9th March · Threat Intelligence Report
Source Check Point Research
Mentions 4 CVEs
Mentioned vulnerabilities
Description
For the latest discoveries in cyber research for the week of 9th March, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES AkzoNobel, a Netherlands-based global paint manufacturer, has confirmed a cyberattack affecting one of its United States sites. The company said the intrusion was contained, while the Anubis ransomware group claimed it stole […] The post 9th March – Threat Intelligence Report appeared first on Check Point Research .
Impact
The threats detailed in this report pose significant risks to organizations worldwide, especially those in manufacturing, legal data services, healthcare, government, and technology sectors. The ransomware attack on AkzoNobel and data breaches at LexisNexis and TriZetto expose sensitive personal, financial, and government data, potentially leading to financial losses, regulatory penalties, reputational damage, and operational disruption. AI-driven malware campaigns and malicious browser extensions threaten data confidentiality and privacy at scale, complicating detection and response due to their use of legitimate cloud services and novel programming languages. Critical vulnerabilities in widely deployed software like Google Chrome, WordPress plugins, VMware cloud platforms, and Qualcomm chipsets increase the attack surface, enabling remote code execution, privilege escalation, and unauthorized surveillance. The espionage campaigns targeting IP cameras in geopolitically sensitive Middle Eastern countries could compromise national security and military operations. The combination of supply chain risks, AI exploitation, and advanced persistent threats (APTs) demands heightened vigilance. Organizations face increased risk of data theft, service disruption, unauthorized access, and long-term infiltration, which can cascade into broader economic and geopolitical consequences.
Defensive guidance
Organizations should implement a multi-layered defense strategy tailored to the specific threats outlined: 1) Conduct immediate audits and containment for any signs of ransomware or data breach activity, focusing on sensitive data repositories and access logs. 2) Apply all available patches promptly for critical vulnerabilities in Chrome, WordPress plugins, VMware Aria Operations, and Qualcomm chipsets, prioritizing systems exposed to the internet or used by high-value users. 3) Enhance monitoring for AI-driven threats by deploying advanced behavioral analytics capable of detecting anomalous use of cloud services and uncommon programming language execution. 4) Restrict and audit browser extension installations, especially in enterprise environments, to prevent malicious AI-themed extensions from harvesting sensitive data. 5) Harden endpoint security by integrating threat emulation and endpoint detection and response (EDR) solutions that can identify and block sophisticated malware and exploit kits like Coruna. 6) For organizations in or interacting with Middle Eastern regions, secure IP camera infrastructure by changing default credentials, segmenting networks, and monitoring for unusual traffic patterns indicative of espionage activity. 7) Train staff on phishing and social engineering tactics used by APT groups to reduce initial compromise risk. 8) Employ zero trust principles to limit lateral movement and privilege escalation opportunities. 9) Regularly review and update incident response plans to incorporate AI-related threat scenarios and supply chain compromise vectors. 10) Collaborate with threat intelligence providers to stay updated on emerging tactics and indicators of compromise.
Summary
The 9th March Threat Intelligence Report from Check Point Research provides a comprehensive overview of recent cyber threats and vulnerabilities impacting global organizations. The report highlights a ransomware attack against AkzoNobel’s U.S. site by the Anubis group, which claimed to have stolen 170 GB of sensitive data including employee and financial records. LexisNexis suffered a breach exposing 3.9 million records, primarily legacy data, including government accounts. TriZetto Provider Solutions disclosed a breach affecting over 3.4 million individuals, exposing insurance and medical information with unauthorized access dating back to 2024. AI-driven threats are increasingly prominent: Pakistan-linked APT36 uses AI coding tools to mass-produce low-quality malware variants targeting Indian government entities, complicating detection by using uncommon programming languages and legitimate cloud services for command and control. Malicious AI-themed Chrome and Edge extensions have harvested large volumes of chat histories and browsing data from 900,000 users across 20,000 enterprises. Fake AI agent installers on GitHub delivered credential and cryptocurrency stealers, sometimes converting infected machines into proxies. Researchers also demonstrated indirect prompt injection attacks against AI agents, enabling data exfiltration and unauthorized actions. Several critical vulnerabilities were patched: CVE-2026-0628 in Chrome’s Gemini AI panel allowed malicious extensions to access cameras, microphones, local files, and execute phishing attacks; CVE-2026-1492 in a WordPress plugin enabled unauthenticated privilege escalation to admin; CVE-2026-22719 in VMware Aria Operations allowed unauthenticated remote code execution; and CVE-2026-21385 in Qualcomm chipsets could cause crashes and code execution, with active exploitation reported. The report also details espionage campaigns by Iran-linked groups targeting IP cameras in Middle Eastern countries, supporting missile operations and battle damage assessment. Chinese-aligned Silver Dragon group and Russia-linked operators use sophisticated malware and backdoors for espionage and control. Additionally, an iPhone exploit kit named Coruna targets devices via malicious websites to steal cryptocurrency and personal data. This report underscores the multifaceted and evolving cyber threat landscape combining ransomware, espionage, AI abuse, and critical software vulnerabilities.
References
Community reviews
Related threats
- CVE-2026-1492: User Registration & Membership (WordPress plugin) · Improper Privilege ManagementCriticalVulnerability
- CVE-2026-21385: Qualcomm Snapdragon · Integer Overflow or WraparoundHighVulnerability
- CVE-2026-22719: VMware Aria Operations · Command InjectionHighVulnerability
- CVE-2026-0628: Google Chrome · Insufficient Policy EnforcementHighVulnerability