US Warns of Iranian APTs on Critical Infrastructure; APT28 Hijacks Routers and Deploys New Malware

Technology giant Cisco has confirmed it was impacted by the TeamPCP supply chain attack, which leveraged the compromised Trivy scanner. Attackers used a malicious GitHub Action to pivot into Cisco's internal development environment, resulting in the theft of source code and AWS cloud credentials. This led to unauthorized activities in a limited number of Cisco's AWS accounts. The incident highlights the severe downstream impact of the initial Trivy compromise, demonstrating how a single compromised tool can unravel the security of dependent organizations. Cisco has responded by isolating affected systems, reimaging workstations, and rotating all compromised credentials.

The pro-Iranian hacktivist group Handala has dramatically intensified its cyber campaign, evolving from primarily web defacements and DoS attacks to employing more destructive tactics. According to Bitdefender, Handala claimed 23 ransomware victims in March 2026 alone, a significant increase in activity. Their updated playbook now includes ransomware, data wiping, doxxing, and even threats of physical violence, targeting organizations in both Israel and the United States. This escalation indicates a more sophisticated and impactful threat actor than previously observed, moving beyond 'low-impact' disruption to cause significant operational and data privacy damage.

CareCloud has officially confirmed that the cyberattack on March 16, 2026, resulted in the theft of sensitive patient data. A forensic investigation concluded that Protected Health Information (PHI) was exfiltrated by the attackers. In addition to the data breach, the incident caused an eight-hour system outage in one of its electronic health record (EHR) environments, leading to significant operational disruption for healthcare providers. This confirmation escalates the severity of the incident, highlighting the dual impact of data compromise and service interruption.