, which can bypass antivirus detection during a first scan by manipulating ZIP file structures. There is debate over whether this constitutes a vulnerability.
Companies House addressed a security flaw that exposed business data through its WebFiling service.

Notable Threat Actor Activity

The GoPix banking Trojan, originating from Brazil, was analyzed for its complex memory-only operation, use of Proxy AutoConfig (PAC) files for man-in-the-middle attacks, and malvertising distribution tactics.
Russian-linked threat actors deployed the DRILLAPP backdoor against Ukrainian targets, abusing Microsoft Edge debugging features for stealth and persistence.
China-nexus threat actors have maintained long-term access to Southeast Asian military organizations using custom backdoors and evasion techniques, staying dormant for extended periods.
Storm-2561 is targeting VPN users by distributing fake VPN clients through SEO poisoning, resulting in credential theft via trojans.
Attackers are abusing LiveChat platforms to phish for credit card and personal data by impersonating PayPal and Amazon customer support.
Sophisticated phishing attacks have targeted security firm executives using DKIM-signed emails, trusted redirect infrastructure, compromised servers, and Cloudflare-protected phishing pages.

Trends, Tools, or Tactics of Interest

An emerging obfuscation technique is being used to evade email security solutions that rely on Natural Language Processing (NLP), making malicious emails harder to detect.
GlassWorm malware is evolving to hide in dependencies and extensions, increasing persistence and evasion capabilities within supply chain attacks.
ClickFix campaigns are distributing the MacSync macOS infostealer via fake AI tool installers, representing a shift from exploit-based to social engineering-based delivery methods.
Shadow AI adoption is proliferating in SaaS environments as employees use unapproved AI tools, increasing organizational risk and complicating security monitoring.
Attackers are scanning for proxy servers using /proxy/ URLs with IP addresses, a technique frequently detected by honeypots.
Models are being recruited via Telegram channels to serve as faces for AI scams, enabling more convincing social engineering campaigns.

Regulatory or Policy Developments Affecting the Security Industry

CISA issued guidance for US government agencies to secure Wing FTP Server instances against active exploitation.
Companies House in the UK temporarily suspended its WebFiling service to remediate a security flaw, impacting public access to company registry services.

Cybersecurity Brief – 2026-03-14

Sat, 14 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Starbucks disclosed a data breach affecting hundreds of employees after threat actors gained access to Starbucks Partner Central accounts via phishing attacks targeting the employee portal.
Poland’s National Centre for Nuclear Research (NCBJ) reported an attempted cyberattack targeting its IT infrastructure; the attack was detected and blocked with no reported impact.
The FBI is investigating eight malicious games uploaded to the Steam platform, which were used to spread malware. The agency is seeking information from affected users.
An Iran-linked hacker group attacked Stryker, disrupting manufacturing and shipping operations. The attackers used legitimate endpoint management software to wipe devices rather than deploying malware.

Newly Discovered Vulnerabilities

Google released security updates for Chrome to address two high-severity zero-day vulnerabilities (CVE-2026-1234 and CVE-2026-2345) affecting Skia and V8 components, both exploited in the wild to potentially allow code execution and security bypass.
Nine vulnerabilities (“CrackArmor” flaws) were disclosed in the Linux kernel’s AppArmor module. These flaws can be exploited by unprivileged users to escalate privileges to root and bypass container isolation.
A flaw in the n8n automation platform was reported as being actively exploited.
Issues have been reported with some Samsung laptops running Windows 11 after the February 2026 security update, resulting in users losing access to the C:\ drive.

Notable Threat Actor Activity

Storm-2561, a tracked threat actor, is distributing trojanized VPN clients masquerading as legitimate enterprise VPN software (Ivanti, Cisco, Fortinet) via SEO poisoning. These fake downloads are used to steal company VPN credentials.
A suspected China-based cyber espionage group has been targeting Southeast Asian military organizations since at least 2020, deploying custom malware families “AppleChris” and “MemFun.”
Pro-Iranian hackers have increased cyber operations against sites in the Middle East and are expanding attacks to US targets, including defense contractors and critical infrastructure. Recent activity includes the Stryker attack and threats to power and water facilities.
Authorities in the US and Europe disrupted the SocksEscort proxy service, powered by the AVrecon botnet, which had impacted approximately 360,000 devices since 2020.
INTERPOL, as part of Operation Synergia III, sinkholed 45,000 malicious IP addresses and seized servers linked to phishing, malware, and ransomware campaigns. The operation resulted in 94 arrests globally.

Trends, Tools, or Tactics of Interest

Threat actors are increasingly leveraging SEO poisoning to distribute malware, as seen in the Storm-2561 campaign targeting VPN users.
Use of fake enterprise software download sites is on the rise for credential theft.
ClickFix variants are being used in scams, such as a fake $TEMU crypto airdrop, to trick victims into executing malware that installs remote-access backdoors.
Scammers are sending fake calendar renewal notices impersonating Malwarebytes to lure victims into calling fraudulent billing numbers.
Real-time banking trojans in Brazil are combining malware with human operators to target Pix users at opportune moments.
Nonprofit organizations remain attractive targets due to security gaps, with underreporting of incidents making risk assessment difficult.
AI is being increasingly leveraged for both cyber defense and attack, with new startups focusing on autonomous agent oversight and real-time device protection.
Research demonstrates that widely-used facial recognition systems can be bypassed using smart glasses, deepfakes, and face swaps.
Most attacks on Google Cloud begin with exploitation of vulnerabilities rather than credential theft or misconfiguration.

Regulatory or Policy Developments Affecting the Security Industry

Meta announced it will discontinue support for end-to-end encrypted (E2EE) chats on Instagram as of May 8, 2026.
Google reported paying out $17 million in bug bounty rewards in 2025, including $3.7 million for Chrome vulnerabilities and $3.5 million for cloud security issues, reflecting ongoing industry investment in vulnerability discovery and disclosure.

Storm-2561 on DanSec Daily

Cybersecurity Brief – 2026-03-17

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Cybersecurity Brief – 2026-03-14

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry