🛡️ Straylight Sentinel Intelligence Report | Wednesday, March 18, 2026 | 14:50 UTC

🛡️ /Straylight Sentinel Brief

[Wednesday, March 18, 2026 | 14:50 UTC Edition]

---

BLUF (Bottom Line Up Front)

State-sponsored actors like APT28 and DPRK are refining their toolkits to target European government entities and cryptocurrency markets, while ransomware operators like LeakNet adopt sophisticated in-memory evasion techniques.

---

🚨 FLASH ALERTS (Critical Threats)

• 01 | Critical Unauthenticated Takeover in Oracle Edge Cloud Infrastructure Designer

  • Exploitation Status: Not Actively Exploited
  • Threat Metrics: CVSS: 9.8 | EPSS: N/A
  • The Risk: Network
  • Tactical Mitigation: Restrict network access to the management interface and apply Oracle's latest patches immediately.
  • 🧠 Analyst Challenge: How do we monitor for unauthenticated HTTP requests targeting infrastructure design tools?
  • Source: Full Report

• 02 | Critical Code Execution Vulnerability in jsPDF Library

  • Exploitation Status: Not Actively Exploited
  • Threat Metrics: CVSS: 9.6 | EPSS: 4.0000%
  • The Risk: Network
  • Tactical Mitigation: Update jsPDF to version 4.2.1 or later and sanitize all user-supplied arguments passed to PDF generation functions.
  • 🧠 Analyst Challenge: Are we auditing our client-side libraries for vulnerabilities that could lead to code execution?
  • Source: Full Report

• 03 | Critical Data Tampering in Moodle Custom Certificate Plugin

  • Exploitation Status: Not Actively Exploited
  • Threat Metrics: CVSS: 9.6 | EPSS: 2.0000%
  • The Risk: Network
  • Tactical Mitigation: Upgrade the mod_customcert plugin to versions 4.4.9 or 5.0.3 to enforce proper context authorization.
  • 🧠 Analyst Challenge: How do we ensure that role-based access controls in third-party plugins are properly scoped to specific contexts?
  • Source: Full Report

---

🤖 THE AI FRONTIER

• Critical Injections in Spring AI Framework

  • The Risk: Spring AI suffers from high-severity SQL injection and JSONPath injection vulnerabilities in its filter expression converters, allowing attackers to bypass metadata-based access controls.
  • Source: Read More

• LibreChat RAG API Authentication Compromise

  • The Risk: LibreChat version 0.8.1-rc2 reuses the same JWT secret for both user sessions and its Retrieval-Augmented Generation (RAG) API, compromising service-level authentication and potentially exposing sensitive AI context data.
  • Source: Read More

---

📰 INDUSTRY INTEL (The Big 5)

• 01 | Operation Roundish: APT28 Targets Ukraine with Roundcube Toolkit

  • The Scoop: APT28 deployed a comprehensive exploitation toolkit against Ukrainian government webmail, utilizing CSS injection and a Go-based implant for credential harvesting and persistent mail forwarding.
  • Why It Matters: Demonstrates advanced evasion and long-term intelligence gathering capabilities targeting critical European infrastructure.
  • Source: View Story

• 02 | DPRK's Contagious Trader Campaign Targets Crypto Bots

  • The Scoop: North Korean actors are weaponizing cryptocurrency trading bots on GitHub using malicious npm dependencies to exfiltrate private keys.
  • Why It Matters: Highlights the ongoing threat to the cryptocurrency sector from state-sponsored actors leveraging open-source supply chains.
  • Source: View Story

• 03 | Konni Group's KakaoTalk-Linked Spear-Phishing

  • The Scoop: The Konni Group executed a multi-stage campaign using spear-phishing and malicious LNK files, notably abusing compromised KakaoTalk PC sessions to distribute RATs to victims' contacts.
  • Why It Matters: Shows the effectiveness of trust-based propagation and the need for behavioral detection against modular RAT deployments.
  • Source: View Story

• 04 | LeakNet Ransomware Adopts Deno-Based In-Memory Loader

  • The Scoop: Ransomware operator LeakNet has shifted to running its own initial access campaigns using ClickFix lures and a novel Deno-based loader that executes payloads entirely in memory.
  • Why It Matters: Traditional file-based detection mechanisms are bypassed, requiring defenders to focus on behavioral signals and restrict administrative tools like PsExec.
  • Source: View Story

• 05 | The Refund Fraud Economy Exploits Major Retailers

  • The Scoop: Cybercriminals are increasingly exploiting major retailers and payment platforms through sophisticated refund fraud schemes, creating a dedicated underground economy.
  • Why It Matters: Retailers face significant financial losses and must implement stricter verification and fraud detection mechanisms.
  • Source: View Story

---

⚡ SPEED ROUND

• Nordstrom's email system abused to send crypto scams to customers
• Minecraft: Dark Tale of Scams, Malware & Extortion
• Fake Pudgy World site steals crypto passwords

---

🛡️ PATCH WATCH (Top 8)

• pyasn1: ASN.1 library vulnerability (CVE-2026-30922)
• Juju: Secret-set tool authorization failure (CVE-2026-32693)
• Cockpit CMS: Headless CMS vulnerability (CVE-2026-31891)
• jsPDF: User control of arguments (CVE-2026-31898)
• music-metadata: Metadata parser vulnerability (CVE-2026-32256)

---