Medusa Ransomware Exploits Zero-Days, Iranian APTs Target US Infrastructure, and Critical Fortinet Flaw Patched

This edition covers the period of April 6-7, 2026, a timeframe marked by significant nation-state activity, rapid zero-day exploitation, and major supply chain compromises. Key events include the identification of China-based Storm-1175, a Medusa ransomware affiliate using zero-days for swift attacks on healthcare and finance. Concurrently, a US federal advisory warns of Iranian APTs targeting critical infrastructure by exploiting Rockwell PLCs. CISA has mandated urgent patching for a new, actively exploited Fortinet zero-day (CVE-2026-35616), while a separate unpatched Windows LPE zero-day, 'BlueHammer,' was publicly released. Supply chain attacks also featured prominently, with a North Korean group compromising the popular Axios npm library and a breach at the European Commission traced back to a compromised Trivy scanner. These incidents highlight the increasing speed and sophistication of threat actors across the globe.