🔴 Active Exploitation and Immediate Risk

• Stryker Incident Puts Endpoint Management in Focus
  The cyberattack affecting Stryker remained one of the most important developments of the week because it demonstrated how quickly disruption can spread when operational systems are affected. Reported impacts included interruptions to order processing, manufacturing activity, and shipments.
  
  What makes this incident especially relevant for defenders is the follow-on guidance emphasizing endpoint management security. Centralized management platforms are powerful administrative layers, but they also represent high-value control points. When misconfigured, over-permissioned, or insufficiently protected, they can magnify the effect of a compromise far beyond a single host or user account.
  
  For enterprise teams, this is a reminder to review administrative access, harden management policies, reduce unnecessary privilege, and validate security baselines across endpoint management environments.
• Quest KACE Warning Extends the Management-Plane Story
  A fresh development over the weekend reinforced the same lesson exposed by the Stryker incident: centralized management systems remain high-value targets because a compromise can scale quickly across large environments. Researchers reported potentially active exploitation of CVE-2025-32975, a critical authentication-bypass flaw affecting Quest KACE Systems Management Appliance (SMA), an on-premises platform used for endpoint inventory, patching, software distribution, and monitoring. Arctic Wolf said it observed suspicious activity in customer environments potentially linked to exploitation of unpatched, internet-exposed KACE SMA instances starting the week of March 9, and SecurityWeek reported the issue on March 21 as a current attack risk.
  
  For defenders, this is another reminder that management infrastructure should be treated as a priority attack surface, with urgent patching, exposure reduction, strong administrative controls, and close review of privileged access paths.
• New KEV Additions Demand Fast Remediation
  CISA’s addition of new vulnerabilities to the Known Exploited Vulnerabilities catalog remains another sign that public exploitation is active across both enterprise and consumer technology. CISA added five more KEV entries on March 20, reinforcing the same message: once a vulnerability lands in KEV, it should move out of routine patch management and into short-deadline exposure reduction.
  
  The broader lesson is straightforward: organizations still lose valuable time when exploited vulnerabilities are handled like maintenance work instead of operational risk.
• Zimbra Exploitation Reinforces the Identity and Session-Theft Theme
  Another late-breaking development worth adding is CVE-2025-66376 affecting Zimbra Collaboration, which CISA added to KEV on March 18 based on evidence of active exploitation. SecurityWeek reported that the flaw was exploited in attacks against Ukrainian entities, with malicious email content triggering script execution when opened in a browser and enabling theft from victim mailboxes. That matters not just as another KEV entry, but because it reinforces the same defensive reality seen across many current campaigns: attackers continue to prioritize identity, mailbox, and session access because those paths often deliver faster operational value than louder intrusion methods.
• Chrome Security Updates Show How Narrow the Update Window Has Become
  Browser security also remained a key theme. Google’s recent desktop Chrome stable release on March 18 rolled out another batch of security fixes, continuing a pattern of rapid browser-side remediation this month. Even when individual exploitation details are not all public, the operational lesson is the same: browser exposure windows are small, and update lag creates unnecessary risk across authentication flows, SaaS access, and general enterprise web activity.
  
  Security teams should confirm not only that updates were released, but that managed endpoints actually received them in time.

🟠 Emerging Threats to Watch

• Iran-Linked Disruption Remains a Strategic Concern
  Iran-linked cyber activity stayed in focus following the Stryker incident. The concern here goes beyond attribution. These campaigns continue to show how disruptive operations can overlap with political messaging, reputational targeting, and opportunistic timing during periods of geopolitical tension.
  
  There is now an important update to that story: on March 20, the U.S. Justice Department announced the seizure of four domains tied to Handala, publicly linking the operation to Iran’s Ministry of Intelligence and Security. The DOJ said Handala used one of the seized domains to claim responsibility for the March 11 destructive malware attack against a U.S.-based multinational medical technologies firm. Reuters then reported that the group quickly restored part of its web presence after the seizure, underscoring a familiar truth about state-linked and pseudo-hacktivist operations: takedowns can disrupt them, but rarely end them.
  
  For defenders, the strategic implication is that certain threat actors are not solely pursuing stealth, persistence, or monetization. In some cases, disruption itself is the objective. That changes how incidents should be triaged and how resilience planning should be framed. Recovery speed, communications readiness, and operational fallback procedures become just as important as detection and containment.
• Messaging Apps Are Still a High-Value Target Through the User Layer
  Another important development last week was the warning that Russian-linked cyber actors are targeting users of commercial messaging apps such as Signal and WhatsApp through phishing and account-compromise activity. That remains a useful reminder that even the strongest encryption does not protect an account that has already been socially engineered, phished, or hijacked through linked-device abuse or account-recovery manipulation. Attackers continue to target the human and identity layer around secure platforms rather than trying to break the platforms’ encryption directly.

🟢 Patch and Mitigation Priorities

The pattern last week was not defined by a single breakthrough exploit. It was defined by the continued convergence of known exploitation, short remediation windows, exposed management infrastructure, and identity-centered attack paths.

That means the priority list for defenders remains disciplined rather than dramatic:

• Patch newly added KEV vulnerabilities immediately, especially where Apple, Craft CMS, Laravel Livewire, Zimbra, or other internet-facing assets are involved.
• Complete March Microsoft patch deployment across high-risk systems without delay, particularly for assets tied to identity, administrative access, or sensitive business operations.
• Verify Chrome and Chromium-based browser updates across managed endpoints rather than assuming auto-update coverage is sufficient.
• Review endpoint and management-plane hardening, including privilege boundaries, enrollment controls, baseline policies, administrative protections, and exposure of internet-facing management consoles such as KACE SMA.
• Increase monitoring for suspicious authentication behavior, abnormal session activity, unusual device registration, mailbox abuse, and signs of phishing-driven account takeover.

Weekly Pulse

Last week did not introduce a fundamentally new threat category. Instead, it reinforced the operating conditions that now define enterprise defense: active exploitation is constant, patch cycles are compressed, identity is still one of the fastest attack paths, and operational disruption remains well within reach when management infrastructure is exposed.

The organizations that handle this environment best are not necessarily the ones with the most tools. They are the ones that close patch gaps quickly, reduce administrative blast radius, harden identity and management layers, and treat public exploitation as an operational problem, not just a vulnerability-management problem.

Bottom Line

The clearest lesson from last week is that defenders need to stay focused on the basics that still matter most: rapid remediation, identity protection, browser and endpoint coverage, and hardening of centralized management systems. The late-week Quest KACE warning and the Zimbra KEV addition both strengthened that conclusion rather than changing it.

Attackers still do not need exotic tradecraft when exposed management layers, exploited known vulnerabilities, and stolen sessions continue to deliver results.