Executive summary

The US Cybersecurity and Infrastructure Security Agency (CISA) added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue between 9 and 15 March 2026: two Chrome flaws for which Google said exploits exist in the wild, and four in management or automation software (Omnissa Workspace ONE UEM, SolarWinds Web Help Desk, Ivanti Endpoint Manager and n8n). After Stryker disclosed a global disruption on 11 March, which ESET describes as a reported data-wiping attack by a pro-Iranian hacktivist group, Iran-aligned disruptive activity was in our assessment the week's main geopolitical thread, while ESET, Lab52 and Zscaler published reporting on campaigns that they attribute to Russia-linked and China-nexus actors. Telus Digital confirmed a breach that ShinyHunters claims is very large, a Eurojust- and Europol-supported operation took down the SocksEscort proxy service, and ransomware.live recorded at least 165 leak-site postings, all criminal claims, led by Qilin. We assess that internet-facing administration tools, rather than this month's Microsoft release, are the priority patching exposure going into the week of 16 March: Likely (B2), based on CISA's evidence of active exploitation for all four management-tool entries and Intel 471's report that Cisco has seen zero-day exploitation of its SD-WAN products since 2023.

Exploited vulnerabilities

CVE Vendor and product Date added Due date Known ransomware use Source
CVE-2021-22054 Omnissa Workspace ONE UEM 9 March 2026 23 March 2026 Unknown CISA
CVE-2025-26399 SolarWinds Web Help Desk 9 March 2026 12 March 2026 Unknown CISA
CVE-2026-1603 Ivanti Endpoint Manager (EPM) 9 March 2026 23 March 2026 Unknown CISA
CVE-2025-68613 n8n 11 March 2026 25 March 2026 Unknown CISA
CVE-2026-3909 Google Skia 13 March 2026 27 March 2026 Unknown CISA
CVE-2026-3910 Google Chromium V8 13 March 2026 27 March 2026 Unknown CISA

Due dates and the known-ransomware-use field are taken from the KEV catalogue as CISA published it on 13 March 2026. On that date CISA listed ransomware use as "Unknown" for all six entries.

Chrome. Google's 12 March desktop update addressed CVE-2026-3910 in V8, and Google said it was aware that an exploit exists in the wild; the Canadian Centre for Cyber Security lists Chrome versions before 146.0.7680.75/76 (Windows and Mac) and 146.0.7680.75 (Linux) as affected. A second update on 13 March fixed CVE-2026-3909, an out-of-bounds write in the Skia graphics library that Google's Threat Analysis Group reported on 10 March, again with Google aware of an in-the-wild exploit. CISA's catalogue entry notes that Skia also ships in ChromeOS, Android and Flutter, and that the V8 flaw could affect other Chromium-based browsers, including Microsoft Edge and Opera.

Management and automation software. The SolarWinds Web Help Desk entry is a deserialisation flaw in AjaxProxy that could let an attacker run commands on the host. CISA gave federal agencies until 12 March to fix it, three days after addition, against 14 days for the other two entries added that day. The Ivanti EPM flaw is an authentication bypass that could let a remote, unauthenticated attacker leak stored credential data. The Omnissa entry is a server-side request forgery (SSRF) flaw in Workspace ONE UEM, formerly VMware Workspace One UEM, which CISA's record ties to the 2021 advisory VMSA-2021-0029. CVE-2025-68613 lets an attacker achieve remote code execution through n8n's workflow expression evaluation system.

Other confirmed exploitation. On 13 March Intel 471 published an analysis of CVE-2026-20127, an authentication bypass in Cisco Catalyst SD-WAN Controller and Manager that CISA added to KEV on 25 February. Intel 471 reports that Cisco has observed zero-day exploitation since 2023, and it counted 2,675 internet-exposed SD-WAN instances as of 27 February. It summarises a Cisco Talos and Australian Signals Directorate account of the UAT-8616 cluster joining a rogue device to an SD-WAN fabric, downgrading software to exploit CVE-2022-20775 for root access, and deleting logs.

Patch Tuesday. Microsoft's 10 March release fixed 79 vulnerabilities, three of them rated critical, according to Cisco Talos, which notes that the SQL Server elevation-of-privilege flaw CVE-2026-21262 had been publicly disclosed. No Microsoft product entered the KEV catalogue during the week.

Notable incidents

Stryker. Stryker told the US Securities and Exchange Commission on 11 March that a cybersecurity incident had caused "a global disruption to the Company’s Microsoft environment" (Form 8-K). The filing says the company had no indication of ransomware or malware, and that the timeline for full restoration was not yet known. BleepingComputer reported on 11 March that Handala claimed the attack, and that people claiming to be Stryker employees said their managed Windows and mobile devices had been remotely wiped. Our 12 March report covers the incident: Stryker 'Handala' incident.

Telus Digital. The business process outsourcing arm of Telus confirmed to BleepingComputer, in a report published on 12 March, that it was investigating "unauthorized access to a limited number of our systems", and said its business operations remained fully operational. ShinyHunters claims it entered using Google Cloud Platform credentials found in data from the Salesloft Drift breach, took close to 1 petabyte of data and demanded $65 million. BleepingComputer could not independently confirm the size of the stolen data, and these remain criminal claims.

Breach notifications. Have I Been Pwned added two breaches on 15 March. The Baydöner record, for a Turkish restaurant chain, covers 1,266,822 accounts, with exposed data including names, phone numbers and plaintext passwords; it states that Baydöner said payment and financial data was not affected. The Divine Skins record, for a League of Legends custom skins service, covers 105,814 accounts, and says Divine Skins stated that an unauthorised third party deleted all skins from its database.

Threat actor activity

Russia-linked activity, as attributed by the reporting vendors. ESET reported on 10 March that Sednit's advanced development team has re-emerged since April 2024 with a toolkit centred on two implants, BeardShell and Covenant, each using a different cloud provider, which enabled long-term surveillance of Ukrainian military personnel. ESET links the SlimAgent keylogger's code to the group's 2010-era Xagent backdoor, and a BeardShell obfuscation technique to its Xtunnel tool. It also notes that Sednit used Covenant in January 2026 spearphishing that exploited CVE-2026-21509, as reported by CERT-UA. ESET says the group is also known as APT28, Fancy Bear, Forest Blizzard or Sofacy, and notes that the US Department of Justice linked it to Unit 26165 of Russia's GRU; see our earlier APT28 profile. Our 12 March article on BadPaw and MeowMeow covers a separate campaign, reported by ClearSky, that used a PNG-steganography loader and a remote access trojan against Ukrainian government and energy organisations, according to Scythe, which attributes the campaign to APT28.

On 13 March Lab52 described DRILLAPP, a JavaScript backdoor that runs through Microsoft Edge. It was used in February 2026 against Ukrainian entities with judicial and charity-themed lures. The first variant used LNK files that load a script hosted on pastefy[.]app; a second, from late February, switched to Control Panel (CPL) files. Edge is launched headless with flags that grant camera, microphone and screen-capture access without user interaction. Lab52 attributes the campaign to actors linked to Russia, and links it to Laundry Bear only with low confidence.

China-nexus. Zscaler ThreatLabz reported on 12 March that, on 1 March, a China-nexus actor targeted countries in the Arabian Gulf with an Arabic-language lure depicting missile attacks. The chain ran from an LNK file and a CHM file to DLL side-loading and a PlugX variant that supports HTTPS command and control and DNS-over-HTTPS. ThreatLabz attributes the activity to a China-nexus actor with high confidence, and links it to Mustang Panda with medium confidence.

Iran-aligned activity. Intel 471 described Handala on 13 March as a disruptive Iranian-aligned operation that has run destructive and espionage-oriented campaigns, including a reported attack on a medtech company. ESET noted on 12 March that Unit 42 counted more than 60 active pro-Iranian hacktivist groups after the US-Israeli operation of 28 February. ESET also observed that state-aligned actors in conflict tend to favour wipers over ransomware, and that MuddyWater has pivoted to abusing legitimate remote monitoring and management (RMM) software. Handala also appears on ransomware.live, with nine postings this week. We assess that Iran-aligned groups will keep pairing destructive operations with public claims against Western and Israeli-linked organisations in the coming weeks: Likely (B2).

Crime and AI-themed lures. Three of the week's archive articles cover credential theft. Microsoft's Storm-2561 report describes SEO poisoning that delivers digitally signed trojans posing as VPN clients (Microsoft). Intel 471 documents OpenClaw-themed lures that push information stealers. Hudson Rock's InfoStealers post, which we covered, links the Polyfill.io supply-chain attack to a North Korean actor; that is Hudson Rock's attribution. Microsoft also published a playbook for detecting prompt abuse in AI tools, including indirect prompt injection through an unsanctioned AI tool (Microsoft).

Ransomware and extortion

ransomware.live's group pages list at least 165 leak-site postings with a discovered date between 9 and 15 March 2026, spread across at least 29 groups. These are criminal claims, not confirmed incidents, and no victim is named here on the strength of a posting.

Group Postings discovered 9–15 March Source
Qilin 28 ransomware.live
Akira 19 ransomware.live
NightSpire 16 ransomware.live
Coinbase Cartel 12 ransomware.live
INC Ransom 10 ransomware.live
Payload 10 ransomware.live
The Gentlemen 10 ransomware.live
Handala 9 ransomware.live
Play 9 ransomware.live
Other 20 groups 42 ransomware.live group pages

Qilin accounts for about 17 per cent of the postings counted here. Payload, the subject of our early profile, and INC, whose 2024 profile is in the archive, each posted ten.

Huntress published a 13 March case study of an attempted ransomware intrusion at a small US construction manufacturing company. The attacker entered through a VPN without multi-factor authentication (MFA), used Remote Desktop Protocol to look for administrator credentials, dumped credentials on a server and tried to disable Microsoft Defender and the Huntress agent before analysts isolated the network. Huntress says nearly half of the environments it protects do not use two-factor authentication on their VPNs.

Law enforcement, policy and regulation

Eurojust announced on 12 March that authorities had targeted a paid proxy service built on malware-infected routers which, by Eurojust's count, compromised 369,000 routers and other devices across 163 countries and served about 124,000 customers. BleepingComputer identifies the service as SocksEscort and reports that it ran on edge devices compromised with the AVRecon Linux malware. In a coordinated operation on 11 March, authorities took down 24 servers in seven countries and seized 34 domains, according to Eurojust (Europol, as quoted by BleepingComputer, gives 23 servers), and US authorities froze about EUR 3.5 million in cryptocurrency. The service's payment platform is estimated to have received more than EUR 5 million. Authorities from France, Austria, the Netherlands and the United States worked together on the case, with Eurojust coordinating judicial cooperation, Europol providing analytical support, and judicial requests sent to Bulgaria, Germany, Hungary and Romania.

Detection and hunting focus

Behaviour this week ATT&CK Where to look
KEV-listed management and automation software exploited T1190 Web Help Desk, EPM, Workspace ONE UEM, n8n and SD-WAN logs; unexpected child processes of the application service account
Exploited Chrome and Chromium flaws T1189 Browser version inventory across Chrome, Edge and other Chromium browsers
VPN access without MFA T1133, T1078 VPN logins from new devices or residential ranges, followed by internal RDP
Post-access movement and defence tampering T1021.001, T1003, T1562.001 RDP from VPN pools, LSASS access, Defender policy changes
LNK and CPL lures (DRILLAPP) T1204.002, T1218.002 control.exe or rundll32.exe loading CPL files from user folders; headless msedge.exe with remote debugging or fake media-stream flags
PlugX side-loading T1574.001 Signed binaries loading DLLs from user AppData folders
Cloud storage as command and control (BeardShell, Covenant) T1102 Endpoint traffic to consumer cloud storage APIs that the organisation does not use
Reported data-wiping attack (Stryker; mechanism not confirmed) T1485 As a precaution, not an observed technique: bulk wipe or retire actions in device management consoles (T1072); new administrator role assignments
Residential proxy abuse T1090 Authentication from residential addresses with impossible-travel patterns

Three priorities follow from the week's reporting. First, confirm every Chrome and Chromium-based browser has taken both the 12 March and 13 March fixes, since the KEV entries cover two separate flaws. Second, treat the management-tool KEV entries as exposure questions before patch questions: find every internet-reachable Web Help Desk, EPM, Workspace ONE UEM and n8n instance, then review its administrator accounts and recent configuration changes. Third, alert on mass device-wipe or retire actions in endpoint management consoles and require a second approver for them, given ESET's account of a reported data-wiping attack on Stryker. These are our recommendations, not vendor guidance.

Further reading