Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

On March 28, 2026, F5 updated its security advisory for a vulnerability impacting BIG-IP APM that was originally disclosed in October 2025 (CVE-2025-53521). The vulnerability was initially classified as a medium-severity denial-of-service (DoS) issue but has been reclassified as a critical remote code execution (RCE) vulnerability. F5 has stated CVE-2025-53521 is being exploited by unauthenticated remote threat actors to deploy web shells.

The widely used Axios npm package, a JavaScript library that enables applications to make HTTP/S requests and is included as a dependency in millions of applications, was compromised in a supply chain attack on March 31, 2026 (UTC).

Arctic Wolf has recently observed a phishing campaign targeting Microsoft 365 that abuses the OAuth device code flow to trick victims into providing authentication codes. Threat actors use Railway’s Platform-as-a-Service (PaaS) infrastructure (a trusted cloud platform with valid IP addresses) to host attack components, allowing the activity to blend in with normal traffic. This enables threat actors to steal valid access and refresh tokens and bypass multi‑factor authentication protections.

Customers do not experience AI as architecture. They experience it as outcomes. They experience it in the quality of the signal they receive, the speed of the investigation, the confidence behind the recommendation, and the amount of time their teams can spend being proactive instead of buried in noise. That is why the most important question in cybersecurity today is not whether a vendor has AI. It is whether that AI produces better outcomes. Security teams are not buying AI for its own sake.

The difference between an AI feature and an AI-led operating model becomes clear the moment a security problem becomes difficult. In real-world security operations — where the signal is ambiguous, the evidence spans multiple domains, and the attacker is behaving in unfamiliar ways — architecture matters much more.

The threat actor TeamPCP has recently launched a coordinated campaign targeting security tools and open-source developer infrastructure by pivoting with stolen CI/CD secrets and signing credentials (such as GitHub Actions tokens and release signing keys). At the time of writing, repositories for Trivy, Checkmarx, and LiteLLM have been impacted, and reports indicate that at least 1,000 enterprise software-as-a-service (SaaS) environments may be affected by this threat campaign.

Every major shift in security operations starts with a shift in the underlying platform. The AI era is no different. As artificial intelligence moves from novelty to necessity, the real dividing line in cybersecurity will not be which vendor can add AI features the fastest. It will be which platforms are built on the right foundation to make AI useful in real operations and trustworthy when the stakes are high. That foundation is data, but not in the simplistic sense the market often uses the term.

Over the last year, AI-assisted malware development has evolved from an experimental practice into a common part of the attacker toolkit. In a rolling window from February 2025 to February 2026, Arctic Wolf Labs observed over 22,000 distinct files triggering AI-focused YARA rules across multiple malware repositories. These files included AI-generated code, large language model (LLM)-style scaffolding, runtime AI API integration, and DeepSeek-derived artifacts.

Cybersecurity has always been defined by moments of inflection. Periods of steady progress are followed by breakthroughs that fundamentally reshape how defenders operate and how technology enables them to succeed. Today we are entering one of those moments.

Every year at RSA Conference, I spend time with security leaders who are trying to solve the same fundamental challenge. They know what strong security operations should look like, but the path to building and sustaining that capability inside their own organization has become increasingly difficult. The market is shifting from buying tools to buying outcomes.

Starting the week of March 9, 2026, Arctic Wolf observed malicious activity in customer environments potentially linked to the exploitation of CVE-2025-32975 on unpatched Quest KACE Systems Management Appliance (SMA) instances that were publicly exposed to the internet. This vulnerability was patched in May 2025. Quest KACE SMA is an on-premises appliance for centralized endpoint management, providing inventory, software deployment, patching, and endpoint monitoring capabilities.

Endpoint security encompasses the processes and technologies used to protect end-user devices—including laptops, servers, mobile devices, IoT systems, and any connected asset with access to corporate resources. As organizations become more distributed and adversaries become more sophisticated, the endpoint has evolved into both a preferred target for threat actors and a pivotal control point within a modern security architecture.

On March 11, 2026, U.S. medical technology company Stryker Corporation disclosed a cyber attack that disrupted its global internal networks and Microsoft systems, leaving thousands of employees unable to access corporate systems and devices inoperable. In its SEC filing, Stryker stated it has no indication of ransomware or malware, considers the incident contained, and is assessing the full impact, with no timeline provided for full restoration.

Security leaders are being squeezed from both sides. On one side, threat actors are scaling operations with AI automation, using it to craft more convincing social engineering attacks, accelerating reconnaissance, and improving lateral movement. On the other side, defenders are drowning in telemetry, suffering under staffing constraints, and facing the harsh reality that threat actors don’t keep business hours.

On March 12, 2026, Veeam released fixes for multiple high and critical severity vulnerabilities in their Backup & Replication product that could allow remote code execution (RCE), privilege escalation, and credential theft. Arctic Wolf has not identified publicly available proof-of-concept exploits for these vulnerabilities, nor have we observed any exploitation.

On March 4, 2026, Cisco released fixes for two maximum-severity vulnerabilities impacting Cisco Secure Firewall Management Center (FMC), which is used to centrally manage Cisco Secure Firewall devices. Arctic Wolf has not observed threat actors exploiting these vulnerabilities, nor have any public proof-of-concept exploits been reported.

On March 03, 2026, pac4j released fixes for a maximum severity vulnerability in pac4j-jwt, tracked as CVE-2026-29000. The flaw arises from improper verification of cryptographic signatures in the JwtAuthenticator component when processing encrypted JWTs (JWE). A remote, unauthenticated threat actor who knows the server’s RSA public key can bypass authentication and impersonate arbitrary users (including administrators) by submitting a crafted JWE whose inner token is an unsigned PlainJWT.

The modern threat landscape is an ever-evolving battlefield of innovation and escalation. Thanks to the rapid adoption of artificial intelligence, both attackers and defenders now have powerful new tools at their disposal. But who has the edge when it comes to the artificial intelligence (AI) arms race? Unsurprisingly, the answer is complicated.

Between January 2025 and January 2026, Arctic Wolf tracked an extensive cyber espionage campaign that we assess was conducted by SloppyLemming (also known as Outrider Tiger and Fishing Elephant), an India-nexus threat actor, targeting government entities and critical infrastructure operators in Pakistan and Bangladesh.

On February 28, 2026, the United States, in coordination with Israel, launched a large-scale military campaign against Iran known as Operation Epic Fury, marking a significant escalation in direct hostilities. The operation involved coordinated air, missile, naval, and cyber strikes targeting Iranian military and nuclear facilities across the country. Iran retaliated with ballistic missile and drone strikes targeting Israeli territory and U.S.