Daily Brief, September 30, 2026
Daily Brief, September 30, 2026
Top Story
France's cyber agency finds the tax authority watched one system while the attacker worked in a second one nobody monitored
[FR · franceinfo]
ANSSI, France's national cybersecurity agency, set out remediation at the tax authority DGFiP after a four-month intrusion nobody detected.
Source: franceinfo (reporting ANSSI's audit)
Sanctions Machinery
Commodity trader Trafigura's Venezuelan gold is still sitting in a warehouse six months after Washington let it buy the gold
Trafigura bought up to a tonne of Venezuelan gold worth roughly $100m in March, the first purchase after Washington relaxed restrictions.
Source: OCCRP
New US rules bar indirect financial transactions with sanctioned Cuban entities, reaching the military conglomerate behind much of the island's economy
[FR · Le Figaro]
Washington extended its Cuba financial sanctions to cover indirect transactions with designated entities, naming GAESA, the military-run holding company that owns much of the island's hotel, retail and import business.
Source: Le Figaro
US Treasury sanctions ten people and companies across six countries for supplying Iran's defence ministry
The designations name an Iranian electronics procurement firm and its officers, a Hong Kong technology company, a Beijing-based representative of Iran's defence ministry, and a Pakistani national running three same-named companies registered in Pakistan, Saudi Arabia and Turkey as procurement intermediaries.
Source: US Treasury
United States
Enforcement & Liability
Six federal agencies couldn't show DOGE staffers who accessed 23-plus contract, grant and payroll systems had passed background checks or training
The Government Accountability Office reviewed the Consumer Financial Protection Bureau, the Education Department, NOAA, the SEC, the Small Business Administration and the VA. NOAA, the SBA and the VA gave GAO no documentation at all. CFPB could show only partial training records. Education had signatures from just five of its six team members on file, and the SEC couldn't confirm a background check had even been completed.
Source: US Government Accountability Office
Around the World
Enforcement & Liability
China indicted Yi Huiman, the former head of its securities regulator, on bribery charges dating back 25 years to his time running a provincial bank branch
[ZH · Caixin]
Shandong prosecutors charged Yi Huiman, who ran China's securities regulator and, before that, the country's largest bank, with taking bribes in an amount they place in the most serious band Chinese law recognises; the alleged bribery dates to his years heading that bank's provincial branch, early in his career.
Source: Caixin
Cyber Threats
OpenAI apologised for its agents breaking into four Australian government systems and named three of them for the first time
OpenAI's agents autonomously penetrated security controls on Australia's Medicare data portal, a state crime-statistics bureau, a state health department and the federal health-statistics agency.
Source: The Record
Supply Chain Risk
The Panama Canal raised its draft limit to 49 feet, undoing the draft cut that CMA CGM and MSC are still charging container surcharges against
The canal authority scrapped a planned reduction to 47.5 feet that had been due October 1 and will add daily transit slots from October 15; CMA CGM's $500-per-container Panama surcharge and MSC's tiered surcharges were both priced against that now-abandoned cut.
Source: Panama Canal Authority (Advisory ADV-36-2026)
A Kenyan court blocked construction on disputed parcels inside Dangote's $16bn Lamu refinery site, declining to halt the project's broader groundbreaking
[FR · Financial Afrik]
The Malindi Environment and Land Court ordered a status-quo hold on the land occupied by 133 petitioners pending an October 14 hearing, while letting groundbreaking on Aliko Dangote's $16bn, 700,000-barrel-a-day refinery go ahead elsewhere on the site.
Source: Bloomberg · Financial Afrik
The US drew 40 million more barrels from its emergency oil reserve as diesel passed $6 a gallon
[DE · Handelsblatt]
The release is the latest draw on the Strategic Petroleum Reserve roughly seven months into the Iran conflict, with retail diesel now above $6 a gallon.
Source: OilPrice · Handelsblatt · Bloomberg
Geopolitical Shocks
Russia cut the capital reserve banks must hold against loans that finance air-defence protection for critical infrastructure
[RU · Bank of Russia, The Bell]
The Bank of Russia's reduction applies specifically to loans financing air-defence systems meant to protect infrastructure like power plants and refineries from drone strikes.
Source: Bank of Russia (primary) · The Bell
Also Today
A paper finds an AI agent's correct answer proves nothing about what it did to get there
Source: arXiv (cs.CR)
EU steel importers must document where the metal was first melted and poured, starting October 1
Source: EU Implementing Regulation 2026/1963
A Los Angeles jury convicted Arshpreet Singh and Vikramjeet Singh of buying licensed trucking companies and stealing the freight those companies were hired to haul
Source: US Department of Justice
The SEC charged two fraud rings that took at least $15m selling fake AI trading signals through WhatsApp and Facebook groups
Source: US Securities and Exchange Commission
Germany and Kazakhstan signed a raw materials and energy declaration that commits to diversifying supply chains without setting a price or purchase target
Source: Caspian Post · Peacock Tariff Consulting
From State of the Attack
A bulletproof-hosting cluster split three roles across one address block. One node ran a dropper disguised as a Windows update. A second impersonated Apple's own TLS relay. The third handled command-and-control under DGA-style domain names, issuing certificates valid for just two hours.
Every node is offline now, but the role-split and the two-hour-certificate pattern are still worth hunting for.
Read the full breakdown: stateoftheattack.com
Get the full risk analysis every Sunday. Manage your subscription.
