Digital data streams highlighting critical network flaws and cyber espionage.

Daily Cybersecurity News - March 14, 2026

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

March 14, 2026 5:04 PM 5 min read

HPE Switches Suffer Critical Password Flaw

Critical

Executive Summary

A critical vulnerability, identified as CVE-2026-23813, has been discovered in the web-based management interface of HPE Aruba Networking AOS-CX switches. This flaw allows a remote, unauthenticated attacker to bypass authentication and potentially reset administrator passwords, leading to a full system compromise. HPE has released patches to address this vulnerability, which is currently not known to be actively exploited in the wild.

Vulnerability Details

Affected Product: HPE Aruba Networking AOS-CX, versions 10.17.0001 and below, 10.16.1020 and below, 10.13.1160 and below, and 10.10.1170 and below
Identifier: CVE-2026-23813
CVSS Score: 9.8 (Critical)
Exploitation Status: Not Actively Exploited

Risk & Impact

Triage: Immediate action is required due to the critical severity and the potential for complete system takeover.
Attack Vector: An unauthenticated attacker can remotely exploit this vulnerability over the network via the web-based management interface without any user interaction. Successful exploitation could allow full control of the network device, enabling the disruption of network communications or compromise of the entire system.
Ease of Exploit: The attack complexity is considered low.

Action Plan

Immediate Action: Upgrade to a patched version of AOS-CX: 10.17.1001, 10.16.1030, 10.13.1161, or 10.10.1180 and later.
Workaround: Restrict access to all management interfaces to a dedicated and isolated Layer 2 segment or VLAN. Implement strict Layer 3 firewall policies to only allow trusted hosts, and disable HTTP(S) interfaces where not essential.
Detection: Enable comprehensive logging and monitoring of all management interface activities to detect and respond to unauthorized access attempts.

Relevant professional terms

Authentication Bypass: A type of vulnerability that allows an attacker to circumvent security controls and access protected resources or functions without providing valid credentials.
Attack Vector: The path or means by which an attacker can gain access to a computer or network server in order to deliver a payload or malicious outcome. In this case, it is the network, via the web-based management interface.

Source: SecurityWeek

AppsFlyer SDK Hijacked For Crypto Theft

Executive Summary

Threat actors executed a supply chain attack by compromising the AppsFlyer Web SDK. Malicious JavaScript was injected to intercept data and steal cryptocurrency from users visiting websites that load the SDK.

Key TTPs

Initial Access: Compromise of a third-party script (supply chain attack).
Execution: Malicious JavaScript was served to web clients loading the trusted SDK from AppsFlyer's infrastructure.
Defense Evasion: The malicious payload used polymorphic obfuscation to defeat signature-based detection.

Campaign Analysis

This incident demonstrates a sophisticated supply chain attack, turning a trusted marketing SDK into a widespread distribution vector for a modular crypto-stealing framework. The attack highlights the inherent risks of third-party scripts, which can provide attackers direct access to end-user data on countless websites simultaneously.

Targeting & Infrastructure

Target Profile: Visitors to any website loading the compromised AppsFlyer Web SDK during the attack window.
Infrastructure: The attack was served from AppsFlyer's CDN, specifically from the domain websdk.appsflyer[.]com.

Actionable Intelligence

Domains: websdk.appsflyer[.]com

Relevant Terms

Supply Chain Attack: An attack strategy that targets a trusted third-party vendor or software to compromise its customers.
SDK (Software Development Kit): A set of tools, libraries, and documentation that help developers create applications for a specific platform.

Source: BleepingComputer

GlassWorm Exploits VSX To Target Developers

Executive Summary

The GlassWorm threat actor is executing a sophisticated supply chain attack, compromising legitimate developer accounts to push malicious updates to popular Open VSX extensions. The campaign targets developers, primarily on macOS, to steal credentials, cryptocurrency wallets, and other sensitive data.

Key TTPs

Initial Access: Compromising legitimate developer accounts to publish malicious updates to existing, trusted VS Code extensions.
Execution: A loader decrypts and executes an AES-256-CBC encrypted payload at runtime. On macOS, persistence is achieved using LaunchAgents.
Defense Evasion: The malware avoids execution on systems with a Russian locale and uses a technique called EtherHiding, leveraging Solana blockchain transactions to resolve C2 infrastructure.

Campaign Analysis

This campaign marks a significant escalation from previous GlassWorm activity, shifting from creating new malicious extensions to hijacking trusted ones. This abuse of the supply chain allows the malware to bypass developer trust and spread more effectively.

Targeting & Infrastructure

Target Profile: Software developers, with a recent focus on macOS users.
Infrastructure: Abuses the Open VSX registry and uses the Solana blockchain and Google Calendar for a resilient, multi-layered C2 infrastructure.

Actionable Intelligence

IPs: 45.32.150[.]251

Relevant Terms

Supply Chain Attack: An attack strategy that targets less-secure elements in a software supply network, such as third-party code or developer tools, to compromise a final product or organization.
C2 (Command and Control): The server infrastructure that attackers use to send commands to and receive stolen data from compromised systems.

Source: The Hacker News

Chinese Spies Infiltrate Southeast Asian Militaries

Executive Summary

A suspected China-based cyber espionage operation, tracked as CL-STA-1087, has been targeting military organizations in Southeast Asia since at least 2020. The campaign focuses on patient, long-term intelligence gathering using custom backdoors named AppleChris and MemFun.

Key TTPs

Initial Access: The exact initial access vector is currently unknown, but the campaign was identified by suspicious PowerShell activity creating reverse shells.
Execution: The MemFun malware uses process hollowing to inject its payload into legitimate `dllhost[.]exe` processes. The AppleChris backdoor is launched via DLL hijacking.
Defense Evasion: Malware variants use delayed execution to evade automated sandboxes and alter file timestamps to match legitimate system files.

Campaign Analysis

This long-running campaign demonstrates a patient and persistent focus on regional military intelligence, specifically targeting documents related to command structures and collaborations with Western forces. The use of custom, modular malware and dead drop resolvers for C2 communications highlights a well-resourced and operationally secure actor.

Targeting & Infrastructure

Target Profile: Military and government organizations across Southeast Asia.
Infrastructure: Uses Pastebin and Dropbox as dead drop resolvers to retrieve C2 server addresses, allowing for flexible and resilient command-and-control infrastructure.

Relevant Terms

Process Hollowing: A defense evasion technique where an attacker creates a new process in a suspended state and replaces its legitimate code with malicious code before resuming it.
Dead Drop Resolver: A method used by malware to retrieve its command-and-control (C2) server address from a legitimate online service (like a Pastebin page) to avoid hardcoding IPs.

Source: The Hacker News