Afternoon Review in IT Security — March 23, 2026

The cybersecurity landscape continues to face significant threats as critical vulnerabilities are actively exploited, supply chain attacks expand their reach, and law enforcement agencies work to dismantle major botnet infrastructure. Today's review covers incidents spanning from enterprise systems management to container environments and state-sponsored threat actors.

Hackers Exploit CVE-2025-32975 to Hijack Unpatched Quest KACE SMA Systems

Arctic Wolf has detected active exploitation of CVE-2025-32975, a maximum-severity vulnerability with a CVSS score of 10.0 affecting Quest KACE Systems Management Appliance (SMA). The cybersecurity firm observed malicious activity beginning the week of March 9, 2026, targeting unpatched SMA systems that are exposed to the internet. Source: Hackers Exploit CVE-2025-32975 (CVSS 10.0) to Hijack Unpatched Quest KACE SMA Systems

The exploitation activity is consistent with threat actors leveraging this critical flaw in customer environments. The indicators of compromise associated with this campaign include the IP address 216.126.225.156 and the use of known attack tools including Mimikatz and runkbot.exe. Organizations running Quest KACE SMA systems should prioritize patching efforts immediately to prevent unauthorized access and lateral movement within their infrastructure.

Trivy Hack Spreads Infostealer via Docker, Triggers Worm and Kubernetes Wiper

The Trivy supply chain attack has revealed a broader compromise affecting developer environments through malicious artifacts distributed via Docker Hub. The last confirmed clean release of Trivy available on Docker Hub is version 0.69.3, while the compromised versions 0.69.4, 0.69.5, and 0.69.6 have been removed from the container image library. Source: Trivy Hack Spreads Infostealer via Docker, Triggers Worm and Kubernetes Wiper

The malicious versions distributed through this supply chain compromise included multiple threats targeting containerized environments. The TeamPCP infostealer was deployed to exfiltrate sensitive information from developer systems, while CanisterWorm propagated as a worm mechanism. Additionally, a Kubernetes wiper tool was included in the payload, capable of destroying workloads and data within Kubernetes clusters. This incident demonstrates the critical importance of verifying container image integrity and monitoring for unauthorized modifications to widely-used development tools.

Global Crackdown Dismantles Four Botnets Behind Major DDoS Attacks

International law enforcement coordinated efforts to dismantle four major botnets responsible for large-scale distributed denial-of-service attack campaigns. The operation successfully targeted the Aisuru, KimWolf, JackSkid, and Mossad botnets, which had been compromising millions of devices worldwide. Source: Global Crackdown Dismantles 4 Botnets Behind Major DDoS Attacks

The takedown of these botnet infrastructures represents a significant disruption to organized cybercriminal operations that have conducted sustained DDoS attack campaigns against critical targets globally. The successful dismantling of these four separate botnets demonstrates the effectiveness of coordinated international law enforcement efforts in combating large-scale infrastructure threats.

FBI Warns of Handala Hackers Using Telegram in Malware Attacks

The Federal Bureau of Investigation has issued a warning regarding Iranian state-sponsored threat actors linked to the country's Ministry of Intelligence and Security (MOIS) who are leveraging Telegram as a distribution channel for malware attacks. Source: FBI warns of Handala hackers using Telegram in malware attacks

The Handala threat group has been observed using multiple domains including handala-redwanted.to, handala-hack.to, justicehomeland.org, and karmabelow80.org to facilitate their malware operations. The group distributes Handala Windows malware through Telegram channels, utilizing the platform's accessibility and encryption features to evade detection. Network defenders should monitor for communications involving these identified domains and be alert to suspicious activity originating from Telegram-based distribution channels.

Closing Perspective

Today's threat landscape reflects a diverse range of attack vectors from critical infrastructure exploitation to sophisticated supply chain compromises and state-sponsored operations. Organizations must maintain vigilant patch management practices, implement robust container security measures, and monitor for emerging threats from both criminal and state-sponsored actors.