Tech Talks With Kinsoft

Attackers exploited two critical Ivanti Endpoint Manager Mobile (EPMM) zero-days — CVE-2026-1281 and CVE-2026-1340, both CVSS 9.8 unauthenticated RCE — in a campaign hitting the European Commission, the Dutch government and other European entities. CERT-EU detected the Commission intrusion on 30 January 2026; it may have exposed some staff names and mobile numbers but was contained and the system cleaned within about nine hours, with no mobile devices compromised. We cover why internet-facing mobile-device-management servers are prime edge-device targets and the value of fast detection and patching.

Running edge devices or MDM in your environment? Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: Help Net Security; The Record (Recorded Future News).

On 12 March 2026, Australian, New Zealand and Pacific (including Tongan) cyber authorities — led locally by the ACSC — issued a joint advisory warning of rising INC Ransom ransomware-as-a-service activity against critical infrastructure, linked to around 11 Australian organisations, mainly in healthcare and professional services. INC Ransom typically enters via compromised credentials, escalates to admin, then steals data for double-extortion. Practical warning for healthcare and critical-infrastructure operators: credential hygiene, phishing-resistant MFA, limiting privilege escalation, monitoring and incident-response readiness.

Run healthcare or critical-infrastructure IT? Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: Cyber News Centre (ACSC/Five Eyes advisory).

Your Monday catch-up, with a security lens. This week: OpenAI moves to acquire AI red-teaming startup Promptfoo, and Anthropic sues the US Defense Department over its "supply-chain risk" label. On the breach desk: medtech giant Stryker is knocked offline by an Iran-linked wiper, outsourcer Telus is hit by ShinyHunters, and Michelin and Ericsson both disclose breaches.

Worried a destructive attack could halt your operations? Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: OpenAI; TechCrunch; CNBC; SecurityWeek; BleepingComputer.

An attacker used the stolen credentials of a French government employee to access the national bank account registry FICOBA for about 16 days (late January–February 2026), exposing data linked to roughly 1.2 million bank accounts — IBANs, names, addresses and in some cases tax identifiers. Account balances were not accessed. FICOBA tracks nearly 300 million accounts for around 80 million people; the episode highlights how stolen-credential access (not hacking) enabled it and the fraud risk when an IBAN is paired with identity data.

Concerned about credential theft and insider access to sensitive systems? Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: Help Net Security.

A WA Office of the Auditor-General report (released 6 March 2026) found systemic Microsoft 365 security failures across seven state entities. Two concrete incidents: sensitive information about 32 people (including minors) was emailed to a third party who uploaded it to a later-compromised Dropbox; and a senior officer's M365 account was phished (weak MFA), leading to a business email compromise and a $71,000 fraudulent-invoice theft. The audit flagged weak governance, identity/access management, no broad DLP, poor logging and phishable SMS-based MFA. We turn it into practical guidance: phishing-resistant MFA, DLP, controlling unmanaged cloud storage, and BEC defences.

Worried about M365 hardening and BEC? Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: iTnews; Computer Weekly.

Your Monday catch-up, with a security lens. This week: OpenAI ships GPT-5.4 with a native computer-use capability, and Nvidia's CEO signals its AI-lab investing spree may be done. But the dominant theme is breaches in healthcare and data brokers — a cancer centre, a health-claims processor, and LexisNexis all disclose major losses of sensitive records.

Hold sensitive health or customer records? Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: TechCrunch; OpenAI; CNBC; SecurityAffairs; BleepingComputer; The Record.

Singapore's Cyber Security Agency attributed a sophisticated espionage campaign against all four major telcos — M1, SIMBA, Singtel and StarHub — to the China-nexus group UNC3886. Active since around July 2025, the attackers exploited Fortinet and VMware zero-days plus advanced Linux rootkits to hold persistent access for close to a year before being evicted. The response, Operation Cyber Guardian, ran more than eleven months with 100+ defenders. Officials found no evidence that customer personal data was exfiltrated and services were not disrupted — the goal was intelligence-gathering on critical infrastructure.

Want to understand whether your network has uninvited long-term guests? Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: TechCrunch; The Record (Recorded Future News).

In February 2026 it emerged (ABC News, 16 Feb; VIQ statement, 20 Feb) that Canadian transcription provider VIQ Solutions had subcontracted Australian court transcription to India-based e24 Technologies in breach of its Commonwealth contracts, resulting in sensitive Federal Court and Federal Circuit and Family Court files being accessed offshore. Staff had reportedly raised offshoring concerns since 2025 but were dismissed; access logs showed files viewed outside Australian hours. The matter went to the ACSC and was called a national-security risk. The episode focuses on data sovereignty, subcontractor risk and contractual data-handling controls — not the contents of any case.

Need to know where your data is actually processed? Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: ACS Information Age; Cyber Daily.

Your Monday catch-up, with a security lens. A blockbuster week for AI money: Nvidia posts a record quarter, OpenAI closes a $110B round, and the Trump administration blacklists Anthropic over its refusal to drop weapons and surveillance restrictions. On security: a Russian-speaking actor uses AI to mass-compromise Fortinet firewalls, ShinyHunters hits CarGurus and Wynn Resorts, and AI-generated code shows up in an attack on Mexican government systems.

Wondering whether your firewalls' management interfaces are exposed? Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: CNBC; TechCrunch; Bloomberg; CNN; The Record; SecurityAffairs.

Detected on 19 February 2026, a ransomware attack on the University of Mississippi Medical Center disrupted its network and IT systems, including the Epic electronic medical record system. UMMC closed most of its clinics statewide (kidney dialysis excepted), cancelled outpatient surgeries, procedures and imaging, and reverted to pen-and-paper documentation. Clinics stayed closed about nine days, reopening around 2 March 2026, with the FBI and CISA involved.

Worried about ransomware and operational resilience in your organisation? Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: BleepingComputer; NPR.