Cybersecurity Brief – 2026-03-25

Wed, 25 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

HackerOne disclosed a data breach impacting hundreds of employees, following a compromise of its US benefits administrator, Navia.
Infinite Campus, a widely used K-12 student information system, warned of a data breach and extortion attempt, attributed to the ShinyHunters threat actor.
The Dutch Ministry of Finance confirmed a breach affecting internal systems, detected in the previous week.
QualDerm, a healthcare provider, suffered a breach impacting 3.1 million individuals, with personal, medical, and insurance data stolen.
Extortion group Lapsus$ claimed to have compromised AstraZeneca, including internal code repositories, credentials, and employee data.

Newly Discovered Vulnerabilities

PTC Inc. warned of a critical remote code execution vulnerability affecting its Windchill and FlexPLM product lifecycle management solutions.
A critical Citrix NetScaler vulnerability was disclosed, allowing unauthenticated remote attackers to read sensitive information from memory.
Chrome 146 was released, addressing eight high-severity memory safety vulnerabilities across seven components.
Firefox 149 introduced a built-in VPN with a 50GB monthly data limit, enhancing privacy protections.
Researchers highlighted ongoing risks and vulnerabilities in IP KVM devices, following recent reports from Eclypsium.

Notable Threat Actor Activity

TeamPCP continued its supply chain attacks, compromising the popular LiteLLM Python package on PyPI (versions 1.82.7–1.82.8) via a Trivy CI/CD compromise, embedding credential harvesters and affecting hundreds of thousands of developers. TeamPCP was also linked to attacks on Trivy, Checkmarx KICS, and VS Code plug-ins, as well as recent compromises of GitHub Actions workflows through stolen CI credentials.
A large-scale malvertising campaign has been leveraging tax-related search ads since January 2026, distributing rogue installers for ConnectWise ScreenConnect. The campaign uses a Huawei driver to disable endpoint detection and response (EDR) solutions.
The Ghost campaign was identified as distributing seven malicious npm packages aimed at stealing cryptocurrency wallets and credentials.
Ongoing phishing campaigns are targeting French-speaking enterprises with fake resumes, leading to the deployment of information stealers and cryptocurrency miners.
FBI and CISA, along with European agencies, warned of Russian threat actors hijacking Signal and WhatsApp accounts via scalable social engineering campaigns.
Scam compounds are hiring individuals to appear as “AI models” in deepfake video calls to facilitate fraud.

Trends, Tools, or Tactics of Interest

The number of newly reported vulnerabilities is expected to exceed 100,000 this year, with a noted trend toward faster exploitation of zero-days.
Security researchers observed a rise in supply chain attacks targeting open-source software and developer tools, with AI-assisted campaigns distributing trojanized packages (e.g., OpenClaw Deployer on GitHub).
Increased use of credential-stealing malware targeting CI/CD pipelines and package repositories.
Attackers are using legitimate drivers (e.g., Huawei) to disable EDR in malware campaigns.
There is a continued increase in phishing campaigns leveraging social engineering and fake documentation (e.g., resumes) to gain initial access.
AI and agentic AI systems are being increasingly targeted, as evidenced by the McKinsey Lilli platform hack and discussions on the need for better governance and identity controls.
JPMorgan Chase reported the use of AI digital twins and digital fingerprints for advanced threat hunting and reducing false positives.
Endpoint security is being challenged by AI coding tools, which facilitate bypassing traditional defenses.
Surveillance systems are being targeted in geopolitical conflicts, as demonstrated by Israel’s exploitation of Iran’s camera network.

Regulatory or Policy Developments

The US Federal Communications Commission (FCC) updated its Covered List to ban the sale of all new consumer routers manufactured outside the USA, citing security risks.
The US Department of Energy (DoE) published a five-year energy security plan (Project Armor) to harden critical energy infrastructure.
Microsoft proposed new identity and governance guardrails for agentic AI systems to address emerging threats from autonomous AI agents.
Gartner released its first Market Guide for Guardian Agents, highlighting the emergence of this security technology category.
A Russian national received an 81-month prison sentence for acting as an initial access broker for Yanluowang ransomware attacks.

Cybersecurity Brief – 2025-11-08

Sat, 08 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

The U.S. Congressional Budget Office confirmed it was hacked, with potential exposure of sensitive government data.
Multiple Russian state-sponsored groups expanded destructive cyberattacks against Ukrainian entities, now targeting the grain sector and associated European organisations.
18 individuals were arrested in connection with international credit card fraud rings, responsible for defrauding 4.3 million cardholders in 193 countries of approximately €300 million between 2016 and 2021.

Newly Discovered Vulnerabilities

QNAP patched seven zero-day vulnerabilities in its NAS devices, which were exploited during the Pwn2Own Ireland 2025 competition.
Samsung Galaxy Android devices were affected by a now-patched zero-day vulnerability (CVE-2025-21042) in the image processing library, exploited via malicious WhatsApp images to deliver the LANDFALL spyware.
Cisco reported that two previously exploited zero-day vulnerabilities in ASA and FTD firewalls are now being actively abused to trigger denial-of-service (reboot loop) conditions.
Google released Chrome 142, addressing a high-severity out-of-bounds write vulnerability in WebGPU (CVE-2025-12725) that could permit remote code execution.
The Keras deep learning tool was found to contain a data exposure vulnerability (CVE-2025-12058), allowing arbitrary file loading and server-side request forgery (SSRF) attacks.
Security researchers identified vulnerabilities in AI infrastructure products Ollama and Nvidia, including one that enables remote code execution.

Notable Threat Actor Activity

A China-linked threat actor targeted a U.S. non-profit using legacy vulnerabilities such as Log4j and IIS for long-term espionage and persistence, as part of broader campaigns against U.S. entities.
The LANDFALL Android spyware was deployed in targeted attacks against Samsung Galaxy users in the Middle East, exploiting a zero-day to access device cameras, microphones, location, and data.
Russian state-sponsored groups escalated cyber operations against Ukraine and its European partners, focusing on destructive attacks in the grain sector.
AI-fueled phishing attacks are surging in Africa, with Microsoft and Group-IB reporting increased sophistication and volume.
Malicious apps impersonating AI tools like ChatGPT and DALL-E are being distributed to deliver malware on mobile devices.
A phishing campaign is using invisible hyphens and other invisible Unicode characters in emails to evade security filters.
The Gootloader malware campaign has resurfaced, continuing to target organisations globally.

Trends, Tools, or Tactics of Interest

Malicious NuGet packages were discovered with hidden logic bombs set to detonate in 2027 and 2028, designed to sabotage databases and Siemens S7 industrial control systems via time-delayed payloads.
Visual Studio Code extensions with ransomware-like features, including data encryption and exfiltration, were published openly, with evidence of AI-generated code.
ClickFix phishing campaigns are evolving, now including embedded tutorial videos and tailored prompts for macOS users to increase infection success rates.
Fake CAPTCHA sites are using instructional videos to guide victims through malware installation.
ID verification laws are driving organisations to store large volumes of sensitive data, increasing the risk and impact of breaches.
AI security agents and synthetic personas are being introduced for security operations centres, raising new governance and risk considerations.
AI agents are being mismanaged due to the misapplication of human identity frameworks, potentially leading to high-speed automated incidents.

Regulatory or Policy Developments Affecting the Security Industry

Google’s $32 billion acquisition of Wiz has cleared DOJ antitrust review, pending further regulatory approvals.
Google launched a new feature on Google Maps allowing businesses to report extortion attempts involving fake negative reviews.
Germany is taking measures against the use of Huawei technology in critical national infrastructure, with additional operational technology security guidance following an F5 hack.
Microsoft announced a partnership with UAE-based G42 to build a 5-gigawatt AI campus, prompting security concerns regarding data handling and geopolitical implications.

Huawei on DanSec Daily

Cybersecurity Brief – 2026-03-25

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments

Cybersecurity Brief – 2025-11-08

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry