Chinese state hackers deploy new malware toolkit targeting South American telecoms. Nation-state iOS exploit kit "Coruna" now powers crypto theft campaigns. FBI dismantles LeakBase forum with 142,000 cybercriminals. Cisco SD-WAN vulnerabilities actively exploited. 90 zero-days exploited in 2025.
A China-linked advanced persistent threat actor UAT-9244 has been conducting an ongoing campaign against telecommunication service providers in South America since 2024, compromising Windows, Linux, and network-edge devices with a sophisticated new malware toolkit.
Why it matters: Telecommunications infrastructure represents critical national security interests. Persistent access to telco networks enables mass surveillance, call interception, SMS monitoring, and network mapping for future operations.
A previously undocumented iOS exploit kit named "Coruna" containing 23 separate exploits has been identified in the wild. Originally developed and used by Russian state actors for targeted espionage, the toolkit has now spread to financially motivated threat actors conducting cryptocurrency theft campaigns.
Google and iVerify analysis reveals Coruna represents spyware-grade capabilities now accessible to criminal organizations. This marks a concerning trend: nation-state exploit kits migrating to financially motivated cybercrime.
Action: Update all iOS devices to the latest version immediately. Avoid clicking links in unsolicited SMS messages. Review installed configuration profiles.
A joint FBI and Europol operation has seized LeakBase, one of the world's largest online forums for trading stolen credentials, hacked databases, and cybercrime tools.
"All forum content, including users' accounts, posts, credit details, private messages, and IP logs, has been secured and preserved for evidentiary purposes." — FBI Seizure Banner
Context: This follows the recent takedown of Tycoon 2FA, a phishing-as-a-service platform that sent fraudulent emails to over 500,000 organizations monthly. Combined, these operations represent significant disruption to the cybercrime ecosystem.
Cisco has flagged two Catalyst SD-WAN Manager vulnerabilities as actively exploited in the wild:
SD-WAN infrastructure is deployed at the network perimeter of thousands of enterprise networks. Successful exploitation provides attackers with:
Immediate action required: Cisco customers must upgrade Catalyst SD-WAN Manager to patched versions immediately. These vulnerabilities are confirmed under active exploitation.
Google Threat Intelligence Group (GTIG) tracked 90 zero-day vulnerabilities exploited in attacks throughout 2025 — almost half targeting enterprise software and appliances.
Trend alert: The shift toward enterprise appliances (VPNs, firewalls, SD-WAN, network management) reflects attacker focus on network perimeter devices that provide persistent access and are difficult to patch.
Iran-nexus threat actor Dust Specter targeted Iraqi Ministry of Foreign Affairs officials with new malware strains: SPLITDROP, TWINTASK, TWINTALK, and GHOSTFORM. The campaign used compromised Iraqi government infrastructure to stage payloads and employed checksum-based C2 validation and geofencing techniques.
Wikimedia Foundation suffered a security incident involving a self-propagating JavaScript worm that vandalized pages and modified user scripts across multiple wikis. The worm exploited cross-site scripting (XSS) vectors in user-editable content.
Bing AI search results promoted fake OpenClaw GitHub repositories containing information-stealing malware. The campaign instructed users to run commands that deployed credential stealers and proxy malware.
Attackers are actively exploiting a critical vulnerability in the User Registration & Membership plugin (60,000+ installations) to create unauthorized WordPress admin accounts.
AI-powered vulnerability intelligence with 331,910+ CVEs indexed. Get real-time threat alerts tailored to your infrastructure.
Start Free TrialStay secure. Stay vigilant.
🗡️ KENSAI Security Team
March 6, 2026