CYBER THREATCAST

Patch N-able N-central to 2026.3.1.7 or later immediately, then hunt for unauthenticated administrative access, abuse of Take Control, and Cloudflared or Cloudflare Tunnel services installed for persistence. CISA added CVE-2026-18577 to its known-exploited list after active attacks, and Huntress reported exploitation and post-compromise activity across multiple organizations. Managed service providers and N-able customers should treat exposed or unpatched N-central systems as potential pivot points into managed endpoints.

Secure SonicWall SMA 1000 appliances now by applying available fixes or mitigations for CVE-2026-15409 and CVE-2026-15410, reviewing VPN logs for suspicious access, and rotating credentials exposed through compromised appliances. INC Ransomware is actively exploiting the SMA 1000 zero-days for initial access, internal access, credential access, data theft, and ransomware deployment against multiple organizations and government-linked victims. Incident responders should prioritize any anomalous SMA 1000 activity as possible ransomware staging.

Treat developer workstations and CI/CD systems that installed affected npm packages as credential-compromised, then rotate npm, GitHub, AWS, Azure, and other build-environment secrets. ChainDrop is an active npm supply-chain worm spreading through more than 2,000 package versions across 444 packages after a maintainer account takeover in the Keyv/Cacheable ecosystem. JavaScript teams should audit recent installs, remove malicious package versions, and check for credential theft and malicious republishing activity.

Isolate internet-reachable water utility OT systems and review Allen-Bradley PLC exposure, remote access, and monitoring immediately. Suspected Iranian hackers hit 36 Minnesota water utilities by targeting operational technology and programmable logic controllers, forcing facilities including Braham to move off internet-connected control and operate manually. Water and wastewater operators using Rockwell Automation Allen-Bradley MicroLogix 1100, MicroLogix 1400, PLCs, or FactoryTalk should assume similar targeting risk and validate manual operating procedures.

Upgrade vulnerable Coldcard firmware, generate new seed phrases, and move Bitcoin to fresh wallets that do not rely on affected Coldcard-generated seeds. Coinkite warned the exploit remains active, and Galaxy Research reported about 1,367 BTC worth roughly $89 million stolen across three waves. Coldcard users, especially those using Mk2, Mk3, Mk4, Mk5, or Q devices with older firmware, should treat weak-seed wallets as unsafe because attackers can derive candidate seeds offline and match them to public Bitcoin addresses without physical access or phishing.