Cybersecurity Brief – 2026-03-06

Fri, 06 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Wikipedia experienced a security incident involving a self-propagating JavaScript worm that vandalized pages and modified user scripts across multiple Wikimedia wikis.
The FBI arrested a suspect linked to the theft of over $46 million in cryptocurrency from the U.S. Marshals Service. The individual is the son of a U.S. government contractor.
LeakBase, a stolen credential marketplace active since 2021 with 142,000 users, was shut down by law enforcement and suspects were arrested.
Spanish and Ukrainian law enforcement dismantled an online gambling ring that exploited war-displaced Ukrainian women, laundering nearly €4.75 million.
Phobos ransomware administrator Evgenii Ptitsyn, a Russian national, pleaded guilty to wire fraud conspiracy in the US after extradition from South Korea.

Cisco disclosed two actively exploited vulnerabilities in Catalyst SD-WAN Manager (CVE-2026-20128, CVE-2026-20122), urging immediate upgrades of affected devices.
Cisco released patches for 48 vulnerabilities in their Firewall ASA, Secure FMC, and Secure FTD products, including two critical vulnerabilities rated CVSS 10.0.
A critical vulnerability in the User Registration & Membership plugin for WordPress (installed on over 60,000 sites) is being exploited to create unauthorized admin accounts.
Google’s Threat Intelligence Group reported that 90 zero-day vulnerabilities were exploited in 2025, with nearly half targeting enterprise software and appliances.

A suspected Iran-linked group, Dust Specter, targeted Iraqi government officials using new malware strains SPLITDROP and GHOSTFORM, delivered by impersonating the Iraqi Ministry of Foreign Affairs.
Russian state-linked APT28 conducted a campaign against Ukrainian entities, deploying two new malware families: BadPaw loader and MeowMeow backdoor.
China-linked APT group UAT-9244 targeted telecommunications providers in South America since 2024, compromising Windows, Linux, and network-edge devices with a new malware toolkit.
Pakistan’s APT36 has adopted AI-driven “vibe-coding” techniques to produce large volumes of low-quality malware, potentially overwhelming defensive measures.
A phishing-as-a-service platform, Tycoon 2FA, known for its ability to bypass MFA, was dismantled following a joint operation by Europol and security vendors.

Messaging platforms are increasingly being abused as vectors for phishing and social engineering attacks, as reported by NCC Group’s Fox-IT.
Spear phishing attacks are on the rise, with attackers using more sophisticated, human-like emails and synthetically generated text to evade detection.
Threat actors are leveraging Bing’s AI-powered search to promote fake GitHub repositories, distributing information-stealing and proxy malware through deceptive OpenClaw installer links.
Attackers are preparing for a post-quantum cryptography era, collecting encrypted data now for potential future decryption once quantum capabilities become available.
Browser security is emerging as a significant blind spot in enterprises, with browsers now functioning as a de facto operating system for modern work, according to Keep Aware’s 2026 State of Browser Security Report.
MFA is not a comprehensive defense against credential abuse in Windows environments, as attackers continue to find ways to bypass or exploit MFA implementations.
Latin America is experiencing twice as many cyberattacks as the United States, attributed to lower cybersecurity maturity in the region.
The use of AI in malware development is increasing, enabling threat actors to scale operations and automate attack delivery.

The US Supreme Court is set to decide on the constitutionality of geofence warrants, which allow law enforcement to collect location data from all devices near a crime scene. Google has advocated for these warrants to be struck down.