When Nation-States Start Playing Nice with Cybercriminals: What This Week's Security News Really Means

2026-03-13

Page content

When Nation-States Start Playing Nice with Cybercriminals: What This Week’s Security News Really Means

I’ve been tracking some interesting developments this week that paint a pretty clear picture of where we’re heading in cybersecurity. Let me walk you through what caught my attention and why it matters for those of us defending networks.

Iran’s New Playbook: Why Pretend When You Can Partner?

The biggest story that made me pause was the intelligence coming out about Iran’s Ministry of Intelligence and Security (MOIS) directly collaborating with cybercriminal groups. This isn’t just another APT report – it represents a fundamental shift in how nation-state actors operate.

We’ve always known Iranian APTs liked to masquerade as regular cybercriminals to muddy attribution waters. But now they’re cutting out the middleman and just working directly with actual criminal organizations. Think about the implications here: you get the technical sophistication and resources of a nation-state combined with the agility and street smarts of cybercriminal groups who’ve been perfecting their craft in the wild.

This partnership model is troubling because it makes our job exponentially harder. When we’re investigating an incident, how do we separate the criminal motivation from the geopolitical one? More importantly, it gives both sides access to capabilities they didn’t have before. Criminals get better tools and intelligence, while nation-states get proven attack methods and established infrastructure.

The Brazilian Banking Malware Evolution

Speaking of criminal innovation, there’s a new player targeting Brazilian banks that’s worth our attention. The VENON malware represents something we’re seeing more of – criminals moving away from traditional development languages to Rust.

What makes this interesting isn’t just the language choice, though that’s significant. Rust-based malware is generally more stable, harder to reverse engineer, and can evade detection better than the Delphi-based families we’ve grown accustomed to seeing from Latin American cybercrime groups. When criminals start investing in better development practices, it tells us they’re thinking long-term about their operations.

The fact that it’s targeting 33 specific Brazilian banks with credential-stealing overlays shows the kind of precision we’re dealing with. This isn’t spray-and-pray malware – it’s carefully crafted for maximum impact in a specific market.

Apple’s NATO Certification: A Bigger Deal Than It Sounds

Here’s something that might have flown under your radar but shouldn’t have: Apple just got NATO approval for iPhones and iPads to handle classified data up to the NATO restricted level. Out of the box. No special software required.

This is actually huge for several reasons. First, it validates that consumer devices can meet serious security requirements when designed properly from the ground up. Second, it’s going to change expectations across government and enterprise environments about what mobile security should look like.

But here’s what really gets me thinking: if Apple can build consumer devices that meet NATO standards, why are we still accepting subpar security in so many enterprise solutions? This certification should be a wake-up call for every vendor claiming their product is “enterprise-grade.”

When Retail Giants Get Breached

The Loblaw data breach notification is worth mentioning not because it’s particularly novel – retail breaches happen – but because of how they handled it. They automatically logged out all customers as a precaution, which is exactly the kind of proactive response we should be seeing more of.

Too often, companies try to minimize disruption even when they’re not sure about the scope of a breach. Loblaw’s approach of “better safe than sorry” should be the standard, not the exception.

Finally, there’s a prototype pollution vulnerability in graphql-upload-minimal that caught CERT’s attention. This might seem like just another CVE, but it highlights something we keep seeing: developers adopting lightweight packages without fully understanding the security implications.

The vulnerability is in the processRequest() function and can pollute global object prototypes, affecting the entire Node.js process. It’s a perfect example of how modern development practices – using lots of small, focused packages – can create unexpected attack surfaces.

What This All Means

Looking at these stories together, I see a few clear trends. Nation-states are getting more creative about their partnerships and operational models. Criminals are investing in better tools and more targeted approaches. Meanwhile, the good guys are slowly raising the bar on what secure-by-design actually means.

The common thread? Everyone’s getting more sophisticated, and the old playbooks aren’t going to cut it anymore. We need to be thinking about threats that blend criminal and nation-state capabilities, defending against malware built with modern development practices, and raising our own standards to match what’s actually possible in security.