🔴 Actively Exploited

• Broadcom VMware Aria Operations — CVE-2026-22719
  Command injection during support-assisted migration workflows.
  Added to KEV March 3. Active wild exploitation confirmed. Patch by March 24 (FCEB deadline).
• Qualcomm Multiple Chipsets — CVE-2026-21385
  Memory corruption in Graphics component. Added March 3. Affects 234 chipsets and has been exploited in targeted mobile and embedded-device attacks. Google Android bulletin confirms wild use.
• Apple Ecosystem — CVE-2023-41974, CVE-2021-30952, CVE-2023-43000
  Use-after-free & integer overflow in iOS/iPadOS/macOS/Safari/tvOS/watchOS. Added March 5. Kernel arbitrary code execution risk. Patch by March 26.
• Rockwell Automation Multiple Products — CVE-2021-22681
  Insufficiently protected credentials in Studio 5000 Logix Designer. Added March 5. ICS risk — unauthorized controller access possible.
• Hikvision Multiple Products — CVE-2017-7921
  Improper authentication → privilege escalation. Added March 5. Surveillance camera exposure remains high.

Trend: Edge appliances, ICS, and legacy embedded systems remain prime initial-access targets, especially for ransomware operations and rapid lateral movement.

🟠 Emerging Threats to Watch

• Geopolitical Cyber Escalation (Iran Conflict)
  Hacktivist surge (Keymous+, DieNet ~70% activity) with DDoS, defacements, leaks. Iran domestic connectivity degraded — limits near-term nation-state ops but increases low-level disruption risk to U.S. banks/telecom/critical infrastructure.
• AI-Accelerated Attacks
  Continued 89% surge in AI-enabled adversaries (CrowdStrike 2026). Prompt injection, malicious AI servers impersonating legit services. Rapid PoC generation observed.
• Credential Abuse Dominance
  Malware-free intrusions (82%) rely on stolen sessions/tokens. AiTM phishing remains #1 initial access vector.

🟢 Patch & Mitigation Priorities

1. March CISA KEV Entries (VMware Aria, Qualcomm, Apple, Rockwell, Hikvision)
   Urgent patching required. Federal deadlines March 24–26.
2. Phishing-Resistant MFA (FIDO2 / WebAuthn)
   Enforce tenant-wide to block AiTM and credential replay.
3. Anomalous Authentication Hunting
   New ASN post-MFA, simultaneous distant sessions, OAuth/mailbox rules shortly after login.
4. Perimeter & AI Endpoint Audit
   Cisco SD-WAN remnants, exposed cameras/ICS, unmanaged AI tools (Ollama).

📡 Notable Scanning Activity

• Sustained probing of VMware Aria, Qualcomm chipsets, and perimeter devices post-KEV addition.
• Increased scans for unmanaged AI/LLM instances and legacy webmail/file transfer appliances.
• Rising reconnaissance tied to Iran-aligned hacktivist groups and botnets (HydraC2, etc.).

⚠️ Infrastructure Exposure Trends

• Some ransomware crews shifting toward data extortion without encryption (e.g., SafePay variants).
• Growing exposure of unmanaged AI endpoints vulnerable to prompt injection or code execution.
• Cloud identity misconfigurations (Entra/Azure) and legacy services widening attack surface.

🎯 What Teams Should Prioritize This Week

1. Hunt and patch latest KEV entries — VMware Aria & Qualcomm highest urgency.
2. Enforce phishing-resistant MFA tenant-wide.
3. Audit exposed services: legacy auth, file transfer appliances, AI endpoints.
4. Hunt anomalous authentication (AiTM indicators, password spray).
5. Prepare for AI-accelerated exploitation cycles — test detection against rapid PoCs.

Weekly Pulse

Exploitation velocity remains elevated. Geopolitical volatility adds unpredictable disruption risk. No major threat shifts were observed in the past 48 hours, but exposure windows remain narrow heading into mid-March.

Bottom line: Patch aggressively. Harden identity. Monitor telemetry continuously.