CyberPulse

Scattered LAPSUS$ Hunters — the cybercrime supergroup behind over 1.5 billion stolen records and the Jaguar Land Rover ransomware attack — is now recruiting women for voice phishing campaigns targeting IT help desks, paying $500-$1,000 per call with scripts provided. CISA simultaneously issued an emergency directive giving federal agencies 48 hours to patch actively exploited Cisco SD-WAN vulnerabilities, while a former U.S. defense contractor executive was sentenced to 7+ years for selling zero-day exploits to a Russian broker.

• https://www.dataminr.com/resources/intel-brief/slh-recruiting-women-for-vishing/
• https://thehackernews.com/2026/02/slh-offers-5001000-per-call-to-recruit.html
• https://pushsecurity.com/blog/scattered-lapsus-hunters
• https://www.immersivelabs.com/resources/blog/scattered-lapsus-hunters-the-cybercrime-group-redefining-threats
• https://www.picussecurity.com/resource/blog/scattered-lapsus-hunters-2025s-most-dangerous-cybercrime-supergroup
• https://federalnewsnetwork.com/cybersecurity/2026/02/cisa-gives-agencies-until-friday-to-patch-critical-cyber-bug/
• https://www.bleepingcomputer.com/

A board-level strategic briefing synthesizing the week that confirmed the AI cyber arms race is live. Two frontier AI companies shipped cyber-specialized models within nine days of each other. A twelve-company coalition committed $100M. Mandiant M-Trends reports 22-second adversary handoff times while CrowdStrike tracks 29-minute eCrime breakout — both shrinking. A CVSS 9.8 authentication bypass in the Model Context Protocol proves the AI agent integration layer is being deployed with default-open configurations. AI coding tools correlate with a 4x spike in critical findings — AI is simultaneously finding and creating more vulnerabilities. And automated voice phishing using human operators and AI agents has launched as a platform. Four board-level questions address machine-speed SOC operations, AI agent protocol governance, AI-generated code scrutiny, and social engineering defense updates.

• https://www.anthropic.com/glasswing
• https://thehackernews.com/2026/04/openai-gpt-54-cyber-defensive-model.html
• https://thehackernews.com/2026/04/nginx-ui-mcp-auth-bypass-cve-2026-33032.html
• https://thehackernews.com/2026/04/mandiant-m-trends-2026-22-second-handoff.html
• https://www.crowdstrike.com/global-threat-report/
• https://thehackernews.com/2026/04/ai-coding-tools-critical-findings-quadrupling.html
• https://www.bleepingcomputer.com/news/security/athr-voice-phishing-platform-ai-agents/
• https://www.darktrace.com/blog/the-state-of-ai-cybersecurity-2026

A global utility infrastructure vendor disclosed unauthorized access to its corporate IT systems via SEC 8-K filing, creating potential supply chain exposure for electricity, gas, and water utilities running its smart metering and grid management products. A new threat group (UNC6692) is deploying the three-component Snow malware suite — Snowbelt browser extension, Snowglaze tunneler, and Snowbasin backdoor — for deep persistent access via social engineering. Four new KEV additions include a CVSS 9.9 privilege escalation in SimpleHelp remote support software used by managed service providers. A second medical device company disclosed a breach, confirming the sector as a target category. Firefox 150 and Tor 15.0.10 patch CVE-2026-6770 in the shared browser engine.

• ttps://www.securityweek.com/itron-8k-sec-filing-unauthorized-access/
• https://www.bleepingcomputer.com/news/security/unc6692-snow-malware-suite-browser-tunneler-backdoor/
• https://thehackernews.com/2026/04/cisa-adds-4-exploited-flaws-simplehelp-samsung-dlink.html
• https://www.bleepingcomputer.com/news/security/medtronic-breach-corporate-it-systems/
• https://www.securityweek.com/firefox-150-tor-15-cve-2026-6770/
• https://www.cybermaterial.com/p/cyber-briefing-20260427
• https://www.bleepingcomputer.com/news/security/new-checkmarx-supply-chain-breach-affects-kics-analysis-tool/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Google released emergency Chrome updates for two actively exploited zero-days — CVE-2026-3909 (Skia out-of-bounds write) and CVE-2026-3910 (V8 arbitrary code execution), both CVSS 8.8. The GlassWorm supply chain campaign escalated with 72+ malicious Open VSX extensions discovered targeting developers and AI coding assistants using transitive dependency poisoning. The medical technology wiper incident continues with no restoration timeline as the Intune weaponization is confirmed. And the Coruna iOS exploit kit has been traced to exploits originally developed by a defense contractor — closing the loop on the proliferation story from government-commissioned tools to mass criminal deployment.

• https://thehackernews.com/2026/03/google-releases-emergency-chrome-update.html
• https://www.bleepingcomputer.com/news/security/google-releases-emergency-chrome-updates-for-two-zero-days/
• https://www.securityweek.com/iran-linked-hacker-attack-on-stryker-disrupted-manufacturing-and-shipping/
• https://www.scworld.com/news/no-restoration-timeline-for-medical-device-maker-stryker-after-cyberattack
• https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-march-2026/
• https://www.securityweek.com/news/
• https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit
• https://iverify.io/blog/coruna-inside-the-nation-state-grade-ios-exploit-kit-we-ve-been-tracking

With conventional military options destroyed in this weekend's coordinated strikes, threat intelligence firms assess that cyber operations are now the sole remaining instrument of asymmetric retaliation — and state-linked cyber units were activated before the kinetic trigger was pulled. This briefing reveals that the wiper malware scenario already happened: a Shamoon 4.0 variant struck Gulf energy infrastructure in January, compromising 15,000 workstations, while port disruptions and rolling blackouts hit weeks before the current escalation. New threat vectors include deepfake social engineering deployed during communications blackouts, with staff receiving fake CEO evacuation messages while internet and news are degraded. CISA is operating at reduced staffing during the most acute threat period in years. Actionable guidance covers wiper preparedness, deepfake countermeasures, OT/ICS hardening, and supply chain contingency planning for simultaneous disruption of the Strait of Hormuz and Red Sea shipping lanes.

• https://www.govexec.com/defense/2026/02/strikes-iran-will-test-us-cyber-strategy-abroad-and-defenses-home/411784/
• https://www.khaleejtimes.com/world/asia/usisraeliran-trigger-unprecedented-cyberattacks
• https://fortune.com/2026/03/01/cyber-retaliation-iran-hack-corporate-security/
• https://fortune.com/2026/02/28/iran-death-ground-existential-threat-us-attacks-retaliation-terrorism-cyberattacks-strait-of-hormuz/
• https://time.com/7381884/iran-missiles-dubai-palm-gulf/
• https://www.cnn.com/world/live-news/israel-iran-attack-02-28-26-hnk-intl
• https://en.wikipedia.org/wiki/2026_Israeli%E2%80%93United_States_strikes_on_Iran
• https://www.ic3.gov/CSA/2025/250630.pdf
• https://windward.ai/blog/middle-east-on-the-precipice-gps-jamming-in-the-arabian-gulf-and-strait-of-hormuz-disrupts-970-ships-daily/
• https://vinciworks.com/blog/the-compliance-fallout-from-the-2026-iran-war-key-risks-and-red-flags/

A low-skill, Russian-speaking hacker used commercial AI services to breach over 600 enterprise firewalls across 55 countries in five weeks. No zero-days required. Amazon just showed us what the automation of mediocrity looks like at scale.

• https://aws.amazon.com/blogs/security/ai-augmented-threat-actor-accesses-fortigate-devices-at-scale/
• https://www.bleepingcomputer.com/news/security/amazon-ai-assisted-hacker-breached-600-fortigate-firewalls-in-5-weeks/
• https://thehackernews.com/2026/02/ai-assisted-threat-actor-compromises.html
• https://cybersecuritynews.com/600-fortigate-devices-hacked/
• https://blog.cloudflare.com/cloudflare-outage-february-20-2026/
• https://cybersecuritynews.com/cloudflare-down-6-hour-of-massive-global-service-outage/
• https://cybersecuritynews.com/cybersecurity-news-weekly/

The Ghost With Admin Access

The Machine Underground

Amazon Threat Intelligence confirmed that the Interlock ransomware group exploited CVE-2026-20131 (CVSS 10.0) in Cisco Secure Firewall Management Center as a zero-day for 36 days before Cisco's March 4 patch — gaining unauthenticated root access on enterprise firewalls. Amazon's MadPot honeypot network caught the exploitation and a misconfigured server exposed Interlock's complete attack toolkit. This is the second Cisco management plane zero-day confirmed exploited by a different threat actor in three weeks, reinforcing that the network management layer is the highest-value target. Also covered: GlassWorm supply chain campaign returns across GitHub, npm, and VS Code; Apple's first silent Background Security Improvement for a WebKit flaw; and a critical unpatched telnetd RCE vulnerability (CVE-2026-32746, CVSS 9.8).

• https://aws.amazon.com/blogs/security/amazon-threat-intelligence-teams-identify-interlock-ransomware-campaign-targeting-enterprise-firewalls/
• https://thehackernews.com/2026/03/interlock-ransomware-exploits-cisco-fmc.html
• https://www.theregister.com/2026/03/18/amazon_cisco_firewall_0_day_ransomware/
• https://www.bleepingcomputer.com/news/security/interlock-ransomware-exploited-secure-fmc-flaw-in-zero-day-attacks-since-january/
• https://cybersecuritynews.com/cisco-firewall-0-day-ransomware/
• https://www.bleepingcomputer.com/news/apple/apple-releases-first-background-security-improvement-update/
• https://thehackernews.com/2026/03/critical-unpatched-telnetd-flaw.html
• https://www.bleepingcomputer.com/news/security/glassworm-supply-chain-attack-targets-github-npm-vscode-extensions/

Attackers hijacked the update infrastructure for Smart Slider 3 Pro (800K+ WordPress installations) and pushed a fully weaponized remote access toolkit through the official update channel for approximately six hours. Adobe released an emergency patch for CVE-2026-34621 (CVSS 8.6), a prototype pollution flaw in Acrobat Reader under active exploitation via malicious PDFs. The GlassWorm campaign evolved with a Zig-compiled dropper targeting multiple developer IDEs simultaneously. Google shipped Device Bound Session Credentials (DBSC) in Chrome 146, binding session cookies to hardware TPM to block infostealer session replay. Thousands of internet-exposed Rockwell PLCs were confirmed, expanding the OT attack surface quantification.

• https://thehackernews.com/2026/04/smart-slider-3-pro-wordpress-update-hijack.html
• https://thehackernews.com/2026/04/adobe-acrobat-reader-cve-2026-34621-zero-day.html
• https://thehackernews.com/2026/04/glassworm-zig-dropper-developer-ides.html
• https://www.hendryadrian.com/cybersecurity-news-daily-recap-11-apr-2026/
• https://hackread.com/adobe-reader-zero-day-actively-exploited/
• https://www.bleepingcomputer.com/news/security/rockwell-plc-thousands-exposed/
• https://this.weekinsecurity.com/this-week-in-security-april-12-2026-edition/
• https://www.bleepingcomputer.com/news/security/google-chrome-dbsc-device-bound-session-credentials/