🐉 Silver Dragon APT is breaching government networks in Europe and Southeast Asia via server exploits and phishing.

Researchers link the activity to the APT41 ecosystem, using BamboLoader and DNS tunneling to maintain covert access.

🔗 Read → https://thehackernews.com/2026/03/apt41-linked-silver-dragon-targets.html

AI in the SOC is shifting from alert triage to full investigations, writes Jon Hencinski of Prophet Security.

In one case, an AI system ran 265 queries across 6 data sources to confirm a compromised AWS credential used for cloud reconnaissance—work normally done by senior analysts.

🔗 How the investigation reconstructed the attack → https://thehackernews.com/expert-insights/2026/03/ai-soc-investigation-has-moved-beyond.html

🖥️ Malicious Packagist packages posing as Laravel helpers install a remote access trojan.

The malware connects to a C2 server, runs shell commands, uploads files, captures screenshots, and retries every 15 seconds to stay persistent.

🔗 Malware behavior and package names → https://thehackernews.com/2026/03/fake-laravel-packages-on-packagist.html

⚠️ Many SOCs’ weakest link isn’t tools—it’s Tier-1 analysts.

Most alerts + least experience → alert fatigue & false positives → slower detection & delayed escalation.

Better threat intel turns alerts into fast decisions.

🔗 How intel feeds + sandbox analysis strengthen Tier-1 triage → https://thehackernews.com/2026/03/building-high-impact-tier-1-3-steps.html

✅ 5-Step Readiness Checklist for Security Automation.

Security questionnaires are a critical part of security reviews, but manual processes slow teams down and increase risk.

📋 This 5-step automated security readiness checklist outlines the foundational steps GRC and information security teams need to prepare for automation that is accurate, defensible, and scalable.

Download the checklist to assess your readiness and take the first step toward more efficient security reviews

🔗 https://thn.news/automated-sec-checklist

🛑 ALERT: Google uncovered an #iPhone exploit kit called Coruna containing 23 iOS exploits targeting versions 13–17.2.1.

The framework fingerprints devices and automatically loads the matching WebKit exploit chain. Researchers say it moved from #surveillance vendors to nation-state operators and later cybercrime groups.

🔗 Exploit chains, campaigns, and malware payload details → https://thehackernews.com/2026/03/coruna-ios-exploit-kit-uses-23-exploits.html

⚠️ Multiple infostealers — Arkanix, NovaStealer, DarkCloud, MawaStealer and others — are active in the wild.

Researchers say Arkanix was likely built with LLM assistance, speeding malware development. Stolen logs are filtered and sold to brokers seeking corporate network access.

🔗 Read → https://thehackernews.com/2026/03/weekly-recap-sd-wan-0-day-critical-cves.html#:~:text=Multiple%20Stealer%20Malware%20Families%20Detected

Human-led. Rules-based. LLM-powered agentic systems. Each promises efficiency. Each has limits.

The real advantage? Knowing when, and how, to use them together.

The teams pulling ahead aren’t betting on a single model. They’re architecting a custom mix of all three.

On March 12th, join Tines for Workflow clarity: Where AI fits in modern automation. You'll learn how to harness AI with clarity and control, and determine the right combination of workflows for you.

🔗 Register and learn more here: https://thn.news/modern-automation-ai

🛑 Hacktivists launched 149 DDoS attacks targeting 110 organizations in 16 countries after the U.S.–Israel strikes on Iran, security researchers report.

Most attacks hit government systems in the Middle East, with Kuwait, Israel, and Jordan seeing the highest activity.

🔗 Read → https://thehackernews.com/2026/03/149-hacktivist-ddos-attacks-hit-110.html

Authorities have seized #LeakBase, a cybercrime forum used to trade stolen databases and infostealer logs.

Site had 142k+ members and hosted hundreds of millions of stolen credentials & financial records used for account takeovers and fraud.

🔗 Read → https://thehackernews.com/2026/03/fbi-and-europol-seize-leakbase-forum.html

⚡ Authorities dismantled Tycoon 2FA, a major phishing-as-a-service toolkit used to bypass MFA.

The platform sent tens of millions of phishing emails monthly and enabled access to nearly 100,000 organizations by stealing credentials, MFA codes, and session cookies.

🔗 Read → https://thehackernews.com/2026/03/europol-led-operation-takes-down-tycoon.html

⚠️ Most encrypted web traffic relies on ECDHE, the TLS key exchange that lets browsers and servers derive a shared secret.

Quantum computers could break the elliptic-curve math behind it. The industry is moving to hybrid exchanges combining ECDHE with post-quantum ML-KEM.

🔗 Learn how hybrid key exchange protects data from future quantum attacks → https://thehackernews.com/expert-insights/2026/03/demystifying-key-exchange-from.html

🚨 Russian-linked hackers are using BadPaw and MeowMeow malware to target Ukrainian entities.

Phishing emails deliver a ZIP with an HTA lure. Code hidden in a PNG loads a .NET dropper that installs a backdoor capable of running PowerShell commands and manipulating files.

🔗 Details → https://thehackernews.com/2026/03/apt28-linked-campaign-deploys-badpaw.html

🛑 Suspected Iran-linked hackers targeted Iraqi officials by impersonating the foreign ministry and delivering malware.

Tracked as Dust Specter, the campaign deploys SPLITDROP, TWINTASK, TWINTALK, and GHOSTFORM via password-protected archives and DLL sideloading.

🔗 Read → https://thehackernews.com/2026/03/dust-specter-targets-iraqi-officials.html

🔥 ActiveState Launches World's Largest Secure OSS Catalog With 79M Components.

ActiveState has launched the world’s largest secure open-source catalog, uniting 79M components across 12+ languages (Java, Python, Rust, etc.). It cuts CVE exposure by 99% via SLSA-3 builds and reclaims 30% of engineering time by automating manual maintenance and governance.

🔗 Read the release: https://thn.news/open-source-catalog

🚨 DDR5 bot scalping, Telegram cybercrime hubs, and new malware campaigns.

This week’s #ThreatsDay Bulletin breaks down the biggest security threats and tactics shaping the threat landscape right now.

🔗 Read → https://thehackernews.com/2026/03/threatsday-bulletin-redis-rce-ddr5-bot.html

⚠️ Cisco confirms active exploitation of two Catalyst SD-WAN Manager flaws.

▶ CVE-2026-20122 enables arbitrary file overwrite via API credentials.
▶CVE-2026-20128 can expose data and grant DCA privileges after login.

🔗 Read → https://thehackernews.com/2026/03/cisco-confirms-active-exploitation-of.html

Patches are out across multiple releases.

⚠️ CISA added two CVSS 9.8 flaws to its KEV list after active exploitation.

One hits Hikvision devices and can expose sensitive data. The other targets Rockwell Logix controllers and could let attackers alter system configs.

🔗 Details → https://thehackernews.com/2026/03/hikvision-and-rockwell-automation-cvss.html

Federal agencies must patch by March 26.

🛑 ClickFix has moved to Windows Terminal.

Microsoft says victims are told to open wt.exe and paste a command from fake CAPTCHA pages.

That launches PowerShell, pulls payloads, and injects Lumma Stealer into Chrome and Edge to steal saved credentials.

🔗 Read → https://thehackernews.com/2026/03/microsoft-reveals-clickfix-campaign.html