InfoSec.Watch - Issue #130

Trivy Vulnerability Scanner Backdoored with Credential Stealer in Supply Chain Attack

Attackers have compromised the widely used open-source Trivy vulnerability scanner, injecting credential-stealing malware into official releases and GitHub Actions used by thousands of CI/CD workflows. The breach could trigger additional downstream supply-chain compromise across CI/CD environments.

Source: https://www.csoonline.com/article/4148317/trivy-vulnerability-scanner-backdoored-with-credential-stealer-in-supply-chain-attack.html

💡 Key Takeaway: Treat this as a behavior problem, not just a malware-name problem: review detections for script execution, trusted-tool abuse, persistence, and outbound connections.

FBI Links Signal Phishing Attacks to Russian Intelligence Services

The FBI has issued a public service announcement warning that Russian intelligence-linked threat actors are actively targeting users of encrypted messaging apps such as Signal and WhatsApp in phishing campaigns that have already compromised thousands of accounts.

Source: https://www.bleepingcomputer.com/news/security/fbi-links-signal-phishing-attacks-to-russian-intelligence-services/

💡 Key Takeaway: Focus on the full user-abuse path here: delivery, user interaction, remote access, and credential misuse should all be covered by detections and response playbooks.

Rapid7 Guidance on Observed Microsoft Teams Phishing Campaigns

The Rapid7 MDR team is currently monitoring an increase in phishing campaigns where threat actors (TAs) impersonate internal IT departments via Microsoft Teams. The primary objective is to persuade users to launch Quick Assist, granting the threat actor remote access to deploy malware and expand the intrusion.

Source: https://www.rapid7.com/blog/post/dr-guidance-on-observed-microsoft-teams-phishing-campaigns

💡 Key Takeaway: Harden remote-assistance workflows: restrict Quick Assist where possible, verify help-desk requests out of band, and alert on unusual remote-support sessions.

Interlock Ransomware Exploits Cisco FMC Zero-day CVE-2026-20131 for Root Access

Amazon Threat Intelligence is warning of an active Interlock ransomware campaign that's exploiting a recently disclosed critical security flaw in Cisco Secure Firewall Management Center (FMC) Software. The vulnerability in question is CVE-2026-20131 (CVSS score: 10.0), a case...

Source: https://thehackernews.com/2026/03/interlock-ransomware-exploits-cisco-fmc.html

💡 Key Takeaway: Treat this as a live exploitation risk: identify exposed assets, prioritize emergency remediation, and hunt for signs of compromise before patching closes the window.

DarkSword iOS Exploit Kit Uses 6 Flaws, 3 Zero-Days for Full Device Takeover

A new exploit kit targeting Apple iOS devices has reportedly been used by multiple threat actors since at least November 2025 to steal sensitive data, according to reporting from Google Threat Intelligence Group, iVerify, and Lookout.

Source: https://thehackernews.com/2026/03/darksword-ios-exploit-kit-uses-6-flaws.html

💡 Key Takeaway: Assume opportunistic exploitation is already underway: patch exposed assets first, review logs for related activity, and verify mitigations are really blocking abuse.

Critical Langflow Flaw CVE-2026-33017 Triggers Attacks Within 20 Hours of Disclosure

A critical security flaw impacting Langflow has come under active exploitation within 20 hours of public disclosure, highlighting the speed at which threat actors weaponize newly published vulnerabilities. The security defect, tracked as CVE-2026-33017 (CVSS score: 9.3), is a...

Source: https://thehackernews.com/2026/03/critical-langflow-flaw-cve-2026-33017.html

💡 Key Takeaway: Identify exposed systems, prioritize by reachability and privilege impact, and verify both patch status and detection coverage rather than assuming the update is enough.

Feds Disrupt IoT Botnets Behind Huge DDoS Attacks

The U.S. Justice Department joined authorities in Canada and Germany in dismantling the online infrastructure behind four highly disruptive botnets that compromised more than three million hacked Internet of Things (IoT) devices, such as routers and web cameras.

Source: https://krebsonsecurity.com/2026/03/feds-disrupt-iot-botnets-behind-huge-ddos-attacks/

💡 Key Takeaway: Use this as a detection and response drill: confirm logging coverage, review similar exposure paths internally, and rehearse containment before the same pattern hits you.

EU Sanctions Companies in China, Iran for Cyberattacks

These rulings prohibit the entities from entering or doing business in the European Union.

Source: https://www.darkreading.com/threat-intelligence/eu-sanctions-companies-china-iran-cyberattacks

💡 Key Takeaway: Review supplier, partner, and procurement exposure against new sanctions designations so routine business activity does not create avoidable compliance risk.

OFAC Sanctions DPRK IT Worker Network Funding WMD Programs Through Fake Remote Jobs

The U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) has sanctioned six individuals and two entities for their involvement in the Democratic People's Republic of Korea (DPRK) information technology (IT) worker scheme with an aim to defraud U.S.

Source: https://thehackernews.com/2026/03/ofac-sanctions-dprk-it-worker-network.html

💡 Key Takeaway: Focus on the whole intrusion chain: delivery, execution, persistence, and command-and-control should all be visible in telemetry before this becomes a missed campaign.

CISA Warns of Zimbra, SharePoint Flaw Exploits; Cisco Zero-Day Hit in Ransomware Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has urged government agencies to apply patches for two security flaws impacting Synacor Zimbra Collaboration Suite (ZCS) and Microsoft Office SharePoint, stating they have been actively exploited in the wild.

Source: https://thehackernews.com/2026/03/cisa-warns-of-zimbra-sharepoint-flaw.html

💡 Key Takeaway: Handle this like an active threat, not routine maintenance: reduce exposure immediately, validate compensating controls, and look for evidence of attempted exploitation.

Active Exploits: CISA Adds Critical Craft CMS and Apple DarkSword Flaws to KEV

CISA adds 5 actively exploited flaws to its KEV catalog, including a critical 10.0 CVSS Craft CMS bug and Apple zero-days linked to DarkSword malware.

Source: https://securityonline.info/active-exploits-cisa-adds-craft-cms-apple-darksword-flaws-kev/

💡 Key Takeaway: Treat this as an active exposure-management problem: identify reachable systems, patch or mitigate by risk tier, and review telemetry for evidence of attempted exploitation.

Sidewinder Espionage Campaign Expands Across Southeast Asia

The suspected India-linked threat group targets governments, telecom, and critical infrastructure using spear-phishing, old vulnerabilities, and rapidly rotating infrastructure to maintain persistent access.

Source: https://www.darkreading.com/threat-intelligence/sidewinder-espionage-campaign-expands-across-southeast-asia

💡 Key Takeaway: Revisit spear-phishing defenses for high-risk teams, and watch for fast-changing attacker infrastructure that can outpace static blocklists.

Oracle Patches Critical CVE-2026-21992 Enabling Unauthenticated RCE in Identity Manager

Oracle has released security updates to address a critical security flaw impacting Identity Manager and Web Services Manager that could be exploited to achieve remote code execution. The vulnerability, tracked as CVE-2026-21992, carries a CVSS score of 9.8 and affects high-value identity infrastructure.

Source: https://thehackernews.com/2026/03/oracle-patches-critical-cve-2026-21992.html

💡 Key Takeaway: Review exposed authentication paths, verify policy enforcement across alternate login flows, and rotate credentials or tokens if abuse is plausible.

One-week Tier-zero Validation Loop

For every Tier-Zero patch this week (firewalls, MDM/EMM, VPN, IAM, backup): 1) verify the new version on-box, 2) confirm exposure is removed or allowlisted externally, 3) review 14 days of admin/auth/config logs for anomalies, and 4) rotate secrets if compromise is plausible.

💡 Key Takeaway: Patching is step one—validation plus assumed-breach log review is step two.

Final Word

This week’s stories reinforce that identity paths and trust boundaries remain a primary operational weak point; local privilege boundaries on Linux still matter once attackers gain a foothold. The broader pattern is that software supply chain abuse keeps creating asymmetric risk for defenders. The practical takeaway is to tighten exposed control planes, validate compensating controls, and review telemetry as if exploitation attempts are already in motion.