Cybersecurity Brief – 2026-03-12

Thu, 12 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Stryker, a global medical technology company, was impacted by a wiper malware attack attributed to the Iran-linked Handala hacktivist group. The attackers claim to have wiped more than 200,000 devices, severely disrupting operations.
Michelin confirmed a data breach linked to an Oracle EBS attack, with cybercriminals leaking over 300GB of allegedly stolen files.
Bell Ambulance reported a data breach affecting 238,000 individuals, with stolen personal information including names, Social Security numbers, and driver’s license numbers.
Meta disabled over 150,000 accounts associated with scam centers in Southeast Asia as part of a coordinated global crackdown, and reported the removal of 10.9 million Facebook and Instagram accounts linked to criminal scam centers in the past year.

Two critical remote code execution (RCE) vulnerabilities in the n8n workflow automation platform were disclosed and patched. The flaws allow arbitrary command execution and exposure of stored credentials. CISA has added the RCE bug to its Known Exploited Vulnerabilities (KEV) catalog and ordered US federal agencies to patch affected systems, with over 24,700 instances still exposed.
An SQL injection vulnerability was identified in the Elementor Ally WordPress plugin, impacting over 250,000 sites and enabling potential theft of sensitive data.
CVE-2026-0866 (“Zombie Zip”) was published, affecting ZIP file processing.
Microsoft’s March Patch Tuesday addressed 84 vulnerabilities, including two publicly known zero-days and eight critical-rated issues. Vulnerabilities could allow privilege escalation and cause service crashes.
SAP released updates for two critical vulnerabilities enabling arbitrary code execution.
Fortinet, Ivanti, and Intel issued patches for high-severity vulnerabilities that could result in arbitrary code execution, privilege escalation, or authentication rate-limit bypass.

The Iran-linked Handala group claimed responsibility for the wiper attack on Stryker, targeting over 200,000 devices.
The PhantomRaven supply-chain campaign launched a new wave of attacks on the npm registry, using 88 malicious packages to exfiltrate sensitive developer data.
Attackers compromised the xygeni/xygeni-action GitHub Action via tag poisoning, maintaining an active command-and-control implant for up to a week.
Chinese state-linked actors shifted focus to Qatari entities in response to Iranian conflict, conducting at least two targeted attacks.

Ransomware attacks surged by 50% in 2025, but the proportion of victims paying ransoms reached an all-time low.
Agentic web browsers, such as Perplexity’s Comet AI Browser, were demonstrated to be susceptible to phishing attacks in under four minutes, highlighting risks with AI-driven autonomous browsing.
Phishing campaigns are leveraging IPv6 tricks to obscure malicious links in emails, as seen in recent “free toothbrush” scams impersonating United Healthcare.
Sextortion emails are incorporating real passwords harvested from disposable inboxes to increase credibility.
Robocall scams are targeting individuals during tax season with fake relief program offers.
Meta introduced new anti-scam protections across WhatsApp, Facebook, and Messenger, including user-facing warnings and enhanced detection systems.
WhatsApp launched parent-managed accounts for pre-teens, providing parents with control over contacts and group participation.
Vulnerability management is evolving towards continuous telemetry, contextual prioritization, and agentic remediation in response to the increasing use of AI and autonomous agents in exploitation.

The US Senate confirmed Joshua Rudd as head of both the NSA and US Cyber Command under the “dual-hat” leadership structure.
CISA mandated federal agencies to patch the actively exploited n8n RCE vulnerability.
Google completed its acquisition of cloud security firm Wiz, which will retain its brand under Google Cloud.