Cyber Threat Intelligence 04 March 2026

NCSA_THAICERT

Healthcare Sector

Healthcare Organizations Are Accepting Cyber Risk To Cut Costs
"Healthcare organizations are cutting cybersecurity budgets under financial pressure even as the threats targeting their systems intensify. A PwC survey of 381 global healthcare executives, conducted between May and July 2025, puts numbers to the gap between the risks the sector faces and the controls it has in place. Data protection ranks as the single biggest driver of cybersecurity spending in the sector, yet only 35% of healthcare organizations have implemented data risk controls across the entire data life cycle. The global average across all sectors is 44%."
https://www.helpnetsecurity.com/2026/03/03/pwc-healthcare-cybersecurity-threats-2026/

Industrial Sector

Honeywell Trend IQ4xx BMS Controller Unauthenticated Remote Web-HMI Control And Lockout
"The Honeywell IQ4 (Trend IQ4) is a line of intelligent building-management controllers designed to provide advanced unitary control, HVAC integration, and scalable I/O expansion for commercial environments. These controllers use Ethernet and TCP/IP networking with embedded XML, support BACnet over IP, and can expand up to 192 I/O points depending on the model, making them suitable for a wide range of plant-control applications. They offer multiple communication ports (Ethernet, USB, RS232, Wallbus), optional Trend current-loop neworking, and seamless compatability with other Trend IQ controllers - enabling unified, energy-efficient building automation across devices."
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5979.php
https://www.securityweek.com/honeywell-researcher-clash-over-impact-of-building-controller-vulnerability/

Vulnerabilities

CISA Adds Two Known Exploited Vulnerabilities To Catalog
"CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
CVE-2026-21385 Qualcomm Multiple Chipsets Memory Corruption Vulnerability
CVE-2026-22719 Broadcom VMware Aria Operations Command Injection Vulnerability"
https://www.cisa.gov/news-events/alerts/2026/03/03/cisa-adds-two-known-exploited-vulnerabilities-catalog
https://www.bleepingcomputer.com/news/security/cisa-flags-vmware-aria-operations-rce-flaw-as-exploited-in-attacks/
Zenity Labs Discloses PleaseFix Vulnerability Family In Perplexity Comet And Other Agentic Browsers
"Zenity Labs today disclosed PleaseFix, a family of critical vulnerabilities affecting agentic browsers, including Perplexity Comet, that allow attackers to silently hijack AI agents, access local files and steal credentials within authenticated user sessions. The vulnerabilities can be triggered through malicious content embedded in routine workflows, enabling unauthorized actions without user awareness. The disclosure includes PerplexedBrowser, a subfamily of vulnerabilities in the Perplexity Comet browser that consists of two distinct exploit paths."
https://zenity.io/company-overview/newsroom/company-news/zenity-labs-discloses-pleasefix-perplexedagent-vulnerability
https://cyberscoop.com/agentic-ai-browsers-allow-hijacking-zenity-labs-comet/
https://www.theregister.com/2026/03/03/perplexity_comet_browser_hole_cal_invite/
New ‘AirSnitch’ Attack Shows Wi-Fi Client Isolation Could Be a False Sense Of Security
"Researchers from UC Riverside developed attacks able to bypass client isolation in Wi-Fi networks used at home, at work, in airports, and in coffee shops. Four computer scientists from Riverside, and one from KU Leuven (Belgium) found that every router and network they tested was vulnerable to at least one attack. Their findings are detailed in a paper (AirSnitch: Demystifying and Breaking Client Isolation in Wi-Fi Networks) presented at the NDSS Symposium 2026."
https://www.securityweek.com/new-airsnitch-attack-shows-wi-fi-client-isolation-could-be-a-false-sense-of-security/
https://www.ndss-symposium.org/wp-content/uploads/2026-f1282-paper.pdf
CVE-2026–2256: From AI Prompt To Full System Compromise
"AI agents are amazing coworkers. They read logs at 3 a.m., automate boring tasks, and never complain about documentation. Unfortunately, they also share one small flaw: when given too much autonomy, they can become exceptionally obedient — including obedient to attacker-controlled input. This research demonstrates how an MS-Agent, while simply doing what it was designed to do, can be quietly manipulated into executing arbitrary system commands and compromising its own host."
https://medium.com/@itamar.yochpaz/cve-2026-2256-from-ai-prompt-to-full-system-compromise-a4114c718326
https://www.securityweek.com/vulnerability-in-ms-agent-ai-framework-can-allow-full-system-compromise/

Malware

Exposing a Russian Campaign Targeting Ukraine Using New Malware Duo: BadPaw And MeowMeow
"ClearSky Team has identified a targeted Russian cyber campaign against Ukraine utilizing two novel malware strains, BadPaw and MeowMeow. The attack chain initiates with a phishing email containing a link to a ZIP archive. Once extracted, an initial HTA file displays a lure document written in Ukrainian concerning border crossing appeals to deceive the victim. Simultaneously, the infection triggers the download of BadPaw, a .NET-based loader. Upon establishing command-and-control (C2) communication, the loader deploys MeowMeow, a sophisticated backdoor."
https://www.clearskysec.com/russian-campaign-targeting-ukraine-badpaw-and-meowmeow/
Silver Dragon: China Nexus Cyber Espionage Group Targeting Governments In Asia And Europe
"Check Point Research has identified and tracked a cyber espionage campaign targeting government organizations across Southeast Asia and parts of Europe. We designate this activity cluster as Silver Dragon, which has been active since at least mid-2024. The campaign combines server exploitation, phishing, custom malware, and cloud-based command infrastructure to establish long-term access in targeted environments. Based on multiple converging indicators, Check Point Research assesses with high confidence that Silver Dragon is a China nexus threat actor, likely operating within the umbrella of APT41."
https://blog.checkpoint.com/research/silver-dragon-china-nexus-cyber-espionage-group-targeting-governments-in-asia-and-europe/
Coruna: The Mysterious Journey Of a Powerful iOS Exploit Kit
"Google Threat Intelligence Group (GTIG) has identified a new and powerful exploit kit targeting Apple iPhone models running iOS version 13.0 (released in September 2019) up to version 17.2.1 (released in December 2023). The exploit kit, named “Coruna” by its developers, contained five full iOS exploit chains and a total of 23 exploits. The core technical value of this exploit kit lies in its comprehensive collection of iOS exploits, with the most advanced ones using non-public exploitation techniques and mitigation bypasses."
https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit
https://iverify.io/press-releases/first-known-mass-ios-attack
https://cyberscoop.com/coruna-ios-exploit-kit-leaked-us-framework/
https://www.helpnetsecurity.com/2026/03/03/coruna-ios-exploit-kit/
Middle East On The Brink: Iran-US-Israel Hostilities Trigger Cyber-Kinetic Conflict
"The geopolitical landscape of the Middle East has entered one of its most volatile phases in decades. On February 28, 2026, tensions that had been simmering for years erupted into a full‑blown conflict involving the Islamic Republic of Iran, the United States, and Israel. A confluence of diplomatic stalemate, military posturing, and covert cyber preparations set the stage for what would evolve from a localized confrontation into an expansive, multi‑domain campaign."
https://cyble.com/blog/middle-east-iran-us-israel-hybrid-conflict/
Abusing .arpa: The TLD That Isn’t Supposed To Host Anything
"Phishing email campaigns are so common that it takes something fundamentally different to stand out. We recently found campaigns using a novel, previously unreported method to get around security controls. Actors are abusing the .arpa top-level domain (TLD), in conjunction with IPv6 tunnels, to host phishing content on domains that should not resolve to an IP address. Unlike familiar TLDs like .com and .net, that are used for domains that host web content, the .arpa TLD has a special role in the domain name system (DNS): it’s primarily used to map IP addresses to domains, providing reverse records. Threat actors have discovered a feature in the DNS record management control of certain providers, which allows them to add IP address records for .arpa domains. From there, they can do whatever they like at the hosting provider. It’s a pretty clever trick."
https://www.infoblox.com/blog/threat-intelligence/abusing-arpa-the-tld-that-isnt-supposed-to-host-anything/
https://hackread.com/hackers-arpa-top-level-domain-phishing-scams/
RedAlert Trojan Campaign: Fake Emergency Alert App Spread Via SMS Spoofing Israeli Home Front Command
"CloudSEK has uncovered a malicious SMS spoofing campaign spreading a fake version of Israel’s “Red Alert” emergency app amid the ongoing conflict. Disguised as a trusted warning platform, the trojanized Android app can steal SMS, contacts, and location data while appearing legitimate. The report highlights how cybercriminals are weaponising public fear during crises to deploy mobile spyware with serious security and real-world implications."
https://www.cloudsek.com/blog/redalert-trojan-campaign-fake-emergency-alert-app-spread-via-sms-spoofing-israeli-home-front-command
https://www.infosecurity-magazine.com/news/redalert-israel-spyware-campaign/
Fake Tech Support Spam Deploys Customized Havoc C2 Across Organizations
"Threat hunters have called attention to a new campaign as part of which bad actors masqueraded as fake IT support to deliver the Havoc command-and-control (C2) framework as a precursor to data exfiltration or ransomware attack. The intrusions, identified by Huntress last month across five partner organizations, involved the threat actors using email spam as lures, followed by a phone call from an IT desk that activates a layered malware delivery pipeline."
https://thehackernews.com/2026/03/fake-tech-support-spam-deploys.html
Fooling AI Agents: Web-Based Indirect Prompt Injection Observed In The Wild
"Large language models (LLMs) and AI agents are becoming deeply integrated into web browsers, search engines and automated content-processing pipelines. While these integrations can expand functionality, they also introduce a new and largely underexplored attack surface. One particularly concerning class of threats is indirect prompt injection (IDPI), in which adversaries embed hidden or manipulated instructions within website content that is later ingested by an LLM. This article shares in-the-wild observations from our telemetry, including our first observed case of AI-based ad review evasion."
https://unit42.paloaltonetworks.com/ai-agent-prompt-injection/
Active Reconnaissance Campaign Targets SonicWall Firewalls Through Commercial Proxy Infrastructure
"GreyNoise observed 84,142 scanning sessions targeting SonicWall SonicOS infrastructure between February 22 and February 25, 2026. The activity originated from 4,305 unique IP addresses across 20 autonomous systems, with three operationally distinct infrastructure clusters executing coordinated VPN enumeration. Ninety-two percent of sessions probed a single API endpoint to determine whether SSL VPN is enabled — the prerequisite check before credential attacks. A commercial proxy service delivered 32% of campaign volume through 4,102 rotating exit IPs in two surgical bursts totaling 16 hours. CVE exploitation was negligible, confirming this as systematic attack surface mapping."
https://www.greynoise.io/blog/active-reconnaissance-campaign-targets-sonicwall-firewalls-through-commercial-proxy-infrastructure

Breaches/Hacks/Leaks

Paint Maker Giant AkzoNobel Confirms Cyberattack On U.S. Site
"The multinational Dutch paint company AkzoNobel has confirmed to BleepingComputer that hackers breached the network of one of its U.S. sites. Following a data leak from the Anubis ransomware gang, a company spokesperson said that the intrusion has been contained and that the impact is limited. “AkzoNobel has identified a security incident at one of our sites in the United States. The incident was limited to the respective site and was already contained,” the company told BleepingComputer."
https://www.bleepingcomputer.com/news/security/paint-maker-giant-akzonobel-confirms-cyberattack-on-us-site/
LexisNexis Confirms Data Breach As Hackers Leak Stolen Files
"American data analytics company LexisNexis Legal & Professional has confirmed to BleepingComputer that hackers breached its servers and accessed some customer and business information. The company's data breach confirmation comes as a threat actor named FulcrumSec leaked 2GB of files on various underground forums and sites. LexisNexis L&P is a global provider of legal, regulatory, and business information, research tools, and analytics used by lawyers, corporations, governments, and academic institutions in more than 150 countries worldwide."
https://www.bleepingcomputer.com/news/security/lexisnexis-confirms-data-breach-as-hackers-leak-stolen-files/
https://therecord.media/lexisnexis-says-hackers-accessed-legacy-data
Star Citizen Game Dev Discloses Breach Affecting User Data
"Cloud Imperium Games (CIG), the game company behind Star Citizen and Squadron 42, says attackers breached systems containing some users' personal information in January. The California-based publisher and video game developer was founded in 2012 by game developer Chris Roberts (of Wing Commander fame), and it operates five game studios with a crew of over 700 employees. In 2012, it announced the multiplayer space-simulation game Star Citizen. However, despite a Kickstarter campaign that raised over $2 million from backers, the game has still not exited its "early access" phase 14 years later."
https://www.bleepingcomputer.com/news/security/star-citizen-game-dev-discloses-breach-affecting-user-data/
Cyber Battlefield: Ariomex, Iran-Based Crypto Exchange, Suffers Data Leak
"Cyber operations against Iran are used not only to disrupt military capabilities but also to pressure senior regime officials and their associates to defect, and to accelerate regime change from within. Current events affect multiple layers of the Iranian regime, including the financial system, where the Iranian government invests substantial efforts in building tools to evade sanctions and finance illegal activity, including via cryptocurrencies. In January 2026, the Central Bank of Iran (CBI) acquired more than half a billion dollars (about $507 million) worth of Tether’s USDT, with indications that the stablecoins were used to prop up the country’s fiat currency."
https://www.resecurity.com/blog/article/cyber-battlefield-ariomex-iran-based-crypto-exchange-suffers-data-leak
https://www.infosecurity-magazine.com/news/iranian-crypto-leaked-database/
https://securityaffairs.com/188848/digital-id/ariomex-iran-based-crypto-exchange-suffers-data-leak.html
Cybercriminals Swipe 15.8M Medical Records From French Doctors Ministry
"Around 15.8 million administrative files were stolen after attackers breached a software supplier to France's health ministry. The supplier, Cegedim Santé, confirmed the data was compromised in late 2025. Approximately 165,000 of these files contained notes penned by doctors, which in "very limited cases" contained sensitive information about an individual's medical history. According to broadcaster France 24, which first reported the news, these medical histories included, in some cases, details of conditions such as HIV/AIDS and individuals' sexual orientations. Top politicians were reportedly among the individuals whose info was extracted."
https://www.theregister.com/2026/03/03/french_medical_leak/

General News

Compromised Site Management Panels Are a Hot Item In Cybercrime Markets
"Threat actors are openly advertising access to hacked websites as part of the underground economy. One of the most promising products is a compromised cPanel credential. They are sold in the thousands across at commodity-level pricing and marketed as plug-and-play infrastructure for and scam campaigns. In new research, Flare security researchers analyzed activity across monitored fraudulent groups over a seven-day period, showing a structured ecosystem operating at scale."
https://www.bleepingcomputer.com/news/security/compromised-site-management-panels-are-a-hot-item-in-cybercrime-markets/
AI Agent Overload: How To Solve The Workload Identity Crisis
"Authenticating workloads is becoming more and more complex, particularly given things like AI agents and the wide range of identity permissions they need. Organizations need to be thinking ahead on securing workloads in complicated modern environments, but it's not an easy task. Researchers at Zscaler hope to explore this evolution in an upcoming RSAC 2026 Conference session entitled, "What Are You, Really? Authenticating Workloads in a Zero Trust World.""
https://www.darkreading.com/cloud-security/ai-agent-workload-identity-crisis
The Tug-Of-War Over Firewall Backlogs In The AI-Driven Development Era
"The relationship between application developers and security teams has always been fraught with tension. At the core lies an ongoing battle — speed versus security — and that tug of war has been further exacerbated by mounting firewall backlog challenges driven by increased reliance on artificial intelligence and automation. Traditionally, developers submit a firewall rule request before deploying a new application, service, or tool inside an enterprise environment."
https://www.darkreading.com/cloud-security/tug-of-war-firewall-backlogs-ai-driven-development
5 Years Of Shifting Cybersecurity Behavior
"Online security is built through routine decisions made across devices and accounts. People choose how to create passwords, how often to reuse them, and how much effort to invest in protecting personal data. The National Cybersecurity Alliance and CybSafe’s Oh, Behave! The Cybersecurity Attitudes and Behaviors Report: 2021–2025 follows those patterns over five years, drawing on responses from more than 24,000 adults and documenting how attitudes and behaviors shift over time."
https://www.helpnetsecurity.com/2026/03/03/national-cybersecurity-alliance-cybsafe-cybersecurity-behavior-trends-report/
Introducing The 2026 Cloudflare Threat Report
"Today’s threat landscape is more varied and chilling than ever: Sophisticated nation-state actors. Hyper-volumetric DDoS attacks. Deepfakes and fraudsters interviewing at your company. Even stealth attacks via trusted internal tools like Google Calendar, Dropbox, and GitHub. After spending the last year translating trillions of network signals into actionable intelligence, Cloudforce One has identified a fundamental evolution in the threat landscape: the era of brute force entry is fading. In its place is a model of high-trust exploitation that prioritizes results at all costs. In order to equip defenders with a strategic roadmap for this new era, today we are releasing the inaugural 2026 Cloudflare Threat Report. This report provides the intelligence organizations need to navigate the rise of industrialized cyber threats."
https://blog.cloudflare.com/2026-threat-report/
https://www.infosecurity-magazine.com/news/ai-deepfakes-supercharge/
https://www.helpnetsecurity.com/2026/03/03/cloudflare-cyber-threat-report-2026/
Half Of US CISOs Work The Equivalent Of a Six-Day Week
"US cybersecurity leaders are being put under increasing pressure to compensate for process gaps and tackle escalating threats, with many working the equivalent of six or seven days a week, according to Seemplicity. The security vendor polled 300 CISOs and their equivalents to produce its State of the Cybersecurity Workforce Report. It revealed that 45% of respondents work 11+ extra hours per week – equivalent to an additional day – and 20% work an extra 16+ hours weekly."
https://www.infosecurity-magazine.com/news/half-us-cisos-work-equivalent/
Huge “Shadow Layer” Of Organizations Hit By Supply Chain Attacks
"Security experts have claimed that the blast radius of third-party data breach incidents is far larger than at first thought, with more than 433 million individuals impacted by 136 events last year. Black Kite compiled its seventh annual Third-Party Breach Report from analysis of verified public breach disclosures in 2025, external cyber risk telemetry and supply chain intelligence. It said 136 verified breaches had 5.28 publicly named downstream victims per vendor, amounting to 719 companies and 433 million individual end customers."
https://www.infosecurity-magazine.com/news/shadow-layer-organizations-supply/
https://content.blackkite.com/ebook/2026-third-party-breach-report/
Quantum Decryption Of RSA Is Much Closer Than Expected
"There’s a new contender in quantum cryptanalysis. The Jesse-Victor-Gharabaghi (JVG) quantum decryption algorithm is faster and requires fewer quantum resources than Shor’s algorithm. Breaking business and the internet has long been the accepted result of combining quantum computers and Shor’s algorithm to solve the factorization problem employed by Rivest-Shamir-Adleman (RSA) and Elliptic Curve Cryptography (ECC). But Shor’s algorithm requires a relatively large quantum computer (comprising an estimated one million qubits); and that is still believed to be at least a decade away."
https://www.securityweek.com/quantum-decryption-of-rsa-is-much-closer-than-expected/
https://www.preprints.org/manuscript/202510.1649
Turns Out Most Cybercriminals Are Old Enough To Know Better
"Contrary to what some believe, cybercrime is not a kids' game. Middle-aged adults, not teenagers, now make up the biggest chunk of people getting busted. That's according to new analysis of 418 publicly announced law enforcement actions between 2021 and mid-2025, which shows offenders aged 35 to 44 account for 37 percent of cases, making it the largest single age group. Add in those aged 25 to 34, who make up another 30 percent, and nearly six in ten cases involve people between 25 and 44. By contrast, the much-hyped 18-24 bracket accounts for 21 percent, while under-18s barely register at under 5 percent."
https://www.theregister.com/2026/03/03/turns_out_most_cybercriminals_are/
CISOs In a Pinch: A Security Analysis Of OpenClaw
"Anthropic's Claude Code Security is a legitimate leap forward for pre-deployment vulnerability detection - and the market sell-off (Cybersecurity ETF at a 2+ year low) is an overreaction based on a category error. AI-powered code scanning doesn't replace runtime threat detection, identity governance, or endpoint protection. More importantly, the fastest-growing enterprise attack surface is the AI agents themselves. Poisoned model supply chains, runtime behavior drift, and zero observability into autonomous agent actions are threats that live entirely outside the code layer. Claude Code Security is a welcome addition to the defender's toolkit, but a toolkit isn't a security strategy. Enterprises still need the governance, runtime visibility, and platform integration that only a full-lifecycle approach can deliver."
https://www.trendmicro.com/en_us/research/26/c/cisos-in-a-pinch-security-analysis-of-openclaw.html

อ้างอิง
Electronic Transactions Development Agency (ETDA)