Major Incidents or Breaches

  • Wynn Resorts disclosed that 21,000 employees were affected by the ShinyHunters hack. The company reportedly paid a ransom to prevent data leakage.
  • Drift Protocol attributed its recent $280M cryptocurrency theft to a six-month, in-person operation where attackers established an operational presence inside the organisation.
  • Axios, a popular NPM package, was compromised in a supply chain attack involving sophisticated social engineering targeting maintainers. North Korean threat actors are linked to this and similar campaigns against Node.js maintainers.
  • Guardarian users were targeted via 36 malicious NPM packages impersonating Strapi plugins, enabling shell execution, container escape, and credential harvesting.
  • The European Commission experienced a significant cyber incident, as noted in Check Point’s threat intelligence report.

Newly Discovered Vulnerabilities

  • Flowise AI Agent Builder is under active exploitation for a CVSS 10.0 remote code execution vulnerability. Over 12,000 instances are exposed.
  • Fortinet issued an emergency patch for a zero-day authentication bypass flaw (CVE-2026-35616) in FortiClient EMS, which allows unauthenticated remote code execution. CISA has mandated federal agencies patch this vulnerability.
  • A new GPUBreach attack technique enables privilege escalation and system takeover through Rowhammer-induced bit-flips on GPU GDDR6 memory.
  • Exploit code for an unpatched Windows privilege escalation zero-day (“BlueHammer”) was leaked, allowing local attackers to gain SYSTEM or administrator privileges.
  • Automated credential harvesting campaigns are exploiting the React2Shell flaw in vulnerable Next.js applications.
  • Google DeepMind researchers identified “AI Agent Traps,” a vulnerability that allows attackers to manipulate and exploit AI agents via malicious web content.

Notable Threat Actor Activity

  • China-linked Storm-1175 has been observed exploiting zero-day and n-day vulnerabilities to rapidly deploy Medusa ransomware in high-velocity attacks.
  • Qilin and Warlock ransomware groups are using the bring-your-own-vulnerable-driver (BYOVD) tactic to disable over 300 endpoint detection and response (EDR) tools during ransomware deployment.
  • An Iran-linked threat actor is conducting password-spraying attacks against over 300 Israeli and UAE Microsoft 365 organisations.
  • DPRK-linked actors are using GitHub as command-and-control infrastructure in multi-stage attacks targeting South Korean entities.
  • North Korean threat actors are targeting Node.js maintainers with social engineering as part of supply chain attacks.
  • A threat cluster tracked as UAT-10608 is automating credential harvesting by exploiting web-exposed Next.js applications.

Trends, Tools, or Tactics of Interest

  • There is increased use of AI-assisted tools by threat actors in supply chain attacks, as seen in the PRT-scan campaign targeting GitHub misconfigurations.
  • Social engineering targeting open-source maintainers is becoming industrialised, with attackers leveraging complex, scalable tactics.
  • The BYOVD technique remains prevalent among ransomware operators for bypassing security controls.
  • Open redirects continue to be widely abused in phishing campaigns.
  • Infostealers are harvesting credentials and session cookies at scale, outpacing traditional breach monitoring capabilities.
  • Developer workstations are being increasingly targeted as entry points for credential theft and lateral movement.
  • Shadow AI use in healthcare persists, with medical professionals adopting unsanctioned AI tools.

Regulatory or Policy Developments Affecting the Security Industry

  • The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch the actively exploited Fortinet EMS vulnerability by Friday.
  • The OWASP GenAI Security Project has updated its risk matrix, now recognising 21 generative AI risks and recommending tailored security approaches for GenAI and agentic AI systems.
  • German authorities have formally identified two Russian nationals as the leaders of the GandCrab and REvil ransomware operations between 2019 and 2021.
  • Microsoft has deprecated and removed the Support and Recovery Assistant (SaRA) tool from all supported Windows versions as of March 10.