Critical Infrastructure Under Siege: ZionSiphon & Lotus Wiper Unleashed as Zero-Days and Bank Breaches Rock Global Networks

The new article focuses exclusively on CVE-2026-32201, providing a detailed breakdown of its attack vector, complexity, and user interaction. It offers more specific hunting hints, such as monitoring `/wsa.asmx` or `/wsb.asmx` endpoints and file modifications, and clarifies that SharePoint Online is not affected. This deeper dive into the single critical vulnerability enhances understanding of its exploitation and detection, without changing the overall severity of the incident.

New reports from Huntress confirm that all three Microsoft Defender zero-days (BlueHammer, RedSun, UnDefend) are actively exploited in the wild. While BlueHammer's exploitation was noted by April 10, proof-of-concept exploits for RedSun (LPE) and UnDefend (DoS) were observed being used by threat actors as early as April 16, 2026. This reinforces the immediate threat posed by these unpatched vulnerabilities, allowing attackers to escalate privileges and disable Defender updates on Windows systems.

Further analysis of the Canada Life data breach confirms the incident's timeline, with Canada Life officially acknowledging unauthorized access on April 21, 2026, following ShinyHunters' dark web claims on April 17. The exposed personal information now explicitly includes dates of birth and gender, in addition to names, addresses, and income levels, slightly increasing the risk of identity theft. Technical analysis also highlights the likely role of phishing (T1566) and the lack of Multi-Factor Authentication as key enabling factors, alongside potential data exfiltration from cloud storage (T1530). New detection and mitigation strategies are also suggested.

Vercel's ongoing investigation into the supply chain attack has confirmed that a limited subset of customer credentials were compromised. In response, Vercel is actively collaborating with industry partners including Microsoft, GitHub, and npm to conduct further checks and ensure comprehensive mitigation. Additionally, law enforcement has been notified regarding the incident. The attacker's sophistication, marked by their operational velocity and detailed understanding of Vercel's systems, continues to be a key aspect of the breach.

The European Union Agency for Cybersecurity (ENISA) has launched version 2.0 of its National Capabilities Assessment Framework (NCAF). This updated framework and online tool provide a structured methodology for EU member states to evaluate the maturity of their National Cybersecurity Strategies (NCSS). Closely aligned with the NIS2 Directive, NCAF 2.0 assists national authorities in identifying strengths, gaps, and priorities, thereby promoting a consistent and higher level of cybersecurity capability across the EU. While voluntary, it serves as a practical tool for demonstrating progress towards NIS2 requirements, supporting incident response, risk management, and supply chain security.