Latest Internet & Cybersecurity News
FBI Surveillance Network Breach Confirms Sophisticated Attack on Wiretap Systems
The FBI disclosed a breach of its Digital Collection System Network (DCSNet), which manages court-approved wiretaps and surveillance orders, with suspicious activity first detected on February 17 and publicly confirmed on March 5. The attack exploited commercial ISP infrastructure using sophisticated, still-unidentified techniques, potentially exposing sensitive law enforcement data and personally identifiable information related to FBI investigations
. The White House, NSA, and CISA are assisting the investigation, though the perpetrator remains unconfirmed despite comparisons to the 2024 Salt Typhoon breach
.
International Law Enforcement Dismantles LeakBase Cybercrime Forum
A coordinated operation across 14 countries, known as Operation Leak, shut down LeakBase, a major cybercrime marketplace with over 142,000 members active since 2021. Law enforcement seized the platform's domains and database on March 3-4, 2026, making arrests and conducting search warrants targeting 37 of the forum's most active users
. The forum had facilitated account takeovers, financial fraud, and network intrusions by trading stolen credentials and hacking tools
.
Russian-Led Campaign Targets Ukraine with New Malware Families BadPaw and MeowMeow
Cybersecurity experts identified a new Russian cyber campaign deploying previously unknown malware families BadPaw and MeowMeow against Ukrainian organizations, using phishing emails with fake border crossing documents. The malware includes sophisticated features like system age checking to avoid detection and backdoor capabilities for remote device control
. A complementary phishing tool called Starkiller has emerged, capable of bypassing multi-factor authentication through real-time proxying and headless browsers
.
Iran Escalates Regional Conflict with Missile, Drone, and Cyber Attacks
Iran has launched missile and drone attacks targeting Israel and U.S. positions while activating proxy groups including Hezbollah and the Houthis, accompanied by increased cyber operations from state-sponsored hacking and ransomware groups. Iranian cyber operations target critical infrastructure including energy companies, shipping ports, financial institutions, and utilities, leveraging difficulty of attribution to conduct attacks during heightened geopolitical tension
. Analysts identify three converging red flags: direct military expansion, global energy and shipping instability, and asymmetric cyber and infrastructure attacks
.
Phobos Ransomware Operator Pleads Guilty After Collecting $39 Million in Ransom
Russian national Evgenii Ptitsyn pleaded guilty to wire fraud conspiracy for operating the Phobos ransomware operation, which has targeted over 1,000 organizations worldwide since 2020, including schools, hospitals, and government agencies. The operation collected more than $39 million in ransom payments through a affiliate model where attackers paid Ptitsyn fees in exchange for decryption keys
. This case highlights the scale and sophistication of organized ransomware-as-a-service operations
.
Nearly Half of Exploited Zero-Day Flaws Target Enterprise Technology in 2026
Google Threat Intelligence Group reported that 90 zero-day vulnerabilities were exploited in the wild during 2025, with almost half targeting enterprise-grade technology, marking an all-time high. China-nexus espionage groups were attributed to at least 10 zero-days in 2025, double the 2024 figure, including attacks on Juniper MX routers and campaigns involving Brickstorm malware
. The report warns that AI will increasingly accelerate vulnerability discovery, weaponization, and exploit deployment in 2026
.
Commercial Surveillance Vendors Now Lead in Zero-Day Exploitation
For the first time, commercial surveillance vendors surpassed state-sponsored espionage groups in zero-day attacks, involved in more than one-third of such incidents in 2025. Of 42 unique zero-days attributed to specific actors, surveillance vendors were involved in 15 compared to 12 linked to state-sponsored groups
. This shift highlights the growing commercialization and proliferation of sophisticated zero-day capabilities across threat ecosystems
.
Coruna iOS Exploit Kit Spreads From Surveillance Vendors to Cybercriminals
Researchers exposed the Coruna exploit kit, which includes advanced techniques like WebKit remote code execution and kernel privilege escalation, spreading from surveillance vendors to Russian espionage groups and financially-motivated cybercriminals. The kit was used by suspected Russian group UNC6353 in 2025 for watering hole attacks targeting Ukrainian websites, and later appeared on fake cryptocurrency sites linked to criminal actors
. Once exploited, Coruna deploys PlasmaLoader to steal cryptocurrency wallet data and sensitive information from victims
.
Hacktivist Groups Launch Coordinated DDoS Attacks Following U.S.-Israel Military Strikes
Three main hacktivist groups—Keymous+, DieNet, and NoName057(16)—were responsible for nearly 70% of observed attack activity between February 28 and March 2, 2026, following U.S.-Israel military operations. Pro-Palestinian hacktivist collective Hider Nex (Tunisian Maskers Cyber Force) launched the first recorded attack during this period, combining DDoS attacks with data breaches to support geopolitical messaging
. The activity demonstrates the rapid mobilization of hacktivist networks in response to geopolitical events
.
Breaches Increase While Victim Numbers Decline but Impact Intensifies
A March 6, 2026 cybersecurity report indicates that breaches have increased overall, though the number of individual victims per breach has decreased, suggesting attackers are targeting fewer but higher-value organizations. The average impact and cost of breaches has strengthened, with costs increasingly passed to consumers rather than being absorbed by organizations
. This trend reflects a strategic shift toward attacking critical infrastructure and enterprise targets with greater financial or operational consequences
.
AI Weaponization Accelerates Cybersecurity Threats in 2026
Security analysts warn that artificial intelligence will be increasingly used by threat actors to speed up and scale attacks in 2026, enhancing reconnaissance, vulnerability discovery, and exploit development. The integration of AI into attack workflows could enable exploitation faster than defensive responses, according to senior vulnerability intelligence analysts at Google Threat Intelligence
. Organizations are urged to prioritize rapid vulnerability patching and threat intelligence sharing to counter AI-accelerated attack capabilities
.