Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Microsoft Security Blog

Google Project Zero

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

For the latest discoveries in cyber research for the week of 23rd March, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Navia Benefit Solutions, a United States-based employee benefits administrator, has disclosed a breach affecting more than 2.6 million individuals after unauthorized access and potential data exfiltration occurred between December 22, 2025 and [&#8230;] The post 23rd March – Threat Intelligence Report appeared first on Check Point Research .

The Check Point Research 23rd March 2026 Threat Intelligence Report provides an extensive overview of recent cyber threats, breaches, and vulnerabilities impacting diverse sectors globally. Notably, Navia Benefit Solutions, a US-based employee benefits administrator, suffered a breach compromising over 2.6 million individuals' sensitive personal, health, and benefits data due to unauthorized access between December 2025 and January 2026. Similarly, Aura, an identity protection firm, was breached via a phone phishing attack that compromised an employee account and marketing platform, exposing approximately 900,000 records, primarily names and emails. The Puerto Rico Aqueduct and Sewer Authority confirmed a cyberattack exposing customer and employee data, though operational systems remained protected due to network segmentation. Intuitive, a robotic surgery company, experienced a phishing-driven breach exposing customer contacts, employee data, and corporate records, while critical surgical platforms remained unaffected.

The report underscores the evolution of AI threats, highlighting a shift from human-led to AI-led attack chains. Researchers discovered a chained vulnerability in Anthropic’s Claude.ai enabling invisible prompt injection, silent exfiltration of conversation history, and open redirect exploitation, facilitating stealthy data theft. Additionally, CVE-2026-33017, a critical unauthenticated remote code execution vulnerability in Langflow, was weaponized within 20 hours of disclosure, allowing arbitrary Python code execution on exposed instances.

Several critical vulnerabilities were patched or actively exploited: ConnectWise patched CVE-2026-3564, a cryptographic signature verification flaw in ScreenConnect that could allow unauthorized session authentication and privilege escalation; Ubiquiti addressed CVE-2026-22557, an unauthenticated path traversal bug in UniFi Network Application enabling file access and system compromise; Zimbra warned of active exploitation of CVE-2025-66376, a stored cross-site scripting flaw allowing code execution via malicious emails; and GNU InetUtils telnetd is affected by CVE-2026-32746, a remote code execution flaw exploitable without authentication, potentially granting root access on Linux, IoT, and industrial systems.

The report also details a supply chain attack involving backdoored React Native npm packages that deployed credential and cryptocurrency theft malware with persistence, affecting over 130,000 combined downloads. Furthermore, an Interlock ransomware campaign exploited a zero-day in Cisco Secure Firewall Management Center (CVE-2026-20131) prior to its public disclosure. The Iranian APT group MuddyWater was linked to spear-phishing and malware campaigns, emphasizing ongoing geopolitical cyber threats.

Overall, the report highlights a complex threat landscape combining traditional phishing, supply chain attacks, critical software vulnerabilities, and emerging AI-driven attack methodologies, demanding heightened vigilance and advanced defensive strategies.

Detailed information about 23rd March – Threat Intelligence Report. Get real-time updates, technical details, and mitigation strategies.

23rd March – Threat Intelligence Report - Live Threat Intelligence - Threat Radar | OffSeq.com

Original Source

23rd March – Threat Intelligence Report

Threats Affecting Puerto Rico

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Affecting Puerto Rico

Lead Pen Test Professional