Major Incidents or Breaches#

  • European Commission Cloud Hack: CERT-EU confirmed a breach attributed to the TeamPCP threat group, exposing data from at least 30 EU entities.
  • Drift Protocol Exploit: North Korean threat actors seized Security Council administrative powers in the Drift Protocol, resulting in a loss of at least $280 million in a coordinated attack.
  • Stryker Cyberattack: Stryker Corporation experienced a data-wiping attack, claimed by an Iranian-linked group. The company reports full operational recovery after three weeks.
  • Hasbro Breach: Hasbro disclosed “unauthorized access” to its systems, leading to business continuity activation and some systems being taken offline.
  • Nacogdoches Memorial Hospital Data Breach: A breach affecting 250,000 individuals occurred in January 2026, involving theft of personal and health information.
  • WhatsApp Spyware Incident: WhatsApp alerted approximately 200 users after a fake iOS app infected devices with spyware, with an Italian firm reportedly facing action.
  • Mercor Supply Chain Attack: AI recruiting firm Mercor is investigating a supply chain attack via LiteLLM, with Lapsus$ claiming theft of 4TB of data.
  • Claude Code Leak Abuse: Following the Claude Code source code leak, threat actors used fake GitHub repositories to distribute Vidar infostealer malware.
  • Adversaries Exploiting Vacant Homes: Threat actors are using vacant homes as mail drop addresses to intercept mail and facilitate fraud.

Newly Discovered Vulnerabilities#

  • Cisco IMC and SSM Flaws: Cisco patched critical vulnerabilities in the Integrated Management Controller (IMC) and SSM, including an authentication bypass (CVSS 9.8) that allowed unauthenticated remote admin access.
  • Progress ShareFile Pre-Auth RCE Chain: Two vulnerabilities in Progress ShareFile can be chained for unauthenticated file exfiltration and remote code execution.
  • F5 BIG-IP APM RCE Exposure: Over 14,000 F5 BIG-IP APM instances remain exposed to a critical RCE vulnerability, with active exploitation ongoing.
  • Claude Code Critical Vulnerability: A critical vulnerability was identified in Claude Code days after its source code leak.
  • Apple DarkSword Exploit Kit: Apple expanded patches for vulnerabilities exploited by the DarkSword kit to iOS and iPadOS 18.7.7.
  • Vite (CVE-2025-30208) Exploitation: Active attempts to exploit the Vite frontend tooling vulnerability have been observed.
  • Next.js (CVE-2025-55182) Exploitation: Threat actors exploited the React2Shell vulnerability to breach 766 Next.js hosts, stealing credentials, SSH keys, and AWS secrets.

Notable Threat Actor Activity#

  • TeamPCP: Attributed to the European Commission cloud breach affecting multiple EU entities.
  • North Korean Actors: Responsible for the $280 million theft from Drift Protocol via Security Council power compromise.
  • Lapsus$: Claimed responsibility for the Mercor LiteLLM supply chain attack.
  • Iranian-linked Group: Claimed the data-wiping attack on Stryker Corporation.
  • REF1695: Financially motivated group leveraging fake installers to distribute RATs and crypto miners since November 2023.
  • Vidar Infostealer Campaign: Threat actors are leveraging the Claude Code leak to distribute infostealer malware via GitHub.
  • Casbaneiro Banking Trojan: Ongoing campaigns targeting Latin American financial institutions, using advanced evasion and replication techniques.
  • Residential Proxy Evasion: 78% of 4 billion sessions using residential proxies successfully evaded IP reputation checks, complicating detection of malicious traffic.
  • Hybrid Cybercrime via Postal Fraud: Use of vacant homes as drop addresses is enabling hybrid cybercrime through mail interception.
  • CloudTrail Evasion Techniques: Noted as an emerging tactic for threat actors to avoid detection in cloud environments.
  • Mining Operations Using ISO Lures: Ongoing campaigns use ISO file lures to deliver RATs and cryptocurrency miners.
  • CrystalX RAT: Newly observed sophisticated RAT capable of spying, stealing data, and altering device configurations.
  • AI in Security Operations: CISOs and industry leaders at RSAC 2026 and in interviews report increased adoption and planned expansion of AI-driven security tools, with debates over automation versus human oversight.
  • Pre-Auth Exploitation Chains: Multiple vulnerabilities are being chained pre-authentication for remote code execution and data exfiltration.
  • Supply Chain Attacks via Open Source: The State of Trusted Open Source report and recent incidents highlight risks in open source software supply chains.

Regulatory or Policy Developments#

  • WhatsApp/Italian Regulatory Action: Italian authorities are reportedly taking action following the spyware incident involving a fake WhatsApp iOS app.
  • Cybersecurity M&A Activity: 38 significant cybersecurity mergers and acquisitions were announced in March 2026, involving major firms such as Airbus, Cellebrite, Databricks, Quantum eMotion, Rapid7, and OpenAI.
  • Malwarebytes VPN Audit: Malwarebytes completed a third-party audit of its VPN infrastructure, with results published for transparency.