The LeakNet ransomware gang combines ClickFix social engineering with a Deno-based in-memory loader to evade detection. GlassWorm's ForceMemo campaign uses stolen GitHub tokens to inject malware into hundreds of Python repositories via force-push. RondoDox botnet peaks at 15,000 exploitation attempts daily across 174 vulnerabilities. Pentera report reveals 67% of CISOs have limited visibility into AI usage. Oracle EBS breach fallout continues with four major companies still silent. Tech giants sign anti-scam industry pact.
The LeakNet ransomware group has evolved its initial access strategy by combining the ClickFix social engineering technique with a novel malware loader built on the Deno JavaScript/TypeScript runtime, according to research published today by ReliaQuest.
LeakNet installs the legitimate, signed Deno executable on victim systems and uses it to run malicious JavaScript directly in memory. Because Deno is a trusted developer tool, it bypasses most endpoint blocklists and application whitelisting controls. ReliaQuest calls this a "Bring Your Own Runtime" (BYOR) attack.
The full attack sequence unfolds in multiple stages:
Romeo*.ps1 and Juliet*.vbs) install Deno and execute the JavaScript payload in memoryjli.dll loaded through Java in C:\ProgramData\USOSharedklist for credential discoveryDespite the sophistication, the attack chain offers clear detection signals:
misexec execution from browsersUnder NIS2 Article 21, essential and important entities must implement measures for supply chain security and incident handling. The BYOR technique exploiting legitimate runtimes highlights the need for behavioral detection beyond simple allowlisting — a requirement that continuous security validation through automated pentesting can address.
The GlassWorm malware campaign has spawned a dangerous new phase dubbed ForceMemo, which leverages stolen GitHub tokens to inject malware into hundreds of Python repositories, according to StepSecurity.
setup.py, main.py, or app.py triggers when anyone runs pip install or executes cloned codeThe malware checks if the system locale is set to Russian — if so, it skips execution. This is a common tactic by Russian-linked threat actors to avoid compromising domestic systems, strongly suggesting the campaign's origin.
Targeted projects include Django apps, ML research code, Streamlit dashboards, and PyPI packages. The earliest injections date back to March 8, 2026, meaning potentially thousands of developers may have already executed compromised code over the past nine days.
git reflogsetup.py, main.py, and app.py files for appended Base64-encoded contentThe RondoDox botnet has significantly escalated its activity, peaking at 15,000 exploitation attempts per day while targeting an expanded arsenal of 174 known vulnerabilities, according to SecurityWeek.
Unlike spray-and-pray botnets, RondoDox has adopted a more targeted approach, focusing exploitation attempts on specific vulnerability classes and device types rather than indiscriminately scanning the internet.
174 CVEs targeted · 15,000 exploitation attempts/day at peak · Focused on IoT devices, network appliances, and unpatched web applications · Multiple exploit chains combining initial access with privilege escalation
The botnet's expansion underscores the critical importance of timely patch management and continuous vulnerability scanning — particularly for internet-facing infrastructure where even a brief patching delay can result in compromise.
A new AI and Adversarial Testing Benchmark Report 2026 from Pentera, surveying 300 US CISOs and senior security leaders, reveals a stark gap between AI adoption speed and security readiness.
The report highlights that AI systems introduce novel risk vectors — autonomous decision-making, indirect access paths, and privileged inter-system interactions — that traditional endpoint, application, and API security tools were never designed to detect or control. The skills gap, not budget, is the primary bottleneck.
As the fallout from the Oracle E-Business Suite breach continues, SecurityWeek reports that Broadcom, Bechtel, Estée Lauder, and Abbott Technologies remain the only major companies that have not issued public statements about potential impact.
The silence is notable given that other affected organizations have already disclosed details and begun customer notification processes. Under both SEC cyber incident disclosure rules and EU NIS2 requirements, material cybersecurity incidents must be reported within defined timeframes — 4 business days for SEC and 24 hours for NIS2 early warning.
Several major technology and retail companies, including Google, Meta, and Microsoft, have signed an industry accord to combat online scams and fraud. The agreement establishes shared frameworks for:
While industry self-regulation has historically shown mixed results, the involvement of the largest platform operators signals growing pressure — both regulatory and reputational — to address the explosion of AI-generated scam content.
Tracebit has raised $20 million in funding to scale its cloud-native deception technology platform. The company plans to expand to new markets and grow its marketing and engineering teams. Deception technology — deploying honeytokens, decoy resources, and tripwires across cloud environments — has gained traction as organizations seek detection methods that don't rely on signatures or known attack patterns.
CISA has added CVE-2025-47813, a year-old Wing FTP Server vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild. The flaw leads to disclosure of the application's full local installation path, which attackers can leverage for further exploitation.
Federal agencies are required to patch within CISA's mandated timeline. All organizations using Wing FTP Server should update immediately and audit access logs for signs of exploitation.
From ransomware using legitimate runtimes to supply chain attacks hijacking your dependencies — the attack surface keeps expanding. KENSAI's autonomous security platform continuously validates your defenses against real-world threats.
Run a Free Security Scan →Published by the KENSAI Security Research Team · March 17, 2026
Sources: ReliaQuest, StepSecurity, SecurityWeek, BleepingComputer, The Hacker News, Pentera