Good morning. This is your security briefing for Tuesday, March 31, 2026, covering 9 articles analyzed overnight. All attribution is by the article authors. All article analysis is automated.
CISA has added CVE-2026-3055 to its Known Exploited Vulnerabilities catalog. This critical memory overread vulnerability in Citrix NetScaler ADC and Gateway configured as SAML Identity Providers allows unauthenticated attackers to extract sensitive data from enterprise identity infrastructure through out-of-bounds memory reads. Active exploitation is confirmed in the wild against internet-facing deployments, and defenders must immediately upgrade to patched versionsβ14.1-66.59, 13.1-62.23, or 13.1 FIPS/NDcPP-37.262 or laterβand check SAML authentication logs for indicators of compromise.
Check Point Research reports an Iran-linked threat actor conducted a password-spraying campaign against Microsoft 365 environments across three waves in March, targeting over 300 organizations in Israel and 25 plus in the UAE. The attackers used Tor exit nodes, VPN services, and red-team tools to gain access and exfiltrate data, with targeting aligned to kinetic operations including municipalities hit by Iranian missile attacks, showing tactical overlap with known Iran-nexus actors like Gray Sandstorm.
According to investigace.cz, Czech company Sigi Consulting received approximately 2.2 million crowns, about 93,000 euros, for intermediary services from Intellexa's Irish branch, the consortium behind Predator spyware. The transaction occurred when Juval Rabin, son of former Israeli Prime Minister Yitzhak Rabin, was a director at the company, and Predator spyware is allegedly used by governments worldwide to monitor journalists, opposition figures, and civil society members.
The Cyber Defense Review introduces the Offense Death Cycle, a proactive defensive framework designed to counter Advanced Persistent Threats through environmental control. The framework emphasizes a continuous loop of intelligence gathering, induced friction, and anticipation to exhaust persistent adversaries by leveraging home-field advantage, contrasting with reactive frameworks like the Cyber Kill Chain and MITRE ATT&CK by prioritizing environmental manipulation over incident response.
The Internet Engineering Task Force has published RFC 9849, introducing the Encrypted Client Hello extension for TLS 1.3 and later versions. This extension encrypts the ClientHello message including Server Name Indication to prevent passive network observers from identifying target servers, and includes downgrade resistance and mitigations against client reaction attacks, requiring implementation changes for clients, client-facing servers, and backend servers.
Feisty Duck reports that Google is leading a redesign of Web PKI by introducing Merkle Tree Certificates to address challenges from post-quantum cryptography's larger signature sizes and Certificate Transparency system fragility. The initiative merges Certificate Transparency with certificate issuance, planned for deployment in 2027, and uses landmark certificates with inclusion proofs to reduce certificate size during the transition to post-quantum algorithms.
The Department of Justice announced charges against Jonathan Spalletta, a Maryland man accused of defrauding Uranium Finance cryptocurrency exchange of over 50 million dollars through two smart contract exploits in April 2021. He allegedly exploited bugs in smart contracts to drain liquidity pools, extorted the exchange for a sham bug bounty, and laundered funds through Tornado Cash mixer before purchasing high-value collectibles, with law enforcement seizing approximately 31 million dollars of the stolen cryptocurrency.
Check Point Research disclosed Operation TrueChaos, which exploited a zero-day vulnerability, CVE-2026-3502, in TrueConf's update mechanism to target government entities in Southeast Asia. Attackers compromised on-premises TrueConf servers to distribute malicious updates containing the Havoc post-exploitation framework, achieving arbitrary code execution on connected endpoints through DLL side-loading.
The Socket Research Team reports a supply chain attack compromised the widely-used Axios JavaScript HTTP client through a malicious npm dependency called plain-crypto-js in versions 1.14.1 and 0.30.4. The attack, facilitated by a compromised npm publisher account, deployed platform-specific payloads including a macOS RAT, Windows VBScript and PowerShell malware, and Linux Python scripts capable of arbitrary command execution and data exfiltration, employing custom encoding schemes and anti-forensics techniques to evade detection.
That concludes today's briefing.