eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Iranian APT MuddyWater Exposed
Bottom Line: Infrastructure associated with the Iranian state-sponsored APT group MuddyWater has been discovered, which provide insights into the group's targets, tools, and exploits.
eSentire's Threat Response Unit (TRU) discovered exposed infrastructure linked to the Iranian state-sponsored APT MuddyWater; this activity has been publicly reported on as well. This led to identification of the group’s attack tradecraft including Command-and-Control tooling (C2), vulnerability exploits and scan results, and target details. Among the identified targets were Israeli healthcare and immigration organizations, Jordanian government webmail services, an Egyptian national airline, UAE-based enterprises, an Iranian domestic marketplace, and a U.S.-based technology company.
Hunt.io identified the use of infrastructure associated with NameCheap and Hosterdaddy (AS152485) IP addresses by the group. The same Hosterdaddy infrastructure has also been referenced in a recent report detailing the group’s attack against an Israeli company. MuddyWater employed open-source tools, including Resocks and Neo-reGeorg, to facilitate tunneling and webshell-based SOCKS proxy pivoting. For C2, the group utilized both open-source and custom frameworks. The group has developed custom C2s including an AI-assisted Python-based UDP C2 named KeyC2. Researchers also identified a PowerShell loader used to deploy Tsundere bot, that uses Ethereum smart contracts to retrieve the C2 server details and enables further attacker-controlled actions.
Platforms like Shodan and Nuclei, along with open-source tools such as Subfinder and Fluff were identified to be used for reconnaissance and enumeration. Shodan API keys found in the directory were reported by researchers. Exploits targeting both known and novel vulnerabilities were identified, including a modified version of an existing Proof-of-Concept (PoC) exploit code for a Fortinet flaw (CVE-2024-5559) and proof of mass exploitation of an N-Central flaw (CVE-2025-9316). The group used AnyDesk Remote Monitoring and Management (RMM) tool for persistent remote access and employed public platforms such as Wasabi S3 and Amazon EC2, as well as custom file servers for data exfiltration.
eSentire's TRU has reviewed the exposed information and the analysis into the artifacts was identical to the above details. TRU also observed similarities in the obfuscation patterns used by the Tsundere bot and the North Korean APT malware known as DEV#POPPER RAT, previously documented in the blog titled North Korean APT Malware Analysis: DEV#POPPER RAT and OmniStealer (Everyday I'm Shufflin'). These findings have been published on TRU’s blog titled MuddyWater APT + Tsundere Botnet: EtherHiding the C2.
For a full list of MuddyWater tools and vulnerabilities discovered via the open directory, see eSentire’s blog post “Iranian APT MuddyWater Exposed”.
eSentire Threat Intelligence Analysis:
MuddyWater (also known as Mango Sandstorm, Seedworm, and Static Kitten), attributed to Iran’s Ministry of Intelligence and Security (MOIS), has been active since at least 2017 and is known for conducting cyber espionage campaigns targeting organizations worldwide. The discovery of the open directory has provided a broader understanding of the group’s Tactics, Techniques, and Procedures (TTPs). Identified custom C2s, exploits for both known and novel vulnerabilities, and ability to conduct mass exploitation further underscores the group’s sophistication. Given the ongoing geopolitical conflict, it is highly likely that MuddyWater will continue targeting organizations holding tactical and strategic value to the Iranian regime.
The identified vulnerability exploits include flaws in widely used products such as Fortinet FortiOS, Citrix NetScaler, and n8n, as well as popular libraries like React2Shell. Devices that implement these products are typically exposed to the Internet. Attackers tend to target publicly accessible vulnerable devices, as they can be easily identified using platforms and tools such as Shodan and Nuclei, which have been leveraged by MuddyWater. Researchers listed the n8n vulnerability, CVE-2025-68613, among the flaws leveraged by the group. This flaw was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on March 11th. While CISA did not indicate whether this activity was related to MuddyWater operations, it mandated that federal agencies remediate the vulnerability by March 25th.
To defend against such sophisticated threats, organizations are recommended to adopt a layered security approach. It is advised to minimize the exposure of edge devices to the Internet, restrict their access to trusted internal networks, and utilize VPNs for secure connectivity. The download and installation of unauthorized software should be restricted, and Multi-Factor Authentication (MFA) should be enforced across all assets. Regular vulnerability assessments and timely patching of all assets should be conducted. Organizations should monitor network traffic for anomalous activity.
The eSentire Threat Intelligence team published a security advisory on the eSentire TRU’s review of the open directory on March 10th. eSentire's TRU has conducted organization-wide threat hunts across customer environments. The team has also added the identified malicious infrastructure to the Global Block List and has developed detections for the tools and vulnerabilities leveraged by the group. eSentire MDR for Network and Endpoint can detect MuddyWater related activity included backdoor deployment, C2 communication, data exfiltration, and exploitation of flaws mentioned in the advisory.
Microsoft March 2026 Patch Tuesday Release
Bottom Line: Microsoft's Patch Tuesday release for the month of March disclosed a total of 93 vulnerabilities including seven critical and two important severity publicly disclosed flaws. Immediate review and remediation of affected systems is strongly recommended.
On March 10th, 2026, Microsoft released its monthly Patch Tuesday updates, which addressed a total of 93 vulnerabilities across the company’s product ecosystem. This month’s release included two publicly disclosed zero‑day vulnerabilities and seven vulnerabilities classified as critical. Among the disclosed important vulnerabilities, Microsoft has assessed two Elevation of Privilege (EoP) flaws as “Exploitation More Likely”, making them notable.
The first zero‑day vulnerability, CVE-2026-21262, is an EoP issue affecting SQL Server. It carries a CVSS score of 8.8, indicating a high‑severity impact. Successful exploitation of this vulnerability could allow an attacker to gain elevated (sysadmin) privileges within a SQL Server environment. Despite its potential impact, Microsoft has assessed the likelihood of exploitation as “Less Likely.”
The second zero‑day, CVE-2026-26127, is a Denial of Service vulnerability within the .NET framework. This flaw has a CVSS score of 7.5. Microsoft reported that an out-of-bounds read in .NET could allow an unauthorized attacker to cause a denial of service over a network. Microsoft has rated this vulnerability as “Exploitation Unlikely”.
This month’s release included seven vulnerabilities categorized as critical. Three of these critical vulnerabilities affect the Azure Compute Gallery, identified as CVE-2026-23651, CVE-2026-26124, and CVE-2026-26122. The first two have been assigned an impact of elevation of privilege, while the third one is highlighted as information disclosure.
Two additional critical vulnerabilities impact Microsoft Office identified as CVE-2026-26110 and CVE-2026-26113. These flaws could allow an unauthorized attacker to execute malicious code locally based on certain conditions. Another critical vulnerability, CVE-2026-26144, affects Microsoft Excel specifically. The final critical vulnerability in this release, CVE-2026-26125, affects the Payment Orchestrator Service.
Although classified as Important, both of the following EoP flaws carry the higher-risk designation of “Exploitation More Likely” and should be prioritized alongside critical vulnerabilities. The first of these vulnerabilities, CVE-2026-25187, affects Winlogon and holds a CVSS score of 7.8. The second vulnerability, CVE-2026-24294, also carries a CVSS score of 7.8 and affects the Windows SMB Server.
eSentire Threat Intelligence Analysis:
The March 2026 Patch Tuesday release from Microsoft reflects several ongoing trends in the organization’s threat landscape. With 93 vulnerabilities addressed in March 2026, an increase compared to the February 2026 release, the distribution of severity and exploitability highlights several priority risks that organizations should not overlook. Microsoft categorizes the zero-day vulnerabilities in this release as publicly disclosed prior to patch release, but there was no confirmed evidence that threat actors were leveraging them in active attacks at the time of disclosure. Organizations are strongly encouraged to apply all relevant security patches released as part of Microsoft’s March Patch Tuesday disclosure. In particular, zero-day vulnerabilities, vulnerabilities designated as “Exploitation More Likely,” and flaws affecting internet-facing applications should be prioritized for immediate patching.
Microsoft’s disclosure of two zero-day vulnerabilities, while currently rated as unlikely to be exploited, continues to draw attention due to the potential value such flaws hold for well-resourced threat actors. Public disclosure of these vulnerabilities may encourage further research and potential weaponization, particularly by advanced adversaries seeking to incorporate newly patched flaws into their post-exploitation toolsets. Additionally, the Windows Winlogon vulnerability (CVE-2026-25187) and the Windows SMB Server vulnerability (CVE-2026-24294) are both assigned the “Exploitation More Likely” designation. Privilege escalation vulnerabilities such as these remain a cornerstone of post-compromise activity. Even when they cannot be exploited remotely without initial access, they represent critical steps for attackers who have already gained a foothold through methods such as phishing, credential compromise, or lateral movement.
The patching of multiple critical vulnerabilities in Microsoft Office and Microsoft Excel reinforces that Microsoft productivity applications continue to be among the most reliable avenues for threat actors. Malicious documents remain one of the most widely abused vectors in phishing campaigns, initial access attempts, and broader social engineering operations. While none of these vulnerabilities were disclosed as zero-days, their critical classification suggests that threat actors may attempt to rapidly weaponize them following public disclosure.
The eSentire Threat Intelligence team is actively tracking the vulnerabilities from this release for additional details and detection opportunities. eSentire Managed Vulnerability Service (MVS) has plugins in place to identify devices vulnerable to the recently disclosed zero-day vulnerabilities.
Stryker Discloses Global Cyber Attack, Hacktivist Group Handala Claims Responsibility
Bottom Line: The pro-Iranian hacktivist group Handala has claimed responsibility for a cyberattack against U.S.-based Stryker, stating that it disrupted the company’s network using wiper malware. The ongoing escalation in regional tensions indicates a strong likelihood of continued hacktivist operations targeting Israel, the United States, and their allies.
On March 11th, 2026, the United States-based medical technology company Stryker disclosed a cyberattack, which they indicate caused a “global network disruption” impacting their Microsoft environment. Within their initial disclosure, Stryker stated that there was “no indication of ransomware or malware”, and that the incident had been contained. Also on March 11th, the Wall Street Journal published an article providing additional insights into the attack, including that employees had cellphones and laptops disabled, and that the logo for the pro-Iranian hacktivist group Handala (aka Handala Hack Team) appeared on login pages for the company.
Additional reporting on the attack states that employees of Stryker identified that devices which were enrolled in Stryker's mobile device management system were remotely wiped in the middle of the night. Handala claimed responsibility for the attack on their Telegram channel, stating that it was in retaliation for a missile strike that hit an Iranian school, killing over 170 people, on February 28th. Handala indicated that the attack against Stryker resulted in over 200,000 “systems, servers, and mobile devices” being wiped, and that the group exfiltrated over 50 terabytes of data.
In updates to their initial statement, Stryker stated that the incident had “caused disruptions to order processing, manufacturing and shipping”, but was contained to their internal Microsoft environment. Stryker also highlighted that their products, such as Mako, Vocera and LIFEPAK35, are “fully safe to use”, and that investigation into the incident remains ongoing.
eSentire Threat Intelligence Analysis:
Handala is a pro-Iranian and pro-Palestinian hacktivist group that formed following the start of the Gaza war in October 2023. Handala has been assessed by Check Point Research as “one of several online personas” maintained by the Iranian APT Void Manticore (aka Storm-0842), which has ties to Iran's Ministry of Intelligence and Security (MOIS). Within Handala's claims, they indicate that the attack was due to Stryker's “Zionist" ties, which has been theorized as potentially relating to the acquisition of the Israeli company Orthospace in 2019 and contracts with the United States military. However, other claims suggest that the attack may have been more opportunistic in nature. Following recent United States and Israeli military operations in Iran, Handala has claimed responsibility for attacks targeting Jordan's fuel systems, and Israeli organizations in the healthcare and energy sectors. Handala also claimed responsibility for another cyberattack on March 11th against Verifone, but these claims have been disputed.
At the time of writing, details regarding specifics of the attack are limited. On March 11th, security researcher Kevin Beaumont indicated that Handala was able to compromise the Active Directory environment of Stryker, and used Intune to wipe devices remotely, but this does not appear to have been verified. The initial access vector used by Handala is currently unknown, but the group has been known to leverage vulnerable or misconfigured edge devices, phishing, or third-party supply chain attacks to gain entry. Additional reporting on the attack has indicated a possible impact on the healthcare sector, where medical organizations are unable to order medical devices and surgical supplies sourced from Stryker. The cyberattack is being referred to as a “real-world supply chain attack”, with claims that many hospitals in the United States use Stryker's supplies, highlighting the substantial impact that attacks on critical systems can have.
eSentire's Threat Intelligence team assesses with high confidence that Pro-Iranian hacktivist activity will continue to target the United States, Israel, and allied countries throughout the duration of the ongoing conflict in Iran. To protect against these threats, organizations should ensure that strong passwords, Multi-Factor Authentication (MFA), and Conditional Access policies are enforced, edge devices are fully up to date on security patches and best practices are followed, and educate employees on how to identify and report phishing and other malicious content. eSentire's Threat Intelligence team published an advisory on the ongoing conflict and continues to track this topic for additional information and detection opportunities.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
