← Back to Blog

Security Briefing, April 22 2026: Cisco SD-WAN Exploitation, France Titres Breach, and NGate NFC Theft

This morning’s threat picture is ugly in a very familiar way. Edge infrastructure is still getting hit, government identity data is still a rich target, and mobile payment workflows are being turned into theft rails.

---

---

1. CISA says another Cisco Catalyst SD-WAN flaw is being actively exploited

BleepingComputer reports that CISA added Cisco Catalyst SD-WAN Manager flaw CVE-2026-20133 to the KEV catalog based on evidence of active exploitation. Cisco had previously described the bug as an information disclosure issue caused by insufficient file system access restrictions, but the real operational message is simpler: internet-facing management planes keep turning into high-value intrusion points.

• If you run Cisco SD-WAN, patching cannot stay in the “we will get to it” pile.
• Review exposure of management interfaces and apply CISA hunt and hardening guidance, not just the vendor patch note.
• Treat recent SD-WAN activity, config changes, and odd API access as incident-response inputs, not routine noise.

---

2. France Titres confirms a breach tied to citizen account data

France Titres, the French government agency behind key identity and registration workflows, disclosed a breach after a threat actor claimed to be selling data. According to the agency statement cited by BleepingComputer, exposed data may include login IDs, names, emails, dates of birth, account identifiers, and for some people addresses, phone numbers, and place of birth. That is exactly the kind of record set that powers phishing, impersonation, and account-recovery abuse.

• Government portals are not just privacy stories, they are identity-operations stories.
• Any organization trusting document or citizen-data workflows should prepare for follow-on phishing and social-engineering campaigns.
• Security teams should warn users that “official” outreach after a public breach can itself become the next attack stage.

---

3. NGate is back, now hiding inside a trojanized NFC payment app

ESET research covered by BleepingComputer shows a new NGate Android variant using a malicious version of HandyPay to steal NFC payment card data and card PINs, with campaigns focused on Brazil. The important shift is not just the malware family itself. It is the attacker economics: a legitimate app workflow can be repurposed cheaply, with less noise, to capture data that later enables unauthorized payments or NFC cash-out fraud.

• Treat sideloaded APKs and fake Play pages as an active financial-fraud channel, not a side issue.
• Mobile-defense messaging should explicitly tell users never to set unknown apps as the default payment app.
• Financial institutions and enterprise mobile teams should watch for unusual NFC enablement, payment-app changes, and Brazil-focused lure campaigns.

---

What security teams should do today

1. Check whether any Cisco Catalyst SD-WAN Manager instances are exposed, unpatched, or missing the latest hunt guidance.
2. Brief customer support, identity, and fraud teams on likely follow-on phishing tied to the France Titres breach.
3. Push mobile-security guidance around NFC abuse, sideloaded APKs, and default payment-app prompts.
4. Frame all three stories the same way: trusted admin, identity, and payment workflows are still the cleanest path to damage.

---

---

Bottom line: Bottom line: the common thread today is not exotic malware wizardry. It is attackers abusing workflows defenders still assume are normal, trusted, and low-drama. That assumption keeps getting people burned.