Good morning. This is your security briefing for Tuesday, March 10, 2026, covering nine articles analyzed overnight. All attribution is by the article authors. All article analysis is automated.
ESET reports that the Sednit group, also known as APT28 and Fancy Bear, has re-emerged with an updated malware toolkit targeting Ukrainian military personnel for long-term espionage operations. The campaign employs two primary implants: BeardShell, a custom C++ implant using cloud storage for command and control with advanced obfuscation techniques, and a heavily modified version of the Covenant .NET post-exploitation framework, enabling persistent access even if one infrastructure is disrupted.
Check Point Research has identified Chinese-nexus APT actors, specifically Camaro Dragon also known as Earth Preta and Mustang Panda, intensifying their targeting of Qatar following regional escalations in the Middle East. Two distinct campaigns deploy the PlugX backdoor and Rust-based loaders using geopolitical lures related to attacks on U.S. bases and impersonating Israeli government communications, demonstrating rapid adaptability in exploiting current events.
Red Asgard's forensic analysis of a compromised Lazarus Group operator machine revealed the Contagious Interview campaign targeting 16,952 crypto and Web3 developers through fake job outreach and malware-laden repositories. Investigators recovered 69 gigabytes of data including victim directories, six drained cryptocurrency wallets with seed phrases, and evidence of an industrialized operation with significant operational security failures by the operator.
BlueVoyant reports that threat group Blitz Brigantine, also tracked as Storm-1811, is deploying A0Backdoor malware through social engineering campaigns targeting finance and health sectors. Attackers impersonate IT support on Microsoft Teams, convince victims to grant Quick Assist access, then deploy a backdoor using malicious DLL sideloading and DNS-based command and control tunneling, with the campaign active since August 2025 and linked to Black Basta and Cactus ransomware affiliates.
SentinelOne has identified attackers compromising FortiGate next-generation firewall appliances through vulnerability exploitation or weak credentials, extracting service account credentials from configuration files. These stolen credentials enabled enrollment of rogue workstations into Active Directory, deployment of remote management tools like Pulseway and MeshAgent, and exfiltration of the NTDS.dit file containing Active Directory database information.
Datadog Security Labs researcher Martin McCloskey reports an active adversary-in-the-middle phishing campaign targeting AWS console credentials using typosquatted domains and real-time proxy infrastructure to intercept credentials and session tokens. Attackers have demonstrated rapid exploitation, gaining unauthorized access to AWS accounts within 20 minutes of credential submission, often through VPN connections, using a sophisticated phishing kit with multi-stage redirects and an exposed administrative panel for real-time credential monitoring.
Salesforce Security is tracking an increase in threat actor activity exploiting misconfigurations in Experience Cloud guest user profiles to gain unauthorized access to customer data. The attackers use a modified version of the open-source Aura Inspector tool to scan public-facing sites and extract sensitive data like names and phone numbers by querying the /s/sfsites/aura endpoint, with the harvested data used for follow-on social engineering and phishing campaigns.
The European Union Agency for Cybersecurity published a technical advisory on March 10th providing guidance for developers on securely using package managers and third-party packages in software development. The advisory addresses common risks associated with third-party dependencies and outlines secure practices for package selection, integration, and monitoring throughout the software development lifecycle.
Microsoft is introducing Entra passkeys for Windows devices in mid-March 2026, enabling phishing-resistant passwordless authentication through Windows Hello using biometrics or PIN. Passkeys are stored in the Windows Hello container and authenticated locally, providing enhanced protection against phishing attacks, though organizations must opt-in and configure specific FIDO2 authentication settings and authorized authenticator identifiers for Windows Hello.
That concludes today's briefing.