Cybersecurity Brief – 2026-03-04

Wed, 04 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

AkzoNobel, a multinational paint company, confirmed a cyberattack that breached the network of one of its U.S. sites.
LexisNexis Legal & Professional confirmed a data breach involving unauthorized access to customer and business information, with stolen files leaked by attackers.
Cloud Imperium Games (developer of Star Citizen) disclosed a breach in January affecting systems containing user personal data.
The University of Hawaii Cancer Center reported a ransomware attack in August 2025 that compromised personal and health data of nearly 1.2 million individuals.
Amazon confirmed that drone strikes damaged three AWS data centers in the United Arab Emirates and one in Bahrain, resulting in significant outages.
Facebook experienced a worldwide outage, rendering accounts inaccessible for a period.
Interpol, with support from private threat hunters, dismantled an African cybercrime syndicate, resulting in 574 arrests and the recovery of over $3 million.

Newly Discovered Vulnerabilities

VMware Aria Operations (CVE-2026-22719): A remote code execution vulnerability is being actively exploited in the wild. CISA has added it to the Known Exploited Vulnerabilities catalog.
Android/Qualcomm Zero-Day (CVE-2026-21385): An actively exploited high-severity memory corruption flaw in Qualcomm display components was patched in the latest Android update.
MS-Agent AI Framework: A vulnerability in Microsoft’s AI framework allows attackers to achieve full system compromise through improper input sanitization, exploitable via the Shell tool.
Chrome Extension Flaw: A now-patched vulnerability allowed Chrome extensions to inherit Gemini’s camera, microphone, and file access permissions.
AirSnitch Wi-Fi Attack: Researchers disclosed a Wi-Fi vulnerability (“AirSnitch”) that allows nearby attackers to intercept sensitive data and perform machine-in-the-middle attacks, demonstrating that Wi-Fi client isolation may not provide adequate protection.
Honeywell IQ4 Building Controllers: Dispute over the impact of vulnerabilities in internet-exposed building management controllers, with researchers claiming thousands are at risk.
CrushFTP: Ongoing brute-force scans reported against CrushFTP instances, which have a history of serious vulnerabilities.

Notable Threat Actor Activity

Fake IT Support/Havoc C2: Threat actors are using fake tech support spam to deploy customized Havoc command-and-control (C2) frameworks inside organizations, enabling data exfiltration and persistence.
OAuth Redirect Abuse: Microsoft warned of phishing campaigns abusing OAuth URL redirection and error flows to bypass email and browser phishing protections, delivering malware to government targets.
Starkiller Phishing Suite: A new phishing toolkit, Starkiller, uses adversary-in-the-middle (AitM) reverse proxy techniques to bypass multi-factor authentication.
Compromised Site Management Panels: Sale of compromised cPanel credentials is surging in cybercrime markets, facilitating plug-and-play phishing and scam operations.
Pro-Iranian Cyber Activity: Increased hacktivist campaigns and cyberattacks attributed to pro-Iranian actors in response to US-Israeli military actions, with an emphasis on causing economic and physical disruption.
Iranian Targeting of IP Cameras: Iranian-linked cyber operations are targeting IP cameras in conjunction with physical warfare in the Middle East.
Silver Dragon: A Chinese-aligned threat group, “Silver Dragon,” is targeting organizations in Southeast Asia and Europe, demonstrating operational links to broader campaigns.
AI-Driven FortiGate Attacks: Threat actors are leveraging the open-source CyberStrikeAI platform in AI-assisted attacks targeting Fortinet FortiGate appliances across 55 countries.
Coruna iPhone Hacking Toolkit: A sophisticated iPhone exploitation toolkit, believed to have originated from a US government contract, is now in the hands of foreign spies and criminals and has likely compromised tens of thousands of devices.

Trends, Tools, or Tactics of Interest

RMM Tool Phishing: Fake video meeting invites are being used to trick users into installing remote monitoring and management (RMM) tools, enabling unauthorized access.
AI Agent and Identity Risks: The rise of Model Context Protocol (MCP) and AI agents is introducing new, unmanaged workload identities, increasing the complexity of identity management and potential attack surfaces.
Quantum Threat to RSA: Recent developments indicate quantum decryption of RSA may be achievable sooner than previously expected, raising concerns over the security of current cryptographic standards.
AI in Security Testing: The deployment of open-source, AI-native security testing platforms is being observed in active cyberattacks, particularly against network appliances.
cPanel Marketplaces: The commoditization of compromised site management credentials is enabling scalable, automated phishing attacks.
Wi-Fi Client Isolation Limitations: AirSnitch research demonstrates that Wi-Fi client isolation may not prevent interception or manipulation of sensitive data.
Vehicle Tire Pressure Sensors: Research shows tire pressure sensors can leak data enabling silent tracking of vehicles.
Journalistic Operations in Censored Environments: Journalists in Iran are relying on satellite communications and encrypted apps to circumvent internet blackouts.

Regulatory or Policy Developments

CISA Action: The addition of VMware Aria Operations CVE-2026-22719 to CISA’s Known Exploited Vulnerabilities catalog mandates urgent mitigation for US federal agencies and highlights the vulnerability’s significance.
Pentagon AI Procurement: The US Department of Defense has dropped Anthropic AI from certain projects over security risks, with OpenAI taking over, reflecting ongoing scrutiny of AI model integration in sensitive environments.
Google Chrome Release Cycle: Google Chrome will move to a two-week release cycle, enabling faster deployment of security patches and features.

Cybersecurity Brief – 2026-01-12

Mon, 12 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Instagram has denied reports of a data breach after claims surfaced that data from over 17 million accounts was leaked online. The company stated that a bug enabling mass password reset email requests was identified and fixed, but asserts that no user passwords or sensitive data were exposed via a breach.
The University of Hawaii Cancer Center confirmed that hackers accessed patient data. The institution did not immediately notify affected individuals and has withheld details regarding the specific research project compromised and any ransom payments made to regain access.

Regulatory or Policy Developments

The California Privacy Protection Agency has taken enforcement action against Datamasters, a marketing firm that sold the health and personal data of millions of users without registering as a data broker. California has now banned data brokers from reselling health data, tightening regulatory controls over the handling and sale of sensitive personal information.

Trends, Tools, or Tactics of Interest

YARA-X version 1.11.0 has been released, introducing new hash function warnings to enhance detection capabilities for malware analysts and threat hunters.

University of Hawaii Cancer Center on DanSec Daily

Cybersecurity Brief – 2026-03-04

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments

Cybersecurity Brief – 2026-01-12

Major Incidents or Breaches

Regulatory or Policy Developments

Trends, Tools, or Tactics of Interest