Daily Security Briefing #203

March 24, 2026 | Read Online

GRIDTIDE disrupted, Claude Code vulnerabilities exposed, and AI training data poisoning…

Executive Summary

Cybersecurity threats continue to evolve with malicious actors adapting to disruptions. The recent Tycoon2FA operators’ resurgence highlights the resilience of phishing-as-a-service ecosystems. Meanwhile, critical vulnerabilities in TP-Link devices have been exposed. Additionally, a long-term espionage campaign targeting Libyan oil refineries has come to light.

Top Articles

Team Mirai and Democracy Schneier explores how Team Mirai’s innovative approach to politics can strengthen democratic processes by harnessing technology to root out corruption. Schneier

Rapid7 Completes BSI C5 Type 2 Examination: Stronger Cloud Security for DACH Organizations Rapid7 has completed the BSI C5 Type 2 attestation for its Command Platform, demonstrating stronger cloud security measures for German, Austrian, and Swiss organizations. Rapid7

New Whitepaper: Exploiting Cellular-based IoT Devices Rapid7’s whitepaper examines the exploitation of cellular modules in IoT devices, highlighting potential attack vectors and security risks. Rapid7

Tycoon2FA Operators Resume Cloud Account Phishing Following Infrastructure Disruption Despite law enforcement efforts, Tycoon2FA operators have resumed large-scale cloud account phishing operations, underscoring the resilience of PhaaS ecosystems. GBHackers

Multiple Vulnerabilities in TP-Link Devices Enable Arbitrary Command Execution TP-Link has published a critical security advisory addressing four high-severity vulnerabilities in its Archer series routers, impacting device configuration files and authentication mechanisms. GBHackers

Long-Term Espionage Campaign Hits Libyan Oil Refinery With AsyncRAT Malware A sophisticated cyber espionage campaign has targeted critical infrastructure in Libya, including an oil refinery, using the publicly available AsyncRAT backdoor. CyberPress

Researchers Uncover Data Leak Site Linked To Active Initial Access Broker Cybersecurity researchers have identified a new Tor-based data leak site named “ALP-001,” marketing itself as a comprehensive repository of data leaks and an access market. CyberPress

AI Transparency: This newsletter uses AI to curate, rank, and summarize cybersecurity content from leading industry blogs. All articles link directly to original authors. Executive summaries are AI-generated based on article content. I curate the sources and deliver the digest—the original authors deserve the credit for their excellent work.