Executive summary

The US Cybersecurity and Infrastructure Security Agency (CISA) added nine vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue between 16 and 22 March 2026, among them a Cisco Secure Firewall Management Center (FMC) flaw that Amazon reports the Interlock ransomware group exploited from 26 January, 36 days before its public disclosure, and three Apple flaws that Google Threat Intelligence Group (GTIG) lists in the DarkSword iOS exploit chain. A week after the Stryker disruption, CISA urged organisations to harden endpoint management systems such as Microsoft Intune, and The Record reports that the Justice Department seized four domains which the Federal Bureau of Investigation (FBI) says Iran's Ministry of Intelligence and Security (MOIS) used, most recently under the Handala name. Wiz reports that attackers compromised Aqua Security's Trivy scanner and its GitHub Actions on 19 March to steal pipeline secrets, and KrebsOnSecurity reported the same day that US, Canadian and German authorities had dismantled the infrastructure behind four Internet of Things (IoT) botnets. ransomware.live recorded at least 168 leak-site postings in the week, all criminal claims, led by Qilin and The Gentlemen. We assess that ransomware operators will keep exploiting internet-facing systems, including firewall management interfaces, virtual private network (VPN) appliances and SharePoint servers, in the coming weeks: Likely (B2), based on Amazon's Interlock findings, Group-IB's account of The Gentlemen's exploited FortiGate devices and Trend Micro's report of Warlock exploiting SharePoint servers.

Exploited vulnerabilities

The nine entries cover Wing FTP Server, Synacor's Zimbra Collaboration Suite (ZCS), Microsoft SharePoint, Cisco FMC and Security Cloud Control (SCC) Firewall Management, three Apple flaws, the Craft content management system (CMS) and Laravel Livewire.

CVE Vendor and product Date added Due date Known ransomware use Source
CVE-2025-47813 Wing FTP Server 16 March 2026 30 March 2026 Unknown CISA
CVE-2025-66376 Synacor Zimbra Collaboration Suite (ZCS) 18 March 2026 1 April 2026 Unknown CISA
CVE-2026-20963 Microsoft SharePoint 18 March 2026 21 March 2026 Unknown CISA
CVE-2026-20131 Cisco Secure Firewall Management Center (FMC) 19 March 2026 22 March 2026 Known CISA
CVE-2025-31277 Apple multiple products 20 March 2026 3 April 2026 Unknown CISA
CVE-2025-43510 Apple multiple products 20 March 2026 3 April 2026 Unknown CISA
CVE-2025-43520 Apple multiple products 20 March 2026 3 April 2026 Unknown CISA
CVE-2025-32432 Craft CMS 20 March 2026 3 April 2026 Unknown CISA
CVE-2025-54068 Laravel Livewire 20 March 2026 3 April 2026 Unknown CISA

Due dates and the known-ransomware-use field are taken from the KEV catalogue as CISA published it on 20 March 2026, the last version before this briefing. On that date CISA listed ransomware use as "Known" for the Cisco entry and "Unknown" for the other eight. CISA gave federal agencies three days to fix the SharePoint and Cisco entries, against 14 days for the other seven.

Cisco FMC and Interlock, as reported by Amazon. The catalogue describes CVE-2026-20131 as a deserialisation flaw in the web-based management interface of FMC and SCC Firewall Management that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root. Amazon's 18 March post says research using its MadPot honeypot sensor network found Interlock exploiting the flaw 36 days before its public disclosure, beginning 26 January 2026, and that Cisco disclosed it on 4 March. According to Amazon, the observed requests contained Java code execution attempts and an embedded web address meant to make a vulnerable target send a Hypertext Transfer Protocol (HTTP) PUT request confirming exploitation. Amazon lists exploit source addresses active in January and March 2026, including 206.251.239[.]164 and 89.46.237[.]33.

DarkSword. GTIG's 18 March report describes DarkSword as an iOS full-chain exploit that supports iOS 18.4 to 18.7 and uses six vulnerabilities. GTIG's table lists CVE-2025-31277 as a memory corruption flaw in JavaScriptCore and CVE-2025-43510 and CVE-2025-43520 as iOS kernel flaws, marks none of the three as exploited as a zero-day, and gives their fixes as iOS 18.6 and iOS 18.7.2 and 26.1 respectively. The three flaws GTIG marks as zero-days, CVE-2026-20700, CVE-2025-43529 and CVE-2025-14174, were already in the catalogue, added on 12 February 2026, 15 December 2025 and 12 December 2025, so all six are now listed. GTIG says every DarkSword vulnerability was patched by iOS 26.3 and recommends Lockdown Mode where an update is not possible.

SharePoint, Zimbra and web applications. The catalogue describes CVE-2026-20963 as a SharePoint deserialisation flaw that allows an unauthorised attacker to execute code over a network. BleepingComputer reported on 19 March that Microsoft patched it in January 2026 and had yet to flag it as exploited in the wild. The Zimbra entry is a cross-site scripting (XSS) flaw in the Classic user interface that attackers could abuse through Cascading Style Sheets (CSS) @import directives in email. CISA describes the Craft CMS flaw as code injection that allows a remote attacker to execute arbitrary code, and the Livewire flaw as code injection that could allow unauthenticated attackers to achieve remote command execution in specific scenarios. The Wing FTP Server entry is an information disclosure flaw triggered by a long value in the cookie named UID.

The Google Skia and Chromium V8 entries that the catalogue dates to 13 March are the subject of our 14 March article: Chrome zero-days in Skia and V8.

Notable incidents

Stryker follow-up. On 18 March CISA said it was aware of malicious cyber activity targeting the endpoint management systems of US organisations, based on the 11 March 2026 cyberattack against Stryker, which affected the company's Microsoft environment. CISA urged organisations to apply Microsoft's newly released Intune best practices: least-privilege administrative roles through role-based access control, phishing-resistant multi-factor authentication (MFA), and Multi Admin Approval, which requires a second administrative account to approve high-impact actions such as device wiping. Reported figures for the scale of the wipe differ: BleepingComputer reported on 19 March that the attackers issued the Intune "wipe" command to factory reset approximately 80,000 devices, while The Record wrote on 20 March that the device wipe feature destroyed company data on more than 200,000 devices. Our 12 March article covers the incident: Stryker 'Handala' incident.

Trivy supply-chain compromise. Wiz reported on 20 March that on 19 March threat actors compromised Aqua Security's Trivy vulnerability scanner, injecting credential-stealing malware into official releases and GitHub Actions. By Wiz's account the actor, which self-identifies as TeamPCP, used access retained after incomplete containment of an earlier incident; backdoored v0.69.4 binaries reached GitHub Releases, Docker Hub, GitHub Container Registry (GHCR) and Amazon Elastic Container Registry (ECR), and 75 of 76 trivy-action tags and 7 setup-trivy tags were force-pushed to malicious versions. Wiz says the malicious actions scrape the memory of the GitHub runner's Runner.Worker process, sweep the file system for Secure Shell (SSH) keys, cloud credentials and Kubernetes tokens, encrypt the haul and send it to the typosquatted domain scan.aquasecurtiy[.]org, with a fallback that creates a repository named tpcp-docs in the victim's GitHub account. In updates timestamped 22 March, Wiz said TeamPCP had expanded to the npm ecosystem through a worm called CanisterWorm that leverages stolen publish tokens, and that malicious Trivy images 0.69.5 and 0.69.6 had been published to Docker Hub. We assess that TeamPCP will use stolen credentials for further compromises in the coming weeks: Likely (B2), because Wiz's 22 March updates already describe a worm spreading with stolen publish tokens and the attacker's continued access to Aqua.

Aura. Aura said an employee fell victim to a targeted phone phishing attack, giving an unauthorised third party about an hour in that employee's account and access to approximately 900,000 records, mostly names and email addresses from a marketing tool of a company Aura acquired in 2021. Aura says no Social Security numbers, passwords or financial information were compromised, and its 19 March update adds that no database supporting its identity theft protection application was accessed. Have I Been Pwned added the breach on 18 March with 903,080 accounts.

Threat actor activity

DarkSword users, as attributed by GTIG. GTIG says that since at least November 2025 it has seen multiple commercial surveillance vendors and suspected state-sponsored actors use DarkSword in distinct campaigns against targets in Saudi Arabia, Turkey, Malaysia and Ukraine. It describes three users: a cluster it tracks as UNC6748, which used a Snapchat-themed website to target Saudi Arabian users in November 2025; the Turkish commercial surveillance vendor PARS Defense, in Turkey in late November 2025 and, for a different customer, in Malaysia in January 2026; and UNC6353, which GTIG calls a suspected Russian espionage group, in a watering-hole campaign on Ukrainian websites active through March 2026. GTIG names three final-stage payloads, GHOSTBLADE, GHOSTKNIFE and GHOSTSABER, and says it notified and collaborated with the Computer Emergency Response Team of Ukraine (CERT-UA) on the UNC6353 activity.

Interlock, as attributed by Amazon. Amazon attributes the FMC campaign to the Interlock ransomware family on convergent technical and operational indicators, including the embedded ransom note, the Tor negotiation portal and a campaign-specific organisation identifier. Its timestamp analysis indicates the actor most likely operates in UTC+3, three hours ahead of Coordinated Universal Time, with 75–80 per cent confidence. Amazon says a misconfigured staging server exposed Interlock's toolkit, including JavaScript and Java remote access trojans, a memory-resident Java webshell, ConnectWise ScreenConnect alongside the custom implants, and Certify, an open-source tool for abusing misconfigurations in Active Directory Certificate Services.

Tax-season malvertising and ScreenConnect loaders. Huntress reported on 19 March a malvertising campaign, active since at least January 2026, that abuses Google Ads on US tax-form searches to serve rogue ScreenConnect installers and ultimately delivers a Bring Your Own Vulnerable Driver (BYOVD) endpoint detection and response (EDR) killer. Huntress says the final payload abuses a previously undocumented Huawei audio driver to terminate Defender, Kaspersky and SentinelOne processes from kernel mode, that it reported over 60 instances of rogue ScreenConnect sessions tied to the campaign, and that Russian-language comments on a fake Chrome update page in the same operator's open directory suggest a Russian-speaking developer. In a second intrusion the attacker pivoted to credential dumping from the Local Security Authority Subsystem Service (LSASS) after blinding the EDR, which Huntress calls consistent with a pre-ransomware or initial access broker playbook. Elastic Security Labs separately described SILENTCONNECT, a previously undocumented loader that deploys ScreenConnect after a Cloudflare Turnstile page posing as a digital invitation, and which Elastic says has remained under the radar since March 2025.

Ransomware and extortion

ransomware.live's group pages list at least 168 leak-site postings with a discovered date between 16 and 22 March 2026, across at least 27 groups. These are criminal claims, not confirmed incidents, and no victim is named here on the strength of a posting.

Group Postings discovered 16–22 March Source
Qilin 30 ransomware.live
The Gentlemen 23 ransomware.live
DragonForce 19 ransomware.live
Akira 17 ransomware.live
NightSpire 13 ransomware.live
WorldLeaks 8 ransomware.live
Coinbase Cartel 7 ransomware.live
Sinobi 7 ransomware.live
Handala 6 ransomware.live
SafePay 5 ransomware.live
Other 17 groups 33 ransomware.live group pages

Qilin accounts for about 18 per cent of the postings counted here. Payload, the subject of our early profile, posted four, and INC Ransom, whose 2024 profile is in the archive, posted three.

The Gentlemen. Group-IB's 19 March report describes The Gentlemen as a ransomware-as-a-service (RaaS) operation of approximately 20 members that emerged in 2025 after breaking away from Qilin affiliate activity, and says that before becoming a RaaS it was known as ArmCorp, a very active Qilin affiliate group. According to Group-IB, the operators maintain a database of approximately 14,700 already-exploited FortiGate devices (the report's technique table gives about 13,400) and, separately, 969 validated brute-forced FortiGate VPN credentials, and use the BYOVD technique to terminate EDR and antivirus processes at the kernel level.

EDR killers. ESET published research on 19 March based on almost 90 EDR killers actively used in the wild. ESET says affiliates, not operators, pick the EDR killers, and that the same driver appears in unrelated tools while the same tool can migrate between drivers, so driver-based attribution to groups is often misleading. It also strongly suspects that artificial intelligence (AI) assisted with the development of some EDR killers, giving the Warlock gang as an example. Trend Micro reported on 16 March that Warlock, which it tracks as Water Manaul, has kept a consistent initial access method, exploiting vulnerable internet-facing SharePoint servers in the incident it examined, and that it now abuses the NSecKrnl.sys driver to terminate security products at kernel level, replacing the googleApiUtil64.sys driver used in earlier campaigns. In two of the week's reports the driver was either new to the actor's operations (Trend Micro on Warlock) or previously undocumented (Huntress). We assess that blocklists of known vulnerable drivers will miss some of the EDR killers used in the coming weeks: Likely (B2).

Law enforcement, policy and regulation

IoT botnets. KrebsOnSecurity reported on 19 March that the US Justice Department joined authorities in Canada and Germany in dismantling the infrastructure behind the Aisuru, Kimwolf, JackSkid and Mossad botnets, which compromised more than three million IoT devices such as routers and web cameras. As KrebsOnSecurity reports it, the Justice Department said the Defense Criminal Investigative Service executed seizure warrants against domains, virtual servers and other infrastructure used in distributed denial-of-service (DDoS) attacks on Department of Defense internet addresses. According to KrebsOnSecurity, the Justice Department said the disruption coincided with law enforcement actions in Canada and Germany targeting individuals who allegedly operated the botnets; KrebsOnSecurity says no further details were available on the suspects.

Domains the FBI ties to MOIS, according to The Record. The Record reported on 20 March that the Justice Department seized four domains, justicehomeland[.]org, handala-hack[.]to, karmabelow80[.]org and handala-redwanted[.]to, allegedly used by Iran's MOIS in operations dating back to 2022. In a 40-page seizure warrant, according to The Record, the FBI outlined MOIS campaigns run through a variety of online monikers, most recently Handala, and prosecutors said the Stryker attack "had a direct impact on emergency medical services and hospitals within Maryland". BleepingComputer had reported on 19 March that two of the domains displayed an FBI seizure notice citing a warrant from the District Court for the District of Maryland, and that Handala acknowledged the seizures.

Our 13 March article covers the SocksEscort case: SocksEscort.

Detection and hunting focus

Behaviour reported this week ATT&CK Where to look
Exploitation of internet-facing servers and appliances (Cisco FMC, SharePoint, FortiGate) T1190 FMC management interface requests carrying Java code; outbound HTTP PUT requests from FMC; SharePoint and FortiGate administration logs
Brute-forced VPN credentials (The Gentlemen) T1110 Repeated VPN authentication failures against default usernames followed by a success
Compromised continuous integration (CI) components (Trivy) T1195.002, T1552.001 Workflow runs on 19–20 March that referenced trivy-action or setup-trivy by tag; repositories named tpcp-docs; traffic to scan.aquasecurtiy[.]org
Rogue remote management tools (Interlock, the tax-form campaign, SILENTCONNECT) T1219 ScreenConnect installations and relays that administrators did not deploy
Malvertising lures (tax forms) T1583.008 Sponsored search clicks that redirect to tax-themed pages and end in an installer download
BYOVD EDR killers T1562.001, T1068 Kernel driver loads new to the estate, followed by termination of security product processes
Reported endpoint management misuse (Stryker) T1072, T1485 Bulk wipe actions in Intune and similar consoles; new Global Administrator accounts
Watering-hole iOS exploitation (DarkSword) T1189 Managed iOS devices still on iOS 18.4 to 18.7

Three priorities follow. First, patch or isolate Cisco FMC and SharePoint, the two entries CISA gave three days, and because Amazon dates Interlock's exploitation from 26 January, review FMC logs from that date rather than from Cisco's 4 March disclosure. Second, rotate any secret available to a pipeline that ran a Trivy action on 19–20 March or Trivy 0.69.4, 0.69.5 or 0.69.6, and pin GitHub Actions to full commit hashes rather than version tags, as Wiz advises for pinning. Third, require Multi Admin Approval for wipes and other high-impact Intune actions, as CISA recommends, and alert on vulnerable-driver loads followed by security process termination. These are our recommendations except where a source is named.

Further reading