Iran-linked Handala wiped 80,000 to 200,000 Stryker devices across 79 countries on 11 March using one stolen Microsoft Intune admin credential, with no malware deployed. NHS Supply Chain issued a UK disruption alert; Stryker filed an SEC 8-K/A. US defenders face this with a proposed $707m CISA cut and a Citrix/F5 vendor stack still burning.
Identity and administration planes are now the primary attack surface; US defenders face this reality with a proposed $707m CISA cut.
One stolen login, no malware, up to 200,000 devices dark in hours across 79 countries. The Microsoft Intune admin console used exactly as designed.
United StatesIran-linked group Handala wiped up to 200,000 Stryker devices across 79 countries on 11 March 2026 using a single stolen Microsoft Intune admin credential. No malware ran. NHS England warned hospitals of three weeks of supply disruption.
Endpoint tools cannot block a wipe issued from a legitimate management console. One identity lacking step-up authentication handed the attackers root-equivalent authority over the entire estate.
The first public company to formally disclose a credential-only wipe as material. Q1 2026 earnings take a hit; full-year guidance held.
Stryker filed an amended SEC disclosure on 10 April 2026, confirming the March device wipe as material: Q1 earnings took a hit, though full-year guidance held.
This is the first time the mechanism has been used for an attack with no malware and no ransom demand. General counsels at Fortune 1000 companies now have a reference point that operational disruption alone can meet the materiality test.
Google-Wiz is the largest pure-cybersecurity deal of the post-CrowdStrike era. SecurityWeek counted 38 cyber M&A deals in March and 42 in February.
Google closed its $32 billion purchase of cloud security firm Wiz in March 2026, the largest pure-cybersecurity acquisition on record.
The consolidation tracks the offensive trends in this briefing: cloud security addresses the identity-and-MDM surface from the Handala operation; AI-native monitoring targets the 393-day dwell problem; and prompt-injection defence covers an attack surface that barely existed at scale three years ago.
CVE-2026-3055 is the third critical memory-disclosure bug in NetScaler in thirty months. Researchers are calling it CitrixBleed 3.
Citrix disclosed CVE-2026-3055 on 23 March 2026, a 9.3-out-of-10 flaw in NetScaler Gateway letting an unauthenticated attacker steal session tokens. CISA gave US federal agencies until 2 April to patch; the UK's NCSC issued a parallel advisory on 25 March.
Researchers are calling it CitrixBleed 3, the third critical memory bug in this appliance family in 30 months. NetScaler often fronts every other authentication decision in an estate, making this an architecture review rather than a routine patch.
A vulnerability triaged in 2025 as a medium-severity denial-of-service issue turned out to be unauthenticated Remote Code Execution. 14,000+ instances still exposed.
F5 reclassified CVE-2025-53521 on 28 March 2026 from a moderate outage risk to an unauthenticated Remote Code Execution flaw scoring 9.8 out of 10. CISA added it to the known-exploited list the same day; over 14,000 instances remained unpatched.
Organisations that scheduled this at the original lower rating were placed in the wrong queue by F5's own first call. Reclassification history now has to be a formal input to patch scheduling.
CVE-2009-0238 was cut during the Bush administration. Attackers dug it back up and CISA put it on the active-exploitation list in April.
CISA confirmed on 14 April 2026 that attackers are actively exploiting CVE-2009-0238, a 17-year-old Microsoft Office flaw. The attack uses a crafted Excel file; modern Office is already protected, but legacy deployments in hospitals and public-sector offices remain vulnerable.
Ransomware affiliates revived old flaws that still work where migration lags by decades. A listing on CISA's known-exploited catalogue has shifted from a backlog item to a compliance deadline with UK regulatory enforcement posture behind it.
NCSC attributed a DNS-hijack campaign to APT28, assessed with near-certainty as GRU Unit 26165. The target was the Outlook login in the kitchen.
Russia's GRU, as APT28, has since 2024 compromised cheap home routers to intercept Microsoft 365 logins. It silently reroutes sign-in pages to a GRU-controlled server. The NCSC and FBI issued coordinated warnings on 7 April 2026.
Corporate monitoring cannot catch this: interception happens before traffic reaches the corporate perimeter. The fix is architectural, binding Microsoft 365 sign-in to corporate-managed DNS over HTTPS rather than the user's home resolver.
Russia's FSB, China's APT31 and Iran's IRGC are all running the same trade against journalists, lawyers and politicians. NCSC and Dutch AIVD advised passkeys plus a device audit.
Russia's FSB, China's APT31, and Iran's IRGC have all been using malicious QR codes to compromise Signal, WhatsApp, and Messenger accounts of politicians, lawyers, and journalists. The NCSC and Dutch intelligence service AIVD issued joint warnings in March 2026.
Three adversary states using the same technique confirms a shift: messaging apps carry material that phone taps once reached, yet sit outside the corporate perimeter where monitoring lives. Both agencies recommend passkeys and a linked-devices audit.
Mandiant's M-Trends 2026 set the China-nexus benchmark at a 393-day average dwell inside VMware hypervisors. The telemetry built for malware does not see it.
Chinese hacking group UNC5221 averaged 393 days undetected inside victim networks, per Mandiant's M-Trends 2026 report. It planted backdoors at the VMware hypervisor layer and routed traffic through Cloudflare Workers. Primary targets were US and UK law firms, business-services companies, and technology providers.
Endpoint detection tools see nothing at the VMware ESXi layer because they are not installed there. For security leads running six-month threat hunts with no hypervisor forensics, 393 days is how long an adversary can stay invisible.
An FBI official told CyberTalks 2026 the China-linked telecoms compromise is not contained. 200+ companies, 80 countries, and Volt Typhoon sits behind it.
An FBI official confirmed in February 2026 that Salt Typhoon's telecoms breach is still ongoing, with at least 200 companies across 80 countries affected. CISA assesses Volt Typhoon has planted footholds in US power, water, transport, and communications networks.
Salt Typhoon spies; Volt Typhoon pre-positions to cause physical disruption at China's choosing. The adversary question has shifted from what they read to what they could turn off.
Treasury sanctioned Sergey Zelenyuk, Matrix LLC and five associates for trafficking 8+ zero-days stolen from L3Harris. The statute was not written for cyber.
US Treasury sanctioned Russian exploit broker Sergey Zelenyuk and his firm Operation Zero in April 2026, using the Protecting American Intellectual Property Act for the first time in a cyber case. Former L3Harris defence-unit executive Peter Williams stole at least eight government hacking tools and sold them to Operation Zero between 2022 and 2025; he was sentenced to 87 months on 24 February 2026.
The sanctions name a UAE routing company used to keep sanctioned Russian entities off the paperwork.
Ryan Goldberg worked at Sygnia. Kevin Martin negotiated ransoms at DigitalMint. Both admitted to using ALPHV/BlackCat against the organisations they were hired to defend.
Two cybersecurity professionals pleaded guilty in early 2026 to running ALPHV/BlackCat ransomware attacks between April and December 2023. Ryan Goldberg worked at incident-response firm Sygnia; Kevin Martin was a ransomware negotiator at DigitalMint. Both used their professional access to select targets.
The case shifts due-diligence for buyers of incident-response services. Whether vendors have the personnel controls and privilege segmentation to prevent staff from acting against clients is now the harder question, not technical capability.
Michigan State Police co-led. German BKA and Finnish KRP ran infrastructure. A Russian national is charged with running the exchange since 2017.
The FBI and Michigan State Police seized cryptocurrency exchange E-Note and charged Russian national Mykhalio Petrovich Chudnovets with laundering more than $70 million in ransomware proceeds since 2017. German and Finnish police cooperated on the infrastructure seizure.
Law enforcement is targeting cash-out services rather than individual operators: there are far fewer off-ramps than there are ransomware affiliates, so each seizure reaches hundreds of downstream crimes.
The FY27 budget would leave CISA on roughly $2bn with 860 fewer staff. The counter-ransomware initiative is already gone.
The Trump administration's FY27 budget, published on 7 April 2026, would cut CISA by $707 million, eliminate 860 posts, and reduce the FBI's cyber budget by a further $560 million. NIST vulnerability-scoring programmes also fall inside the cuts.
The same week's CVE deadlines, covering three actively exploited flaws, are now to be enforced by an agency with a third fewer staff than two years ago.
The Cyber Security and Resilience Bill passed Public Bill Committee. ICO fined Capita £14m for missing PAM and AD tiering, citing NCSC guidance as the GDPR baseline.
The UK Cyber Security and Resilience Bill reached Report Stage on 2 March 2026, introducing a 24-hour initial incident-reporting window and a 72-hour full-report requirement. Data centres will be classed as essential services. The ICO fined Capita £14 million for its 2023 breach, citing absent Privileged Access Management controls.
The 24-hour clock means board escalation playbooks must close within a single trading day.
European Commission draft CRA guidance opened 3 March. Only a third of German entities registered by the NIS2 deadline. Infringement proceedings are running.
The European Commission published draft guidance for its Cyber Resilience Act on 3 March 2026. Manufacturer flaw-reporting obligations start September 2026; full requirements apply from December 2027. NIS2, the EU's core cybersecurity law, is in force but unevenly applied: only around one-third of German companies required to register had done so by the 6 March 2026 deadline.
The NIS2 fine ceiling is €15 million or 2.5 per cent of worldwide turnover.
The threat cadence is accelerating. Ransomware postings reached 808 in March, up 19% month-on-month and 33% above the 2025 monthly average. The KEV catalogue added nine CVEs in the window with active exploitation confirmed on multiple critical-severity appliances. Nation-state dwell benchmarks are lengthening, not shortening. US federal enforcement capacity is proposed to contract. UK and EU regulatory pressure is rising but takes time to change enterprise posture. The defender advantage is narrowing, not widening, in this window.
