Good morning. Yesterday's security developments from Sunday, March 29, 2026. We analyzed 12 articles. All attribution is by the article authors. All article analysis is automated.
eSentire reports that a North Korean APT group has deployed EtherRAT, a Node.js backdoor using Ethereum smart contracts for resilient command and control communication via a technique called EtherHiding. The malware targets retail, business services, software, and finance sectors, stealing cryptocurrency wallets and cloud credentials while evading detection through CDN-like beaconing and self-reobfuscation capabilities.
Security researcher Patrick Wardle at the Objective-See Foundation discovered and reverse-engineered undocumented Endpoint Security events in macOS 26.4 that enable network connection monitoring. The ES_EVENT_TYPE_RESERVED_5 authorization event fires before outbound connections and allows security tools to permit or deny them, offering new hooks for building firewall-like capabilities through Endpoint Security APIs.
AWS Labs has released the Threat Modeling MCP Server, an automated tool that integrates with LLM clients to perform comprehensive threat modeling using the STRIDE methodology. The server automates business context analysis, architecture analysis, threat actor identification, and includes automatic code security validation against identified threats for software developers, security engineers, and architects.
Cisco AI Defense announced DefenseClaw, an enterprise governance layer designed to mitigate security risks from AI agents built on frameworks like OpenClaw. It addresses threats including data exfiltration through malicious skills, code injection vulnerabilities, and compromised infrastructure by scanning skills, MCP servers, and plugins before execution using a multi-component architecture with CLI, Gateway, and Plugin components.
The European Commission experienced a cyber-attack targeting its public-facing Europa web platform on March 30, 2026. Initial containment measures were implemented and an investigation is ongoing, though limited technical details about the attack vector or type have been disclosed.
On March 10, 2025, X platform experienced significant outages affecting thousands of users. Elon Musk claimed a 'massive cyberattack' was responsible, though evidence from X and attackers claiming credit was reportedly very limited, highlighting vulnerabilities in large social media platforms and raising questions about attribution.
Synacktiv researchers detail Resource-Based Constrained Delegation attacks in cross-domain and cross-forest Active Directory environments. The technique allows attackers with credentials in a child domain to modify the msDS-AllowedToActOnBehalfOfOtherIdentity attribute and impersonate privileged users in parent domains using Kerberos S4U2Self and S4U2Proxy protocols, demonstrating privilege escalation across domain trust boundaries.
watchTowr reports that Citrix NetScaler appliances configured as SAML IDPs are affected by memory overread vulnerabilities tracked as CVE-2026-3055, with active in-the-wild exploitation observed since at least March 27th. The vulnerabilities allow attackers to leak sensitive memory contents including administrative session IDs through malformed requests, potentially leading to complete appliance compromise.
F5 disclosed that CVE-2025-53521, a critical RCE vulnerability in BIG-IP APM systems, allows unauthenticated attackers to execute arbitrary code. Originally categorized as a DoS with CVSS 7.5, it has been re-classified to RCE with CVSS 9.8 and is actively being exploited in the wild, prompting F5 to recommend immediate patching.
Mattiwatti released 'efiguard-detected', a detection tool that identifies when EfiGuard has disabled Windows PatchGuard by exploiting a SetVariable backdoor left by EfiGuard's default DSE bypass method. The tool reads two bytes from ntoskrnl's base address from user mode, returning 'MZ' if the backdoor is active and PatchGuard is disabled.
A security researcher reverse-engineered Apple's new Background Security Improvements mechanism that silently installs security updates without user interaction. Analysis revealed Apple fixed at least two undisclosed vulnerabilities beyond the publicly acknowledged CVE-2026-20643, including a WebGL integer overflow in ANGLE and ServiceWorker dangling reference issues.
GitHub user nicocha30 released Ligolo-IWA, a JavaScript agent that runs Ligolo-ng network tunneling capabilities inside Chrome and Edge browsers by leveraging Isolated Web Applications. The tool enables advanced network tunneling through browser isolation and claims to bypass EDR detection, requiring installation via developer interfaces in Chrome 120 or later.
That concludes today's briefing.