Chinese state hackers bereitstellen new Malware toolkit targeting South American telecoms. Nation-state iOS Exploit-Kit "Coruna" now powers crypto theft Kampagnen. FBI dismantles LeakBase forum with 142,000 cybercriminals. Cisco SD-WAN Schwachstellen aktiv ausgenutzt. 90 Zero-Days ausnutzened in 2025.
A China-linked Advanced Persistent Bedrohung actor UAT-9244 has been conducting an ongoing Kampagne against telecommunication service providers in South America since 2024, compromising Windows, Linux, and Netzwerk-edge devices with a ausgeklügelt new Malware toolkit.
Why it matters: Telecommunications infrastructure represents critical national security interests. Persistent access to telco Netzwerke enables mass surveillance, call interception, SMS monitoring, and Netzwerk mapping for future operations.
A previously undocumented iOS Exploit-Kit named "Coruna" containing 23 separate ausnutzens has been identified in freier Wildbahn. Originally developed and used by Russian state actors for targeted espionage, the toolkit has now spread to financially motivated Bedrohungsakteure conducting cryptocurrency theft Kampagnen.
Google and iVerify analysis reveals Coruna represents spyware-grade capabilities now accessible to criminal Organisationen. This marks a concerning trend: staatlich unterstützt Exploit-Kits migrating to financially motivated cybercrime.
Action: Update all iOS devices to the latest version sofort. Avoid clicking links in unsolicited SMS messages. Review installed configuration profiles.
A joint FBI and Europol operation has seized LeakBase, one of the world's largest online forums for trading stolen Zugangsdaten, hacked Datumnbanks, and cybercrime tools.
"All forum content, including users' accounts, posts, credit details, private messages, and IP logs, has been secured and preserved for evidentiary purposes." — FBI Seizure Banner
Context: This follows the recent takedown of Tycoon 2FA, a phishing-as-a-service platform that sent fraudulent emails to over 500,000 Organisationen monthly. Combined, these operations represent significant disruption to the cybercrime ecosystem.
Cisco has flagged two Catalyst SD-WAN Manager Schwachstellen as aktiv ausgenutzt in freier Wildbahn:
SD-WAN infrastructure is bereitgestellt at the Netzwerk perimeter of thousands of Unternehmen Netzwerke. Successful Ausnutzung provides attackers with:
Immediate action required: Cisco customers must upgrade Catalyst SD-WAN Manager to gepatchent versions sofort. These Schwachstellen are bestätigt under aktive Ausnutzung.
Google Bedrohungsanalyse Group (GTIG) tracked 90 Zero-Day Schwachstellen ausnutzened in attacks throughout 2025 — almost half targeting Unternehmen software and appliances.
Trend alert: The shift toward Unternehmen appliances (VPNs, Firewalls, SD-WAN, Netzwerk management) reflects attacker focus on Netzwerk perimeter devices that provide persistent access and are difficult to patchen.
Iran-nexus Bedrohungsakteur Dust Specter targeted Iraqi Ministry of Foreign Affairs officials with new Malware strains: SPLITDROP, TWINTASK, TWINTALK, and GHOSTFORM. The Kampagne used kompromittiert Iraqi Regierung infrastructure to stage payloads and employed checksum-based C2 validation and geofencing techniques.
Wikimedia Foundation suffered a Sicherheitsvorfall involving a self-propagating JavaScript worm that vandalized pages and modified user scripts across multiple wikis. The worm ausnutzened Cross-Site-Scripting (XSS) vectors in user-editable content.
Bing AI search results promoted fake OpenClaw GitHub repositories containing information-stealing Malware. The Kampagne instructed users to run commands that bereitgestellt credential stealers and proxy Malware.
Attackers nutzen aktiv aus a kritische Schwachstelle in the User Registration & Membership plugin (60,000+ installations) to create unbefugt WordPress admin accounts.
KI-gestützt Schwachstelle intelligence with 331,910+ CVEs indexed. Get real-time threat alerts tailored to your infrastructure.
Start Free TrialStay secure. Stay vigilant.
🗡️ KENSAI Sicherheitsteam
6. März 2026