Friday 13 March 2026

Major Incidents or Breaches

• England Hockey is investigating a potential data breach after the AiLock ransomware group listed the organisation as a victim on its leak site.
• Canadian retail giant Loblaw notified customers of a data breach, logging out all users from accounts as a precaution.
• Telus Digital confirmed a security incident following claims by threat actors of the theft of nearly 1 petabyte of data.
• The SocksEscort proxy botnet, which compromised over 369,000 IPs globally using AVRecon Linux malware, was dismantled in a coordinated law enforcement operation.
• Kroll was impersonated in a crypto wallet scam, with attackers leveraging the firm’s reputation to target victims.
• The US Department of Justice charged another ransomware negotiator for colluding with the BlackCat/ALPHV ransomware group.
• Meta disabled more than 150,000 accounts used to power scam centres in Asia and launched new protection tools across its platforms.

Newly Discovered Vulnerabilities

• Veeam released patches for seven critical vulnerabilities in its Backup & Replication software, including multiple remote code execution flaws.
• Google issued emergency updates for Chrome to address two zero-day vulnerabilities actively exploited in the wild.
• Apple backported patches for a WebKit vulnerability (CVE-2024-23296) exploited by the Coruna exploit kit to older iOS, iPadOS, and macOS versions.
• The Ally WordPress plugin was found to have a SQL injection vulnerability exposing over 200,000 websites to potential data theft.
• Splunk and Zoom patched critical and high-severity vulnerabilities that could allow arbitrary shell command execution or privilege escalation.
• Cisco patched high-severity vulnerabilities in IOS XR that could result in denial-of-service, command execution, or device takeover.
• Critical vulnerabilities in the N8n workflow automation tool allowed unauthenticated remote code execution and server takeover.
• A newly disclosed Android vulnerability enables attackers to bypass lock screens in under 60 seconds, potentially exposing encryption keys and sensitive data.
• Microsoft Authenticator on Android and iOS had a bug that could allow malicious apps to intercept authentication codes or sign-in links. Updates have been released.
• Six new Android malware families were identified targeting Pix payments, banking apps, and crypto wallets, with capabilities for data theft and financial fraud.

Notable Threat Actor Activity

• Iranian APTs, including the group known as Handala Hack (Void Manticore), have increased destructive cyberattacks, combining wiping attacks with hack-and-leak operations and collaborating with cybercriminal groups.
• The Rust-based VENON malware is targeting 33 Brazilian banks, using credential-stealing overlays and marking a shift from previous Delphi-based malware.
• The AI-assisted Slopoly malware, attributed to the Hive0163 threat actor, was used for persistent access and data theft in Interlock ransomware attacks.
• The Polyfill supply chain attack, initially attributed to China, has been linked to North Korean threat actors following further investigation.

Trends, Tools, or Tactics of Interest

• Phishing campaigns are increasingly impersonating city and county officials to solicit fraudulent payments, as warned by the FBI.
• Attackers are using phishing not only to target employees but also to overload SOC analysts with complex investigations, increasing operational fatigue.
• Modern phishing campaigns are leveraging trusted infrastructure and legitimate-looking domains to evade detection.
• A React-based phishing page was observed using EmailJS for credential exfiltration, demonstrating the use of modern web frameworks and third-party services in phishing kits.
• Cybercriminals are treating stolen travel loyalty points as a form of underground currency, reselling them for flights and hotel stays.
• Automation in DAST (Dynamic Application Security Testing) can introduce hidden costs if not properly aligned with application behaviour.
• Delinea’s acquisition of StrongDM highlights a shift in Privileged Access Management (PAM) towards ephemeral, real-time credentials for cloud and developer environments.
• Meta has rolled out AI-powered anti-scam tools across WhatsApp, Facebook, and Messenger to detect impersonation, suspicious friend requests, and scam messages.

Regulatory or Policy Developments Affecting the Security Industry

• US lawmakers have introduced a bipartisan bill to require the FBI to obtain a warrant before accessing Americans’ communications and to ban federal purchase of commercial data on US residents.
• Confusion persists regarding US policy on commercial spyware, with recent reversals of sanctions and contract reactivations raising concerns among privacy advocates.