Executive summary

The US Cybersecurity and Infrastructure Security Agency (CISA) added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue between 23 and 29 March 2026: a Langflow code injection flaw, embedded malicious code in Aqua Security's Trivy and an F5 BIG-IP Access Policy Manager (APM) flaw. Wiz attributes compromises of Checkmarx's KICS GitHub Action on 23 March and the LiteLLM Python package on 24 March to TeamPCP, the self-identified actor behind the Trivy compromise, and JFrog links malicious telnyx package versions uploaded on 27 March to the same actor. Trend Micro reported a Pawn Storm campaign using malware it calls PRISMEX against the defence supply chain of Ukraine and its allies, and The Record reported that the Justice Department confirmed to Reuters a breach of the Federal Bureau of Investigation (FBI) director's personal email, from which the Handala group leaked material. ransomware.live recorded at least 134 leak-site postings in the week, all criminal claims, led by Qilin and Akira. We assess that TeamPCP will use credentials stolen in these compromises to reach further packages or pipelines in the coming weeks: Likely (B2), because Wiz says a Python Package Index (PyPI) advisory traced the LiteLLM compromise to a token exposed in the Trivy incident, and JFrog calls the telnyx compromise, which it ties to the same actor by its public key, likely a direct result of TeamPCP's recent attacks.

Exploited vulnerabilities

CVE Vendor and product Date added Due date Known ransomware use Source
CVE-2026-33017 Langflow 25 March 2026 8 April 2026 Unknown CISA
CVE-2026-33634 Aqua Security Trivy 26 March 2026 9 April 2026 Unknown CISA
CVE-2025-53521 F5 BIG-IP 27 March 2026 30 March 2026 Unknown CISA

Due dates and the known-ransomware-use field are taken from the KEV catalogue as CISA published it on 27 March 2026, the last version before this briefing. On that date CISA listed ransomware use as "Unknown" for all three entries. CISA gave federal agencies three days to fix the F5 entry, against 14 days for the other two.

Langflow, as reported by Sysdig. The catalogue describes CVE-2026-33017 as a code injection vulnerability that could allow building public flows without requiring authentication. Sysdig reported on 19 March that its Threat Research Team observed the first exploitation attempts in the wild within 20 hours of the advisory's publication on 17 March, when no public proof-of-concept code existed. Across its honeypots, Sysdig recorded exploit events from six unique source addresses in the 48 hours after the advisory, including one attacker that dumped environment variables and read .env files, and it cautions that the source addresses may be proxies or virtual private server (VPS) nodes.

Trivy. The catalogue says the Trivy entry could allow an attacker to gain access to everything in the continuous integration and continuous delivery (CI/CD) environment, including all tokens, Secure Shell (SSH) keys, cloud credentials and database passwords, and its note says additional vendor guidance must be followed to ensure full remediation. Wiz's Trivy post of 20 March added a 23 March update reporting a parallel compromise of kics-github-action.

F5 BIG-IP APM. The catalogue names CVE-2025-53521 an unspecified vulnerability that could allow a threat actor to achieve remote code execution in BIG-IP APM, while CISA's 27 March alert titles it a remote code execution vulnerability. The Hacker News reported on 28 March that F5 had initially categorised and remediated the flaw as a denial-of-service vulnerability, has reclassified it as remote code execution on the basis of new information obtained in March 2026, and has updated its advisory to confirm exploitation in vulnerable BIG-IP versions. According to The Hacker News, F5's indicators include the presence of /run/bigtlog.pipe or /run/bigstart.ltm; hashes, sizes or timestamps of /usr/bin/umount and /usr/sbin/httpd that do not match known-good versions, although F5 notes that each release and engineering hotfix (EHF) may have different file sizes and timestamps; and audit log entries showing a local user accessing the iControl REST application programming interface (API) from localhost to disable Security-Enhanced Linux (SELinux). As The Hacker News reports it, F5 also lists changes to three webtop renderer files, though their presence alone does not signal a security issue, and cautions that although it has observed webshells written to disk, they "have been observed to work in memory only", so those files might not be modified. The Hacker News gives the fixed versions as 17.5.1.3, 17.1.3, 16.1.6.1 and 15.1.10.8, and reports Defused Cyber seeing acute scanning activity for vulnerable BIG-IP devices after the KEV addition. We assess that attackers will keep targeting newly disclosed flaws in internet-facing products within days of an advisory or a KEV listing in the coming weeks: Likely (B2), based on Sysdig's Langflow exploitation timeline and Defused Cyber's report, via The Hacker News, of scanning after the F5 listing.

Citrix NetScaler, as described by the EU institutions' cybersecurity service (CERT-EU) and the UK National Cyber Security Centre (NCSC). CERT-EU's 23 March advisory says Citrix published a security advisory that day for two NetScaler Application Delivery Controller (ADC) and NetScaler Gateway flaws: CVE-2026-3055, an out-of-bounds read on systems configured as a Security Assertion Markup Language (SAML) identity provider (IdP), and CVE-2026-4368, a race condition that may lead to user session mix-up on gateway or authentication, authorisation and accounting (AAA) virtual servers. CERT-EU said that at the time of writing there was no public evidence of active exploitation, and recommended taking snapshots of the appliances before patching and terminating all active and persistent sessions afterwards. The NCSC's 25 March note encouraged UK organisations to take immediate action and lists the fixed releases 14.1-66.59 and 13.1-62.23, and 13.1-37.262 for the Federal Information Processing Standards (FIPS) and Network Device collaborative Protection Profile (NDcPP) builds of NetScaler ADC. CERT-EU notes a known issue in builds 14.1-66.54 and 14.1-66.59 in which Secure Ticket Authority (STA) server binding may fail when the STA server is configured using its full path.

SharePoint, as described by CERT-EU. CERT-EU's 25 March advisory on CVE-2026-20963, the SharePoint deserialisation flaw CISA added to the catalogue on 18 March, says Microsoft updated its advisory on 17 March to indicate that an unauthenticated attacker could exploit it. As a precautionary measure once servers are up to date, CERT-EU recommends enabling the Antimalware Scan Interface (AMSI) in Full Mode, deploying an endpoint detection and response (EDR) solution, and rotating SharePoint Server ASP.NET machine keys and restarting Internet Information Services (IIS), and it advises a compromise assessment on internet-facing assets.

Notable incidents

TeamPCP's campaign, as reported by Wiz and JFrog. Wiz reported on 23 March that the GitHub Action for KICS, Checkmarx's open source infrastructure-as-code scanner, was compromised with credential-stealing malware by TeamPCP, and that between 12:58 and 16:50 Coordinated Universal Time (UTC) that day users pinning to one of the compromised tags would have been served the malware. Wiz says the attacker used what appears to be a compromised identity, the cx-plugins-releases service account, to update all 35 tags, and that the payload sends stolen secrets to checkmarx[.]zone, with a repository named docs-tpcp in the victim's GitHub account as a fallback. Wiz also confirmed that two Checkmarx extensions on Open VSX, cx-dev-assist 1.7.0 and ast-results 2.53.0, were compromised. It assesses with high confidence that this is the Trivy actor, citing familiar naming conventions and the same public key.

Wiz reported on 24 March that malicious LiteLLM versions 1.82.7 and 1.82.8 were published to PyPI that morning and quarantined by PyPI at 11:25 UTC, and that a PyPI advisory identifies an API token exposed via the prior Trivy incident as the root cause. Wiz describes LiteLLM as an open-source Python library and proxy server for large language models (LLMs) and says its data shows it in 36 per cent of cloud environments. According to Wiz, version 1.82.8 adds a malicious litellm_init.pth file that runs whenever Python is invoked on the system, and the payload targets environment variables, SSH keys, cloud credentials, Kubernetes configurations and CI/CD secrets, exfiltrating them to checkmarx[.]zone in 1.82.7 and models[.]litellm[.]cloud in 1.82.8.

JFrog reported on 27 March that versions 4.87.1 and 4.87.2 of telnyx were uploaded to PyPI that day with malicious code similar to TeamPCP's previous attacks, delivered inside a valid Waveform Audio File Format (WAV) file, and that the package had since been quarantined. JFrog says the encoded public key is exactly the same as in the LiteLLM compromise, but that how the library was compromised is unknown. It advises uninstalling either version, downgrading to 4.87.0 and rotating all exposed credentials.

The FBI director's email, as reported by The Record. The Record reported on 27 March that Handala, a group it describes as having ties to Iran's Ministry of Intelligence and Security (MOIS), leaked photographs of FBI Director Kash Patel allegedly stolen from his personal email account, along with emails from 2010 and 2019. According to The Record, the Justice Department confirmed to Reuters that the email was breached and the documents appeared authentic, and an FBI spokesperson said the information is "historical in nature and involves no government information". The Record says Handala claimed the leak was in response to FBI actions the previous week.

Have I Been Pwned. The breach list of Have I Been Pwned (HIBP) shows four breaches added in the week. Its Sound Radix record, added on 26 March with 292,993 accounts, says the audio production tools company disclosed a March 2026 breach that impacted 293k unique email addresses and names, self-submitted it, and advised that hashed passwords may also have been exposed. HIBP also loaded two older breaches, RuneScape Boards (around 2011, 222,762 accounts) and Scuf Gaming (June 2015, 128,683 accounts). On 27 March it added 339,778 accounts from what its record describes as a breach of "Version 5", one of the many iterations of the BreachForums hacking forum.

Threat actor activity

Pawn Storm and PRISMEX, as reported by Trend Micro. Trend Micro's TrendAI Research reported on 26 March that Pawn Storm, which it describes as a Russia-aligned advanced persistent threat (APT) group also known as APT28, Fancy Bear, UAC-0001 and Forest Blizzard, has been using PRISMEX, a collection of interconnected malware components, to target the defence supply chain of Ukraine and its allies. Trend Micro says the campaigns have been active since at least September 2025 and significantly escalated in January 2026, and that a late-January campaign exploited the Microsoft Office flaw CVE-2026-21509. It adds that an exploit sample for the Windows zero-day CVE-2026-21513, which Akamai attributed to APT28 infrastructure and found to share command-and-control (C2) infrastructure with the CVE-2026-21509 campaign, reached VirusTotal 11 days before Microsoft's 10 February 2026 patch, but that Trend Micro has not independently confirmed that the campaign's shortcut (.lnk) files exploit CVE-2026-21513. According to Trend Micro, PRISMEX hides payloads in Portable Network Graphics (PNG) images with a custom steganography algorithm, persists through Component Object Model (COM) hijacking and abuses the Filen.io cloud storage service for C2. Trend Micro attributes the campaign to Pawn Storm with high confidence. Our APT28 profile is in the archive: APT28.

Silver Fox, as reported by ESET. ESET reported on 27 March that Silver Fox, which it says has been active since at least 2023, is conducting a targeted spearphishing campaign against Japanese manufacturers and other businesses during Japan's tax filing and organisational change season, with lures about tax compliance violations, salaries, job changes and employee stock ownership plans. ESET says the sender fields impersonate real employees and even chief executive officers (CEOs) at the targeted companies, and that opening the malicious files drops ValleyRAT, a remote access trojan Silver Fox has used across multiple campaigns.

Ransomware and extortion

ransomware.live's group pages list at least 134 leak-site postings with a discovered date between 23 and 29 March 2026, across at least 24 groups. These are criminal claims, not confirmed incidents, and no victim is named here on the strength of a posting.

Group Postings discovered 23–29 March Source
Qilin 24 ransomware.live
Akira 17 ransomware.live
NightSpire 15 ransomware.live
INC Ransom 11 ransomware.live
DragonForce 9 ransomware.live
Handala 9 ransomware.live
Play 8 ransomware.live
ALP-001 7 ransomware.live
Other 16 groups 34 ransomware.live group pages

Qilin accounts for about 18 per cent of the postings counted here. INC Ransom, whose 2024 profile is in the archive, posted 11; Payload, the subject of our early profile, posted six; and Interlock, the subject of our 20 March article, posted one.

Law enforcement, policy and regulation

Initial access broker sentenced, according to the Justice Department. The Justice Department said on 23 March that a court in the Southern District of Indiana had sentenced a 26-year-old Russian citizen to 81 months in prison for assisting major cybercrime groups, including the Yanluowang ransomware group, in attacks against US companies and other organisations. According to the department, he was an initial access broker who sold illicit access to other cybercriminals, the attacks he facilitated caused over $9 million in actual losses, and police in Rome arrested him before his extradition to the United States.

Foreign-produced routers. The Federal Communications Commission's (FCC) Public Safety and Homeland Security Bureau announced on 23 March that it had added routers produced in a foreign country to the FCC Covered List, except routers granted a Conditional Approval by the Department of War (DoW) or the Department of Homeland Security (DHS), based on a National Security Determination the FCC received on 20 March. The determination, attached to the notice, takes its definition of routers from the National Institute of Standards and Technology's Internal Report 8425A, under which they include consumer-grade networking devices that are primarily intended for residential use and can be installed by the customer, and states that routers produced abroad were directly implicated in the Volt, Flax and Salt Typhoon cyberattacks. Under the FCC's rules, covered equipment is prohibited from receiving equipment authorisations.

Detection and hunting focus

Behaviour reported this week ATT&CK Where to look
Poisoned GitHub Actions and PyPI packages (KICS, LiteLLM, telnyx) T1195.002 Workflow runs that used kics-github-action by tag on 23 March; installed litellm 1.82.7 or 1.82.8 and telnyx 4.87.1 or 4.87.2
Python startup hook (LiteLLM 1.82.8) T1546.018 A litellm_init.pth file in Python site-packages directories
Secret harvesting from files (TeamPCP payloads, a Langflow honeypot attacker) T1552.001 Reads of .env files and SSH keys by build or application processes; repositories named docs-tpcp; traffic to checkmarx[.]zone, models[.]litellm[.]cloud or 83[.]142[.]209[.]203
Exploitation of internet-facing applications (Langflow, F5 BIG-IP APM) T1190 Unexpected requests to the Langflow /api/v1/build_public_tmp endpoint; F5's file indicators as The Hacker News lists them, such as /run/bigtlog.pipe
Webshells on F5 BIG-IP APM (F5, as The Hacker News reports it) T1505.003 Failures of the sys-eicheck integrity checker and iControl REST access from localhost, from F5's indicators as The Hacker News lists them
Spearphishing attachments and links (Pawn Storm, Silver Fox) T1566.001, T1566.002 Rich Text Format (RTF) attachments that open remote Web Distributed Authoring and Versioning (WebDAV) shares; tax and human resources (HR) themed emails whose sender name and address do not match
Steganographic payloads (PRISMEX PNG images, telnyx WAV files) T1027.003 Python processes that download WAV files and then execute code; the PRISMEX drop files Trend Micro lists, a dynamic-link library (DLL) named EhStoreShell.dll under %PROGRAMDATA%\USOPublic\Data\User and a SplashScreen.png under %PROGRAMDATA%\Microsoft OneDrive\setup\Cache
COM hijacking and cloud storage C2 (PRISMEX) T1546.015, T1102 User-registered COM objects under HKCU\Software\Classes\CLSID pointing to %PROGRAMDATA% or %TEMP%; Filen.io traffic from hosts with no business use for it

Three priorities follow. First, update BIG-IP APM and check every internet-accessible APM system for signs of compromise, as CISA's catalogue note asks, using the log as well as the file indicators F5 published, as The Hacker News lists them, because F5, in The Hacker News's report, says the webtop files it lists might not be modified when webshells work in memory only. Second, treat every runner or host that used the compromised KICS tags during the 23 March exposure window, LiteLLM 1.82.7 or 1.82.8, or telnyx 4.87.1 or 4.87.2 as having exposed every secret it could reach and rotate those secrets, and pin GitHub Actions to full commit hashes rather than version tags, as Wiz advises in its Trivy post. Third, update Langflow or, as Sysdig advises where no patched version is available, restrict access to the build_public_tmp endpoint, and patch NetScaler appliances configured as a SAML IdP, gateway or AAA virtual server with CERT-EU's snapshot and session steps. These are our recommendations except where a source is named.

Further reading