Welcome to the April 2026 edition of the Cyber Threat Report. This month's articles cover threats targeting widely used, internet-facing technologies and the shrinking time organisations have to respond to new vulnerabilities.
Our first article covers a critical zero-day vulnerability in Citrix NetScaler, CVE‑2026‑3055, which allows attackers to hijack sessions through memory exposure, similar to the earlier CitrixBleed vulnerability. Approximately 30,000 systems remain exposed.
The second article examines Storm-1175, a financially motivated threat actor exploiting unpatched perimeter systems to deploy Medusa ransomware, often within 24 hours of gaining initial access.
Our third article looks at CVE‑2026‑34621, a prototype pollution vulnerability in Adobe Acrobat Reader being exploited through malicious PDF documents delivered via spear-phishing campaigns.
Our fourth article covers a supply chain attack in which two malicious versions of Axios, a JavaScript HTTP client with approximately 100 million weekly downloads, were used to deploy a cross-platform Remote Access Trojan attributed to North Korean state actor Sapphire Sleet. Separately, we recommend reviewing the NCSC's recent advisory on the exposure of Russian military intelligence operations hijacking vulnerable routers to conduct cyber attacks.