Weekly Threat Briefing — 2026-03-09 to 2026-03-16
41 findings104 articles7 sections
- Critical findings
- 0
- High findings
- 0
- CISA KEV additions
- 0
- First seen in this period
- 104 Articles545 CVEs9,534 IOCs
First seen in this period: news articles, each counted once · CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · CISA KEV catalog additions · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.
Priority queue
Act on these first
Critical and high findings from this briefing and its live updates. Most severe first, then newest.
- Critical severitySection VulnerabilitiesSource: KEV
- Critical severityIvanti Endpoint Manager Authentication Bypass (CVE-2026-1603)Section VulnerabilitiesSource: KEV
- Critical severityn8n Workflow Remote Code Execution (CVE-2025-68613)Section VulnerabilitiesSource: KEV
- Critical severitySection VulnerabilitiesSource: RSS
- Critical severityGNU inetutils telnetd Buffer Overflow (CVE-2026-32746)Section VulnerabilitiesSource: CVE
- Critical severitySection Threat ActorsSource: RSS
- Critical severitySection VulnerabilitiesSource: RSS
- High severitySolarWinds Web Help Desk Deserialization Vulnerability (CVE-2025-26399)Section VulnerabilitiesSource: KEV
- High severitySection VulnerabilitiesSource: RSS
- High severitySection VulnerabilitiesSource: RSS
Executive summary · as of 08:44 UTC
The situation
The period from March 9-16, 2026 witnessed a convergence of high-severity threats requiring immediate organizational attention. Two critical Chrome zero-day vulnerabilities (CVE-2026-3909, CVE-2026-3910) were actively exploited, prompting emergency patching from Google. Supply chain attacks escalated with the AppsFlyer Web SDK hijacking and malicious Steam games distributing malware. CISA added six vulnerabilities to the KEV catalog, including critical authentication bypass in Ivanti Endpoint Manager and n8n RCE flaws. Law enforcement actions disrupted the SocksEscort proxy network and sinkholed 45,000 IP addresses linked to cybercrime operations. The Iranian threat actor Handala Hack intensified wiper attacks via phishing and Microsoft Intune abuse, while China-linked espionage operations targeted military entities in Southeast Asia. Critical infrastructure remained vulnerable with Veeam Backup & Replication RCE flaws and telnetd buffer overflow affecting GNU inetutils. Multiple organizations disclosed significant breaches, including Telus Digital (claiming 1 petabyte stolen), Starbucks employee data exposure, and Canadian retail giant Loblaw customer information compromise.
The threat landscape shows adversaries exploiting both zero-day vulnerabilities and supply chain weaknesses with increasing sophistication. Commercial spyware policy uncertainty in the US, combined with AI-generated malware (Slopoly) in ransomware attacks, demonstrates evolving attacker capabilities. The disruption of cybercriminal infrastructure through Operation Synergia III represents positive enforcement action, yet persistent threats from state-sponsored actors and financially-motivated groups continue. Organizations must prioritize immediate patching of Chrome, Veeam, and other critical vulnerabilities while implementing enhanced supply chain security controls and multi-factor authentication hardening.
Defensive priorities include: emergency Chrome updates across enterprise environments, review of backup infrastructure for Veeam vulnerabilities, enhanced monitoring for credential theft targeting VPN solutions, validation of software supply chain integrity, and preparation for post-quantum cryptography migration. The intersection of AI-enabled attacks, state-sponsored operations, and traditional cybercrime creates a complex threat environment requiring layered defensive strategies.
Browse the full briefing
41 findings · 7 sections- 7 critical
- 18 high
- 10 medium
- 6 info
- Vulnerabilities10 findingsCritical Vulnerabilities & Zero-Days5 critical · 5 high
- Malware8 findingsMalware Campaigns & Supply Chain Attacks5 high · 3 medium
- Threat Actors4 findingsState-Sponsored & Advanced Threat Actor Activity1 critical · 3 high
- Tools & Techniques5 findingsAttacker Tools, Techniques & Infrastructure Disruption1 high · 3 medium · 1 info
- Vulnerabilities5 findingsData Breaches & Incident Disclosures1 critical · 3 high · 1 medium
- Policy4 findingsPolicy, Compliance & Industry Concerns1 high · 3 medium
- DFIR Lab5 findingsDetection, Forensics & Security Operations5 info
Critical Vulnerabilities & Zero-Days
Multiple critical vulnerabilities require immediate patching, including actively exploited Chrome zero-days and authentication bypass flaws affecting enterprise infrastructure.
- Critical severityGoogle Chrome Zero-Days Exploited in Active Attacks (CVE-2026-3909, CVE-2026-3910) (opens the source in a new tab)
Google released emergency patches for two high-severity Chrome vulnerabilities under active exploitation: CVE-2026-3909 (Skia out-of-bounds write) and CVE-2026-3910 (Chromium V8 improper memory buffer restriction). Both allow remote code execution via crafted HTML pages and affect multiple Chromium-based browsers, Android, Flutter, and ChromeOS.
- Critical severityIvanti Endpoint Manager Authentication Bypass (CVE-2026-1603)
Ivanti EPM contains an authentication bypass vulnerability using alternate path that allows remote unauthenticated attackers to leak specific stored credential data. Added to CISA KEV catalog indicating active exploitation or significant threat.
- Critical severityn8n Workflow Remote Code Execution (CVE-2025-68613)
n8n workflow automation platform vulnerable to improper control of dynamically managed code resources in expression evaluation system, enabling remote code execution. Critical risk for organizations using n8n for automation workflows.
- Critical severityVeeam Backup & Replication Critical RCE Flaws (opens the source in a new tab)
Veeam patched multiple vulnerabilities including four critical remote code execution flaws in Backup & Replication solution. Backup servers are high-value targets for ransomware operators seeking to prevent recovery.
- Critical severity
- High severity
- High severityMicrosoft Authenticator Code Leakage Vulnerability (opens the source in a new tab)
Bug in Microsoft Authenticator on Android and iOS could allow malicious apps on same device to intercept authentication codes or sign-in links, bypassing multi-factor authentication protections.
- High severityAndroid Lock Screen Bypass Under 60 Seconds (opens the source in a new tab)
Researchers demonstrated vulnerability allowing attackers to pull encryption keys, recover PINs, and access sensitive data from affected Android devices within one minute of physical access.
- High severityApple Patches Coruna Exploit Kit Vulnerabilities (opens the source in a new tab)
Apple released security updates for older iOS and iPadOS versions to address vulnerabilities exploited by Coruna exploit kit in cyberespionage and crypto-theft attacks.
- High severityMultiple WordPress Plugin SQL Injection Vulnerabilities
Numerous WordPress plugins affected by blind SQL injection vulnerabilities including WP EasyCart, Media Library Assistant, Booking Calendar, and WP ERP. Several rated CVSS 8.5 high severity allowing unauthorized data access.
Malware Campaigns & Supply Chain Attacks
Sophisticated supply chain compromises and malware distribution campaigns targeting cryptocurrency users, gamers, and enterprise VPN clients.
- High severityAppsFlyer Web SDK Supply Chain Attack (opens the source in a new tab)
AppsFlyer Web SDK temporarily hijacked with malicious JavaScript code designed to steal cryptocurrency. Supply chain attack affecting websites implementing the compromised SDK version.
- High severityAI-Generated Slopoly Malware in Interlock Ransomware Attack (opens the source in a new tab)
New malware strain 'Slopoly', likely created using generative AI tools, enabled threat actors to maintain persistence for over one week on compromised server, facilitating data theft in Interlock ransomware operation.
- High severityStorm-2561 Fake Enterprise VPN Client Distribution (opens the source in a new tab)
Threat actor Storm-2561 distributing fake VPN clients for Ivanti, Cisco, and Fortinet via SEO poisoning to steal corporate VPN credentials. Uses signed trojans and mimics trusted brands while abusing legitimate services.
- High severityFake Temu Coin Airdrop ClickFix Campaign (opens the source in a new tab)
Fake $TEMU cryptocurrency airdrop uses ClickFix social engineering trick to make victims execute malware themselves, installing stealthy remote-access backdoor for persistent access.
- High severityReal-Time Banking Trojan Targeting Brazil Pix Users (opens the source in a new tab)
Banking trojan campaign combines classic malware with real-time human operator, waiting for opportune moments to strike Brazilian Pix instant payment users during active sessions.
- Medium severityFBI Investigation: Malicious Steam Games Distribution (opens the source in a new tab)
FBI seeking victims of eight malicious games uploaded to Steam platform containing malware. Demonstrates gaming platforms as attack vector for widespread malware distribution.
- Medium severity
- Medium severity
State-Sponsored & Advanced Threat Actor Activity
Increased Iranian wiper attacks and China-linked espionage operations demonstrate persistent state-sponsored threats with strategic targeting.
- Critical severityHandala Hack Escalates Wiper Attacks via Microsoft Intune (opens the source in a new tab)
Iran-linked Handala Hack group (Void Manticore) increasing wiper attack frequency through phishing and abuse of Microsoft Intune for deployment. Targeting critical infrastructure with destructive capabilities.
- High severityChina-Based Military Espionage in Southeast Asia (opens the source in a new tab)
Suspected Chinese espionage operation demonstrated strategic operational patience against military targets in Southeast Asia, deploying custom backdoors with long-term persistence objectives.
- High severityIranian MOIS Collaborating with Cybercriminals (opens the source in a new tab)
Iranian Ministry of Intelligence and Security (MOIS) increasingly working with actual cybercriminal groups rather than just pretending to be criminal actors, blurring lines between state-sponsored and criminal operations.
- High severityStorm-2561 SEO Poisoning Campaign (opens the source in a new tab)
Active since 2025, Storm-2561 uses search engine optimization poisoning to distribute fake enterprise VPN clients for credential harvesting. Microsoft published detailed TTPs, IOCs, and mitigation guidance.
Attacker Tools, Techniques & Infrastructure Disruption
Law enforcement actions disrupted major cybercrime infrastructure while adversaries demonstrate evolving techniques including prompt injection and AI-generated malware.
- High severityGoogle Cloud Attacks Primarily Via Bug Exploitation (opens the source in a new tab)
Vulnerability exploitation now surpasses stolen credentials and misconfigurations as primary cause of Google Cloud compromises. AI-assisted attacks enable exploits faster than patching cycles.
- Medium severitySocksEscort Proxy Network Disrupted (opens the source in a new tab)
US and European law enforcement disrupted SocksEscort cybercrime proxy network powered by AVRecon malware compromising Linux edge devices for anonymized malicious traffic routing.
- Medium severityPrompt Injection Attacks Against AI Tools (opens the source in a new tab)
Microsoft documented how hidden instructions in content can subtly bias AI systems. Prompt injection attacks enable manipulation of AI tool outputs, requiring oversight and structured response playbooks.
- Medium severityClickFix Social Engineering Technique Evolution (opens the source in a new tab)
ClickFix trick continues evolution, convincing users to manually execute malicious code by disguising it as legitimate troubleshooting steps. Used in Temu cryptocurrency scam campaign.
- Info severityOperation Synergia III Disrupts Cybercrime Infrastructure (opens the source in a new tab)
International law enforcement operation sinkholed 45,000 IP addresses and seized servers linked to cybercrime operations worldwide, representing significant disruption to criminal infrastructure.
Source: RSS
Data Breaches & Incident Disclosures
Multiple high-profile organizations disclosed significant data breaches affecting employees, customers, and sensitive operational data.
- Critical severityTelus Digital Confirms Petabyte-Scale Data Breach (opens the source in a new tab)
Canadian BPO giant Telus Digital confirmed security incident after threat actors claimed theft of nearly 1 petabyte of data over multi-month breach period. Massive scale suggests extensive compromise.
- High severityStarbucks Employee Data Breach (opens the source in a new tab)
Starbucks disclosed data breach affecting hundreds of employees after threat actors compromised Starbucks Partner Central accounts, accessing employee personal information.
- High severityCanadian Loblaw Customer Data Breach (opens the source in a new tab)
Major Canadian retail giant Loblaw notified customers of data breach, automatically logging out all customers from accounts as precautionary measure. Full scope of compromise under investigation.
- High severityEngland Hockey Ransomware Attack (opens the source in a new tab)
England Hockey investigating potential data breach after AiLock ransomware gang listed organization as victim on leak site. Sports organizations increasingly targeted by ransomware operators.
- Medium severityPoland Nuclear Research Centre Cyberattack (opens the source in a new tab)
Poland's National Centre for Nuclear Research (NCBJ) targeted by cyberattack on IT infrastructure. Attack detected and blocked before impact, but highlights critical infrastructure targeting.
Source: RSS
Policy, Compliance & Industry Concerns
Regulatory uncertainty around commercial spyware, nonprofit security challenges, and post-quantum cryptography preparation emerge as key policy concerns.
- High severityRansomware Negotiator Charged in BlackCat Scheme (opens the source in a new tab)
DOJ charged former DigitalMint employee for involvement in insider scheme where ransomware negotiators secretly partnered with BlackCat (ALPHV) ransomware operation, compromising victim recovery efforts.
Source: RSS - Medium severityUS Commercial Spyware Policy Uncertainty (opens the source in a new tab)
Rescinded sanctions and reactivated contracts create confusion about Trump administration's commercial spyware policy direction. Opponents fear shifting stance on use of surveillance technology.
Source: RSS - Medium severityNonprofit Sector Cyber Incident Underreporting (opens the source in a new tab)
Threat actors increasingly target nonprofits due to security gaps and valuable data, but lack of sufficient reporting makes it difficult to understand full scope. Data gap hampers defensive efforts.
Source: RSS - Medium severityPost-Quantum Cryptography Urgency (opens the source in a new tab)
Organizations must prepare cryptographic infrastructure for post-quantum world as quantum computing advances threaten current encryption standards. Migration cannot be delayed.
Source: RSS
Detection, Forensics & Security Operations
New detection capabilities, forensic techniques, and security operations insights emerge to support defenders.
- Info severityElastic Security Detection Rules via Terraform (opens the source in a new tab)
Elastic published guidance on defining and deploying detection rules and exceptions using Elastic Stack Terraform Provider versus detection-rules repository capabilities, enabling infrastructure-as-code approach.
Source: RSS - Info severityMicrosoft Email Security Benchmark Insights (opens the source in a new tab)
Latest Microsoft benchmarking data reveals how Microsoft Defender mitigates modern email threats compared to SEG and ICES vendors, providing transparency into comparative detection capabilities.
Source: RSS - Info severityVehicle Data for Forensic Occupant Analysis (opens the source in a new tab)
Berla demonstrates how vehicle data including door, seat, and seatbelt events can reconstruct occupant activity and timelines for investigative purposes, expanding digital forensics capabilities.
Source: RSS - Info severityEvent Log Archiving for Timeline Reconstruction (opens the source in a new tab)
Proactive event log archiving essential for reliable timeline reconstruction in digital investigations. Missing logs mean missing evidence in incident response and forensic analysis.
Source: RSS - Info severityGoogle VRP Paid $17.1M in 2025 (opens the source in a new tab)
Google paid over $17 million to 747 security researchers through Vulnerability Reward Program in 2025, demonstrating continued investment in coordinated vulnerability disclosure.
Source: RSS
Sources & Attribution
These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.
CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.