eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Cisco Security Advisories Publication and Updates
Bottom Line: Cisco disclosed two maximum severity vulnerabilities within its Cisco Secure Firewall Management Center software, along with confirming the exploitation of two additional vulnerabilities within Cisco Catalyst SD-WAN products. Organizations utilizing these applications should prioritize immediate patching.
On March 4th, 2026, Cisco issued the Security Advisory Bundled Publication for March 2026, addressing multiple vulnerabilities across its software portfolio. Among the disclosed issues were two maximum severity vulnerabilities, CVE-2026-20079 (CVSS: 10) and CVE-2026-20131 (CVSS: 10), affecting Cisco Secure Firewall Management Center (FMC) software. Successful exploitation of these vulnerabilities could result in severe impacts, including Remote Code Execution (RCE) and the potential for attackers to obtain root-level privileges. Following this release, Cisco also updated its February 2026 security advisory confirming exploitation of CVE-2026-20122 (CVSS: 5.4) and CVE-2026-20128 (CVSS: 7.5), in Cisco Catalyst SD-WAN Manager.
Vulnerabilities in the Cisco FMC software:
- CVE-2026-20079: An authentication bypass vulnerability in the web interface of Cisco FMC software which could allow a remote attacker to bypass authentication and execute scripts to obtain root access to the device
- The vulnerability arises from the improper creation of a system process during the device's boot sequence
- An attacker can exploit the flaw by sending specially crafted HTTP requests to the affected system
- CVE-2026-20131: A RCE vulnerability in the web-based management interface of Cisco FMC software which could allow an unauthenticated remote attacker to execute arbitrary Java code as root on the device
- The vulnerability stems from the insecure deserialization of a user-supplied Java byte stream
- The flaw also affects Cisco Security Cloud Control (SCC) Firewall Management
The flaws have not been reported to be exploited in the wild at the time of writing.
On February 25th, 2026, Cisco disclosed a zero-day vulnerability, CVE-2026-20127 (CVSS: 10.0), affecting its Catalyst SD-WAN Manager (formerly SD-WAN vManage) products. On March 5th, Cisco confirmed exploitation of two other flaws impacting the same products.
- CVE-2026-20122: An arbitrary file overwrite vulnerability which could allow an authenticated remote attacker to overwrite files on the device and gain “vmanage” privileges
- An attacker can exploit the improper file handling on the API interface of an affected device by uploading a malicious file to the local file system
- CVE-2026-20128: An information disclosure vulnerability which could allow an authenticated local attacker to gain Data Collector Agent (DCA) user privileges
- An attacker could exploit the presence of a DCA credential file on an affected device by gaining access to the filesystem with low-privileged user permissions and reading the file that stores the DCA password on the system
Cisco has released security updates addressing all the identified vulnerabilities and has confirmed that no workarounds are available to mitigate these flaws.
eSentire Threat Intelligence Analysis:
Cisco products are widely deployed across industries to support networking and network security operations. Due to their critical role in enterprise infrastructure, vulnerabilities in these products are frequently targeted by threat actors, as successful exploitation can provide unauthorized access to an organization’s network and facilitate further malicious activity. Organizations are strongly advised to evaluate the potential business impact based on affected assets and apply the relevant security updates immediately.
Although the Cisco FMC vulnerabilities had not been reported as exploited at the time of writing, the eSentire Threat Intelligence team assesses that exploitation is highly likely in the near term, given the critical severity of the vulnerabilities and the potential impact of successful attacks. Cisco recommends limiting the exposure of the FMC management interface to the public Internet to reduce the attack surface associated with CVE-2026-20131.
The number of actively exploited vulnerabilities affecting Cisco Catalyst SD-WAN Manager has extended with the disclosure of CVE-2026-20122 and CVE-2026-20128. While Cisco previously provided temporary mitigations for CVE-2026-20127 in February 2026, the recent advisory does not include any workarounds for the newly identified flaws. As a result, upgrading to the patched, secure version remains the only effective measure to mitigate the risk of exploitation.
The eSentire Threat Intelligence team published security advisories addressing CVE-2026-20079 and CVE-2026-20131 on March 4th, 2026, and CVE-2026-20127 on February 25th, 2026. eSentire Managed Vulnerability Service (MVS) has plugins to identify devices vulnerable to CVE-2026-20122 and CVE-2026-20128 and will add the relevant plugins for CVE-2026-20079 and CVE-2026-20131 as they become available. The eSentire Threat Intelligence team is actively tracking the vulnerabilities for additional details and detection opportunities.
Microsoft Announces Disruption of Tycoon 2FA in Coordination with Industry Partners
Bottom Line: Microsoft, in collaboration with government agencies and industry partners, including eSentire, led an operation to take down infrastructure relating to the Phishing-as-a-Service (PhaaS) offering Tycoon2FA.
On March 4th, 2026, Microsoft, in collaboration with industry partners including eSentire, announced a disruption operation against the Tycoon 2FA Phishing‑as‑a‑Service (PhaaS) platform. This platform played a central role in enabling Adversary‑in‑the‑Middle (AitM) phishing attacks since 2023 by intercepting Multi‑Factor Authentication (MFA) codes, stealing session cookies, and facilitating rapid account takeovers that frequently resulted in Business Email Compromise (BEC).
Tycoon 2FA emerged in 2023 as a sophisticated PhaaS offering that lowered the barrier for conducting high‑fidelity credential phishing and session hijacking at scale. Tycoon2FA operated as a commercialized service developed by the threat actor group known as Storm‑1747. It was marketed primarily through Telegram and Signal and offered attackers a streamlined, browser‑based control panel that centralized campaign creation, configuration, deployment, and victim monitoring. Pricing for the service began at approximately $120 USD for 10 days of access, with monthly plans costing about $350. Once users logged into the Tycoon2FA control panel, they could configure all aspects of a phishing campaign from a single dashboard. The panel included pre‑built templates that impersonated major cloud services such as Microsoft 365, Outlook, OneDrive, SharePoint, and Gmail. Threat actors could customize lures, adjust branding themes, create malicious attachments, define redirect chains, and set up exfiltration options.
According to Microsoft Threat Intelligence, Tycoon2FA was responsible for tens of millions of phishing messages each month and affected more than 500,000 organizations worldwide. eSentire’s telemetry indicates that 32% of all tracked security incidents in 2025 involved Tycoon 2FA, and the platform served as the initial access vector in approximately 18% of disrupted intrusions consistent with BEC tactics.
Microsoft, Europol, the U.S. District Court for the Southern District of New York, law‑enforcement agencies in Latvia, Lithuania, Portugal, Poland, Spain, and the United Kingdom, and industry partners including Proofpoint, Intel 471, eSentire, Cloudflare, Health‑ISAC, SpyCloud, Resecurity, Coinbase, and the Shadowserver Foundation were all involved in the coordinated disruption of Tycoon 2FA. Microsoft seized 330 domains associated with Tycoon 2FA’s core infrastructure, this included both control panels and fraudulent login pages.
eSentire Threat Intelligence Analysis:
The takedown of Tycoon 2FA is a notable blow to the cybercrime ecosystem, as the platform had become a widely used tool that enabled threat actors to conduct AiTM phishing campaigns capable of bypassing MFA protections. By disrupting this infrastructure, the operation removes a key capability relied upon by numerous threat actors conducting credential theft and account takeover campaigns. However, similar to previous coordinated disruptions, such as the takedown of the Lumma Stealer infrastructure led by Microsoft, it is likely that many Tycoon 2FA customers will pivot to alternative PhaaS offerings. While this transition may temporarily disrupt active campaigns, the broader cybercriminal ecosystem is expected to adapt.
No arrests related to the Tycoon 2FA operation have been publicly reported; it remains possible that the platform’s developers could attempt to rebuild or relaunch the service in the future. Nevertheless, disruption operations of this scale can erode trust within criminal marketplaces, potentially impacting the platform’s reputation among prospective customers and reducing its immediate operational effectiveness.
Security teams should adopt a defense‑in‑depth approach to identity security that assumes MFA can be defeated through AiTM techniques. Teams should prioritize phishing‑resistant authentication methods, such as FIDO2 security keys or passkeys, and they should ensure that Conditional Access policies enforce strong session controls, including continuous access evaluation where appropriate. It is advisable to enhance visibility across sign‑in telemetry by centralizing logs from cloud identity providers.
eSentire’s Threat Response Unit (TRU) has previously tracked Tycoon 2FA activity and published multiple technical reports and advisory detailing the infrastructure and tactics associated with the PhaaS platform. eSentire has released an advanced hunting query that organizations can leverage to proactively search for artifacts associated with Tycoon 2FA activity within their environments. In addition, eSentire maintains detection rules designed to identify Tycoon 2FA and other similar PhaaS offerings, enabling earlier detection of AiTM phishing activity. Indicators of Compromise (IoCs) related to Tycoon 2FA are also available through the eSentire Threat Intelligence Feed.
Cyber-Activity Associated with Iran Conflict
Bottom Line: Following the U.S. and Israeli military operations against Iran, there is an increased risk of cyberattacks from pro-Iranian groups targeting U.S., Israeli, and allied organizations, particularly in critical/high-value sectors.
On February 28th, 2026, the United States and Israel conducted major military strikes against Iran, which were dubbed Operation Epic Fury and Operation Roaring Lion. These military operations involved the targeting of Iranian air defenses, military sites, and leadership using physical strikes, which resulted in the death of Iran's Supreme Leader Ayatollah Ali Khamenei. Iran responded with kinetic strikes against Israel, and other allies of the United States that are hosting American troops in the region. Since the strikes, cyber-attacks from pro-Iranian groups have been identified targeting organizations within Israel, the United States, and their allies, which will likely continue for the duration of the conflict.
In the days following the strikes, reports emerged of increased activity from pro-Iranian hacktivist groups, including the Islamic Cyber Resistance, who announced a recruitment campaign of “cyber experts and resources” for a “great epic battle”. Flashpoint identified activity from several Iran-linked groups following the strikes, including the Handala Group, Fatimiyoun Electronic Team, and the Islamic Cyber Resistance. Attacks conducted by the Handala Group involved targeting Industrial Control Systems (ICSs) in Israel, to disrupt manufacturing and energy distribution within the country. Identified campaigns from Fatimiyoun Electronic Team and the Islamic Cyber Resistance involved performing Distributed Denial-of-Service (DDoS) attacks and the deployment of wiper malware against United States and Israeli military logistics providers, and Western financial and energy firms. CrowdStrike also identified a surge in reconnaissance and DDoS attacks performed by Iran-aligned groups following the military operations.
In an assessment of this developing situation, Anomali suggested that following the United States and Israel's military operations, Iran would utilize cyber operations as an “instrument of asymmetric retaliation”, indicating that Iran-backed APT groups were escalating operations. Anomali stated that “Iran's published war doctrine names cyber as a first-tier response” and claimed with high confidence that further “Iranian retaliatory cyber operations are imminent”. On March 5th, Symantec and Carbon Black's Threat Hunter Team published a report on activity relating to Seedworm (also known as MuddyWater), an Iranian APT group. The initial attacks were identified to be from earlier in February 2026, prior to the strikes, but that activity had “continued in recent days” following the military operations. The attacks targeted a bank, software company, and an airport in the United States, and non-governmental organizations in both the United States and Canada. The Threat Hunter Team highlighted that the impacted software company is a “supplier to the defense and aerospace industries” with a presence in Israel, while also noting that the campaigns put the threat actors in a “potentially dangerous position to launch attacks” amid growing escalations.
eSentire Threat Intelligence Analysis:
Following Operation Rising Lion in June 2025, a surge in pro-Iran hacktivist activity was identified, with SOCRadar observing over 600 distinct cyber-attack claims within 15 days. The Canadian Centre for Cyber Security (CCCS) also noted a spike in similar activity in June 2025, which involved hacktivist groups conducting DDoS attacks and website defacement against United States-based defence companies, financial institutions, and the military. An Iranian Ransomware-as-a-Service (RaaS) operation, Pay2Key.I2P, also re-emerged following the attacks, stating that affiliates could keep 80% of ransom payments if “engaged in an attack against enemies of Iran”. In the days following the latest military operations, Unit 42 has identified several pro-Iranian hacktivist groups that have claimed attacks against various organizations, including fuel systems in Jordan, banks and payment infrastructure in Israel, websites relating to Kuwait's government and military, airports in Bahrain, Saudi Arabia, and the United Arab Emirates, and a Turkish media outlet. Unit 42 also identified unverified claims from the pro-Russia hacktivist group Russian Legion, stating to have accessed Israel's Iron Dome missile defense system, but no evidence was provided.
Iranian state-sponsored threat actors are known to target critical infrastructure, energy (oil & gas), water & wastewater, in addition to various government and private sector organizations, such as telecommunications, financial, healthcare, and academic. Operations involving Iranian APT groups are known to conduct espionage and influence-motivated campaigns but also expand to include the usage of destructive wiper malware. Wiper malware is notable as it does not provide opportunities for threat actors to profit off an infection, as its purpose is to cause destruction by destroying data from infected systems. Wiper malware is often used by state-sponsored or hacktivist groups, with examples of Iran-linked groups including APT33, APT35, Agrius, and the Handala Group. Usage of wiper malware against critical infrastructure targets can have adverse, real-world impacts on a country, such as disrupting supply chains leading to shortages of critical resources (food, water, energy, etc.), which can impact a country’s public health, economy, and war efforts.
Along with an increase in pro-Iranian cyber activity, it is also important to note that other threat actors will likely leverage this topic as a lure within their own financially motivated campaigns, attempting to capitalize on current events. Examples of similar trends can be observed with the COVID-19 pandemic, the Russia-Ukraine war, and the United States military strikes against Venezuela in January 2026, which were all used as lures within attacks.
Based on these historic trends, eSentire's Threat Intelligence team assesses with moderate confidence that pro-Iranian hacktivist and APT groups will continue to target United States-affiliated organizations in retaliatory cyber operations. Iranian APT groups are known to utilize a variety of initial access methods, including vulnerability exploitation, social engineering, and brute force attacks. Given the heightened risk and critical impact that attacks can have, organizations are urged to:
eSentire published an advisory on March 2nd regarding this topic, and eSentire's Threat Response Unit (TRU) will discuss it further in the TRU Intelligence Briefing on March 10th, 2026. eSentire’s TRU team is also performing threat hunts across customer environments for known Tactics, Techniques, and Procedures (TTPs) associated with Iranian APTs, and IP addresses related to known Iranian infrastructure has been blocked via eSentire’s Global Block List. eSentire's Threat Intelligence team continues to track this topic for additional information and detection opportunities.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
