Weekly Roundup Covers Handala’s Stryker Claim, ClipXDaemon, Espionage Warnings and March Patches
Summary
The roundup covers Handala’s claimed wipe of Stryker devices, ClipXDaemon’s clipboard hijacking, Finnish warnings of Russian and Chinese cyber espionage, India’s Aadhaar bug bounty, Microsoft’s March patches, and an attack on a Polish hospital.
Key points
- Handala claimed responsibility for remotely wiping more than 200,000 Stryker devices across 79 countries; the group said it was retaliation for a U.S. military strike in Iran.
- ClipXDaemon targets Linux cryptocurrency users by replacing copied wallet addresses, disguising itself as a kernel process, and persisting through changes to ~/.profile.
- Finland’s Security and Intelligence Service warned of ongoing Russian and Chinese state-backed cyber espionage targeting technology companies, research institutions, and government networks.
- India’s UIDAI launched a bug bounty program to test myAadhaar, its official website, and the Secure QR Code app.
- Microsoft’s March 2026 Patch Tuesday addressed 79 vulnerabilities, including two zero-days and multiple remote code execution flaws.
- A cyberattack on a hospital in Szczecin, Poland, encrypted parts of its IT system and blocked access to digital records; officials said patient care continued, though administrative work slowed.
Article Details
- Event Type
- Weekly roundup of destructive cyberattacks, cyber espionage warnings, malware discovery, a bug bounty launch, and security updates.
- Impact
- The article reports that Iran-linked Handala claimed responsibility for remotely wiping more than 200,000 Stryker devices across 79 countries, disrupting some operations. A cyberattack on a Polish hospital encrypted parts of its IT system and blocked access to digital records, slowing administration while patient care continued. ClipXDaemon can redirect copied cryptocurrency wallet addresses to attacker-controlled addresses. SUPO warned of Russian and Chinese state-backed espionage targeting technology companies, research institutions, and government networks. UIDAI launched a bug bounty, and Microsoft’s March 2026 updates addressed 79 vulnerabilities, including two zero-days.
MITRE ATT&CK
Threat Actors
Malware
Vendors
Products
.NETMicrosoft’s March 2026 Patch Tuesday update addresses 79 vulnerabilities across its ecosystem, including SQL Server, .NET, Office, SharePoint, Azure, and Windows.Aadhaarof over 200,000 Stryker devices and the ClipXDaemon Linux cryptoâwallet hijacker, alongside India’s Aadhaar bug bounty and Microsoft’s March 2026 patch releases—underscoring the urgent need for timely mitigation.AzureMicrosoft’s March 2026 Patch Tuesday update addresses 79 vulnerabilities across its ecosystem, including SQL Server, .NET, Office, SharePoint, Azure, and Windows.Azure MCP ToolsAdditional updates target SharePoint, Azure MCP Tools, and Windows privilege escalation vectors.Microsoft SharePointMicrosoft’s March 2026 Patch Tuesday update addresses 79 vulnerabilities across its ecosystem, including SQL Server, .NET, Office, SharePoint, Azure, and Windows.Microsoft WindowsMicrosoft’s March 2026 Patch Tuesday update addresses 79 vulnerabilities across its ecosystem, including SQL Server, .NET, Office, SharePoint, Azure, and Windows.myAadhaarIndia’s UIDAI launched a structured bug bounty to strengthen the Aadhaar ecosystem, testing myAadhaar, the official site, and Secure QR Code.OfficeMicrosoft’s March 2026 Patch Tuesday update addresses 79 vulnerabilities across its ecosystem, including SQL Server, .NET, Office, SharePoint, Azure, and Windows.Secure QR Code appTwenty expert ethical hackers have been enlisted to rigorously test core platforms, including the myAadhaar portal, the official website, and the Secure QR Code app.SQL ServerMicrosoft’s March 2026 Patch Tuesday update addresses 79 vulnerabilities across its ecosystem, including SQL Server, .NET, Office, SharePoint, Azure, and Windows.
Countries
FinlandFinland’s SUPO warns of ongoing Russian and Chinese state-backed cyber espionage targeting tech firms and research institutions.Indiawipe of over 200,000 Stryker devices and the ClipXDaemon Linux cryptoâwallet hijacker, alongside India’s Aadhaar bug bounty and Microsoft’s March 2026 patch releases—underscoring the urgent need for timelyIranIran-linked group Handala remotely wiped over 200,000 devices at Stryker, disrupting operations in 79 countries.PolandThe Independent Public Regional Hospital in Szczecin, Poland, experienced a cyberattack on March 7–8, 2026, which encrypted parts of its IT system and blocked access to critical digital records.United StatesHandala has claimed responsibility, stating the attack was retaliation for a recent U.S.
Industries
GovernmentThese campaigns are targeting technology companies, research institutions, and government networks.ResearchFinland’s SUPO warns of ongoing Russian and Chinese state-backed cyber espionage targeting tech firms and research institutions.TechnologyKey stories include destructive cyberattacks, such as system-wide wipes and targeted breaches, as well as state-backed cyber espionage targeting technology and research sectors.