THREATNOIR
Subscribe
Back to Weekly Roundups
2026-W15 Classification: PUBLIC

WEEKLY INTELLIGENCE BRIEFING

2026-04-06 to 2026-04-12 80 articles

Articles scanned
80
Top IOCs
15
Download STIX LinkedIn X
TLDR
  • 🚨 Mexican government breached at scale using Claude AI and ChatGPT to exfiltrate 195M tax records
  • 🎯 Adobe patches critical Reader zero-day exploited since November 2025 with APT connections
  • ⚡ Marimo RCE flaw weaponized within 10 hours of disclosure, showing acceleration of exploit timelines
  • 🏭 Iranian APTs confirmed inside US critical infrastructure with SCADA manipulation capabilities
  • 🔒 Chrome 146 deploys device-bound sessions to combat cookie theft attacks
  • 💰 Major ransomware week with multiple state/local governments and healthcare providers hit
  • 🔧 Supply chain attacks surge: CPUID, Smart Slider 3 Pro, and W3LL phishing kit disrupted

Intelligence Breakdown

5 modules
Vulnerabilities & Exploits
VULNERABILITIES-AND-EXPLOITS
2026-W15

Critical Marimo pre-auth RCE flaw now under active exploitation. CVE-2026-39987 (CVSS 9.3) exploited within 10 hours of disclosure for credential theft via unauthenticated WebSocket endpoint.

Adobe Patches Reader Zero-Day Exploited for Months. CVE-2026-34621 (CVSS 9.6) enables arbitrary code execution, actively exploited since November 2025 with Russian APT connections.

Chrome 147 Patches 60 Vulnerabilities, Including Two Critical Flaws Worth $86,000. Two critical heap buffer overflow flaws in WebML component patched with significant bounties.

Orthanc DICOM Vulnerabilities Lead to Crashes, RCE. Nine flaws in healthcare DICOM server enable DoS, data leaks, and remote code execution.

Key Takeaway

Patch critical vulnerabilities immediately as exploitation windows have collapsed to hours, not days.

APT & Nation-State
APT-AND-NATION-STATE
2026-W15

Nearly 4,000 US industrial devices exposed to Iranian cyberattacks. Iranian APTs target exposed Rockwell PLCs with SCADA display manipulation causing operational disruptions since March 2026.

GraphAlgo Scam: Lazarus Hackers Register Real US LLCs to Spread Malware. North Korean Lazarus Group registers legitimate Florida LLCs and uses GitHub typosquatting to distribute RATs to developers.

Hacker Used Claude Code, GPT-4.1 to Exfiltrate Hundreds of Millions of Mexican Records. Single attacker used AI to automate reconnaissance and exfiltrate 195M tax records from nine Mexican agencies.

Key Takeaway

Nation-state actors are weaponizing AI for reconnaissance and targeting critical infrastructure with increasing sophistication. Learn more

Supply Chain
SUPPLY-CHAIN
2026-W15

Supply chain attack at CPUID pushes malware with CPU-Z/HWMonitor. API compromise led to trojanized downloads for six hours, affecting widely-used system monitoring tools.

Backdoored Smart Slider 3 Pro Update Distributed via Compromised Nextend Servers. WordPress plugin update infrastructure hijacked for six hours, potentially impacting 800K+ installations.

FBI Recovers Deleted Signal Messages Through iPhone Notifications. Push notification cache vulnerability affects all messaging apps, exposes content even after app deletion.

GlassWorm Campaign Uses Zig Dropper to Infect Multiple Developer IDEs. Fake VS Code extension deploys multi-IDE malware via Solana blockchain C2.

Key Takeaway

Validate software downloads from official sources and monitor third-party update infrastructure for signs of compromise. Learn more

Ransomware & Breaches
RANSOMWARE-AND-BREACHES
2026-W15

ShinyHunters Claims Rockstar Games Snowflake Breach via Anodot. Major gaming studio breached through supply chain attack via Anodot-Snowflake integration.

Android Banking Trojan Linked to Cambodia Scam Compounds Hits 21 Countries. Forced labor operations in Cambodia power global banking trojan campaign across 21 countries.

Over 20,000 crypto fraud victims identified in international crackdown. Operation Atlantic identifies 20K+ victims, freezes $12M in international law enforcement action.

Key Takeaway

Implement defense in depth for cloud environments and monitor third-party integrations for unauthorized access. Learn more

References
REFERENCES
2026-W15

Regulatory Updates

Regulatory & AI Security
Action items and policy signal

Google Rolls Out DBSC in Chrome 146 to Block Session Theft on Windows. Device Bound Session Credentials prevent cookie theft by binding sessions to hardware TPM.

Anthropic's Mythos Will Force a Cybersecurity Reckoning—Just Not the One You Think. Claude Mythos Preview can autonomously discover vulnerabilities and develop exploits.

Browser Extensions Are the New AI Consumption Channel That No One Is Talking About. AI extensions pose 60% higher vulnerability rates and bypass traditional security controls.

Key Takeaway

Evaluate AI security tools for dual-use risks and implement controls for ungoverned AI consumption channels. Learn more