InfoSec.Watch - Issue #128

Transparent Tribe Uses AI to Mass-produce Malware Implants in Campaign Targeting India

The Pakistan-aligned threat actor known as Transparent Tribe has become the latest hacking group to embrace artificial intelligence (AI)-powered coding tools to strike targets with various implants. The activity is designed to produce a "high-volume, mediocre mass of implants"...

Source: https://thehackernews.com/2026/03/transparent-tribe-uses-ai-to-mass.html

💡 Key Takeaway: Validate controls around initial access (MFA, phishing-resistant auth), review logs for IOCs, and rehearse containment for the affected TTPs.

Hikvision and Rockwell Automation CVSS 9.8 Flaws Added to CISA KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Hikvision and Rockwell Automation products to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.

Source: https://thehackernews.com/2026/03/hikvision-and-rockwell-automation-cvss.html

💡 Key Takeaway: Track obligations and deadlines, map requirements to existing controls, and document evidence collection before audits/enforcement tighten.

Cisco Issues Emergency Patches for Critical Firewall Vulnerabilities

Cisco has handed security teams one of the largest ever patching workloads affecting its firewall products, including fixes for two ‘perfect 10’ vulnerabilities in the company’s Secure Firewall Management Center (FMC) Software. Overall, the March 4 release , the first of its s...

Source: https://www.csoonline.com/article/4141268/cisco-issues-emergency-patches-for-critical-firewall-vulnerabilities.html

💡 Key Takeaway: Identify exposure, prioritize patching/mitigations for internet-facing or high-privilege paths, and add detections for exploit attempts.

CISA Adds Actively Exploited Vmware Aria Operations Flaw CVE-2026-22719 to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a recently disclosed security flaw impacting Broadcom VMware Aria Operations to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation in the wild.

Source: https://thehackernews.com/2026/03/cisa-adds-actively-exploited-vmware.html

💡 Key Takeaway: Identify exposure, prioritize patching/mitigations for internet-facing or high-privilege paths, and add detections for exploit attempts.

Sometimes, You Can Just Feel the Security in the Design (juniper Junos Evolved CVE-2026-21902 Pre-auth RCE)

On today’s ‘good news disguised as other things’ segment, we’re turning our gaze to CVE-2026-21902 - a recently disclosed “Incorrect Permission Assignment for Critical Resource” vulnerability affecting Juniper’s Junos OS Evolved platform. This vulnerability affects only Junipe...

Source: https://labs.watchtowr.com/sometimes-you-can-just-feel-the-security-in-the-design-junos-os-evolved-cve-2026-21902-rce/

💡 Key Takeaway: Identify exposure, prioritize patching/mitigations for internet-facing or high-privilege paths, and add detections for exploit attempts.

Cisco Drops 48 New Firewall Vulnerabilities, 2 Critical

Edge bugs are so fetch, and Cisco just patched 50 new ones, including some heavy hitters with 10 out of 10 scores on the CVSS scale.

Source: https://www.darkreading.com/vulnerabilities-threats/cisco-48-firewall-vulnerabilities-2-critical

💡 Key Takeaway: Identify exposure, prioritize patching/mitigations for internet-facing or high-privilege paths, and add detections for exploit attempts.

Unauthenticated Nginx UI Flaw Leaks Decryption Keys and Server Secrets

A critical 9.8 CVSS flaw (CVE-2026-27944) in Nginx UI lets hackers download and decrypt full system backups via an open API. Update and rotate secrets!

Source: https://securityonline.info/unauthenticated-nginx-ui-flaw-leaks-decryption-keys-and-server-secrets/

💡 Key Takeaway: Validate controls around initial access (MFA, phishing-resistant auth), review logs for IOCs, and rehearse containment for the affected TTPs.

CISA Warns Feds to Patch Ios Flaws Exploited in Crypto-theft Attacks

CISA ordered U.S. federal agencies to patch three iOS security flaws targeted in cyberespionage and crypto-theft attacks using the Coruna exploit kit.

Source: https://www.bleepingcomputer.com/news/security/cisa-warns-of-apple-flaws-exploited-in-spyware-crypto-theft-attacks/

💡 Key Takeaway: Track obligations and deadlines, map requirements to existing controls, and document evidence collection before audits/enforcement tighten.

CISA Adds Ios Flaws From Coruna Exploit Kit to KEV List

The nation-state-grade iOS exploit kit targets 23 vulnerabilities affecting iOS 13 to 17.2.1.

Source: https://www.securityweek.com/cisa-adds-ios-flaws-from-coruna-exploit-kit-to-kev/

💡 Key Takeaway: Track obligations and deadlines, map requirements to existing controls, and document evidence collection before audits/enforcement tighten.

YARA-X 1.14.0 Release, (sat, Mar 7th)

YARA-X 1.14.0 release brings 4 improvements and 2 bugfixes.

Source: https://isc.sans.edu/diary/rss/32774

💡 Key Takeaway: Pilot in a sandbox, validate coverage against your environment, and add it to a repeatable workflow (CI, detection engineering, or hardening).

FBI and Europol Seize Leakbase Forum Used to Trade Stolen Credentials

A joint law enforcement operation has dismantled LeakBase, one of the world's largest online forums for cybercriminals to buy and sell stolen data and cybercrime tools. The LeakBase forum, per the U.S.

Source: https://thehackernews.com/2026/03/fbi-and-europol-seize-leakbase-forum.html

💡 Key Takeaway: Track obligations and deadlines, map requirements to existing controls, and document evidence collection before audits/enforcement tighten.

Google Confirms CVE-2026-21385 in Qualcomm Android Component Exploited

Google on Monday disclosed that a high-severity security flaw impacting an open-source Qualcomm component used in Android devices has been exploited in the wild. The vulnerability in question is CVE-2026-21385 (CVSS score: 7.8), a buffer over-read in the Graphics component.

Source: https://thehackernews.com/2026/03/google-confirms-cve-2026-21385-in.html

💡 Key Takeaway: Identify exposure, prioritize patching/mitigations for internet-facing or high-privilege paths, and add detections for exploit attempts.

Critical Openclaw Vulnerability Exposes AI Agent Risks

The now-patched flaw is the latest in a growing string of security issues associated with the viral AI tool, which has seen rapid adoption among developers.

Source: https://www.darkreading.com/application-security/critical-openclaw-vulnerability-ai-agent-risks

💡 Key Takeaway: Identify exposure, prioritize patching/mitigations for internet-facing or high-privilege paths, and add detections for exploit attempts.

Termite Ransomware Breaches Linked to Clickfix Castlerat Attacks

Ransomware threat actors tracked as Velvet Tempest are using the ClickFix technique and legitimate Windows utilities to deploy the DonutLoader malware and the CastleRAT backdoor. [...].

Source: https://www.bleepingcomputer.com/news/security/termite-ransomware-breaches-linked-to-clickfix-castlerat-attacks/

💡 Key Takeaway: Validate controls around initial access (MFA, phishing-resistant auth), review logs for IOCs, and rehearse containment for the affected TTPs.

US Cyber Strategy Targets Adversaries, Critical Infrastructure, and Emerging Technologies

Trump’s Cyber Strategy calls for stronger deterrence against cyber adversaries, modernization of federal networks, protection of critical infrastructure, and investment in technologies such as AI and post-quantum cryptography.

Source: https://www.securityweek.com/us-cyber-strategy-targets-adversaries-critical-infrastructure-and-emerging-technologies/

💡 Key Takeaway: Identify exposure, prioritize patching/mitigations for internet-facing or high-privilege paths, and add detections for exploit attempts.

One-week Tier-zero Validation Loop

For every Tier-Zero patch this week (firewalls, MDM/EMM, VPN, IAM, backup): 1) verify the new version on-box, 2) confirm exposure is removed/allowlisted with an external check, 3) review 14 days of admin/auth/config logs for anomalies, and 4) rotate secrets if compromise is plausible.

💡 Key Takeaway: Patching is step one—validation + assumed-breach log review is step two.

Final Word

This week’s theme: control planes and edge surfaces keep driving real-world blast radius. Treat exposure management as continuous—tighten identity, reduce reachable admin surfaces, and ship detections that assume exploitation attempts will happen.

💡 Key Takeaway: Treat control planes like production attack surface: reduce exposure, patch fast, and validate with logs—not hope.