The Watch

The First Mass-Scale iOS Attack

Three independent intelligence streams confirmed today what mobile security researchers have feared since Operation Triangulation in 2023: a U.S. government-origin iOS exploit kit has leaked and proliferated into the hands of multiple adversary groups. The kit — called Coruna — chains 23 separate vulnerabilities to achieve zero-click compromise of iPhones running iOS 13 through 17.2.1. At least 42,000 devices are confirmed compromised, with the true number almost certainly higher.

Google's Threat Intelligence Group first identified Coruna in February 2025. iVerify corroborated the analysis and suggested U.S. government origins. The attack vector is a classic watering hole — the target visits a malicious or compromised website, and the phone is owned. No taps, no installs, no user interaction.

Why This Is EternalBlue-Scale

The parallel to EternalBlue is deliberate and precise. In 2017, NSA exploit tools leaked by the Shadow Brokers fueled WannaCry (200,000+ systems) and NotPetya. Coruna follows the same pattern: government offensive tools leaking into a 'second-hand zero-day market' where they cascade to less discriminating operators.

The 23-vulnerability chain is extraordinary. Commercial spyware like Pegasus typically chains 3-5 exploits. This depth suggests years of development investment and deep iOS internals expertise — likely spanning WebKit renderer bugs, sandbox escapes, kernel exploits, and persistence mechanisms. The breadth across five major iOS versions indicates the toolkit was actively maintained before proliferation.

Any employee browsing a compromised website on a vulnerable iPhone is silently owned — this includes news sites, industry forums, and supply chain vendor portals that threat actors commonly target as watering holes.

What We Don't Know Yet

No CVEs have been publicly assigned. This suggests either coordinated disclosure is in progress or Apple hasn't fully characterized the exploit chain. Watch Apple's next security advisory closely. Specific IOCs from Google TAG and iVerify should be expected within days.

CVE-2026-22719: VMware Aria Operations — Confirmed Exploited

CVE-2026-22719 in VMware Aria Operations was added to CISA's Known Exploited Vulnerabilities catalog on March 3, 2026. KEV listing means confirmed exploitation — not a proof-of-concept, not theoretical. Aria Operations is a centralized IT management platform with deep hooks into your virtualization infrastructure. Compromise gives attackers a god-view of your virtual environment: VM inventory, performance data, configuration details, and potentially credentials for vCenter and integrated systems.

Specific vulnerability class and CVSS score are not yet disclosed in available reporting. Check Broadcom's security advisory for patch details.

Silver Dragon / APT41: Google Drive as C2

APT41-linked Silver Dragon has been active since mid-2025 targeting government entities in Europe and Southeast Asia, pairing Cobalt Strike with Google Drive as command-and-control infrastructure. This TTP evolution is significant because most organizations cannot block or easily monitor Google Drive API traffic. If your detection strategy relies on network IOCs and domain blocklists, you have a critical blind spot.

Packagist Supply Chain: Cross-Platform RAT via Fake Laravel Packages

Threat actors uploaded malicious packages to Packagist (the primary PHP package repository) disguised as legitimate Laravel utilities. Installation via Composer deploys a cross-platform RAT functional on Windows, macOS, and Linux. The blast radius extends beyond the developer's machine to CI/CD pipelines, source code repositories, deployment credentials, and production environments.

Havoc C2 via Fake Tech Support

The Havoc C2 framework — an open-source post-exploitation tool with lower detection rates than Cobalt Strike in most EDR products — is being delivered through social engineering campaigns impersonating IT or tech support. Researchers assess this as a ransomware precursor. If your detection engineering team hasn't specifically tuned for Havoc, assume you're blind to it.

You have four active threats to triage today — and your detection stack likely catches only one of them out of the box.

The Numbers Paint a Clear Picture

Three independent intelligence streams converged today on a single conclusion: identity is the attack surface that matters most right now, and it's being exploited at industrial scale.

• Palo Alto Networks IR data: Identity weaknesses present in 89% of breach investigations
• Cloudflare threat intel report: 230 billion+ threats blocked per day by a single provider, with 'attack factories' achieving malware-equivalent outcomes using tokens and SaaS relationships
• Microsoft advisory: Attackers actively exploiting legitimate OAuth redirection behavior to bypass email and browser phishing defenses

The Cloudflare report introduces a critical conceptual shift: measuring attack effectiveness (ratio of effort to outcome) rather than attacker sophistication. Their proof point: last summer's Salesloft Drift attack impacted 700+ companies through trusted SaaS vendor relationships — no advanced skills required.

OAuth: They're Using the Protocol as Designed

Microsoft's advisory is specific: threat actors aren't breaking OAuth — they're using it as designed to slip past defenses that trust the protocol. The attack chain involves phishing users into granting OAuth consent to malicious applications, which then use delegated permissions (mail.read, files.readwrite, directory.read.all) without triggering traditional credential-based alerts. Default Entra ID configurations that allow user consent to unverified publishers are the enabler.

This maps to MITRE ATT&CK T1550 (Use Alternate Authentication Material) and T1528 (Steal Application Access Token). The key insight from cross-source analysis: identity-based attacks have crossed the industrialization threshold. What was once the province of skilled operators is now available as packaged operations.

Cloudflare's threat report argues the industry should stop measuring attacker sophistication and start measuring attack effectiveness — because identity-based attacks now deliver malware-equivalent outcomes at industrial scale without requiring advanced skills.

Healthcare: The Canary in the Coal Mine

One source flagged that healthcare organizations are quietly accepting more cyber risk to cut costs — during a period when attacks are industrialized at 230B/day. If your organization operates in healthcare, partners with healthcare entities, or processes PHI, this directly affects your third-party risk posture. Document every risk acceptance decision with board-level sign-off.

A 1,000x Reduction in Quantum Resources Needed

The Jesse-Victor-Gharabaghi (JVG) quantum decryption algorithm has reportedly reduced the quantum computing resources needed to break RSA and ECC encryption by a factor of 1,000. Where Shor's algorithm required an estimated 1 million qubits — safely a decade or more away — JVG claims to achieve the same result with fewer than 5,000 qubits.

Current quantum hardware from IBM, Google, and others operates in the 1,000–1,500 qubit range, with roadmaps targeting 10,000+ qubits within 2-4 years. If JVG's claims hold under peer review, Q-Day shifts from 'sometime in the 2030s' to potentially the late 2020s.

The Harvest-Now-Decrypt-Later Problem Is Already Active

Nation-state actors with active quantum programs are already intercepting and storing encrypted traffic. Every day your data traverses RSA/ECC-protected channels is a day that data accumulates in adversary archives. For data with confidentiality requirements beyond 5 years — healthcare records, financial data, trade secrets, classified communications — the exposure window is already open.

This finding arrives alongside Google's recent deployment of quantum-resistant Merkle Tree Certificates in Chrome and the IETF's formation of a new post-quantum working group. The infrastructure for migration is maturing, but organizational readiness lags significantly.

If JVG holds under peer review, the conversation shifts from 'we should start thinking about PQC' to 'we needed to start two years ago.' A full cryptographic migration takes years — the clock just accelerated.

Critical Caveat

JVG has not yet undergone extensive peer review. Extraordinary claims require extraordinary evidence, and quantum computing breakthroughs have been prematurely announced before. However, the asymmetric cost of being wrong favors action: starting PQC migration early costs operational effort, while delaying and being caught flat-footed by a sudden Q-Day is catastrophic.