The cybercrime group TeamPCP launched CanisterWorm, a multi-stage malware campaign affecting Iranian systems and CI/CD pipelines. The wiper targets machines using Iranian time zones or Farsi locales, erasing local data. The worm spreads through npm packages, hijacking developer credentials and establishing persistent systemd services for follow-on payloads.

TeamPCP also compromised Aqua Security's GitHub organization, defacing 44 repositories and exposing internal code, CI/CD workflows, and sensitive configurations. Access was achieved via a stolen service account token from a prior Trivy supply-chain compromise. This highlights the persistence of threat actors within development environments.

Oracle released an emergency patch for CVE-2026-21992 in Fusion Middleware Identity Manager and Web Services Manager. The vulnerability permits unauthenticated remote code execution. No active exploitation has been reported, but the low-complexity flaw represents a high-risk target for attackers.

Trio-Tech International disclosed a ransomware attack on its Singapore subsidiary, resulting in encrypted files and partial public data exposure. Response protocols included offline systems, third-party cybersecurity engagement, and law enforcement notification. The incident remains under investigation for full scope assessment.

Citrix patched CVE‑2026‑3055 in NetScaler ADC and Gateway appliances, which allows unauthenticated out-of-bounds memory reads when configured as a SAML Identity Provider. No exploitation in the wild has been confirmed. The vulnerability's low complexity underscores a notable risk.

The threat actor TeamPCP compromised Aqua Security's internal GitHub organization, aquasec-com, renaming and defacing all 44 repositories in a rapid two-minute operation. Forensic analysis links the attack to a stolen service account token from a previous Trivy GitHub Actions compromise, granting write access across multiple internal repos. The exposed repositories include core security products, CI/CD pipelines, internal tooling, and knowledge bases, potentially revealing sensitive code, configurations, and credentials.

The cybercrime group TeamPCP deployed CanisterWorm, a multi-stage malware campaign, combining a wiper targeting Iranian systems with a self-propagating worm in CI/CD pipelines and the npm ecosystem. The wiper spreads via exposed cloud services, erasing data on hosts set to Iranian time zones or Farsi locales, while the worm steals credentials, hijacks packages, and persists on developer workstations through systemd services. CanisterWorm leverages blockchain-based ICP canisters as decentralized command-and-control channels, enabling follow-on payloads, republishing of compromised npm packages, and demonstrating TeamPCP’s automated, cloud-native, and resilient approach to large-scale exploitation and supply chain attacks.

Operation Alice, led by German authorities with Europol support, dismantled over 373,000 dark web sites used to advertise child sexual abuse material (CSAM) and cybercrime-as-a-service (CaaS). The investigation, spanning nearly five years, centred on a fraudulent platform run by a Chinese national, unmasking 440 customers and generating international cooperation across 22 countries. Authorities seized 105 servers in Germany, issued an international arrest warrant for the administrator, and continue investigating more than 100 individuals linked to the operation.

Europol and six national authorities disrupted Tycoon2FA, a subscription-based phishing-as-a-service platform targeting MFA-protected cloud accounts, by seizing 330 domains forming its core infrastructure. Initial activity declined briefly, but CrowdStrike observed campaign volumes returning to pre-disruption levels, with operators continuing established tactics like adversary-in-the-middle attacks and AI-generated decoy pages.

Oracle released fixes for CVE-2026-21992, a critical flaw in Fusion Middleware Identity Manager and Web Services Manager that allows unauthenticated remote code execution. No in-the-wild exploitation or public proof-of-concept has been reported, but the vulnerability’s low complexity and potential access make it a high-risk target. Arctic Wolf notes prior exploitation of similar Fusion Middleware zero-days by ransomware groups.

Trio-Tech International reported that a Singaporean subsidiary suffered a ransomware attack on March 11, 2026, resulting in encryption of certain network files and the subsequent publication of some data. The subsidiary activated response protocols, took systems offline, engaged third-party cybersecurity professionals, and notified law enforcement. The full scope of affected data is still under investigation, and the incident is now considered a potentially material cybersecurity event, though no disruption to overall operations has been reported.

Citrix released fixes for CVE‑2026‑3055, a critical vulnerability in NetScaler ADC and NetScaler Gateway that allows unauthenticated out-of-bounds memory reads when configured as a SAML Identity Provider. No exploitation in the wild or public proof-of-concept has been reported, but the vulnerability’s low complexity and history of targeting similar flaws in NetScaler highlight a significant risk.

LevelBlue SpiderLabs investigated a modular malware campaign initially detected via a Visual Basic Script (VBS) that employed Unicode obfuscation and a fileless PowerShell loader. The attack used PNG-embedded .NET assemblies, staged payloads through open directories, and deployed multiple malware families including Remcos RAT and XWorm variants, while a secondary vector involved weaponised PDFs and batch scripts. The infrastructure enabled repeated, scalable delivery across endpoints and cloud-hosted content, illustrating a reusable framework that separates loader logic from payloads and leverages diverse execution methods for persistence and lateral movement.