Cybersecurity Brief – 2026-03-24

Tue, 24 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Mazda disclosed a security incident detected in December that exposed information belonging to employees and business partners.
Crunchyroll is investigating claims of a data breach in which hackers allege theft of personal information for approximately 6.8 million users.
Trio-Tech, a semiconductor services firm, reported a ransomware attack on a subsidiary in Singapore, resulting in file encryption.
Navia Benefit Solutions, a U.S.-based employee benefits provider, was listed among recent victims in threat intelligence bulletins.
Microsoft is addressing an ongoing issue affecting Exchange Online, intermittently preventing access to mailboxes via Outlook mobile and Mac desktop clients.
Microsoft released emergency update KB5085516 to fix an issue breaking Microsoft account sign-ins across multiple apps, including Teams and OneDrive.

Newly Discovered Vulnerabilities

Citrix released patches for two vulnerabilities in NetScaler ADC and NetScaler Gateway, including a critical flaw that could allow unauthenticated data leaks.
QNAP patched four vulnerabilities exploited at Pwn2Own, which could enable attackers to access sensitive information, execute code, or cause unexpected behavior.
CISA ordered U.S. federal agencies to patch three iOS vulnerabilities exploited in attacks involving the DarkSword exploit kit, linked to cryptocurrency theft and espionage.
Multiple attack vectors were identified in AWS Bedrock, Amazon’s AI application platform, which could allow attackers to access enterprise data and systems.

Notable Threat Actor Activity

The Tycoon2FA phishing-as-a-service platform resumed full operations after a law enforcement takedown, with attack volumes and tactics returning to previous levels.
North Korean threat actors (WaterPlum/Contagious Interview) were observed abusing Visual Studio Code auto-run tasks to deploy StoatWaffle malware via malicious Microsoft Visual Studio project files.
TeamPCP group conducted wiper attacks targeting Kubernetes clusters configured for Iranian systems, using malicious scripts to wipe machines. The group was also behind the Trivy supply chain attack, distributing info-stealer malware via Docker Hub and compromising Aqua Security’s GitHub repositories.
The FBI issued a warning about Iranian Handala hackers using Telegram to facilitate malware attacks.
Attackers are using phishing campaigns with copyright infringement notices to deliver info-stealer malware, targeting sectors including healthcare, government, hospitality, and education.
A financially motivated group deployed the “CanisterWorm” wiper, spreading through poorly secured cloud services and targeting systems in Iran.
Microsoft reported an IRS-themed phishing campaign impacting 29,000 users, using urgency and tax season themes to deploy remote monitoring and management (RMM) malware and harvest credentials.

Trends, Tools, or Tactics of Interest

The Trivy supply chain attack demonstrated the risk of compromised open-source security tools, with attackers deploying info-stealers to steal cloud credentials, SSH keys, tokens, and sensitive secrets from CI/CD environments.
Ransomware operators are increasingly leveraging AI to accelerate attacks, bypass security controls, exploit valid credentials, and target data more efficiently.
The Mandiant M-Trends 2026 report highlighted that the time for initial access handoff between threat actors has shrunk from hours to as little as 22 seconds.
AI-generated phishing emails are becoming more sophisticated, with urgency and time pressure replacing traditional red flags such as poor grammar or spelling.
Security researchers observed the use of malicious Docker images and hijacked GitHub repositories to propagate malware in developer environments.
Attackers are mimicking official app stores with over 1,500 fake sites to distribute unvetted gambling apps.
Google announced “Advanced Flow” to make Android sideloading safer by slowing down scam-driven installs.

Regulatory or Policy Developments

CISA mandated immediate patching of actively exploited iOS vulnerabilities by U.S. federal agencies.
The FBI’s warning regarding the use of Telegram by Iranian threat actors signals ongoing law enforcement focus on encrypted communications in cyber operations.
OpenAI introduced a ‘Library’ feature for ChatGPT, allowing users to store personal files and images on OpenAI’s cloud, raising considerations for data security and privacy.
The RSAC 2026 Conference pre-event announcements included new security solutions and discussions on the role of humans in AI-powered security, with debate over the necessity of a “human in the loop.”

Cybersecurity Brief – 2025-11-25

Tue, 25 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

SitusAMC, a major real-estate finance services provider, disclosed a data breach impacting customer data.
Harvard University reported a compromise of its Alumni Affairs and Development systems via a voice phishing attack, resulting in exposure of personal data of students, alumni, donors, and staff.
Delta Dental of Virginia suffered a breach affecting 146,000 individuals, with names, Social Security numbers, ID numbers, and health information stolen from a compromised email account.
Spanish airline Iberia notified customers of a data breach following claims of 77GB of stolen data.
Multiple organisations, including Canon, Cox, and Mazda, have been named as victims in the Oracle E-Business Suite (EBS) extortion campaign, with Cox confirming over 1.6 TB of data was stolen and Canon confirming subsidiary impact. Mazda reported no data leakage or operational impact.
Illegal streaming devices (e.g., Superbox, modded Amazon Fire TV Sticks) have been implicated in widespread scams, data theft, and integration into botnets.
Russian-linked threat actors are distributing StealC V2 infostealer malware via malicious Blender 3D model files uploaded to online marketplaces.
CISA issued a warning about active spyware campaigns targeting high-value Signal and WhatsApp users, leveraging commercial spyware and remote access trojans (RATs).

Newly Discovered Vulnerabilities

Five vulnerabilities have been identified in Fluent Bit, a widely used open-source telemetry agent, which can be chained to achieve remote code execution and stealthy intrusions into cloud infrastructure.
A critical flaw in Oracle Identity Manager (CVE-2025-61757) is under active exploitation and has been added to CISA’s Known Exploited Vulnerabilities catalog.
New Chrome and Fortinet zero-day vulnerabilities were reported as being actively exploited.
Microsoft confirmed a critical bug in Windows 11 24H2 causing File Explorer and Start Menu crashes when provisioning systems with cumulative updates.
Issues with URL mapping and URL-based access control continue to present high-profile vulnerabilities, notably in Oracle Identity Manager.
The Ray framework, used in AI clusters, has an exploitable flaw being used to hijack infrastructure for cryptomining and data theft.

Notable Threat Actor Activity

A new wave of Shai-Hulud malware attacks is targeting the npm registry, infecting over 500 packages (including well-known names like Zapier and Postman) and leaking secrets on GitHub. The campaign now executes malicious code during the preinstall phase, increasing exposure risks in build and runtime environments.
Threat actors are exploiting Black Friday by distributing phishing emails, scams, and malware targeting online shoppers and gamers. They are also selling stolen data and compromised accounts on the dark web.
The “ClickFix” attack uses a fake Windows Update animation in browsers to trick users and deliver malware, with the payload hidden in image files.
Matrix Push C2 is abusing browser push notifications to deliver realistic phishing and malware alerts.
CrowdStrike terminated an insider who aided hackers in falsely claiming a system breach by sharing internal screenshots.
The “Scattered LAPSUS$ Hunters” group continues to be active, according to recent threat intelligence reporting.

Trends, Tools, or Tactics of Interest

Vision language models are being advanced for physical security applications, enhancing employee safety monitoring.
Amazon has deployed an Autonomous Threat Analysis system using specialised AI agents for automated bug detection and remediation.
Research shows that the Chinese DeepSeek-R1 AI model generates insecure code, particularly when prompted with topics related to Tibet or Uyghurs.
Microsoft highlighted security risks introduced by new agentic AI features, warning that AI agents could perform malicious actions without proper controls.
Increased use of cloud-native patching is being advocated due to limitations and deprecation of traditional tools (SCCM and WSUS) in hybrid work environments.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced the removal of Windows Internet Name Service (WINS) support from Windows Server releases starting November 2034.
CISA’s alert and addition of Oracle Identity Manager’s CVE-2025-61757 to the KEV catalog increases urgency for remediation across affected organisations.

Mazda on DanSec Daily

Cybersecurity Brief – 2026-03-24

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments

Cybersecurity Brief – 2025-11-25

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry