A new technique called “Zombie ZIP” manipulates ZIP headers so scanners treat DEFLATE-compressed payloads as uncompressed data, allowing signatures to be missed and extraction tools to report errors. Researcher Chris Aziz of Bombadil Systems published a PoC showing it bypassed 50 of 51 VirusTotal engines, prompting a CERT/CC bulletin and CVE-2026-0866; users and vendors are urged to validate compression methods and handle malformed archives cautiously. #ZombieZIP #CERT_CC
Category: Cyber Security News
BeatBanker is a new Android malware discovered by Kaspersky that poses as a Starlink app on fake Google Play Store sites to trick users into sideloading an APK that combines banking trojan functions, Monero mining, and now deploys the BTMOB RAT. It evades detection by loading hidden DEX code, delaying malicious actions, maintaining persistence via a near-inaudible MP3 loop, and using a modified XMRig miner plus FCM telemetry to optimize stealthy mining and remote access. #BeatBanker #BTMOB #XMRig #Monero #Starlink
Adobe released patches for 80 vulnerabilities across eight products, including Adobe Commerce, Magento Open Source, Illustrator, Acrobat Reader, and Premiere Pro. The update addresses 19 Commerce/Magento flaws—including multiple high-severity privilege-escalation issues (CVE-2026-21290, CVE-2026-21361, CVE-2026-21284, CVE-2026-21311, CVE-2026-21309, and CVE-2026-21289)—and Adobe reports no known exploitation in the wild. #AdobeCommerce #MagentoOpenSource…
Microsoft released patches for 83 vulnerabilities across its products, including one critical remote code execution flaw that has already been mitigated. Two bugs were publicly disclosed (.NET DoS CVE-2026-26127 and SQL Server elevation CVE-2026-21262), and several Azure and privilege-escalation issues may require special attention and non-standard patching. #Microsoft #Azure…
Attackers are shifting from noisy breaches to long-term, stealthy infiltration, using advanced evasion and persistence techniques to remain undetected. Picus Security’s Red Report 2026 shows Virtualization/Sandbox Evasion (T1497) and context-aware checks—demonstrated by Blitz and LummaC2—use system, user-activity, and timing tests to prevent payload execution, highlighting the need for Adversarial Exposure Validation. #Blitz #LummaC2 #T1497 #PicusRedReport2026 #AdversarialExposureValidation
KadNap is a newly discovered botnet that has infected roughly 14,000 ASUS routers and other edge devices, forming a peer-to-peer network that uses a custom Kademlia-based DHT to hide its command-and-control infrastructure. Researchers at Black Lotus Labs link KadNap to the Doppelganger proxy service, note heavy infection concentration in the United States, and report that Lumen has blocked traffic to the botnet’s control infrastructure on its network. #KadNap #ASUS
Microsoft is adding passkey support to Microsoft Entra on Windows, bringing phishing-resistant, passwordless sign-in via Windows Hello to both managed and unmanaged devices in a public preview. The opt-in rollout runs mid-March through late April 2026 for worldwide tenants (with GCC, GCC High, and DoD following mid-April to mid-May), and IT admins must enable Passkeys (FIDO2) and create a Windows Hello AAGUID passkey profile to enroll. #MicrosoftEntra #WindowsHello
Finland’s Security and Intelligence Service (SUPO) warns that Russian and Chinese intelligence services are conducting sustained cyberespionage and influence operations targeting the country’s technology sector, research institutions and government. The assessment cites high-profile incidents like the Vastaamo psychotherapy breach and a parliamentary intrusion blamed on APT31 and warns that such state-backed…
SAP released 15 security notes on its March 2026 Security Patch Day addressing critical, high, and medium-severity vulnerabilities across multiple products. The most severe fixes include a Log4j-related deserialization code injection (CVE-2019-17571) and another critical deserialization flaw (CVE-2026-27685), plus a high-severity Supply Chain Management DoS (CVE-2026-27689); organizations should apply updates promptly….
Join runZero and SecurityWeek for a candid OT cybersecurity webinar on March 10, 2026, that examines how IT/OT convergence has bridged the air gap and exposed legacy systems to greater risk. Speakers will explain why traditional scanning fails in fragile OT environments and present visibility, exposure management, and protocol-level defense strategies…
Kai emerged from stealth with $125 million in seed and Series A funding to build an AI-powered platform that bridges IT and OT cybersecurity. Founded by Galina Antova and Damiano Bolzoni, the San Jose-based company will use the investment to scale R&D and go-to-market while offering autonomous capabilities such as threat…
The Independent Public Regional Hospital in Szczecin was forced to revert to paper-based workflows after a cyberattack on the night of March 7–8, 2026, which encrypted parts of its IT system and blocked staff access to critical digital records. Hospital officials say patient care continued without compromise while authorities and cybersecurity…
Microsoft will enable hotpatch security updates by default for all eligible Windows devices managed via Microsoft Intune and the Microsoft Graph API starting with the May 2026 security update. Updates will be delivered through Windows Autopatch, which Microsoft says will halve the time to reach 90% patch compliance and can be managed or disabled using Intune controls that go live April 1, 2026. #WindowsAutopatch #MicrosoftIntune
CISA has classified a high-severity Ivanti Endpoint Manager vulnerability (CVE-2026-1603) as actively exploited and ordered U.S. federal agencies to patch affected systems within three weeks. Ivanti released EPM 2024 SU5 last month to address this flaw and an SQL injection issue, while Shadowserver reports over 700 Internet-facing EPM instances and Ivanti says it has no confirmed exploitation reports. #IvantiEPM #CVE-2026-1603
Cybersecurity leadership has evolved into a business-facing role where CISOs must align cyber risk management with business priorities, regulatory demands, and global markets. Hannah Suarez highlights the need for clear cloud ownership, business-driven prioritization of frameworks, and urgent attention to supply chain vulnerabilities to enable secure growth. #HannahSuarez #LoyaltyStatus…