Microsoft’s March patch cycle fixed 93 flaws, while CISA warned on Siemens SIDIS Prime in critical infrastructure. Stryker reported manufacturing and shipping disruption after a cyberattack, Albania’s parliament suspended internal email, INTERPOL said 45,000 malicious IPs were taken down, and the U.S. sanctioned facilitators of North Korean IT-worker fraud targeting businesses and remote hiring channels across multiple regions this week.

Over the past 48 hours, CISA added four exploited vulnerabilities to the KEV catalog and issued an ICS advisory on Siemens SINEC NMS. Odido confirmed a customer data leak, while SmarterTools disclosed ransomware after an auth-bypass on an unpatched VM. Researchers flagged active exploitation of a critical BeyondTrust RCE and reported nation-state use of Google Gemini for campaigns this week.

This 48-hour DFM roundup tracks active MongoDB exploitation, service disruption fallout, and cross-border cybercrime enforcement. Key takeaways for DFIR teams include prioritizing patch-and-rotate workflows for memory-leak exposures, preserving volatile artifacts early, and validating rollback and integrity controls in live-service environments. Policy and governance themes underline the operational value of clear authority lines, evidence discipline, and rapid notification during holiday staffing periods.

A turbulent 48 hours saw fresh SaaS supply-chain breaches, a ransomware hit on an LG battery subsidiary, and renewed scrutiny of backup resilience and offline records. Law enforcement ran large-scale fraud crackdowns across India and arrested a Russian hacking suspect in Thailand, while new UK and US policy moves tightened expectations on incident reporting, sanctions and third-party risk.