Daily Threat Briefing – April 8, 2026

### Executive Summary The briefing reports multiple critical, actively exploited threats: APT28 is hijacking MikroTik/TP-Link routers to harvest Microsoft 365 tokens; Iranian-linked actors are targeting internet-exposed Rockwell/Allen-Bradley PLCs; Docker (CVE-2026-34040) and Flowise (CVE-2025-59528) vulnerabilities are under active exploitation; ComfyUI instances have been co-opted into a cryptomining/proxy botnet; and healthcare organizations have suffered ransomware and wiper incidents—accompanied by urgent mitigation guidance.