Major Incidents or Breaches

  • ADT, a major home security provider, confirmed a data breach after the ShinyHunters extortion group threatened to leak stolen data unless a ransom was paid.
  • Medical data of 500,000 UK Biobank volunteers was listed for sale on Alibaba, despite existing access controls.
  • NASA disclosed that employees were targeted and duped in a spear-phishing campaign orchestrated by a Chinese national posing as a U.S. researcher, with the intent to compromise U.S. defense software.
  • A U.S. federal civilian agency’s Cisco Firepower device was compromised with the Firestarter backdoor, which remains persistent even after applying security patches.
  • Bitwarden’s NPM package was compromised in a supply chain attack attributed to TeamPCP, involving the Shai-Hulud worm.
  • Over 10,000 Zimbra Collaboration Suite servers remain vulnerable to active exploitation of a cross-site scripting (XSS) flaw.
  • 26 malicious apps impersonating popular cryptocurrency wallets were discovered on the Apple App Store, targeting users’ recovery phrases and private keys.

Newly Discovered Vulnerabilities

  • PhantomRPC: A newly discovered privilege escalation technique in Windows RPC allows attackers to create fake RPC servers to escalate privileges.
  • Pack2TheRoot: A vulnerability in the Linux PackageKit daemon allows local users to install or remove system packages and gain root access.
  • Four new exploited vulnerabilities affecting SimpleHelp, Samsung MagicINFO 9 Server, and D-Link DIR-823X routers were added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
  • CrowdStrike patched a critical LogScale vulnerability, and Tenable fixed a high-severity flaw in Nessus.

Notable Threat Actor Activity

  • The ShinyHunters extortion group is behind the ADT breach and subsequent ransom threat.
  • The BlackFile extortion group has been linked to a surge of data theft and vishing attacks targeting retail and hospitality sectors since February 2026.
  • Tropic Trooper is targeting Chinese-speaking individuals using a trojanized SumatraPDF reader to deploy the AdaptixC2 post-exploitation agent via GitHub.
  • North Korea’s Lazarus Group continues to target macOS users through the ClickFix tool for initial access and data theft.
  • TeamPCP is linked to the Bitwarden NPM package supply chain attack.
  • A Chinese threat actor conducted a spear-phishing campaign targeting NASA employees and U.S. defense software.

Trends, Tools, or Tactics of Interest

  • AI-powered phishing attacks have significantly increased in the past six months, evolving from broad campaigns to highly personalized, 1-to-1 attacks.
  • Attackers are leveraging supply chain vulnerabilities, as evidenced by the Bitwarden NPM compromise.
  • The Firestarter malware demonstrates advanced persistence capabilities, surviving firmware updates and security patches on Cisco ASA and Firepower devices.
  • There is a rise in malicious crypto wallet apps on legitimate platforms, with 26 such apps found on the Apple App Store.
  • The use of trojanized legitimate software (e.g., SumatraPDF) and abuse of GitHub for payload delivery is being seen in targeted attacks.
  • Shadow IT, SaaS, and shadow AI/agents continue to present significant organizational risks.

Regulatory or Policy Developments

  • Article 9 of the EU’s Digital Operational Resilience Act (DORA) establishes authentication and access control as legal obligations for financial entities.
  • CISA set a May 2026 deadline for U.S. federal agencies to remediate newly listed exploited vulnerabilities in its KEV catalog.
  • Microsoft will roll out Entra passkey support for phishing-resistant passwordless authentication to Windows devices, starting late April.
  • Microsoft now allows IT administrators to uninstall Copilot from enterprise devices via a new policy setting.
  • The Trump administration announced intentions to crack down on Chinese companies exploiting U.S.-developed AI models.
  • A new U.S. bill is under consideration to address concerns about warrantless surveillance powers under a key federal spy program.