Trend Micro reported in March 2026 that the Russia-aligned APT group Pawn Storm (APT28/Fancy Bear) is actively targeting Ukrainian defense supply chains and allied infrastructure using a new malware framework named PRISMEX. The campaign has been active since at least September 2025 and escalated significantly in early 2026, targeting governm...

Sekoia reported in March 2026 ongoing campaigns by the China-linked Silver Fox intrusion set, which blends cybercrime and espionage techniques. The group uses tax-themed phishing emails and fake government communications to lure victims—primarily across South Asia—into executing malicious payloads. These campaigns have evolved significantly ...

Summary: Unit 42 reported in March 2026 that threat group TeamPCP conducted a large-scale supply chain attack compromising widely trusted security and developer tools, including Trivy, KICS, LiteLLM, and the Telnyx Python SDK. The campaign injected malicious code into GitHub Actions workflows and PyPI packages, allowing payloads to execute a...

Malwarebytes reported on March 26, 2026 a supply chain malware campaign named GlassWorm that targets developers through compromised or malicious packages distributed via repositories such as npm, PyPI, GitHub, and Visual Studio Code extensions. The campaign begins when a developer installs or updates a seemingly legitimate package that has b...

Microsoft Defender Security Research reported in March 2026 an active malware campaign observed since late February 2026 that uses WhatsApp messages to distribute malicious Visual Basic Script (VBS) files. The campaign targets Windows systems and relies on user execution of scripts delivered through a trusted messaging platform. Once execute...