TL;DR
• Android Zero-Day Exploited in the Wild, But Patches Are Stuck in Carrier Hell – CVE-2026-21385 affects 200+ Qualcomm chipsets, Google patched it months ago, and attackers are actively exploiting it. Your clients' devices? Still vulnerable.
• Iran-Linked Hacktivists Targeting State/Local Governments & Critical Infrastructure – Geopolitical tensions = cyber collateral damage. Small governments and supply chain targets are in the crosshairs.
• Commercial Spyware Vendors Now Out-Hack Entire Nations – Private surveillance companies exploit more zero-days than China, Russia, and North Korea combined. The threat isn't just sophisticated. It's industrialized.
THIS WEEK’S TOP STORY
North Korea's Economy is Basically Running on Ransomware Right Now
…And here’s why that’s your problem.
North Korea isn't just dabbling in hacking, they've industrialized it into a legitimate economic engine, running extortion, crypto theft, and fraud operations at scale like other countries export semiconductors. This isn't some rogue hacker collective in a basement; it's a government-backed cyber workforce with quotas, resources, and zero ethical guardrails.
Learn more: https://cybersecurityventures.com/examining-north-koreas-cybercrime-economy/
OUR TAKE
For MSPs, this means you're not just defending against opportunistic criminals. You're up against a nation that needs your clients' money to keep the lights on. They're motivated, sophisticated, and backed by state resources. And when ransomware hits one of your clients, there's a non-zero chance the ransom payment is literally funding a nuclear program. Yikes… Sleep tight.
Headlines
March 05, 2026
Nearly 1 billion user records were reportedly exposed in three major cyber incidents involving Canadian retail giant Canadian Tire, European DIY retailer ManoMano and U.S.-based automotive marketplace CarGurus.
March 05, 2026
State and local governments and some crucial technology infrastructure are among the key retaliatory targets as hostilities escalate in the Middle East.
March 05, 2026
A Europol-led sting against the infamous Tycoon2FA MFA bypass phishing service has been successful, with operations disrupted and ringleaders and cyber criminal users identified…
Editorial
Welcome to 2026, where your data is cheaper than your dignity and AI is better at lying than your ex…
Listen, I've been staring at this week's tech news roundup like it's a car crash in slow motion… except the car is on fire, the driver is a chatbot, and somehow we're all being charged a subscription fee to watch.
Let me break down the absolute chaos that is our digital hellscape right now.
Giphy
Your Phone is a Snitch (And It's Not Even Getting Paid)
Android users are walking around with a zero-day vulnerability in their Qualcomm chips that's being "actively exploited in the wild." Translation: Someone's probably reading your texts right now, and the patch that could save you? It's sitting in a queue somewhere between your carrier's quarterly earnings call and their executive's third vacation home purchase.
Google's over here like "yeah, we fixed it months ago lol" but the actual device in your pocket? That's still compromised, bestie. Because in 2026, the gap between a security patch existing and it actually reaching your phone is measured in "thoughts and prayers."
And Apple users? Don't get smug. There's an exploit kit called "Coruna" (fancy!) targeting iPhones, linked to Russian intelligence and Chinese cybercriminals. It's giving Cold War meets Silicon Valley, and honestly, that crossover episode slaps harder than it should.
The Spyware Economy is BOOMING and Democracy is the Clearance Rack
Here's a stat that should make you throw your phone into the ocean: Commercial spyware vendors are now exploiting more zero-days than literal nation-states.
Read that again.
The surveillance capitalism machine has gotten so efficient that private companies are out-hacking China, Russia, and North Korea. They're selling phone-hacking toolkits like they're selling SaaS subscriptions (because they literally are… $120 for a 10-day license to bypass your multi-factor authentication!).
North Korea's GDP is Just "Cybercrime" Now
Casual reminder that one-third to HALF of North Korea's entire national budget comes from cyber fraud and extortion. They're out here running a whole economy on ransomware like it's a legitimate export industry.
Somewhere, an economist is having a breakdown trying to categorize "state-sponsored hacking" in the GDP charts, and honestly? Same.
The One Bright Spot: Criminals Getting Owned
In a rare W for humanity, authorities took down Tycoon2FA, a phishing service that was responsible for 62% of all phishing attempts Microsoft blocked at its peak. They seized 330 domains and disrupted a service with 2,000 active criminal subscribers.
It's like watching the Jedi finally shut down the Death Star, except the Empire will probably have Death Star 2.0 operational by next quarter.
Other News From Around The Web
🚨 Breaches & Exploitation Watch (Patch Fast, Assume Exposure)
Zero-day in Qualcomm Android chips under active attack (CVE-2026-21385)
Google says a Qualcomm chipset zero-day is being exploited “in the wild.” The catch: even after Android ships fixes, OEMs and carriers control how quickly patches reach devices—creating a risk window that can stretch from days to months.
Source: Computer Weekly | Wed, Mar 4 - https://www.computerweekly.com/news/366639578/Zero-day-in-Android-phone-chips-under-active-attack
Commercial spyware suppliers now exploit more zero-days than nation-states (GTIG)
Google’s Threat Intelligence Group reports commercial surveillance vendors were the most frequent attributed first exploiters of tracked zero-days in 2025—suggesting spyware ecosystems are scaling faster than many policy frameworks.
Source: Computer Weekly | Thu, Mar 5 - https://www.computerweekly.com/news/366639774/Spyware-suppliers-exploit-more-zero-days-than-nation-states
🕵️ Phishing: A Big Disruption, Bigger Lesson
AI didn’t invent social engineering—it made it worse (podcast)
A conversation on how deepfakes, automation, and AI-assisted persuasion are amplifying the scale and believability of social engineering.
Source: Cybercrime Magazine | Thu, Mar 5 - https://cybersecurityventures.com/ai-didnt-invent-social-engineering-it-made-it-worse/
🏛️ Government, AI, and the Politics of Infrastructure
7 tech companies commit to protect consumers from rising electricity prices
A pledge announced during the State of the Union aims to reduce the burden of AI-related infrastructure costs—signaling that energy pricing is becoming a political constraint on AI scale. Source: Nextgov | Wed, Mar 4 - https://www.nextgov.com/artificial-intelligence/2026/03/7-tech-companies-commit-protect-consumers-rising-electricity-prices/411883/
Trump’s CISA nominee says he’s prepared to lead the cyber defense agency
Sean Plankey told Nextgov/FCW he’s ready to protect federal civilian networks and critical infrastructure, as scrutiny continues around agency leadership and readiness.
Source: Nextgov | Wed, Mar 4 - https://www.nextgov.com/people/2026/03/trumps-cisa-nominee-said-he-left-coast-guard-address-gop-hold/411894/
IRS CEO largely dodges questions about IRS/SSA data sharing
In congressional questioning, the IRS CEO cited litigation when asked about data sharing and disputed records describing data handling at SSA—keeping federal data governance in the spotlight. Source: Nextgov | Wed, Mar 4 - https://www.nextgov.com/digital-government/2026/03/irs-ceo-largely-dodges-questions-about-data-sharing-irs-ssa/411893/
The Bottom Line
We're All Just Data Points in Someone Else's Business Model
This week's news is a masterclass in late-stage tech capitalism: Companies creating problems, selling solutions to those problems, getting hacked because of other problems, then using AI to create new problems faster than we can regulate the old ones.
Your phone is vulnerable. Your data is for sale. Nation-states and private companies are in an arms race to exploit your devices. Retailers want AI to shop for you. And the people in charge keep promising they'll protect you... right after this next round of funding.
Welcome to 2026. Update your passwords. Enable your VPN. And maybe, just maybe, consider that carrier pigeon startup.