Good morning. This is your security briefing for Friday, April 03, 2026, covering 12 articles analyzed overnight. All attribution is by the article authors. All article analysis is automated.
The National Cyber Security Centre and international partners are warning of targeted attacks by Russia-based actors against popular messaging applications including WhatsApp, Messenger, and Signal. According to the NCSC, these attacks primarily target high-risk individuals such as government officials, using social engineering techniques to obtain verification codes, add unauthorized devices, join group chats covertly, and impersonate contacts. The advisory recommends enabling two-step verification, avoiding sharing verification codes, and using corporate services for work communications.
The FBI has issued a Public Service Announcement warning about data security risks from foreign-developed mobile applications, particularly those originating from China. According to the FBI, these apps can collect extensive user data including personal information and contact lists, which may be accessible to foreign governments under their national security laws. The apps pose risks through persistent data collection, storage on foreign servers, and potential embedded malware that can exploit device vulnerabilities.
Politico reports that the FBI has classified a suspected Chinese cyber intrusion into its surveillance system as a major cyber incident. Hackers gained unauthorized access to law enforcement sensitive information and personally identifiable information about FBI investigation subjects by exploiting a commercial ISP's vendor infrastructure. The breach represents a significant counterintelligence success for China and poses major risks to U.S. national security.
Ukraine's CERT-UA reports a decrease in cyber incidents during the second half of 2025 while highlighting emerging threats from advanced social engineering tactics and the proliferation of standardized hacker toolkits. The Ukrainian cybersecurity authority warns that threat actors are leveraging increasingly sophisticated methods despite the overall reduction in incident volume.
Hunt.io has published an analysis of the Axios supply chain attack, which involved attackers compromising a primary maintainer's npm account to publish malicious versions of the popular Axios JavaScript library. The attack deployed a multi-stage dropper that executed cross-platform RATs on macOS, Windows, and Linux systems in under two seconds, with attribution suggested to BlueNoroff or TA444.
Silverfort has discovered a bypass in the Group Policy mechanism intended to disable NTLMv1 authentication in Active Directory. The bypass exploits a flag in the NETLOGON_LOGON_IDENTITY_INFO structure that can override Group Policy settings, allowing attackers to force NTLMv1 authentication and conduct credential theft, relay attacks, and lateral movement. Microsoft acknowledges the behavior but does not classify it as a vulnerability, noting that NTLMv1 will be removed in Windows 11 24H2 and Server 2025.
ironsh has released iron-proxy, an egress firewall tool designed to secure untrusted workloads in CI pipelines, AI coding agents, and sandboxed containers. According to ironsh, it functions as a MITM proxy with a built-in DNS server, enforcing default-deny policies for outbound traffic and implementing boundary-level secret injection to prevent credential exfiltration.
infernux has released log-horizon, a Microsoft Sentinel SIEM analysis tool that evaluates log sources to determine their security value and cost-effectiveness. The tool classifies log tables, maps detection coverage, identifies gaps in log ingestion, and provides cost-value scoring across four operational phases using a knowledge base of 344 plus entries covering 190 plus connectors.
SpecterOps researcher Allen DeMoura has developed ghostsurf, a tool that enables browser-based NTLM relay attacks by overcoming limitations in existing tools like ntlmrelayx. According to SpecterOps, the tool addresses the challenge of handling multiple parallel browser connections during NTLM authentication relay, enabling attackers to browse authenticated web applications like CyberArk PAM and access sensitive secrets.
Whispergate has released InfraGuard, a red team tool that functions as a Command and Control redirector and infrastructure protection system. It validates incoming requests against C2 profiles, filtering out scanners, bots, and blue team probes by redirecting them to decoy sites while allowing legitimate beacon traffic to reach the teamserver.
SpiderLabs researcher Tom Neaves has demonstrated a method to passively track wireless devices by exploiting RF power levels to defeat MAC address randomization. The technique correlates signal strength over time with changing MAC addresses, affecting 802.11 Wireless, Bluetooth, and BLE devices, bypassing privacy measures designed to prevent device tracking.
Team Cymru has analyzed the Yurei double extortion ransomware campaign, which employs a comprehensive operator toolkit containing legitimate tools like AnyDesk, PsExec, and winPEAS alongside custom scripts for network enumeration, credential theft, and ransomware deployment. According to Team Cymru, the toolkit appears designed for users of RMM tools like Scout and Recon, enabling attackers to conduct reconnaissance, lateral movement, and disable security software before deploying ransomware and threatening to leak stolen data.
That concludes today's briefing.