Monthly Threat Digest MARCH 2026

For a detailed threat digest, download the pdf file here

March marked a turning point in the threat landscape, with five actively exploited zero-days reshaping the pace and urgency of cyber defense. Among the most concerning developments is the continued activity of Void Manticore, an Iranian state-backed group linked to MOIS. The group has intensified its hybrid warfare playbook, blending destructive wiper malware with coordinated data leaks and psychological operations to amplify disruption beyond the technical domain.

At the same time, the Russia-linked APT28 has escalated its targeting of Ukrainian government entities, leveraging the Microsoft Office vulnerability CVE-2026-21509 to gain footholds within critical systems. This activity underscores a persistent trend of state-sponsored actors rapidly operationalizing newly discovered flaws to support strategic intelligence objectives and destabilization efforts.

On the vulnerability front, vendors are racing to contain active exploitation. VMware pushed urgent patches for multiple flaws in VMware Aria Operations, including CVE-2026-22719, while Google Chrome users faced immediate risk from CVE-2026-3909 and CVE-2026-3910. These vulnerabilities, affecting components like Skia and the V8 engine, highlight how browser-level flaws remain prime entry points for attackers.

Compounding the threat environment, rising geopolitical tensions have fueled a surge in cyber-enabled influence and intrusion campaigns. Threat actors are capitalizing on this climate through phishing lures, credential harvesting, and multi-stage malware delivery. Simultaneously, the TeamPCP supply chain campaign signals a shift toward ecosystem-level compromise, targeting widely used developer tools. As these risks converge, proactive patching, supply chain scrutiny, and layered defenses are no longer optional; they are operational imperatives.

Subscribe to receive our weekly threat digests and alerts directly in your inbox.