Cybersecurity briefing, 2026-04-02

Here's your PlainSec briefing for Thursday, April 2nd.

• Active Dawn zero-day in Chrome enables sandbox escape
• UNC1069 expands Node.js supply chain attacks beyond Axios
• TrueConf update flaw lets attackers reach isolated government networks
• Drift Protocol admin key compromise enables $130M-$285M crypto theft
• Active cyber intrusion disrupts Hasbro operations for weeks
• Attackers exploit Vite dev server feature to steal files
• Mercor AI confirms data theft via LiteLLM supply chain breach
• Tiered CrystalX RAT bundles spyware, stealer, prankware
• Cambodia extradites key crypto scam leader to China amid crackdown
• REF1695 campaign update
• Federal citizen lists to restrict mail ballots; data mismatch risk
• Akira executes full ransomware attacks in under one hour
• Open-source AI runtime breach disrupts vendor trust and operations
• Chinese APT TA416 resumes stealthy espionage on European diplomats
• Kernel-level BPFDoor variants evade detection in telecom infrastructure
• Mass CERT-UA impersonation sends AGEWHEEZE RAT via password-protected ZIP
• Qilin’s msimg32.dll disables 300+ EDR drivers to hide ransomware activity
• Automated Next.js exploit powers centralized credential harvesting service
• Qilin ransomware automation shifts detection focus to pre-ransomware phase
• Stolen supply-chain secrets fuel cloud intrusions and extortion
• Authenticated admin access enables root file write in Cisco Nexus Dashboard Insights
• Cisco SSM On-Prem has both authenticated privilege escalation and unauthenticated root RCE
• VenomStealer campaign update
• WhatsApp VBS drops renamed Windows tools, MSI backdoors
• Encrypted Nexus Dashboard backups leak credentials, enable root access
• Third-party vendor breach exposes Nissan dealership data, not Nissan systems
• Security update

Recent editions

• Wednesday, April 1, 2026: TrueConf update flaw lets attackers reach isolated government networks · 18 stories
• Tuesday, March 31, 2026: Critical Citrix NetScaler memory leak now exploited; admin sessions at risk · 10 stories
• Monday, March 30, 2026: Intesa Sanpaolo fined €31.8M over employee snooping · 6 stories
• Sunday, March 29, 2026: Coruna exploit kit recycles Triangulation iOS zero‑days · 12 stories
• Saturday, March 28, 2026: TeamPCP pauses new supply-chain compromises, monetizes haul · 14 stories
• Friday, March 27, 2026: Coruna exploit kit recycles Triangulation iOS zero‑days · 31 stories
• Thursday, March 26, 2026: Iran-related cyber campaigns spike with wipers and ransomware · 19 stories