Cybersecurity Brief – 2026-03-12

Thu, 12 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Stryker, a global medical technology company, was impacted by a wiper malware attack attributed to the Iran-linked Handala hacktivist group. The attackers claim to have wiped more than 200,000 devices, severely disrupting operations.
Michelin confirmed a data breach linked to an Oracle EBS attack, with cybercriminals leaking over 300GB of allegedly stolen files.
Bell Ambulance reported a data breach affecting 238,000 individuals, with stolen personal information including names, Social Security numbers, and driver’s license numbers.
Meta disabled over 150,000 accounts associated with scam centers in Southeast Asia as part of a coordinated global crackdown, and reported the removal of 10.9 million Facebook and Instagram accounts linked to criminal scam centers in the past year.

Newly Discovered Vulnerabilities

Two critical remote code execution (RCE) vulnerabilities in the n8n workflow automation platform were disclosed and patched. The flaws allow arbitrary command execution and exposure of stored credentials. CISA has added the RCE bug to its Known Exploited Vulnerabilities (KEV) catalog and ordered US federal agencies to patch affected systems, with over 24,700 instances still exposed.
An SQL injection vulnerability was identified in the Elementor Ally WordPress plugin, impacting over 250,000 sites and enabling potential theft of sensitive data.
CVE-2026-0866 (“Zombie Zip”) was published, affecting ZIP file processing.
Microsoft’s March Patch Tuesday addressed 84 vulnerabilities, including two publicly known zero-days and eight critical-rated issues. Vulnerabilities could allow privilege escalation and cause service crashes.
SAP released updates for two critical vulnerabilities enabling arbitrary code execution.
Fortinet, Ivanti, and Intel issued patches for high-severity vulnerabilities that could result in arbitrary code execution, privilege escalation, or authentication rate-limit bypass.

Notable Threat Actor Activity

The Iran-linked Handala group claimed responsibility for the wiper attack on Stryker, targeting over 200,000 devices.
The PhantomRaven supply-chain campaign launched a new wave of attacks on the npm registry, using 88 malicious packages to exfiltrate sensitive developer data.
Attackers compromised the xygeni/xygeni-action GitHub Action via tag poisoning, maintaining an active command-and-control implant for up to a week.
Chinese state-linked actors shifted focus to Qatari entities in response to Iranian conflict, conducting at least two targeted attacks.

Trends, Tools, or Tactics of Interest

Ransomware attacks surged by 50% in 2025, but the proportion of victims paying ransoms reached an all-time low.
Agentic web browsers, such as Perplexity’s Comet AI Browser, were demonstrated to be susceptible to phishing attacks in under four minutes, highlighting risks with AI-driven autonomous browsing.
Phishing campaigns are leveraging IPv6 tricks to obscure malicious links in emails, as seen in recent “free toothbrush” scams impersonating United Healthcare.
Sextortion emails are incorporating real passwords harvested from disposable inboxes to increase credibility.
Robocall scams are targeting individuals during tax season with fake relief program offers.
Meta introduced new anti-scam protections across WhatsApp, Facebook, and Messenger, including user-facing warnings and enhanced detection systems.
WhatsApp launched parent-managed accounts for pre-teens, providing parents with control over contacts and group participation.
Vulnerability management is evolving towards continuous telemetry, contextual prioritization, and agentic remediation in response to the increasing use of AI and autonomous agents in exploitation.

Regulatory or Policy Developments Affecting the Security Industry

The US Senate confirmed Joshua Rudd as head of both the NSA and US Cyber Command under the “dual-hat” leadership structure.
CISA mandated federal agencies to patch the actively exploited n8n RCE vulnerability.
Google completed its acquisition of cloud security firm Wiz, which will retain its brand under Google Cloud.

Cybersecurity Brief – 2025-04-23

Wed, 23 Apr 2025 00:00:00 +0000

Major Incidents and Breaches

Marks & Spencer Cyberattack: The UK retailer confirmed a cyberattack affecting operations, including delayed Click and Collect orders. The company implemented temporary operational changes and is responding to the incident.
DeepSeek Breach: An AI-focused organisation suffered a significant breach, with sensitive data appearing on dark web forums, highlighting ongoing risks to AI platforms.
SK Telecom Data Exposure: South Korea’s largest mobile operator disclosed a malware attack that exposed sensitive USIM-related customer data.
Healthcare Ransomware Attacks: Three additional healthcare organisations-DaVita, Bell Ambulance, and Alabama Ophthalmology Associates-were impacted by ransomware, continuing the trend of targeting healthcare.
Baltimore Public Schools Data Breach: A February ransomware attack resulted in the theft of personal information belonging to thousands of students, teachers, and administrators.
City of Abilene Cyberattack: The Texas municipality went offline following a cyberattack, with incident response and investigation ongoing.

Newly Discovered Vulnerabilities

GCP Cloud Composer Privilege Escalation: A now-patched vulnerability in Google Cloud Platform’s Cloud Composer could have allowed attackers to escalate privileges via malicious PyPI packages.
Active! Mail RCE Zero-Day: A remote code execution vulnerability in Active! Mail is being actively exploited in attacks against large Japanese organisations.
Ripple’s xrpl.js Library Compromised: The widely used Ripple cryptocurrency JavaScript library “xrpl.js” was compromised, enabling theft of XRP wallet seeds and private keys.
Cookie-Bite Attack PoC: A proof-of-concept demonstrates how a malicious Chrome extension can steal Azure Entra ID session tokens, bypassing MFA and maintaining access to Microsoft 365 services.
Docker Malware Targeting Teneo Web3 Node: A new malware campaign exploits Docker environments using a previously undocumented technique to mine cryptocurrency by faking heartbeat signals.

Notable Threat Actor Activity

Russian Organisations Targeted by Sophisticated Backdoor: A new backdoor, disguised as secure networking software updates, is being used to target Russian entities.
China-Linked Billbug Group: The Billbug APT (aka Lotus Panda/Blossom, Bronze Elgin) breached multiple organisations in a Southeast Asian country, continuing its targeting of government and telecom sectors.
Russia-Linked Phishing on NGOs: Russian threat actors are conducting phishing campaigns against NGOs connected to Ukraine, using video call lures to compromise Microsoft 365 accounts.
Russian Sabotage Against Dutch Critical Infrastructure: Dutch intelligence reported Kremlin-backed attempts to sabotage critical infrastructure, underlining ongoing state-sponsored cyber risk.
Elusive Comet Hacking Group: This group is exploiting Zoom’s remote control feature in social engineering attacks to steal cryptocurrency from users.

Trends, Tools, and Tactics

Increasing Abuse of AI in Cybercrime: Threat actors are leveraging AI tools to assist in social engineering, phishing, and scam campaigns, as highlighted in Microsoft’s latest Cyber Signals report.
Phishing via Google Sites and DKIM Replay: Sophisticated phishing attacks are abusing Google Sites and DKIM replay to send signed emails that redirect to credential harvesting pages.
Browser Security Concerns: The browser is increasingly the primary endpoint in cloud-native workplaces, yet remains largely unmonitored, presenting a growing attack surface.
Microsoft Secure Future Initiative: In response to the Storm-0558 breach, Microsoft has migrated MSA signing services to Azure confidential VMs and is purging millions of legacy cloud tenants, as part of broader security enhancements.
Android and Chrome Security Updates: Android will introduce auto-reboot after three days of inactivity, and Chrome is dropping third-party cookie prompts while adding IP protection in Incognito mode.
Sensitive Content Protection: Google Messages is rolling out a feature to warn users about potentially explicit images and allow easy blocking, improving user safety.

Regulatory and Policy Developments

Zambia’s New Cyber Laws: Recently signed cyber security and cyber crime acts in Zambia have raised concerns among international observers regarding increased surveillance and potential suppression of dissent.

Other Notable Observations

Edge Vulnerabilities and SMB Threats: Verizon’s report notes a surge in edge-related vulnerabilities, persistent ransomware threats, and ongoing challenges for small and medium businesses (SMBs).
Legal Debates on Device Search Protections: Ongoing discussions about the comparative legal protections of biometrics vs. passcodes for device searches, relevant for privacy and compliance considerations.

Bell Ambulance on DanSec Daily

Cybersecurity Brief – 2026-03-12

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Cybersecurity Brief – 2025-04-23

Major Incidents and Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, and Tactics

Regulatory and Policy Developments

Other Notable Observations