Good morning. Yesterday's security developments from Wednesday, March 11, 2026, covering 8 articles across nation-state operations, malware infrastructure, and breach disclosures. All attribution is by the article authors. All article analysis is automated.
Stryker Corporation filed an 8-K disclosure reporting a cybersecurity incident affecting their Microsoft environment with suspected Iranian attribution. The medical device manufacturer reports global disruption to IT systems but states there's no indication of ransomware or malware, though investigations continue with external experts into potential data exposure and operational impacts.
According to the Proofpoint Threat Research Team, Iranian state-sponsored groups along with threat actors from China, Belarus, Pakistan, and Hamas have significantly escalated espionage operations targeting Middle Eastern government and diplomatic organizations following US and Israeli strikes on Iran in February. The campaigns employ credential phishing, spoofed authentication pages, and various malware delivery methods including Cobalt Strike and Rust backdoors, with multiple APT groups leveraging conflict-themed lures for intelligence gathering.
Hunt.io researchers uncovered Operation Roundish, where APT28, also known as Fancy Bear, deployed a sophisticated exploitation toolkit targeting Roundcube webmail instances used by Ukrainian government entities including the State Migration Service. The toolkit enables credential harvesting, persistent mail forwarding, bulk email exfiltration, two-factor authentication secret extraction, and includes a Go-based implant named 'httd' for establishing persistence on compromised systems.
Research by Eugenio Benincasa reveals that European universities, particularly French institutions like INSA engineering schools, have established cybersecurity partnerships with Chinese defense-linked universities such as Beihang University. France cancelled a planned joint institute due to concerns over dual-use knowledge transfer in fields like software engineering and information security that could benefit China's military and intelligence objectives, including offensive cyber capabilities and espionage operations.
Black Lotus Labs discovered KadNap, a sophisticated botnet malware that has infected over 14,000 Asus routers since August 2025. The malware uses a custom Kademlia distributed hash table protocol to obscure command-and-control infrastructure and transforms compromised devices into proxies for malicious traffic routing, primarily serving the Doppelganger proxy service.
Researchers at newtonpaul.com uncovered a phishing campaign exploiting Microsoft's Device Code Authentication mechanism through malicious pages hosted on Cloudflare Worker Pages domains. Attackers trick victims into completing a legitimate Microsoft authentication flow using fake Adobe service pages, then intercept the device code to obtain access and refresh tokens for account compromise.
Reuters reports that a foreign hacker compromised FBI servers at the New York Field Office in February 2023, accessing files related to the Jeffrey Epstein investigation. The breach occurred when Special Agent Aaron Spivack inadvertently left a server vulnerable in the Child Exploitation Forensic Lab, though the hacker was later de-escalated after FBI officials revealed their identity via video chat.
That concludes today's briefing.