DFIRLab
All Briefings
weeklyMarch 16, 2026 — March 23, 2026Published 07:00 UTC

Weekly Threat Briefing — 2026-03-16 to 2026-03-23

35 findings82 articles6 sections

Subscribe
Critical findings
0
High findings
0
CISA KEV additions
0
First seen in this period
82 Articles601 CVEs11,139 IOCs

First seen in this period: news articles, each counted once · CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · CISA KEV catalog additions · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.

Priority queue

Act on these first

Critical and high findings from this briefing and its live updates. Most severe first, then newest.

Showing 10 of 20
Browse all 35 findings

Executive summary · as of 07:00 UTC

The situation

The period from March 16-23, 2026 saw significant threat activity across multiple attack vectors. Critical infrastructure exploitation dominated the threat landscape, with ransomware actors weaponizing zero-day vulnerabilities in Cisco Secure Firewall Management Center (CVE-2026-20131) since January, and APT28 targeting Ukrainian government entities via Zimbra flaws. Law enforcement achieved a major victory with the FBI seizure of Handala hacktivist group infrastructure following a destructive attack on Stryker medical devices. Nation-state threats intensified with the proliferation of the DarkSword iOS exploit chain targeting government officials and the Lazarus Group's Bluenoroff conducting cryptocurrency theft operations. The discovery of PolyShell, a critical unauthenticated RCE vulnerability affecting all Magento 2 installations, poses immediate risk to e-commerce platforms. Organizations face an elevated threat environment requiring immediate patching of actively exploited vulnerabilities in Cisco, Zimbra, SharePoint, and Ubiquiti products, while Apple users should update to address multiple buffer overflow vulnerabilities being exploited by sophisticated adversaries.

Browse the full briefing

35 findings · 6 sections
Findings by severity
  • 6 critical
  • 14 high
  • 13 medium
  • 2 info
Vulnerabilities5 critical · 3 high

Critical Vulnerabilities and Active Exploitation

Multiple critical vulnerabilities are under active exploitation, including zero-day attacks on Cisco Secure Firewall and a newly disclosed Magento RCE flaw.

Threat Actors1 critical · 4 high

Nation-State and Organized Cybercrime Activity

Advanced persistent threat groups and ransomware operators conducted sophisticated campaigns targeting government, healthcare, and financial sectors.

Malware4 high · 3 medium

Emerging Malware Threats and Attack Campaigns

New malware families and sophisticated attack frameworks emerged targeting mobile devices, containers, and enterprise systems.

Tools & Techniques1 high · 5 medium

Attack Techniques and Tactical Developments

Sophisticated attack methodologies emerged including AI-targeted exploits, font rendering tricks, and credential theft campaigns.

Policy2 medium · 2 info

Policy Updates and Regulatory Actions

Government agencies and major technology companies announced significant policy updates and enforcement actions.

DFIR Lab2 high · 3 medium

Data Breaches and Security Incidents

Multiple organizations disclosed significant data breaches affecting millions of individuals.

Sources & Attribution

These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.

CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.