Good morning. This is your security briefing for Tuesday, March 03, 2026, covering 13 articles analyzed overnight. All attribution is by the article authors. All article analysis is automated.
We have a critical security alert. CVE-2026-22719, a remote code execution in VMware Aria Operations allows unauthenticated remote code execution during support, has been added to the CISA Known Exploited Vulnerabilities catalog.
According to reports from both Google Threat Intelligence Group and the iVerify Team, a sophisticated iOS exploit kit named Coruna has been discovered containing 23 exploits across five full exploit chains targeting iOS versions 13.0 through 17.2.1. The kit was used by multiple threat actors including Russian espionage group UNC6353 in watering hole attacks against Ukrainian users and Chinese financially motivated actor UNC6691 in campaigns through fake financial websites, achieving remote code execution in Safari and local privilege escalation. The discovery highlights an active zero-day exploit market where nation-state-grade capabilities are being shared across different threat actors for mass-scale surveillance operations targeting ordinary iPhone users rather than high-profile individuals.
Calif reports that CVE-2025-38617 is a Linux kernel vulnerability in packet sockets that enables privilege escalation to root access through a heap buffer overflow in the packet_set_ring function. The exploit manipulates the tp_reserve field and relies on a race condition timing attack, allowing attackers to gain complete system control, steal data, and establish persistence on Linux systems using packet socket functionality.
Quarkslab researchers discovered three vulnerabilities in Avira Internet Security versions up to 1.1.109.1990 that enable arbitrary file deletion and local privilege escalation to SYSTEM level. The flaws include a software updater symbolic link vulnerability, insecure deserialization using BinaryFormatter, and a TOCTOU vulnerability in the Optimizer component, with a fix now available in version 1.1.114.3113.
According to Nordic Financial CERT, the 2026 Cyber Threat Landscape report identifies multiple threat actors targeting the Nordic financial sector, including organized crime groups conducting credential theft and ransomware campaigns, and nation-states exploiting supply chains for intelligence gathering. Emerging threats include exploitation of AI and large language models by adversaries, post-quantum cryptography risks from harvest-now-decrypt-later strategies, and significant concerns about indirect exposure through compromised third parties and shared infrastructure.
Mike reports that researchers discovered 14 active PlugX malware staging domains linked to PRC threat actors Mustang Panda, UNC6384, and RedDelta targeting governments, diplomatic entities, and civil society organizations. The infrastructure uses Evoxt Enterprise VPS before moving behind Cloudflare, with domains registered through NameCheap and NameSilo, demonstrating sophisticated tradecraft including re-registering expired domains and rapid deployment cycles of 1-3 days.
Arctic Wolf reports that India-nexus threat actor SloppyLemming conducted a year-long campaign from January 2025 to January 2026 targeting government entities and critical infrastructure in Pakistan, Bangladesh, and Sri Lanka. The operation deployed custom malware including BurrowShell backdoor via malicious PDFs and a Rust-based keylogger through macro-enabled Excel documents, leveraging over 112 domains and abusing Cloudflare Workers for command and control infrastructure while targeting nuclear facilities, defense, telecommunications, energy, and financial institutions.
Ctrl-Alt-Intel reports that DPRK-linked threat actors conducted a sophisticated campaign targeting cryptocurrency organizations through exploitation of the React2Shell vulnerability and compromised AWS credentials. Attackers systematically enumerated cloud infrastructure, accessed secrets from AWS Secrets Manager and Kubernetes, and performed lateral movement from AWS IAM to Kubernetes while using South Korean VPN nodes for obfuscation, resulting in exfiltration of proprietary software and sensitive data from crypto staking platforms and exchanges.
InfoStealers reports that a LummaC2 infostealer infection exposed a North Korean state-sponsored operation called Vueyi that used an Indonesian facilitator as a proxy to run cryptocurrency scams and fake IT worker schemes. The infection originated from gaming mod downloads and exfiltrated credentials for CDN infrastructure, fake worker networks, and a Bitcoin wallet containing $65,000, with the operation employing deepfake technology for HR interviews and identity synthesis to target Western platforms including cryptocurrency exchanges.
ClearSky Research Team reports that a Russian state-aligned threat actor, tentatively linked to APT28, has launched a cyber campaign against Ukrainian entities using two new malware strains: BadPaw, a .NET loader, and MeowMeow, a sophisticated backdoor. The attack begins with phishing emails containing HTA files that deploy the malware, which employs advanced evasion techniques including virtual machine detection and .NET Reactor obfuscation to avoid analysis.
Check Point Research reports that Silver Dragon, a Chinese-nexus APT group potentially linked to APT41, has been actively targeting government entities in Southeast Asia and Europe since mid-2024, with specific campaigns against Uzbekistan. The group uses phishing emails, exploits public-facing servers, and deploys custom tools alongside Cobalt Strike beacons for post-exploitation, utilizing Google Drive for command and control infrastructure.
Microsoft reports that attackers are exploiting OAuth redirection mechanisms to deliver phishing and malware by crafting URLs with silent authentication flows and invalid scopes that trigger error redirects to attacker-controlled sites. The technique primarily targets government and public-sector organizations and bypasses traditional security measures by leveraging trusted identity provider domains, making detection difficult compared to conventional credential theft attacks.
Recurity Labs announced that Felix 'FX' Lindner, founder and owner of the company, passed away on March 1, 2026. The organization will continue operations maintaining his values of technical excellence, professionalism, and integrity while honoring his impact on the security community as a collaborator, mentor, and teacher.
That concludes today's briefing.