CVE-2026-32746 on DanSec Daily

Cybersecurity Brief – 2026-03-19

Thu, 19 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Aura, an identity protection company, confirmed a data breach exposing nearly 900,000 marketing contacts, including names and email addresses.
Marquis, a Texas-based financial services provider, disclosed that a ransomware attack in August 2025 led to the theft of data belonging to 672,000 individuals and operational disruption.
Nordstrom’s email system was abused to send cryptocurrency scam emails to customers from a legitimate company address.
Stryker, a medtech company, continues recovery efforts following a cyberattack attributed to the Iranian-linked Handala group, likely using malware-stolen credentials.

Newly Discovered Vulnerabilities

Cisco Secure Firewall Management Center (FMC): CVE-2026-20131, a critical zero-day vulnerability, is being actively exploited by the Interlock ransomware group for remote code execution and root access.
GNU InetUtils telnetd: CVE-2026-32746, a critical unpatched flaw, allows unauthenticated remote attackers to execute arbitrary code as root.
Ubuntu Desktop: CVE-2026-3888, a high-severity vulnerability in default installations (24.04+), allows privilege escalation to root via a systemd cleanup timing exploit.
ConnectWise ScreenConnect: A cryptographic signature verification vulnerability has been patched, which could have allowed unauthorized access and privilege escalation.
Zimbra Collaboration Suite: An XSS vulnerability is being actively exploited; CISA has ordered urgent patching. Microsoft SharePoint is also under active exploitation for a separate flaw.
Claude AI: A trio of vulnerabilities, including prompt injection, exposes Claude users to potential data theft through chained attacks initiated from Google searches.
Apple WebKit: CVE-2026-20643, a vulnerability that could allow sites to access user data, has been patched via a background security update.
IP KVM Devices: Nine critical vulnerabilities across four vendors allow unauthenticated attackers to gain root access and take control of host systems.

Notable Threat Actor Activity

Interlock ransomware: Actively exploiting the Cisco FMC zero-day (CVE-2026-20131) in a campaign ongoing since January 2026.
Horabot: New campaign in Mexico identified, involving sophisticated multi-stage malware delivery and targeting financial information.
SideWinder: Espionage group, suspected to be India-linked, expanding operations across Southeast Asia targeting governments, telecom, and critical infrastructure using spear-phishing, old vulnerabilities, and rotating infrastructure.
DPRK IT Worker Network: OFAC sanctioned six individuals and two entities for funding North Korean WMD programs through fraudulent remote IT work.
Iranian-linked Handala group: Attributed to the Stryker breach, leveraging credentials stolen via malware.
Magecart: Ongoing use of novel techniques, such as hiding payloads in EXIF data of third-party favicons, to evade repository scanners and steal payment information.
Darksword iOS Exploit Kit: Used by state-sponsored and criminal actors, this kit chains multiple iOS zero-days to compromise devices for surveillance and data theft, targeting users in Saudi Arabia, Turkey, Malaysia, Ukraine, and reportedly by Russian hackers.
SnappyClient: A new C2 implant targeting cryptocurrency wallets, supporting remote access, data theft, and spyware capabilities.
Shipping-Themed Phishing: Surge in phishing campaigns targeting Middle East and Africa, leveraging shipping themes.

Trends, Tools, or Tactics of Interest

Refund Fraud Economy: Increase in organized refund fraud exploiting major retailers and payment platforms, with methods and tutorials being commercialized.
Fake Shop Networks: Discovery of a network of over 20,000 fake online shops designed to steal payment and personal data.
Font-Rendering Evasion: Researchers demonstrated a method to hide malicious commands from AI assistants using font-rendering tricks.
Scanning Activity: Increased scans for “adminer” and “phpMyAdmin” observed in honeypots.
Shadow AI: SaaS applications are enabling unmonitored AI activity, increasing risk of data exposure and breaches.
Security Tooling: Emergence of autonomous offensive security platforms (e.g., XBOW) and new AI detection/response startups (e.g., Manifold, Native) focused on vulnerability discovery and endpoint security.

Regulatory or Policy Developments

OFAC Sanctions: The US Treasury’s OFAC sanctioned individuals and entities tied to North Korean IT worker schemes funding WMD programs.
EU Sanctions: The European Union sanctioned Chinese and Iranian companies and individuals for cyberattacks against EU member states, expanding measures already in place in the US and UK.
CISA Directives: CISA issued emergency directives for US government agencies to patch actively exploited vulnerabilities in Zimbra and SharePoint.

Cybersecurity Brief – 2026-03-18

Wed, 18 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

UK Companies House disclosed a vulnerability that exposed details of millions of firms, which could have been exploited to obtain sensitive company information and alter official records.
Robotic surgery manufacturer Intuitive confirmed a cyberattack after an employee fell victim to a phishing scheme, resulting in unauthorised access to internal business applications.
GlassWorm malware resurfaced in a supply-chain attack targeting over 400 code repositories and packages on GitHub, npm, VSCode, and OpenVSX, impacting the software supply chain.
Sears exposed AI chatbot phone calls and text chats to the public web, allowing access to customer conversations containing contact information and personal details.
LeakNet ransomware adopted the ClickFix technique via compromised websites for initial access and deployed a Deno-based in-memory loader, increasing stealth in attacks.
The RondoDox botnet escalated its activity, targeting 174 vulnerabilities with up to 15,000 exploitation attempts per day.
A phishing attack targeted cybersecurity firm Outpost24, using trusted brands and domains in an attempt to compromise C-suite credentials; the attack was unsuccessful.

Newly Discovered Vulnerabilities

Apple released its first Background Security Improvements update to patch a WebKit vulnerability (CVE-2026-20643) affecting iOS, iPadOS, and macOS, which enabled same-origin policy bypass.
A critical unpatched vulnerability (CVE-2026-32746) in the GNU InetUtils telnet daemon (telnetd) allows unauthenticated remote code execution as root via port 23.
Multiple AI platforms, including Amazon Bedrock, LangSmith, and SGLang, were found vulnerable to data exfiltration and remote code execution attacks using DNS queries.
CISA flagged the year-old Wing FTP vulnerability (CVE-2025-47813) as actively exploited, which can disclose the full local installation path of the application.
A new font-rendering attack was identified that hides malicious commands from AI tools by embedding them in HTML, evading detection by AI-based security solutions.

Notable Threat Actor Activity

North Korean threat actor group Konni was observed deploying EndRAT through phishing campaigns and leveraging the KakaoTalk desktop app to propagate malware to victims’ contacts.
LeakNet ransomware group is now using ClickFix for social engineering and Deno runtime for in-memory malware loading, enhancing stealth and evasion.
The Warlock ransomware group demonstrated augmented post-exploitation activities, including a new Bring Your Own Vulnerable Driver (BYOVD) technique and advanced cross-network movement.
Attackers are increasingly using IPv4-mapped IPv6 addresses to obfuscate attack origins, as noted in recent web scanning activity.

Trends, Tools, or Tactics of Interest

Attackers are shifting from traditional intrusion methods to credential theft, with increased use of infostealer malware and AI-enabled social engineering, leading to more incidents of attackers “logging in, not breaking in.”
Ransomware actors are moving away from Cobalt Strike in favour of native Windows tools due to declining ransom payment rates and a surge in data theft.
Akamai reported a convergence of Layer 7 DDoS, API abuse, and AI-powered attacks into highly coordinated, multi-vector campaigns that are more challenging to detect and mitigate.
Integrated Cloud Email Security (ICES) is highlighted as a recommended solution for modern email threats, as attackers continue to evolve phishing techniques.
SEO poisoning is being used to lure users searching for VPNs into downloading malicious software that steals corporate login credentials.
AI security remains a concern: studies indicate most CISOs are relying on outdated tools and skills to secure AI systems, and 90% of surveyed users do not trust AI with their data.
Use of in-memory loaders and open-source runtimes (such as Deno) is increasing in ransomware deployment for stealthier attacks.
Supply chain threats continue to target open-source repositories and extensions, as evidenced by the GlassWorm campaign.
Google is implementing stricter controls on Android apps abusing accessibility features to combat mobile malware.
A new tactic was observed where malicious commands are hidden from AI-based detection tools using font-rendering tricks in HTML.

Regulatory or Policy Developments

The European Union Council imposed sanctions on three entities and two individuals from China and Iran for involvement in cyberattacks targeting critical infrastructure.
Major tech companies including Anthropic, AWS, Google, Microsoft, and OpenAI have collectively invested $12.5 million in the Linux Foundation for open source security initiatives.
Google, Meta, and Microsoft are among the signatories of a new industry pact to combat online scams and fraud.