Trend Micro reported in March 2026 that the Russia-aligned APT group Pawn Storm (APT28/Fancy Bear) is actively targeting Ukrainian defense supply chains and allied infrastructure using a new malware framework named PRISMEX. The campaign has been active since at least September 2025 and escalated significantly in early 2026, targeting government, military, logistics, and humanitarian organizations across Eastern and Central Europe. The attack chain begins with spear-phishing emails delivering malicious RTF documents that exploit CVE-2026-21509, a Microsoft Office OLE security bypass vulnerability, requiring only that the document be opened. This triggers the retrieval of a malicious .lnk file, which may further exploit CVE-2026-21513, a zero-day vulnerability in the MSHTML framework, enabling code execution without user warnings. The PRISMEX framework then executes a multi-stage, largely fileless infection chain using steganography to hide payloads in images, COM hijacking for persistence, and in-memory execution via .NET assembly loading. Command-and-control communication leverages legitimate cloud storage services to blend malicious traffic with normal activity.

Impact: This campaign enables both espionage and potentially destructive operations. Attackers can gain persistent access to critical infrastructure, exfiltrate sensitive data, and potentially deploy disruptive capabilities such as wiper functionality. Targeting logistics hubs, weather services, and supply chain entities increases the risk of operational disruption supporting military and humanitarian efforts.

Recommendation: Organizations should patch CVE-2026-21509 and CVE-2026-21513 across all systems. Restrict or disable unnecessary COM objects, such as Shell.Explorer.1 and where feasible. Enforce strict controls on Office macros and block execution of RTF files from untrusted sources. Monitor for abnormal CLR loading behavior in non-.NET processes such as explorer.exe, and investigate COM registry modifications under user-controlled paths. Inspect outbound traffic to cloud storage services for anomalous patterns and implement allow-listing where possible. Adopt a behavioral detection strategy focused on in-memory execution and trusted service abuse rather than relying solely on signature-based detection.

Summary: Unit 42 reported in March 2026 that threat group TeamPCP conducted a large-scale supply chain attack compromising widely trusted security and developer tools, including Trivy, KICS, LiteLLM, and the Telnyx Python SDK. The campaign injected malicious code into GitHub Actions workflows and PyPI packages, allowing payloads to execute automatically during routine CI/CD operations. The attack leveraged stolen credentials and publishing tokens to poison package versions and repositories. Malware executed silently within pipelines, harvesting sensitive data such as cloud access tokens, SSH keys, Kubernetes secrets, and API credentials. The campaign evolved into a multi-stage operation deploying infostealers, persistent backdoors, and a worm component (CanisterWorm) capable of lateral movement across environments. Advanced techniques included reading process memory to extract secrets, abusing Python .pth files for automatic execution, and using steganography in audio files to deliver payloads. Command-and-control infrastructure relied on typosquatted domains and decentralized mechanisms to evade detection.

Impact: This campaign provides attackers with deep access into development pipelines and production environments, enabling large-scale credential theft and potential downstream compromise. Reported impact includes hundreds of thousands of affected systems and significant volumes of exfiltrated data. The use of trusted security tools increases the likelihood of widespread exposure, while worm-like propagation and wiper capabilities introduce risk of both operational disruption and destructive attacks.

Recommendation: Organizations should audit CI/CD pipelines, dependency chains, and software bill of materials (SBOM) for affected packages. Enforce strict version pinning and disable automatic execution of unverified package scripts. Rotate all exposed credentials, including cloud tokens, SSH keys, and Kubernetes secrets. Monitor for unusual access to instance metadata services, Kubernetes APIs, and environment variables. Implement least privilege across pipeline environments and restrict outbound connections to untrusted domains. Strengthen supply chain security controls by validating package integrity and limiting reliance on unverified third-party components.

Malwarebytes reported on March 26, 2026 a supply chain malware campaign named GlassWorm that targets developers through compromised or malicious packages distributed via repositories such as npm, PyPI, GitHub, and Visual Studio Code extensions. The campaign begins when a developer installs or updates a seemingly legitimate package that has been tampered with or published from a compromised maintainer account. After installation, a hidden preinstall script fingerprints the system and delays execution before retrieving stage-two payload details from the Solana blockchain, avoiding static infrastructure indicators. The malware then deploys an infostealer targeting browser data, cryptocurrency wallets, npm tokens, git credentials, and cloud secrets. In later stages, it installs a Node.js-based remote access trojan and a malicious browser extension masquerading as “Google Docs Offline,” which captures cookies, keystrokes, clipboard data, browsing history, and session activity. Persistence is established through scheduled tasks and registry Run keys, while command-and-control infrastructure is dynamically resolved using distributed hash tables and blockchain lookups.

Impact: GlassWorm enables credential theft, persistent remote access, and browser-level surveillance on developer systems. Compromised credentials and tokens may allow attackers to access source code repositories, cloud environments, and CI/CD pipelines, increasing the risk of downstream supply chain attacks and broader organizational compromise.

Recommendation: Organizations should enforce dependency version pinning and review any unexpected package updates or maintainer changes before deployment. Audit systems for the presence of unauthorized browser extensions, especially those mimicking legitimate tools such as “Google Docs Offline.” Monitor for persistence mechanisms including scheduled tasks and registry Run keys tied to unknown scripts. Inspect outbound connections for blockchain-based or dynamic infrastructure resolution patterns. Restrict access to sensitive credentials stored on developer systems and rotate any exposed tokens. Deploy endpoint monitoring to detect unauthorized script execution and browser data access.

Microsoft Defender Security Research reported in March 2026 an active malware campaign observed since late February 2026 that uses WhatsApp messages to distribute malicious Visual Basic Script (VBS) files. The campaign targets Windows systems and relies on user execution of scripts delivered through a trusted messaging platform. Once executed, the malware initiates a multi-stage infection chain designed to establish persistence and enable remote access. The infection chain uses renamed legitimate Windows utilities, including curl.exe and bitsadmin.exe, to download additional payloads from cloud services such as AWS S3, Tencent Cloud, and Backblaze B2. The malware creates hidden directories under C:\ProgramData, retrieves secondary VBS scripts, and attempts repeated User Account Control (UAC) bypass by modifying registry keys such as HKLM\Software\Microsoft\Win. In the final stage, it deploys unsigned MSI installers (e.g., Setup.msi, AnyDesk.msi) to establish persistent remote access while blending in with normal software installation activity.

Impact: The campaign provides attackers with persistent remote access to compromised systems. This enables data exfiltration, deployment of additional malware, and use of infected devices for further activity. The use of trusted platforms like WhatsApp and cloud storage increases the likelihood of user interaction and reduces detection through traditional network controls.

Recommendation: Organizations should block or restrict execution of script hosts such as wscript.exe, cscript.exe, and mshta.exe from user-writable or untrusted paths. Monitor for renamed system utilities where file names do not match OriginalFileName metadata. Inspect outbound traffic to cloud storage services for anomalous download behavior. Detect registry modifications related to UAC settings under HKLM\Software\Microsoft\Win. Block unsigned or unexpected MSI installations, especially those executed from ProgramData or temporary directories. Educate users to treat unexpected WhatsApp attachments as untrusted and prevent execution of unsolicited scripts.