Cybersecurity briefing, 2026-03-20

Here's your PlainSec briefing for Friday, March 20th.

• Interlock ransomware uses zero-day to compromise firewalls
• Russian APT breaches Ukrainian maritime agency through Zimbra flaw
• Critical SharePoint flaw being actively exploited
• US, allies disrupt IoT botnets behind massive DDoS attacks
• FBI takedown of Handala websites after Stryker mass-wipe
• Iran deploys cyber Chaos campaign to pressure rivals
• CISA urges US firms to harden Microsoft Intune
• FBI director Kash Patel confirmed the agency is purchasing commercially available
• ScreenConnect flaw and SILENTCONNECT loader enable unauthorized access
• Oracle patches critical unauthenticated RCE in Fusion Middleware

Recent editions

• Thursday, March 19, 2026: Critical ScreenConnect flaw and SILENTCONNECT loader observed · 9 stories
• Wednesday, March 18, 2026: Boggy Serpens escalates attacks on maritime and energy · 10 stories
• Tuesday, March 17, 2026: Wing FTP Server flaw added to federal KEV list · 10 stories
• Monday, March 16, 2026: Attackers weaponize 250+ WordPress sites to steal credentials · 3 stories
• Sunday, March 15, 2026: Iran-aligned actors escalate cyber attacks on US, allies · 5 stories
• Saturday, March 14, 2026: Law enforcement dismantles global SocksEscort residential-proxy botnet · 10 stories
• Friday, March 13, 2026: Iran-linked hackers cripple Stryker's global Microsoft environment · 10 stories