CISO Daily Digest: Vercel Breach, ZionSiphon OT Malware, MS Defender Zero-Days (20260420)

Major Security Events on April 20

• Vercel Breach: Deployment platform Vercel suffered a breach tied to the Context AI hack, exposing limited customer credentials. The incident highlights supply chain risks in the AI/cloud ecosystem.
• ZionSiphon OT Malware: Researchers detected ZionSiphon malware specifically targeting Israeli water and desalination OT systems, threatening critical water infrastructure and desalination facilities.
• Third Microsoft Defender Zero-Day: A third zero-day vulnerability in Microsoft Defender was disclosed, with all three now confirmed to be under active exploitation.
• US DOJ Dismantles Russian Military DNS Hijacking Network: The US Department of Justice, with the FBI, dismantled a Russian military hacker-operated DNS hijacking network used for information theft.
• Anthropic MCP Vulnerability: Researchers discovered a design vulnerability in Anthropic’s Model Context Protocol (MCP) enabling remote code execution, threatening the AI supply chain.

🔗 References: Vercel Breach (The Hacker News) | ZionSiphon (iThome) | MS Defender (iThome)

Active Threats This Week

📌 Vercel Breach via Context AI Supply Chain Attack

Vercel confirmed a security breach linked to the Context AI incident, exposing limited customer credentials. The breach underscores the cascading risks in the AI supply chain, where a compromise at one provider can affect downstream platforms. Organizations using Vercel should rotate API tokens and review access logs.

🔗 Reference: The Hacker News

📌 ZionSiphon Malware Targets Israeli Water Infrastructure

Security researchers discovered ZionSiphon, a sophisticated malware targeting Israeli water treatment and desalination facilities. The malware aims to disrupt water resource processing, posing a direct threat to critical national infrastructure. This follows increased OT/ICS targeting in geopolitical conflicts.

🔗 Reference: iThome

📌 Microsoft Defender Triple Zero-Day Under Active Exploitation

A third zero-day vulnerability in Microsoft Defender was disclosed, joining two previously disclosed flaws—all confirmed under active exploitation. The vulnerabilities affect the antivirus update mechanism, potentially allowing attackers to disable or bypass endpoint protection.

🔗 Reference: iThome

📌 Russian Military DNS Hijacking Network Dismantled

The US DOJ and FBI dismantled a DNS hijacking network operated by Russian military hackers (associated with APT28). The infrastructure was used to intercept DNS queries and redirect victims to malicious servers for credential theft and surveillance.

🔗 Reference: iThome