CYBER THREATCAST

Patch or isolate SonicWall SMA 1000 appliances affected by CVE-2026-15409 and CVE-2026-15410 immediately, then review remote-access logs for ransomware staging or unusual administrative activity. CISA added both flaws to KEV after in-the-wild exploitation, and INC Ransomware is reported as the most active group targeting the zero-days, making exposed SMA1000 systems a near-term ransomware entry point for appliance users across multiple countries.

Upgrade all self-hosted and on-premises N-able N-central servers to build 2026.3.1.7 or later and investigate for administrative takeover, Take Control abuse, Cloudflare Tunnel persistence, Cloudflared services, and suspicious svchost.exe activity. CVE-2026-18577 is being actively exploited against builds before 2026.3.1.7, and attackers have used compromised N-central servers to reach managed devices inside MSP and downstream customer environments.

Patch exposed on-premises VeloCloud Orchestrator deployments to 5.2.3.14, 6.1.3.4, 6.4.2.4, 7.0.0.1, or later, and restrict management access while checking for unauthorized changes to managed network configuration data. CVE-2026-16812 is actively exploited in the wild; hosted and dedicated VCO offerings were patched, but on-premises systems before those fixed versions remain at risk of OS command execution and VCO host compromise.

Remove internet exposure from Unitronics Vision series PLCs and other PLC/HMI/SCADA assets, enforce protected remote access, and monitor OT environments for alarm disabling, unexpected PLC failures, and forced manual operations. Iranian-affiliated CyberAv3ngers actors are targeting internet-exposed PLCs in water and wastewater environments, and reporting links the group to disruptive activity against water, energy, and local government utilities.

Prioritize protection for Apple iOS users exposed to fake AWS or Apple ID sign-in pages and watering-hole sites, and review mobile fleets running iOS 18.4 through 18.7 for signs of compromise. A Chinese threat actor is using the leaked DarkSword iOS exploit kit across more than 100 web properties to deploy GHOSTBLADE, which can steal keychain, iCloud, Wi-Fi credentials, and files from vulnerable iOS devices.