LI Defense Brief — March 30, 2026

Executive Summary What You Need To Know This Week

For Decision Makers — Plain Language

This is the most significant week for defense sector cyber threats since Operation Epic Fury began. Iranian-linked group Handala breached FBI Director Kash Patel’s personal Gmail account on March 27, publishing over 300 emails and personal photographs — a direct retaliation after the FBI seized Handala’s operational domains and the State Department posted a $10 million reward for the group’s members. The same group previously conducted the destructive attack against medical technology company Stryker that wiped employee devices in real time. This week, Handala also claimed to have published personal data of Lockheed Martin employees stationed in the Middle East.

Simultaneously, the ShinyHunters extortion group breached the European Commission’s AWS cloud environment on March 30, claiming over 350GB of stolen data including databases, internal documents, and employee information. ShinyHunters has been on an unprecedented campaign — also responsible for voice phishing attacks targeting Okta and Microsoft SSO environments, the TELUS Digital breach involving 1 petabyte of data including FBI background checks, and multiple identity-based intrusions across sectors.

Identity has become the primary attack surface. Attackers are logging in, not breaking in. Infostealer malware listings linked to LummaC2 surged 72% as stolen credentials are commoditized on underground marketplaces. On the vulnerability front, F5 reclassified a BIG-IP APM vulnerability to critical RCE on March 30 after confirming active exploitation. Microsoft SharePoint CVE-2026-20963 is under active exploitation. A Citrix NetScaler critical flaw is under active reconnaissance. And a supply chain attack compromised the Telnyx Python package on PyPI, hiding credential-stealing malware inside a WAV audio file.

The bottom line: if Handala can breach the FBI Director’s email, they can reach your organization. Identity and credential hygiene are no longer optional — they are the perimeter. Immediate priority actions are listed under each threat item below.

Cyber Threats 80% Active Campaigns Targeting Defense Sector CISA · NSA · FBI · Dragos · Unit 42 · Qualys

Iranian Escalation — Handala Breaches FBI Director, Claims Lockheed Martin

Critical

Sources: TechCrunch · Reuters · CNN · Axios · NBC News · DOJ · March 27–30, 2026

Iran-linked group Handala breached FBI Director Kash Patel’s personal Gmail account on March 27, publishing over 300 emails, personal photographs, and documents. The FBI confirmed the breach, stating the information was “historical in nature” involving no government information. The State Department has offered up to $10 million for information on Handala members. The DOJ formally accused Iran’s Ministry of Intelligence and Security (MOIS) of operating the group. In the same week, Handala claimed to have published personal data of Lockheed Martin employees stationed in the Middle East — the manufacturer of the F-35, F-22, and THAAD missile defense system. This follows Handala’s destructive attack on Stryker on March 11 that wiped employee devices in real time. The escalation trajectory is clear: from medical technology to the FBI Director to the nation’s largest defense contractor in under three weeks. Defense contractors of all sizes should assume they are within Handala’s targeting aperture.

Action Required: Audit all employee personal email hygiene — personal Gmail accounts with any connection to work systems are attack vectors. Enforce separation between personal and corporate identities. Review endpoint management configurations per CISA’s March 18 alert on Stryker-style attacks. Brief all employees on Handala’s tactics. Report any suspicious contact or phishing to FBI CyWatch at (855) 292-3937.

Identity-Based Attacks — The New Perimeter

Critical

Sources: IBM X-Force Threat Intelligence Index 2026 · SiliconANGLE · SecurityWeek · Cybersecurity Dive · March 2026

Identity has fully replaced the network as the primary attack surface in 2026. Attackers are abusing valid credentials and trusted integrations to move through systems undetected rather than relying on malware or exploiting software vulnerabilities. Infostealer malware — particularly LummaC2 — has surged 72% in underground marketplace listings, harvesting browser-stored passwords, session cookies, and authentication tokens that are packaged and sold to other threat actors. ShinyHunters demonstrated this at scale: voice phishing kits targeting Okta and Microsoft SSO environments capable of intercepting credentials and bypassing MFA. The European Commission breach announced March 30 came through AWS. The Crunchyroll breach came through an Okta SSO account. The Infinite Campus breach came through a compromised Salesforce account. MFA bypass techniques including MFA fatigue, SIM swapping, session hijacking, and adversary-in-the-middle attacks are rendering credential-centric security models obsolete.

Action Required: Deploy phishing-resistant MFA (FIDO2/WebAuthn) on all critical systems — SMS and push-based MFA are no longer sufficient. Audit all OAuth integrations and third-party app permissions. Implement session token monitoring and anomaly detection. Review all SSO configurations for least-privilege access. Train all staff on voice phishing (vishing) tactics — attackers are calling employees pretending to be IT support.

Volt Typhoon — Active Pre-Positioning Continues

Critical

Sources: CISA AA24-038A · Dragos 2026 Annual Report · Palo Alto Unit 42 · DefenseScoop

Volt Typhoon (PRC state-sponsored, also tracked as Voltzite by Dragos) remains embedded inside U.S. critical infrastructure networks into Q1 2026. Dragos CEO Robert Lee confirmed in February 2026 that Voltzite was operating “inside the control loop” of utility systems — not just maintaining access, but actively positioning for disruption capability. The Air Force has publicly warned that Volt Typhoon’s persistent access could enable China to wage “total war” by targeting the utilities that military installations and defense contractors depend on. Defense contractors dependent on public utilities — power, water, telecommunications — are directly in the blast radius even if their own networks are secure. Tactics remain consistent: living-off-the-land using legitimate Windows tools (wmic, netsh, PowerShell), SOHO router compromise for C2 masking, credential harvesting via NTDS.dit extraction. Do not assume the prior FBI disruption of the KV Botnet eliminated the threat — it has been rebuilt.

Action Required: Hunt for LOLBin abuse in your environment — focus on unusual wmic, netsh, and PowerShell execution patterns. Review SOHO and edge device logs for anomalous outbound connections. Audit Active Directory for unauthorized NTDS.dit access. Implement CISA CPG 2.0 OT-specific controls. Assess your dependency on public utilities and develop contingency plans for utility disruption scenarios.

Critical Vulnerabilities Under Active Exploitation

High

Sources: CISA KEV Catalog · BleepingComputer · Help Net Security · F5 Advisory · March 2026

Multiple critical vulnerabilities are under active exploitation this week. F5 BIG-IP APM (CVE-2025-53521): Reclassified from DoS to critical RCE on March 30 after F5 confirmed active exploitation. Attackers deploying webshells on unpatched devices. CVSS v4 score: 9.3. Microsoft SharePoint (CVE-2026-20963): Remote code execution affecting SharePoint Server Subscription Edition, 2019, and 2016. CISA added to KEV catalog March 19. Unauthenticated attackers can achieve RCE through deserialization of untrusted data. Citrix NetScaler ADC (CVE-2026-3055): Critical flaw (CVSS 9.3) under active reconnaissance. Appliances configured as SAML Identity Providers are vulnerable. Telnyx Python Package (PyPI Supply Chain): Malicious versions 4.87.1 and 4.87.2 published March 27 contain credential-stealing malware hidden inside a WAV audio file using steganography. Targets Windows, Linux, and macOS.

Action Required: Patch F5 BIG-IP APM immediately — active webshell exploitation confirmed. Patch SharePoint servers if not already done per CISA’s March 21 deadline. Audit Citrix NetScaler configurations for SAML IDP exposure. Check all Python environments for Telnyx package versions 4.87.1 or 4.87.2 and downgrade to 4.87.0. Review CISA KEV catalog weekly as standard operating procedure.

Russian State-Sponsored — CDC Targeting + Messaging App Warning

High

Sources: CISA/FBI/NSA Joint Advisory AA22-047A (ongoing) · CISA/FBI PSA March 20, 2026

Russian state-sponsored actors continue persistent targeting of U.S. cleared defense contractors supporting Army, Air Force, Navy, Space Force, and Intelligence Community programs. Primary objectives remain weapons platform development timelines, communications infrastructure plans, and export-controlled technology. TTPs are unchanged: brute force credential attacks against M365 accounts, spearphishing with malicious domains, credential harvesting combined with known CVEs for privilege escalation, and Active Directory mapping. Additionally, CISA and FBI released a public service announcement on March 20 warning that Russian intelligence services are now targeting commercial messaging apps — including Signal, WhatsApp, and Telegram — used by defense personnel. Pro-Russian hacktivist groups have also aligned with Iranian-linked actors, pooling resources and creating coordinated multi-nation-state campaigns.

Action Required: Enforce MFA on all M365 and cloud accounts. Review authentication logs for impossible logins and VPS-originated access. Brief all cleared personnel on the Russian messaging app targeting advisory. Audit mobile device security practices for employees with security clearances. Monitor for coordinated Russian-Iranian activity patterns.

Physical & Proximity 10% Pre-Positioning & Proximity Indicators FARA Filings · OSINT · FBI Counterintelligence · Flashpoint

Ohio Corridor — FARA-Flagged Entities Near Defense Facilities (Continued)

Monitor

Sources: FARA Registration Database · OSINT Corporate Filings · DOJ Public Records

Two entities with foreign principal registrations under FARA identified last week continue to operate within proximity of defense facilities in the Ohio corridor — relevant to organizations in Columbus and the Dayton/Wright-Patterson AFB region. No new activity identified, but the watch item remains active. One entity lists a principal office within 4 miles of a known defense contractor cluster. A second entity has incorporated a subsidiary in the Columbus metro area within the past 18 months. This watch item gains additional relevance in the context of Iranian escalation — the general pattern of foreign principal proximity to defense infrastructure remains consistent with documented pre-positioning behavior across multiple nation-state actors.

Action Required: Maintain heightened physical security awareness at facilities in the Columbus/Dayton corridor. Report any unusual physical surveillance or unexpected vendor/visitor activity to your facility security officer. Cross-reference any new vendor relationships against the FARA registration database.

Lockheed Martin Employee Data Published — Physical Security Implications

Elevated

Sources: Handala Claim · Reuters · Lockheed Martin Statement · March 26, 2026

Handala claimed to have published personal data of dozens of Lockheed Martin employees stationed in the Middle East. Lockheed Martin acknowledged awareness and stated it has policies and procedures in place to “mitigate cyber threats.” The publication of defense contractor employee personal data — names, roles, locations — creates direct physical security risk for those individuals and indirect risk for associated facilities and programs. With employee personal data now publicly available, defense contractor personnel are at increased risk for targeted social engineering, recruitment attempts, and physical intimidation. Flashpoint’s 2026 GTIR documented 91,321 instances of insider recruiting activity in 2025 — employees with public profiles listing cleared positions or overseas assignments are particularly exposed.

Action Required: Brief all employees — particularly those with overseas assignments or cleared positions — on the heightened targeting environment. Recommend employees audit their personal social media and LinkedIn profiles for operational security. Ensure physical security protocols are updated at facilities with employees named in any publications. Reinforce insider threat reporting mechanisms.

Known Actors 10% Active Threat Actor Profiles — Defense Sector MITRE ATT&CK · Unit 42 · CISA · Dragos · FBI · DOJ

Handala Hack Team (MOIS)

Formally attributed to: Iran’s Ministry of Intelligence and Security (MOIS) by DOJ

The most operationally active Iranian cyber group in the current conflict. DOJ formally accused MOIS of operating Handala. Escalation in under three weeks: Stryker (March 11) — destructive wipe of employee devices; Lockheed Martin employee data (March 26) — publication of personal details of employees in the Middle East; FBI Director Kash Patel (March 27) — breach of personal Gmail, publication of 300+ emails and photographs. The FBI seized several Handala domains, which quickly came back online. State Department offering up to $10 million for identification of group members. Not primarily financially motivated — operations are explicitly framed as retaliation for the U.S.-Israel war against Iran. Negotiation is ineffective as a response strategy.

Primary TTPs

Destructive Wipes, Email Compromise, Data Publication

Target Sectors

Defense, Medical Tech, Intelligence Community

Activity Level

Critical · Rapidly Escalating

ShinyHunters

Multiple campaigns: Voice phishing, SSO targeting, cloud exploitation, data extortion

One of the most prolific threat actors of 2026, operating across identity theft, voice phishing, and data extortion at scale. This week claimed the European Commission breach — 350GB from AWS accounts. In January 2026, conducted vishing campaigns targeting Okta and Microsoft SSO with custom phishing kits capable of MFA bypass. Also claimed: TELUS Digital (1PB including FBI background checks), Crunchyroll (6.8M users via Okta SSO), Infinite Campus (11M student records via Salesforce). Defense contractors using cloud SSO and SaaS platforms are directly within operational scope.

Primary TTPs

Voice Phishing, SSO/OAuth Abuse, Cloud Exploitation

Target Sectors

Government, Technology, Defense (supply chain)

Activity Level

Active · High Volume · Expanding

Volt Typhoon (Voltzite)

Also known as: Bronze Silhouette · Vanguard Panda · Insidious Taurus · Dev-0391

Active since mid-2021. Primary mission: pre-position inside U.S. critical infrastructure for future disruption during geopolitical conflict — particularly a potential Taiwan scenario. As of February 2026, confirmed embedded inside U.S. utility control loops. Air Force has publicly warned that persistent access could enable China to wage “total war” by targeting base utilities. Defense contractors dependent on public utilities are directly exposed — does not need to attack your network to affect your operations. KV Botnet has been rebuilt following FBI disruption.

Primary TTPs

LOLBins, SOHO Router C2, NTDS.dit Credential Theft

Target Sectors

Defense, Energy, Telecom, Transportation

Activity Level

Active · Embedded · Persistent

Russian GRU / SVR — CDC Targeting Units

Associated with: Cozy Bear · Fancy Bear · Historical CDC intrusion campaigns

Long-running persistent campaign against U.S. cleared defense contractors. Primary objective: weapons platform data, communications infrastructure plans, export-controlled technology. Documented targeting of Army, Air Force, Navy, Space Force, and Intelligence Community contractors. Maintained access for 6+ months in multiple incidents using legitimate credentials. New: CISA/FBI March 20 PSA warns Russian intelligence targeting commercial messaging apps used by defense personnel. Pro-Russian hacktivist groups have aligned with Iranian actors, creating coordinated multi-nation-state threats.

Primary TTPs

Credential Theft, Spearphishing, M365, Messaging Apps

Target Sectors

Cleared Defense Contractors (CDCs)

Activity Level

Persistent · Converging with Iranian ops

Priority Actions This Week’s Non-Negotiables

Immediate — This Week

1. Patch F5 BIG-IP APM — active webshell exploitation confirmed
2. Deploy phishing-resistant MFA (FIDO2/WebAuthn) on all critical systems
3. Audit all OAuth integrations and SSO configurations
4. Patch Microsoft SharePoint against CVE-2026-20963
5. Check Python environments for compromised Telnyx package
6. Brief all employees on Handala targeting and personal email security

Near-Term — 30 Days

1. Implement session token monitoring and credential anomaly detection
2. Hunt for LOLBin abuse — wmic, netsh, PowerShell patterns
3. Audit Citrix NetScaler configurations for SAML IDP exposure
4. Review mobile device security per CISA/FBI messaging app advisory
5. Develop utility disruption contingency plans (Volt Typhoon scenario)
6. Cross-reference all vendors against FARA registration database