Weekly Security Intelligence Briefing — Week of 2026-02-23

“`html

Executive Summary

The week of February 23, 2026 presents an elevated risk posture across network infrastructure, mobile platforms, enterprise software, and the software supply chain. Security teams face concurrent pressure from multiple high-priority threats requiring immediate action. Two Cisco Secure Firewall Management Center vulnerabilities received CVSS 10.0 scores with no available workarounds, demanding emergency patching. CISA added VMware Aria Operations (CVE-2026-22719), Hikvision cameras, and Rockwell Automation Logix controllers to the Known Exploited Vulnerabilities catalog, with federal remediation deadlines of March 24-26. An Android zero-day (CVE-2026-0006, CVSS 9.8) is actively exploited in the wild. Nation-state activity intensified: the CyberStrikeAI platform compromised 600+ FortiGate devices autonomously, Iranian threat actors launched a multi-actor campaign following military operations, and APT28 deployed a custom Covenant variant for long-term espionage. Supply chain threats expanded with malicious npm packages, Chrome extension ownership hijacks, and AI-assisted malvertising targeting developer toolchains. Microsoft’s March 2026 Patch Tuesday addressed 79-84 vulnerabilities including two actively exploited zero-days. Security teams should prioritize network infrastructure patching, OT/ICS remediation, and developer environment hardening this week.

Critical Action Items

1. Patch Cisco Secure Firewall Management Center immediately, CVSS 10.0, no workaround.
   CVE-2026-20079 and CVE-2026-20131 affect Cisco Secure Firewall Management Center. Both are unauthenticated, network-accessible, with full confidentiality/integrity/availability impact. No workaround exists. Apply Cisco’s published patches immediately. Prioritize internet-exposed FMC instances. Reference Cisco PSIRT advisory (March 2026).
2. Remediate VMware Aria Operations RCE, CISA KEV deadline March 24, 2026.
   CVE-2026-22719 (CVSS 8.1) enables remote code execution via command injection. CISA added it to the KEV catalog on March 3, 2026, with a federal remediation deadline of March 24. Apply Broadcom/VMware patches. If patching is delayed, restrict network access to Aria Operations management interfaces. Federal agencies must comply; all organizations should treat this as urgent.
3. Patch or isolate Hikvision cameras and Rockwell Logix OT/ICS systems, CISA KEV deadline March 26, 2026.
   CVE-2017-7921 (Hikvision, CVSS 9.8) and CVE-2021-22681 (Rockwell Automation, CVSS 9.8) were added to CISA KEV on March 5, 2026. Both are actively exploited. Apply available patches. Where patching is not feasible for OT/ICS systems, implement network segmentation, disable unnecessary remote access, and monitor for anomalous traffic. Federal deadline is March 26; critical infrastructure operators should treat this as a Category 1 priority.
4. Apply Microsoft March 2026 Patch Tuesday, two actively exploited zero-days included.
   Microsoft patched 79-84 vulnerabilities on March 10, 2026, including two zero-days under active exploitation. Apply updates across all Windows environments immediately. Prioritize domain controllers, Exchange servers, and internet-facing systems. Validate that Adobe patches published the same cycle are also applied.
5. Patch Android devices and audit mobile device management policies, CVE-2026-0006, CVSS 9.8.
   The Android March 2026 patch rollup addresses CVE-2026-0006, a zero-day under active exploitation with a CVSS score of 9.8. Push updates to all managed Android devices via MDM immediately. Review BYOD policies for unmanaged devices. Additionally, CVE-2026-21385 (Qualcomm kernel privilege escalation, CVSS 7.8) is included in the same rollup.
6. Audit and patch Ivanti Endpoint Manager, SolarWinds, and VMware Workspace One, CISA KEV additions.
   CISA flagged high-severity vulnerabilities in Ivanti EPM, SolarWinds (CVE-2021-22054, CVSS 7.5), and VMware Workspace One as actively exploited. Apply available vendor patches. Organizations running Ivanti EPM should also validate that previously applied patches are complete, as CISA’s advisory indicates active exploitation of recently patched flaws, suggesting patch bypass activity or delayed deployment.

Key Security Stories

CyberStrikeAI: AI-Native Attack Platform Autonomously Compromises 600+ FortiGate Devices

An AI-native attack platform designated CyberStrikeAI has autonomously compromised more than 600 FortiGate devices in an ongoing campaign (SCC-CAM-2026-0001). This represents a qualitative shift in threat actor capability: the platform automates target identification, vulnerability selection, exploitation, and post-exploitation sequencing without continuous operator involvement. The campaign’s scale, hundreds of devices in a compressed timeframe, demonstrates that AI-assisted offensive tooling is moving from theoretical concern to operational reality.

FortiGate devices are deployed extensively as enterprise perimeter firewalls and VPN gateways. A compromised FortiGate provides an adversary with persistent access to internal network segments, the ability to intercept encrypted traffic, and a platform for lateral movement. Organizations running FortiGate appliances should audit firmware versions, review management access controls, and examine logs for indicators consistent with unauthorized configuration changes or unexpected outbound connections.

The AI-native nature of this platform also signals a detection challenge: attack cadence, timing, and technique selection may not match human-operated campaign patterns that existing behavioral analytics were trained to recognize. Detection teams should review their FortiGate-specific detection rules and consider whether anomaly thresholds account for high-velocity, automated exploitation patterns.

Source: SCC-CAM-2026-0001, SCC Pipeline, March 5, 2026

Cisco Secure Firewall Management Center: Dual CVSS 10.0 Vulnerabilities, No Workaround

Cisco disclosed two critical vulnerabilities in Secure Firewall Management Center, CVE-2026-20079 and CVE-2026-20131, both scoring CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Both are remotely exploitable, require no authentication, need no user interaction, and achieve full impact across confidentiality, integrity, and availability. Cisco explicitly confirmed no workaround is available. The only remediation path is patching.

Firewall Management Center is the centralized policy and configuration platform for Cisco Secure Firewall deployments. Compromise of FMC gives an attacker the ability to modify firewall rules across the entire managed environment, effectively removing network segmentation controls organization-wide. This is not a standard critical vulnerability; it is a control plane vulnerability with enterprise-wide blast radius.

Organizations should treat this as a P0 emergency patch event. If immediate patching is not possible, restrict FMC management access to dedicated, isolated management networks and implement out-of-band monitoring for configuration changes. Any FMC instance exposed to untrusted networks should be considered potentially compromised until patched and audited.

Source: SCC-CVE-2026-0004; Cisco PSIRT Advisory, March 2026

Microsoft March 2026 Patch Tuesday: 79-84 Vulnerabilities Including Two Actively Exploited Zero-Days

Microsoft released its March 2026 security update on March 10, 2026, addressing between 79 and 84 vulnerabilities across Windows, Office, Azure, and related products. Two vulnerabilities are confirmed as actively exploited zero-days at time of release. Adobe published a coordinated update addressing additional vulnerabilities in the same cycle. The patch volume is consistent with recent Patch Tuesday cadence, but the presence of two zero-days under active exploitation elevates urgency.

The EchoLeak vulnerability (CVSS 8.6), tracked separately, affects Microsoft Excel with Copilot integration and enables zero-click information disclosure. The attack requires no user interaction, simply opening a crafted document triggers data exfiltration through the AI Copilot interface. This is particularly significant for organizations that have deployed Microsoft 365 Copilot in environments handling sensitive or regulated data.

Cisco Talos published Snort rules for prominent vulnerabilities in this cycle. Organizations running network-based intrusion detection should update Snort/Suricata rules alongside patch deployment. Teams should prioritize applying patches to systems exposed to the internet or handling sensitive data before end of business on March 14.

Sources: SCC-STY-2026-0001 through SCC-STY-2026-0007; SCC-CVE-2026-0007; Microsoft Security Update Guide, March 2026; Cisco Talos

Iranian Cyber Campaign Escalates Following Military Operations

A multi-actor Iranian cyber campaign expanded significantly following military operations (SCC-CAM-2026-0003). The campaign involves coordinated activity across multiple Iranian threat groups operating in parallel rather than sequentially, a pattern consistent with Iran’s documented approach of using independent cyber units with overlapping target sets during periods of elevated geopolitical tension. Targeted sectors and specific TTPs are consistent with Iranian offensive cyber doctrine focused on disruption and intelligence collection.

Iran’s cyber capabilities have matured significantly over the past decade. Current campaigns demonstrate wiper deployment, data theft for information operations, and destructive attacks against critical infrastructure. Organizations in sectors historically targeted by Iranian actors, energy, government, defense industrial base, financial services, and telecommunications, should elevate monitoring posture and validate that incident response playbooks are current.

The timing correlation with military operations is a well-documented pattern for Iranian state-sponsored groups (tracked by MITRE ATT&CK as groups including APT33, APT34, and APT35). Security teams should cross-reference current threat intelligence for campaign-specific IOCs and consider temporarily lowering alert thresholds for Iranian TTPs including spear-phishing, credential harvesting, and VPN exploitation.

Source: SCC-CAM-2026-0003; MITRE ATT&CK, Iranian APT group profiles

APT28 Deploys Custom Covenant Variant for Long-Term Espionage Operations

Russian state-sponsored threat group APT28 (Fancy Bear, tracked by MITRE ATT&CK as G0007) is deploying a customized variant of the open-source Covenant post-exploitation framework. APT28’s modification of an open-source tool rather than using proprietary malware is a deliberate operational choice: it increases attribution complexity, reduces development overhead, and allows rapid capability updates. The campaign targets long-term espionage objectives rather than immediate destructive effects.

Covenant is a .NET-based C2 framework with extensive post-exploitation capabilities including credential harvesting, lateral movement, and payload delivery. APT28’s customization likely includes modified network signatures to evade detection rules tuned to default Covenant traffic patterns. Security teams should review their C2 detection logic for Covenant indicators and not rely solely on known-bad signature matches.

Concurrently, Russian state-sponsored actors have been linked to Signal and WhatsApp account hijacking campaigns targeting government officials, military personnel, and journalists (Dutch government warning, March 9, 2026). These campaigns use phishing linked devices to silently forward messages. Organizations handling sensitive communications should audit linked devices on Signal and WhatsApp accounts and enforce re-registration verification policies.

Sources: BleepingComputer, APT28 Covenant variant, March 10, 2026; MITRE ATT&CK G0007; Dutch government advisory via BleepingComputer, March 9, 2026

CISA KEV & Critical CVE Table

CVE	Product	CVSS	Status	KEV Deadline	Description
CVE-2026-20079	Cisco Secure Firewall Management Center	10.0	Patch-Critical; No Workaround	N/A (not yet KEV)	Unauthenticated remote code execution. Network-accessible, no user interaction required. Full C/I/A impact. Dual critical advisory with CVE-2026-20131.
CVE-2026-20131	Cisco Secure Firewall Management Center	10.0	Patch-Critical; No Workaround	N/A (not yet KEV)	Unauthenticated remote code execution. Paired with CVE-2026-20079 in March 2026 Cisco bundle advisory. No workaround available.
CVE-2026-22719	VMware Aria Operations	8.1	CISA KEV, Actively Exploited	March 24, 2026	Remote code execution via command injection. Network-accessible, no authentication required, high complexity. Added to CISA KEV March 3, 2026.
CVE-2017-7921	Hikvision IP Cameras	9.8	CISA KEV, Actively Exploited	March 26, 2026	Authentication bypass allowing unauthorized access to camera feeds and device configuration. Long-standing vulnerability now confirmed exploited in current campaigns. Added to CISA KEV March 5, 2026.
CVE-2021-22681	Rockwell Automation Logix Controllers (OT/ICS)	9.8	CISA KEV, Actively Exploited	March 26, 2026	Improper cryptographic verification allowing adversary to forge requests to Logix controllers. Critical infrastructure risk. Added to CISA KEV March 5, 2026.
CVE-2026-0006	Android (Google)	9.8	Zero-Day, Actively Exploited	N/A (not yet KEV)	Zero-day vulnerability under active exploitation, patched in Android March 2026 security rollup. Full C/I/A impact, network-accessible, no interaction required.
CVE-2026-21385	Qualcomm Android Kernel	7.8	High, Patch Available	N/A	Local privilege escalation in Qualcomm kernel component. Requires local access with low privileges. Included in Android March 2026 patch rollup.
CVE-2026-20122	Cisco Catalyst SD-WAN Manager	7.1	Confirmed Exploited, Campaign Expanding	N/A	Actively exploited as part of an expanding SD-WAN targeting campaign. Cisco PSIRT advisory March 5, 2026.
CVE-2026-20128	Cisco Catalyst SD-WAN Manager	7.1	Confirmed Exploited, Campaign Expanding	N/A	Second confirmed exploited CVE in the Cisco SD-WAN campaign. Paired with CVE-2026-20122 in Cisco PSIRT advisory March 5, 2026.
CVE-2021-22054	SolarWinds (product unspecified in source)	7.5	CISA KEV, Actively Exploited	TBD (per CISA KEV catalog)	Server-side vulnerability confirmed actively exploited. Added to CISA KEV catalog, March 10, 2026 advisory cycle.
EchoLeak (CVE TBD)	Microsoft Excel + Copilot	8.6	High, Zero-Click Information Disclosure	N/A	Zero-click vulnerability. Opening a crafted Excel document triggers information disclosure through Microsoft Copilot AI interface. No user interaction required beyond document open.
Ivanti EPM (CVE TBD)	Ivanti Endpoint Manager	High (CVSS unconfirmed)	CISA KEV, Actively Exploited	~March 31, 2026 (est. 3-week CISA deadline from March 10)	Recently patched Ivanti EPM flaw confirmed exploited. CISA ordered federal agencies to patch within three weeks of March 10 advisory. Source: BleepingComputer / CISA, March 10, 2026.

Note: CVE identifiers marked “TBD” were not confirmed in available source material for this reporting period. Specific CVE IDs should be validated against the CISA KEV catalog (cisa.gov/known-exploited-vulnerabilities-catalog) and vendor advisories before operational use. KEV deadlines apply to federal agencies under BOD 22-01; all organizations should treat KEV items as high-priority patches regardless of agency status.

Supply Chain & Developer Tool Threats

Malicious npm Package: @openclaw-ai/openclawai RAT and Credential Stealer

A malicious npm package named @openclaw-ai/openclawai was published to the npm registry, masquerading as an installer for the OpenClaw AI tool. The package deploys a remote access trojan and steals sensitive data from compromised macOS hosts, including credentials. The package was uploaded by a user account “openclaw-“, a typosquatting pattern designed to appear legitimate at a glance. This attack follows the now-standard malicious package playbook: impersonate a known tool name, target developers who install packages without verification, and weaponize the installation process itself.

Separately, Bing AI’s enhanced search feature actively promoted a fake OpenClaw GitHub repository hosting information stealers and proxy malware. Users following Bing AI search results were directed to malicious repositories with instructions to run commands deploying malware. This represents a new attack surface: AI-powered search surfaces are now being manipulated to serve as malware distribution channels. The OpenClaw campaign thus executed a two-vector attack, npm typosquatting for developers who search package registries, and AI-enhanced search poisoning for those who search the web.

Additionally, the “InstallFix” campaign spread fake Claude Code sites using a ClickFix-style technique, instructing developers to run malicious commands in their CLI under the guise of installation troubleshooting. This pattern exploits developer trust in AI coding tool setup instructions.

Sources: The Hacker News, malicious npm package, March 9, 2026; BleepingComputer, Bing AI/OpenClaw, March 5, 2026; Dark Reading, InstallFix campaign, March 9, 2026

Chrome Extension Supply Chain: Malicious Code Injected After Ownership Transfer

Two Google Chrome extensions associated with a single developer were transferred to new ownership and subsequently turned malicious. The new owners pushed updates that injected arbitrary code into the extension runtime and harvested sensitive user data from browser sessions. This attack exploits a structural gap in the browser extension ecosystem: extensions inherit their user base and trust reputation across ownership transfers, but the new owner’s identity and intent are not validated.

Organizations managing browser environments should inventory installed extensions, flag extensions that have changed ownership or publisher, and implement policies restricting extension installation to an approved list. Enterprise Chrome management via Google Admin Console supports extension allowlisting. Security teams should treat any extension update that introduces new permissions or network destinations as a potential supply chain event requiring review.

Source: The Hacker News, Chrome extension ownership transfer, March 9, 2026

Michelin Data Breach Linked to Oracle E-Business Suite Attack Campaign

Michelin suffered a data breach linked to an active attack campaign targeting Oracle E-Business Suite deployments (SCC-DBR-2026-0001, CVSS 8.6). Oracle EBS is widely deployed in enterprise environments for ERP, HR, and supply chain functions, making it a high-value target for both financially motivated actors and nation-state groups seeking operational data. The campaign targeting EBS installations represents a supply chain-adjacent risk: attackers targeting widely deployed enterprise application platforms can achieve broad impact across many organizations running similar configurations.

Organizations running Oracle E-Business Suite should validate that all available Oracle Critical Patch Updates are applied, audit administrative and service account access, and review logs for indicators of unauthorized data access or configuration changes. Given the active campaign context, network monitoring for anomalous EBS API activity is advisable.

Source: SCC-DBR-2026-0001

UNC4899 (North Korea): Developer AirDrop Trojanized File Leads to Crypto Firm Compromise

North Korean threat actor UNC4899 breached a cryptocurrency organization after a developer unknowingly AirDropped a trojanized file to their work device. The attack chain began with social engineering, the developer accepted an AirDrop transfer, likely believing it was a legitimate file, and the trojanized file then provided UNC4899 with access to the corporate environment. This technique is notable because it exploits a trusted, proximity-based peer-to-peer transfer mechanism rather than email phishing or web-based delivery.

Security teams and developers should treat AirDrop and similar proximity-based transfer mechanisms with the same scrutiny applied to email attachments. Organizational policies should restrict AirDrop to “Contacts Only” on corporate devices, or disable it entirely. The cryptocurrency sector remains a primary UNC4899 target, but the technique is transferable to any environment where developers use personal devices alongside work systems.

Source: The Hacker News, UNC4899, March 9, 2026

Nation-State & APT Activity Summary

Russia, APT28 (G0007): Custom Covenant C2, Signal/WhatsApp Hijacking

APT28 deployed a customized Covenant post-exploitation framework variant in ongoing long-term espionage operations. The custom build is designed to blend with legitimate traffic and evade signature-based detection. Concurrently, Russian state-sponsored actors (attribution to specific group pending verification per source reporting) targeted government officials, military personnel, and journalists with Signal and WhatsApp account hijacking campaigns via phishing-linked device registration. The Dutch government issued a public warning on March 9, 2026.

• Targeted sectors: Government, military, journalism, defense
• Primary TTPs (MITRE ATT&CK): T1219 (Remote Access Software, Covenant C2), T1566 (Phishing), T1550 (Use Alternate Authentication Material, linked device abuse), T1078 (Valid Accounts)
• Detection guidance: Monitor for Covenant-pattern C2 beaconing with modified signatures; audit Signal/WhatsApp linked device registrations on accounts used by sensitive personnel; alert on unexpected device registrations

Iran, Multi-Actor Campaign Following Military Operations

Multiple Iranian threat groups are operating in a coordinated parallel campaign, consistent with Iran’s documented pattern of launching cyber operations during periods of heightened geopolitical tension. Iranian groups associated with this activity pattern include actors tracked as APT33, APT34, and APT35 by MITRE ATT&CK. Campaign objectives include disruption, intelligence collection, and data theft for information operations.

• Targeted sectors: Energy, government, defense industrial base, financial services, telecommunications, critical infrastructure
• Primary TTPs: T1566 (Phishing), T1190 (Exploit Public-Facing Application), T1485 (Data Destruction, wiper deployment history), T1589 (Gather Victim Identity Information)
• Recommended posture: Elevate monitoring for Iranian-associated IOCs; validate incident response playbooks include wiper attack scenarios; patch VPN and remote access infrastructure immediately

China, Years-Long Campaign Against Asian Critical Infrastructure

A Chinese threat actor has conducted a years-long campaign targeting high-value organizations across South, Southeast, and East Asia. Targeted verticals include aviation, energy, government, law enforcement, pharmaceutical, technology, and telecommunications. The campaign uses web server exploits for initial access and Mimikatz for credential harvesting and lateral movement, tools well within detection capability for organizations with mature SOC operations, but effective against organizations with limited visibility into server-side activity.

• Targeted sectors: Aviation, energy, government, law enforcement, pharmaceuticals, technology, telecommunications
• Primary TTPs: T1190 (Exploit Public-Facing Application), T1003 (OS Credential Dumping, Mimikatz), T1021 (Remote Services, lateral movement)
• Detection guidance: Alert on Mimikatz behavioral signatures (LSASS memory access); audit web server access logs for exploit patterns; review privileged account activity for lateral movement indicators

North Korea, UNC4899: Crypto Sector Targeting via Developer Social Engineering

UNC4899 continues targeting cryptocurrency organizations, now demonstrating capability to weaponize proximity-based file transfer (AirDrop) as an initial access vector. The actor is assessed with moderate confidence as state-sponsored, consistent with North Korea’s documented financial motivation for cryptocurrency theft operations.

• Targeted sectors: Cryptocurrency, financial services, technology
• Primary TTPs: T1204.002 (User Execution, Malicious File), T1566.004 (Phishing via proximity-based transfer, novel variant), cloud compromise techniques

Pakistan, APT36: AI-Assisted Malware Development at Scale

Pakistan’s APT36 threat group is using AI-assisted “vibe-coding” techniques to generate malware at scale. While the individual malware samples produced by this method are described as technically mediocre, the volume of unique variants created overwhelms signature-based defenses and strains analyst triage capacity. This is the practical operational threat from AI-assisted offensive tooling: not sophistication, but scale.

• Targeted sectors: Indian government and military (historical targeting), expanding
• Detection implication: Behavioral detection and heuristic analysis become more critical as signature-based approaches are volume-saturated; EDR behavioral rules should be prioritized over IOC-only detection
• Source: Dark Reading, APT36 AI malware, March 5, 2026

Phishing & Social Engineering Alert

Fake IT Support Vishing Campaign Deploys Havoc C2, Ransomware Precursor (SCC-CAM-2026-0002)

An active vishing (voice phishing) campaign has threat actors posing as IT support personnel to trick employees into granting remote access. Once access is obtained, operators deploy Havoc, an open-source C2 framework, as a persistent foothold. The campaign is assessed as a ransomware precursor: Havoc establishes the access and reconnaissance capability that precedes ransomware deployment in most modern double-extortion campaigns. The campaign has a high priority score (0.78) in the SCC pipeline.

A parallel campaign uses Microsoft Teams phishing to target employees at financial and healthcare organizations. Attackers contact targets over Teams, impersonating IT support, and convince them to grant remote access via Quick Assist. The Teams vector is particularly effective because many employees trust internal-appearing Teams messages as inherently legitimate, and Quick Assist is a Microsoft-native tool that may not trigger endpoint security alerts.

Attack characteristics:

• Initial contact via phone (vishing) or Microsoft Teams message impersonating IT support
• Pretext: urgent IT issue requiring remote access to resolve
• Tool of choice: Quick Assist (Microsoft native, lower detection profile) or other remote access tools
• Post-access payload: Havoc C2 framework for persistence, reconnaissance, and lateral movement
• End goal: Ransomware deployment following environment reconnaissance

Evasion methods:

• Microsoft-native tools (Teams, Quick Assist) to avoid triggering third-party tool alerts
• Open-source C2 (Havoc) to complicate attribution and evade commercial threat intel feeds tuned to proprietary malware
• Social engineering leverages authority (IT support) and urgency, standard pretexting that bypasses technical controls

Detection guidance:

• Alert on Quick Assist or Remote Desktop session initiation by non-IT personnel accounts
• Monitor for Havoc C2 behavioral indicators: irregular beaconing, .NET-based process injection patterns
• Train users: IT support will not initiate contact via Teams and request remote access without a prior ticket
• Implement Teams external access controls to prevent or flag messages from unverified external accounts
• MITRE ATT&CK TTPs: T1566.004 (Phishing via Voice), T1219 (Remote Access Software), T1059 (Command and Scripting Interpreter, post-access), T1486 (Data Encrypted for Impact, ransomware end-state)

Sources: SCC-CAM-2026-0002; BleepingComp