🛡️ Straylight Sentinel Intelligence Report | Monday, March 16, 2026 | 16:18 UTC

🛡️ /Straylight Sentinel Brief

[Monday, March 16, 2026 | 16:18 UTC Edition]

BLUF (Bottom Line Up Front)

State-sponsored actors are ramping up espionage in Europe and the Middle East, while novel evasion techniques like Deno runtime abuse and rapidly weaponized botnets challenge enterprise defenses. Meanwhile, the unchecked proliferation of Shadow AI introduces severe data leakage risks.

🚨 FLASH ALERTS (Critical Threats)

01 | Critical Vulnerabilities in Telesquare SKT LTE Router Allow RCE and IDOR Exploitation Status: Unpatched / High Risk Threat Metrics: CVSS: 9.3 | EPSS: 26.0000% The Risk: Network Tactical Mitigation: Disable WebDAV HTTP methods such as PUT, DELETE, and MKCOL on the router interface, and implement strict network access controls to isolate the device from public internet exposure. 🧠 Analyst Challenge: How do legacy IoT devices with unpatched firmware continue to pose critical risks to modern enterprise networks, and what compensating controls are most effective? Source: Full Report

Shadow AI is Everywhere: Finding and Securing Unsanctioned AI Tools The Risk: Employees are rapidly adopting unsanctioned AI tools, creating a 'Shadow AI' problem that exposes organizations to data leakage and compliance risks. Security teams must discover and secure these hidden AI implementations before sensitive corporate data is ingested into public LLMs. Source: Read More

Multiple Vulnerabilities Discovered in Vanna-AI Framework The Risk: Security flaws have been identified in the Vanna-AI framework, specifically impacting SQL generation and training data removal functions. These vulnerabilities could potentially allow unauthorized data manipulation within AI-driven database querying systems. Source: Read More

01 | Handala Hack: Iranian Intelligence Affiliate Targets Albania and Israel The Scoop: The Iranian-linked group Void Manticore, operating as Handala Hack, is utilizing custom wiping malware and NetBird tunneling for destructive attacks and hack-and-leak operations. Why It Matters: High risk of data destruction and supply chain compromise for targeted government and private sector entities in the affected regions. Source: View Story

02 | Operation CamelClone: Multi-Region Espionage Targets Ukraine The Scoop: A sophisticated espionage campaign is using the HOPPINGANT JavaScript loader and legitimate tools like Rclone to exfiltrate data to MEGA cloud storage. Why It Matters: Loss of sensitive government and defense intelligence amidst major-power rivalries, with network-based detection hindered by the abuse of public cloud services. Source: View Story

03 | RondoDox Botnet Exploits 174 Vulnerabilities for DoS Attacks The Scoop: A rapidly evolving botnet is targeting IoT devices and internet-exposed services, weaponizing newly disclosed vulnerabilities within days of publication. Why It Matters: Widespread Denial of Service capabilities leveraging compromised residential IPs, highlighting the critical need for rapid exposure management. Source: View Story

04 | CastleRAT Evades Security by Abusing Deno JavaScript Runtime The Scoop: A novel attack chain uses the Deno runtime for in-memory execution, combining steganography and social engineering to bypass traditional disk-based detection. Why It Matters: Total host control including keylogging, clipboard hijacking, and digital identity theft without leaving traditional forensic artifacts on disk. Source: View Story

05 | Microsoft Exchange Online Outage Blocks Mailbox Access The Scoop: A major outage is preventing users from accessing their Exchange Online mailboxes, disrupting business communications globally. Why It Matters: Immediate operational downtime and communication blackout for affected enterprises relying on Microsoft's cloud infrastructure. Source: View Story

Phishers hide scam links with IPv6 trick in free toothbrush emails Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential theft China-nexus Threat Actor Targets Persian Gulf Region With PlugX Investigating a new Click-fix variant MAAS VIPKeylogger Campaign

D-Link DNS/DNR Series: Multiple high-severity vulnerabilities (CVE-2026-4213) LB-LINK BL-WR9000: Security vulnerability in function sub44E8D0 (CVE-2026-4227) BabyChakra Pregnancy & Parenting App: Security flaw in Android version up to 5.4.3.0 (EUVD-2026-12447) HCL AION: Vulnerability related to upload size limits (EUVD-2025-208731) Forcepoint Web Security: Stored XSS via improper input neutralization (EUVD-2025-208729) Mattermost: Inconsistent error responses in /mute command (EUVD-2026-12437)

• Flexmls IDX: Reflected Cross-site Scripting (EUVD-2026-12445)