Major Incidents or Breaches

• Drift disclosed that the $285 million theft on April 1, 2026, resulted from a six-month social engineering campaign attributed to North Korean (DPRK) threat actors, involving targeted infiltration and operational planning.
• Multiple Syrian government accounts were hijacked in March, exposing significant deficiencies in the state’s cybersecurity posture and basic operational security.

Newly Discovered Vulnerabilities

• Fortinet released an emergency patch for a new critical vulnerability (CVE-2026-35616) in FortiClient Enterprise Management Server (EMS), which is being actively exploited in the wild.
• Attackers are exploiting the React2Shell vulnerability (CVE-2025-55182) in vulnerable Next.js applications as part of a widespread, automated credential theft campaign.

Notable Threat Actor Activity

Major Incidents or Breaches

• The European Commission confirmed a data breach resulting from the Trivy supply chain attack, with attackers exfiltrating over 300GB of data from the Commission’s AWS environment, including personal information.
• Hackers reportedly stole Cisco source code as part of an ongoing supply chain hacking campaign.
• The FBI disclosed that a recent hack of its wiretap tools poses a national security risk.

Newly Discovered Vulnerabilities

• Fortinet released out-of-band patches for a critical vulnerability in FortiClient EMS, tracked as CVE-2026-35616. The flaw has a high CVSS score and has been actively exploited in the wild.

Notable Threat Actor Activity

Major Incidents or Breaches

• Solana-based decentralized exchange Drift confirmed a security incident on 1 April 2026, resulting in a loss of approximately $285 million. The attack, attributed to North Korean threat actors, exploited durable nonces and social engineering to compromise an admin key and drain five vaults.
• Hims & Hers Health disclosed a data breach involving the theft of support tickets from a third-party customer service platform (Zendesk).
• The German political party Die Linke suffered an IT systems outage and data theft, with the Qilin ransomware group claiming responsibility and threatening to leak sensitive data.
• Meta paused work with data vendor Mercor after a data breach potentially exposed sensitive AI industry secrets, affecting major AI labs.
• T-Mobile clarified that a recent insider-driven cybersecurity incident had a limited impact.
• European Commission cloud infrastructure was breached as part of the ongoing TeamPCP supply chain campaign, with over 1,000 SaaS environments reportedly affected. Sportradar was also named among impacted organizations.
• Sensitive Customs and Border Protection (CBP) facility codes leaked via publicly accessible online flashcards.
• Axios npm package was compromised in a supply chain attack following a targeted social engineering campaign by North Korean threat actors (UNC1069).
• ChatGPT experienced a data leak, and a water facility was hit by ransomware, according to SecurityWeek’s round-up.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• European Commission Cloud Hack: CERT-EU confirmed a breach attributed to the TeamPCP threat group, exposing data from at least 30 EU entities.
• Drift Protocol Exploit: North Korean threat actors seized Security Council administrative powers in the Drift Protocol, resulting in a loss of at least $280 million in a coordinated attack.
• Stryker Cyberattack: Stryker Corporation experienced a data-wiping attack, claimed by an Iranian-linked group. The company reports full operational recovery after three weeks.
• Hasbro Breach: Hasbro disclosed “unauthorized access” to its systems, leading to business continuity activation and some systems being taken offline.
• Nacogdoches Memorial Hospital Data Breach: A breach affecting 250,000 individuals occurred in January 2026, involving theft of personal and health information.
• WhatsApp Spyware Incident: WhatsApp alerted approximately 200 users after a fake iOS app infected devices with spyware, with an Italian firm reportedly facing action.
• Mercor Supply Chain Attack: AI recruiting firm Mercor is investigating a supply chain attack via LiteLLM, with Lapsus$ claiming theft of 4TB of data.
• Claude Code Leak Abuse: Following the Claude Code source code leak, threat actors used fake GitHub repositories to distribute Vidar infostealer malware.
• Adversaries Exploiting Vacant Homes: Threat actors are using vacant homes as mail drop addresses to intercept mail and facilitate fraud.

Newly Discovered Vulnerabilities

• Cisco IMC and SSM Flaws: Cisco patched critical vulnerabilities in the Integrated Management Controller (IMC) and SSM, including an authentication bypass (CVSS 9.8) that allowed unauthenticated remote admin access.
• Progress ShareFile Pre-Auth RCE Chain: Two vulnerabilities in Progress ShareFile can be chained for unauthenticated file exfiltration and remote code execution.
• F5 BIG-IP APM RCE Exposure: Over 14,000 F5 BIG-IP APM instances remain exposed to a critical RCE vulnerability, with active exploitation ongoing.
• Claude Code Critical Vulnerability: A critical vulnerability was identified in Claude Code days after its source code leak.
• Apple DarkSword Exploit Kit: Apple expanded patches for vulnerabilities exploited by the DarkSword kit to iOS and iPadOS 18.7.7.
• Vite (CVE-2025-30208) Exploitation: Active attempts to exploit the Vite frontend tooling vulnerability have been observed.
• Next.js (CVE-2025-55182) Exploitation: Threat actors exploited the React2Shell vulnerability to breach 766 Next.js hosts, stealing credentials, SSH keys, and AWS secrets.

Notable Threat Actor Activity

• TeamPCP: Attributed to the European Commission cloud breach affecting multiple EU entities.
• North Korean Actors: Responsible for the $280 million theft from Drift Protocol via Security Council power compromise.
• Lapsus$: Claimed responsibility for the Mercor LiteLLM supply chain attack.
• Iranian-linked Group: Claimed the data-wiping attack on Stryker Corporation.
• REF1695: Financially motivated group leveraging fake installers to distribute RATs and crypto miners since November 2023.
• Vidar Infostealer Campaign: Threat actors are leveraging the Claude Code leak to distribute infostealer malware via GitHub.
• Casbaneiro Banking Trojan: Ongoing campaigns targeting Latin American financial institutions, using advanced evasion and replication techniques.

Trends, Tools, or Tactics of Interest

• Residential Proxy Evasion: 78% of 4 billion sessions using residential proxies successfully evaded IP reputation checks, complicating detection of malicious traffic.
• Hybrid Cybercrime via Postal Fraud: Use of vacant homes as drop addresses is enabling hybrid cybercrime through mail interception.
• CloudTrail Evasion Techniques: Noted as an emerging tactic for threat actors to avoid detection in cloud environments.
• Mining Operations Using ISO Lures: Ongoing campaigns use ISO file lures to deliver RATs and cryptocurrency miners.
• CrystalX RAT: Newly observed sophisticated RAT capable of spying, stealing data, and altering device configurations.
• AI in Security Operations: CISOs and industry leaders at RSAC 2026 and in interviews report increased adoption and planned expansion of AI-driven security tools, with debates over automation versus human oversight.
• Pre-Auth Exploitation Chains: Multiple vulnerabilities are being chained pre-authentication for remote code execution and data exfiltration.
• Supply Chain Attacks via Open Source: The State of Trusted Open Source report and recent incidents highlight risks in open source software supply chains.

Regulatory or Policy Developments

• WhatsApp/Italian Regulatory Action: Italian authorities are reportedly taking action following the spyware incident involving a fake WhatsApp iOS app.
• Cybersecurity M&A Activity: 38 significant cybersecurity mergers and acquisitions were announced in March 2026, involving major firms such as Airbus, Cellebrite, Databricks, Quantum eMotion, Rapid7, and OpenAI.
• Malwarebytes VPN Audit: Malwarebytes completed a third-party audit of its VPN infrastructure, with results published for transparency.

Major Incidents or Breaches

• Hasbro, the global toy manufacturer, has disclosed a cyberattack and is investigating the extent of potential data compromise.
• The Axios NPM package was breached in a North Korean supply chain attack. Attackers used a stolen NPM access token to bypass GitHub Actions OIDC-based CI/CD controls and publish backdoored package versions.
• CERT-UA reported a phishing campaign impersonating the agency to distribute AGEWHEEZE malware to approximately 1 million email addresses.
• TrueConf conference servers were targeted via a zero-day vulnerability, allowing attackers to execute arbitrary files on connected endpoints through malicious software updates.
• Over 2.3 million Android devices were infected with the NoVoice malware, which was distributed through more than 50 apps on Google Play.
• A new service, EvilTokens, is enabling device code phishing attacks against Microsoft accounts, facilitating advanced business email compromise (BEC) campaigns.
• The TeamPCP supply chain campaign update confirmed its first victim and documented post-compromise cloud enumeration activities, with attribution narrowing towards specific threat actors.
• A new phishing campaign is targeting Spanish-speaking users in Latin America and Europe with dynamic PDF lures to deliver Casbaneiro (Metamorfo) banking trojans.
• Cyberattacks against Latin American governments have intensified, with disruptive incidents in Puerto Rico and a surge in attacks on Colombia’s health sector.
• The US Department of Justice has charged an individual for exploiting smart contract vulnerabilities to steal $55 million from the Uranium crypto exchange, leading to its shutdown.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Cisco Source Code Breach: Cisco confirmed a cyberattack resulting in the theft of internal source code. Attackers leveraged credentials stolen in the recent Trivy supply chain incident to breach Cisco’s development environment.
• Axios NPM Package Compromise: The npm account for Axios, a widely-used JavaScript HTTP client, was hijacked to distribute remote access trojans targeting Linux, Windows, and macOS. The attack is suspected to have North Korean threat actor involvement.
• Claude Code Source Leak: Anthropic disclosed that internal source code for its Claude Code AI assistant was inadvertently published via an npm packaging error. No customer data or credentials were exposed.
• TrueConf Zero-Day Exploitation: Government networks in Southeast Asia were targeted using a zero-day vulnerability in TrueConf video conferencing software, in a campaign dubbed “Operation TrueChaos.”
• Uranium Finance Crypto Exchange Theft: A Maryland individual was charged with stealing $53 million from Uranium Finance through two hacks, subsequently laundering the proceeds via a cryptocurrency mixer.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• The Dutch Ministry of Finance took its treasury banking portal and some systems offline following a detected cyberattack, as investigations into the breach continue.
• Healthcare IT firm CareCloud disclosed a data breach exposing sensitive patient data and causing an eight-hour network disruption.
• The European Commission reported a cyber intrusion and data theft, with the ShinyHunters group claiming to have stolen over 350GB of information from Commission cloud systems.
• The FBI confirmed Iranian hackers compromised the personal email account of Kash Patel, noting the data accessed was outdated.
• Researchers report that nearly 66 billion stolen identity records are now circulating on criminal forums, a 23% increase from the previous year.
• Stolen tax documents are being actively sold on the dark web, with prices ranging from $4 to $20 per identity.
• TeamPCP supply chain campaign continues to expand, with Telnyx targeted and Databricks investigating an alleged compromise. The campaign involves dual ransomware operations and data leaks, including AstraZeneca data.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• The European Commission confirmed a data breach following a cyberattack on its Europa.eu platform. The incident, claimed by the ShinyHunters extortion gang, resulted in unauthorised access to data.
• The FBI confirmed that Iranian-linked Handala hackers compromised the personal email account of Director Kash Patel, with some exfiltrated data published. The US government has offered a $10 million reward for information on the hackers.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Iran-linked threat actors breached the personal email account of Kash Patel, director of the U.S. Federal Bureau of Investigation (FBI), and leaked a cache of photos and other documents.
• The same Iranian group conducted a wiper attack against Stryker, a medical technology company.

Newly Discovered Vulnerabilities

• A critical memory overread vulnerability (CVE-2026-3055, CVSS 9.3) affecting Citrix NetScaler ADC and NetScaler Gateway is under active reconnaissance by threat actors.

Notable Threat Actor Activity

Major Incidents or Breaches

• The European Commission is investigating a security breach after a threat actor gained access to its Amazon cloud environment.
• The Dutch National Police disclosed a security breach resulting from a successful phishing attack; the impact is described as limited and did not affect citizens’ data.
• A pro-Iranian hacking group claimed responsibility for breaching the personal email account of FBI Director Kash Patel, releasing emails and documents.
• Bearlyfy, a pro-Ukrainian group, has conducted over 70 cyberattacks targeting Russian companies since January 2025, recently deploying custom GenieLocker ransomware.
• TeamPCP compromised the Telnyx Python package on PyPI, pushing malicious versions that deliver credential-stealing malware hidden in WAV files as part of an ongoing supply chain campaign.
• Developers on GitHub are being targeted by a large-scale campaign using fake Visual Studio Code (VS Code) security alerts to spread malware.
• Apple is sending Lock Screen alerts to iPhones and iPads running outdated iOS/iPadOS versions, warning of active web-based exploits and urging immediate updates.
• The Alliance for Creativity and Entertainment (ACE) announced the shutdown of AnimePlay, an illegal streaming platform with over 5 million users.

Newly Discovered Vulnerabilities