MaxwellCTI Weekly: October 13-19, 2026
MaxwellCTI Weekly: October 13-19, 2026
Covers 5 daily digests (2026-10-13 to 2026-10-19).
All summaries, analysis, and story clustering are done by an LLM. It may make mistakes and say incorrect things. Check the sources and support the actual journalists.
Top Stories
1. Attackers Target French Supermarkets via Danfoss, Copeland, and Dixell Vulnerabilities
8 outlets, 2026-10-13 to 2026-10-16 - severity 4/5
Attackers hijacked internet-connected refrigeration controllers from Danfoss, Copeland, and Dixell to trigger extended defrost cycles, causing significant food spoilage across approximately 700 supermarkets in France and potentially affecting US military commissaries. The attack targeted legacy hardware, including the Danfoss AK-SM 800 and AK-SC 355, by exploiting vulnerabilities such as authentication bypasses (CVE-2025-41450), command injection (CVE-2025-41451), and a denial-of-service flaw (CVE-2025-41452), as well as a predictable daily password generation mechanism. In some cases, the breach occurred via a third-party service provider managing the equipment. Financial losses are estimated in the tens of millions of euros, with specific reports of 270,000 euros lost by two stores in the Alsace region. Danfoss and Copeland confirmed the vulnerabilities existed in end-of-life products, while France's ANSSI and the Paris prosecutor's office launched investigations. No ransom demand or claim of responsibility has been identified, and ANSSI warns that further attacks on large retailers remain possible.
Sources
- Cyberattack shuts down refrigerators at French supermarkets - BleepingComputer, 2026-10-12 (quality: 19/21)
- Cyberattack disrupts refrigeration at hundreds of French supermarkets - The Record (Recorded Future), 2026-10-11 (quality: 18/21)
- Refrigeration Controller Hack Spoils Food Across European Supermarkets - SecurityWeek, 2026-10-13 (quality: 18/21)
- Dangerous flaws in refrigeration equipment were disclosed months before retail attacks - Cybersecurity Dive, 2026-10-13 (quality: 18/21)
- Hackers heat up supermarket fridges, spoiling food across France - Malwarebytes, 2026-10-13 (quality: 17/21)
- Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers - The Hacker News, 2026-10-13 (quality: 20/21)
- Fridge hack costing millions and sparking fires stemmed from poor security - Ars Technica Security, 2026-10-14 (quality: 17/21)
- EU Grocers Pay a Steep Price for Unpatched Fridge Firmware - DarkReading, 2026-10-15 (quality: 20/21)
- Thousands of refrigerator devices remain exposed following French cyberattack - Cybersecurity Dive, 2026-10-15 (quality: 19/21)
- Supermarket Refrigeration Attack Widens to Copeland, Dixell Controllers - SecurityWeek, 2026-10-15 (quality: 20/21)
2. Discover-Tech used AdFection campaign to deliver Candiru spyware to Al Jazeera
6 outlets, 2026-10-16 to 2026-10-19 - severity 4/5
The Israeli company Discover-Tech used its Controlium platform to facilitate the AdFection campaign, delivering Candiru zero-click spyware to targets including at least 45 devices at Al Jazeera. The attack chain utilized a "NOAS server" to filter targets by IP address and ad identifiers, delivering malicious JavaScript through targeted online advertisements across nearly 200,000 unique websites and mobile applications. This infrastructure delivered Candiru's DevilsTongue malware to Windows systems to steal credentials, files, and messages. While Al Jazeera was a primary victim, network exposure was also identified for the United Nations, European Union, NATO, and the U.S. Department of Defense. Citizen Lab estimates that between hundreds of thousands and millions of users were directed to Discover-Tech domains through nearly four billion ad bids. Researchers recommend blocking targeted advertisements at the gateway to mitigate these vectors.
Sources
- AdFection: How mercenary spyware invades victims’ devices through targeted advertising - CyberScoop, 2026-10-15 (quality: 21/21)
- Targeted ads delivered 0-click exploits to install mercenary malware - Ars Technica Security, 2026-10-15 (quality: 18/21)
- Zero-click spyware infecting devices through online ads, researchers say - The Record (Recorded Future), 2026-10-15 (quality: 19/21)
- Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads - The Hacker News, 2026-10-15 (quality: 21/21)
- Targeted ads installed Candiru spyware in zero-click attacks - BleepingComputer, 2026-10-16 (quality: 19/21)
- Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel - SecurityWeek, 2026-10-17 (quality: 19/21)
3. Microsoft Disrupts Storm-3119 and Storm-2990 Phishing Campaigns Targeting Global Organizations
8 outlets, 2026-10-15 - severity 4/5
Microsoft and international partners disrupted a Chinese-language cybercriminal ecosystem operated by Storm-3119 and Storm-2990, which utilized the YAM Store marketplace to distribute the CoGUI and Iron Man System phishing kits. Between January and October 2026, the network sent over one billion phishing messages targeting more than 75,000 organizations across 150 countries, specifically impacting healthcare, financial services, and IT sectors in Japan, the United States, Australia, and India. The attackers maintained persistence by hijacking Microsoft 365 and Azure for Education tenants using stolen application credentials to facilitate their campaigns. The operation generated tens of millions of dollars for the operators before the US District Court for the Southern District of Florida authorized the seizure and redirection of the supporting domains on October 7, 2026.
Sources
- The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime - Microsoft Threat Intelligence, 2026-10-14 (quality: 20/21)
- Global takedown hits network behind 1 billion phishing messages - BleepingComputer, 2026-10-14 (quality: 19/21)
- Microsoft and partners disrupt vast Chinese-language phishing kit ecosystem - CyberScoop, 2026-10-14 (quality: 19/21)
- Microsoft, Health-ISAC and partners take down popular phishing kit services - Cybersecurity Dive, 2026-10-14 (quality: 18/21)
- Microsoft takes down 3 major phishing platforms used by Chinese cybercriminals - The Record (Recorded Future), 2026-10-14 (quality: 20/21)
- Yam Store: The Phishing Network Behind a Billion Messages - DarkReading, 2026-10-14 (quality: 20/21)
- Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages - SecurityWeek, 2026-10-14 (quality: 21/21)
- Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages - The Hacker News, 2026-10-14 (quality: 20/21)
4. North Korean Famous Chollima used fraudulent IT employment to target 70 US companies
6 outlets, 2026-10-14 to 2026-10-15 - severity 4/5
The North Korean threat group Famous Chollima (also known as WageMole and purpledelta), operating under the Munitions Industry Department's 313 General Bureau, used fraudulent identities to secure remote IT employment at approximately 70 US companies across 17 states and the District of Columbia. Facilitators including US citizens Michael James Bostelle, Juan Cecilio Pena Carrillo, and Trey Michael Nolte, along with 12 China-based individuals, managed "laptop farms" in Texas to host company-issued hardware. Operatives diverted these laptops by filing fake theft reports, claiming relocations, or abusing IT staffing roles, while spoofing device hashes and using backstories of displaced Eastern Europeans or East Asians to evade detection. The scheme targeted sectors including healthcare, retail, manufacturing, and cleared defense contractors, generating $3 million in fraudulent wages and causing an additional $3 million in legal and remediation costs. In response, the US Department of Justice, FBI, and other agencies conducted Operation Lonestar Roundup, seizing 187 computers from over 40 residences and indicting 14 people.
Sources
- DOJ charges 14 over a sprawling North Korean remote work scheme - CyberScoop, 2026-10-13 (quality: 20/21)
- Two arrested as DOJ takes down laptop farms responsible for $3 million in North Korean revenue - The Record (Recorded Future), 2026-10-13 (quality: 19/21)
- FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested - BleepingComputer, 2026-10-14 (quality: 18/21)
- Feds crack down on North Korean IT-worker schemes with new raids, charges and arrests - Cybersecurity Dive, 2026-10-14 (quality: 19/21)
- US Arrests Two in Crackdown on North Korean IT Worker Laptop Farms - SecurityWeek, 2026-10-14 (quality: 20/21)
- U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud - The Hacker News, 2026-10-14 (quality: 20/21)
5. China-nexus Armory Castle Exploits BeyondTrust Remote Support Zero-Day Targeting Government Entities
5 outlets, 2026-10-16 to 2026-10-19 - severity 4/5
The China-nexus threat actor Armory Castle, also known as UNC5221 and Warp Panda, exploited a zero-day vulnerability (CVE-2026-102764) in BeyondTrust Remote Support to gain administrative control over both self-hosted and BeyondTrust-hosted appliances. Starting August 29, 2026, the actor used an improper origin validation flaw to escalate privileges to root, deploy the SAWFLY PHP web shell and BARECLAW SOCKS5 proxy, and steal credentials via the /ns/sbin/bt-secrets utility to move laterally into downstream systems. The attack targeted government entities, legal services, and technology companies, with the actor deleting system logs to hinder detection. BeyondTrust contained the initial activity by September 28 and pushed patches to SaaS customers by October 9, though the patch was developed by September 30. CISA has since added the vulnerability to its Known Exploited Vulnerabilities catalog.
Sources
- China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers - The Hacker News, 2026-10-16 (quality: 20/21)
- Prolific Chinese espionage group exploits BeyondTrust zero-day - CyberScoop, 2026-10-16 (quality: 18/21)
- China-nexus espionage actor targets BeyondTrust support tool in zero-day campaign - Cybersecurity Dive, 2026-10-16 (quality: 20/21)
- Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day - SecurityWeek, 2026-10-16 (quality: 19/21)
- BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs - DarkReading, 2026-10-16 (quality: 19/21)
6. Microsoft Patches Windows Vulnerabilities Including Actively Exploited CVE-2026-96951 Shell Bypass
6 outlets, 2026-10-14 - severity 4/5
Microsoft released security updates on October 14, 2026, addressing between 1,411 and 1,417 vulnerabilities, including 70 to 85 critical flaws. A primary concern is CVE-2026-96951, an actively exploited Windows Shell security feature bypass (CVSS 8.8) that allows attackers to evade Mark of the Web defenses. Other significant vulnerabilities include CVE-2026-108398, which enables the bypass of Windows Defender Application Control in the .NET Framework, and several remote code execution flaws affecting Outlook, SharePoint, SQL Server, and QUIC. CISA has added CVE-2026-96951 to its Known Exploited Vulnerabilities catalog, mandating that federal agencies patch the flaw by October 16.
Sources
- Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities - Cisco Talos Blog, 2026-10-13 (quality: 17/21)
- October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th) - SANS Internet Storm Center, 2026-10-13 (quality: 16/21)
- Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days - BleepingComputer, 2026-10-13 (quality: 17/21)
- Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day - SecurityWeek, 2026-10-14 (quality: 17/21)
- Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug - The Hacker News, 2026-10-14 (quality: 19/21)
- Zero-Days Lurk in Microsoft's Overgrown October Patch Tuesday - DarkReading, 2026-10-13 (quality: 20/21)
7. Kazakhstan-linked UAT-6275 Targets CIS Government Organizations Using CVE-2025-8088 and PickleShell
4 outlets, 2026-10-15 to 2026-10-16 - severity 4/5
UAT-6275, also known as Silent Lynx, TAG-193, and Hydra Saiga, is a Kazakhstan-linked threat actor that has conducted cyber-espionage campaigns against government organizations, embassies, and think tanks across the Commonwealth of Independent States since at least 2020. The group targeted sectors including diplomacy, energy, and water resources in countries such as Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus, compromising at least 34 organizations since December 2024. Attack chains evolved from macro-enabled Word documents and PS2EXE downloaders to the use of malicious shortcuts launching GitHub-hosted PowerShell scripts and the exploitation of CVE-2025-8088 in WinRAR to deploy PickleShell. The actor utilized custom reverse shells including FoalShell, Chvost, and Laplas, as well as implants written in Rust, Go, and Python, often leveraging compromised government email accounts for phishing. Research from Cisco Talos, Recorded Future, and VMRay identified these activities, which included reconnaissance on over 200 global targets.
Sources
- Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations - Cisco Talos Blog, 2026-10-14 (quality: 19/21)
- TAG-193’s Regional Espionage Operations - Recorded Future, 2026-10-14 (quality: 17/21)
- Suspected Kazakhstan-linked hackers target governments across former Soviet states - The Record (Recorded Future), 2026-10-15 (quality: 17/21)
- Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks - The Hacker News, 2026-10-15 (quality: 19/21)
8. UTA0576 exploits Ivanti Connect Secure zero-day chain to gain root access
6 outlets, 2026-10-14 to 2026-10-15 - severity 4/5
A suspected criminal threat actor tracked as UTA0576 is exploiting a zero-day chain in Ivanti Connect Secure, including an authentication bypass and remote code execution flaw (CVE-2026-104935) and an unnamed privilege escalation vulnerability to gain root access. The attackers use the X-DSCGI-PATH header to upload Perl scripts disguised as ZIP files and execute commands in memory to evade the Ivanti Integrity Checker Tool, subsequently deleting Linux audit and Ivanti debug logs. UTA0576 employs custom Python-based LDAP and Kerberos tools to target BitLocker recovery keys, LAPS passwords, and perform Kerberoast attacks. Previdian reported 105 exploitation attempts from 50 unique IP addresses in the US and Singapore, while Shadowserver identified over 5,600 exposed hosts. Ivanti has released patches for CVE-2026-104935 in versions 22.8R2.5, 25.1.3.0, 25.1.3.1, and 25.1.1.2, though a fix for the privilege escalation vulnerability is still in development. CISA recommends a full factory reset, version upgrade, and a comprehensive reset of all passwords, certificates, and API keys for compromised systems.
Sources
- Hacker targets Ivanti Connect Secure in chained exploitation - Cybersecurity Dive, 2026-10-14 (quality: 17/21)
- Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles - DarkReading, 2026-10-14 (quality: 20/21)
- CISA warns admins to immediately fix Ivanti flaw exploited as zero-day - BleepingComputer, 2026-10-14 (quality: 18/21)
- CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts - The Hacker News, 2026-10-14 (quality: 20/21)
- Ivanti misses opportunity to fix vulnerability before attackers got to work and made it a zero-day - CyberScoop, 2026-10-13 (quality: 18/21)
- Ivanti warns of Connect Secure zero-day exploited in attacks - BleepingComputer, 2026-10-13 (quality: 18/21)
- Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN - SecurityWeek, 2026-10-13 (quality: 16/21)
- Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far - The Hacker News, 2026-10-13 (quality: 19/21)
Under the Radar
High-severity stories that received limited coverage this period.
12th October – Threat Intelligence Report
2 outlets, 2026-10-13 - severity 5/5
Multiple high-profile data breaches and AI-driven campaigns targeted government, retail, and infrastructure sectors globally. The Danish government's Central Register of Persons exposed data for 8.8 million individuals, while the threat group Xuanye targeted ASOS using stolen employee credentials and DataSuckers claimed records of 7.9 million ATB customers. In Asia, Osaka Metropolitan University suffered a ransomware attack affecting 500 servers and 130,000 individuals, and South Korean financial institutions were targeted by an AI-assisted campaign using the ARTEX toolkit and Claude Code. Additionally, the FortiBleed campaign compromised over 86,000 Fortinet FortiGate firewalls, with access sold to ransomware affiliates INC, Lynx, and Payload.
Why it matters: Mass breach of 8.8 million Danish citizens and critical infrastructure targeting in Ukraine constitute critical real-world impact.
Sources
- 12th October – Threat Intelligence Report - Check Point Research, 2026-10-12 (quality: 17/21)
- How “123456” became the key to almost 9 million personal records - Malwarebytes, 2026-10-12 (quality: 14/21)
Threat actors exploit CVE-2026-102255 vulnerability in SonicWall SMA 1000 appliances
2 outlets, 2026-10-13 - severity 4/5
Threat actors are actively exploiting a critical server-side request forgery (SSRF) vulnerability, identified as CVE-2026-102255, in SonicWall SMA 1000 appliances. Starting October 8, at least 135 exploitation attempts were detected originating from two US-based IP addresses. Successful exploitation allows attackers to control the WorkPlace interface and use the gateway as a proxy to access internal services. SonicWall has released hotfixes to address the flaw.
Why it matters: Confirmed active exploitation of a critical vulnerability in widely used network appliances allowing unauthorized access to internal services.
Sources
- Maximum-Severity SSRF Flaw in SonicWall SMA Devices Under Attack - DarkReading, 2026-10-12 (quality: 18/21)
- Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch - The Hacker News, 2026-10-12 (quality: 18/21)
International Operation Targets West African Scam Compounds for Investment Fraud
2 outlets, 2026-10-14 - severity 4/5
A joint operation by the U.S. Department of Justice, the FBI, the UK National Crime Agency, and other international partners targeted scam compounds in West Africa to combat fraud and human trafficking. Law enforcement arrested 28 individuals and seized 303 devices during raids in Ghana and Nigeria, while rescuing 117 trafficking victims. The operation disrupted cryptocurrency investment fraud and "pig butchering" schemes, resulting in the removal of 3.7 million social media accounts by Meta and other technology companies. Ghanaian police identified 89 victims who lost approximately $8.3 million, and authorities identified over $11 million in potentially freezable funds.
Why it matters: Major international law enforcement operation resulting in 28 arrests, 117 rescues, and the removal of 3.7 million fraudulent accounts.
Sources
- West African scammers targeted in joint international government-industry operation - CyberScoop, 2026-10-13 (quality: 17/21)
- West African scam compounds raided, more than 100 suspected trafficking victims ‘rescued’ - The Record (Recorded Future), 2026-10-13 (quality: 18/21)
All Stories by Category
Vulnerabilities & Patches
- Cisco Patches Critical Zero-Day Vulnerability in Secure Email Gateway (2026-10-15, 3 outlets, severity 4/5)
- Cisco patches new Secure Email Gateway zero-day exploited in attacks - BleepingComputer
- Cisco Warns of Exploited Secure Email Gateway Vulnerability - SecurityWeek
- Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability - The Hacker News
- Bricksforge WordPress Flaw Exploited for Critical Remote Code Execution (2026-10-13, 1 outlet, severity 4/5)
- ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More (2026-10-16, 1 outlet, severity 4/5)
- September 2026 CVE Landscape (2026-10-14, 1 outlet, severity 4/5)
- September 2026 CVE Landscape - Recorded Future
- GitLab Fixes Critical Remote Code Execution Vulnerability (2026-10-13, 2 outlets, severity 3/5)
- GitLab warns of max severity code execution vulnerability - BleepingComputer
- GitLab fixes critical vulnerability that exposed software environments to sabotage - Cybersecurity Dive
- SAP Patches Critical Vulnerabilities Across Multiple Products in October 2026 Cycle (2026-10-14, 3 outlets, severity 2/5)
- SAP warns of maximum severity OAuth2 SSRF security flaw - BleepingComputer
- SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities - SecurityWeek
- SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft - The Hacker News
- Didier Stevens Discovers Orphaned VBA Projects in AutoCAD DWG Files (2026-10-14 to 2026-10-19, 1 outlet, severity 2/5)
- Orphaned VBA Projects Inside DWG Files, (Wed, Oct 14th) - SANS Internet Storm Center
- Orphaned VBA Projects Inside DWG Files: YARA Rule, (Sun, Oct 18th) - SANS Internet Storm Center
- Docker Fixes Docker Hub Vulnerability Allowing Attackers to Impersonate Users (2026-10-14, 2 outlets, severity 2/5)
- Docker Hub flaw let attackers impersonate users, tamper with images - BleepingComputer
- Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another - The Hacker News
- Chrome and Firefox Patch 114 Flaws; Mozilla Launches Enterprise Edition (2026-10-14, 1 outlet, severity 2/5)
- ICS Patch Tuesday: Siemens Issues 17 Advisories, Rockwell Fixes ArmorBlock Takeover Flaw (2026-10-15, 1 outlet, severity 2/5)
- Google Increases Chrome Bug Bounties for Memory Safety Flaws (2026-10-14, 1 outlet, severity 2/5)
- Google Partially Reverses Chrome Bug Bounty Cuts - SecurityWeek
- Chrome and Eiliko Vulnerabilities, OpenAI Lawsuits, and AI Threats (2026-10-19, 1 outlet, severity 2/5)
- A week in security (October 12 – October 18) - Malwarebytes
- Prioritize Real-World Risk Over Theoretical CVSS Scores (2026-10-16, 1 outlet, severity 1/5)
- IBM Report Outlines Strategies to Scale Open-Source Security Fixes (2026-10-19, 1 outlet, severity 1/5)
- Open-source security rests on understanding risks, scaling fixes - Cybersecurity Dive
Data Breaches
- Burger King Japan Data Breach Exposes 11 Million Customer Records (2026-10-19, 1 outlet, severity 4/5)
- Burger King Japan data breach exposes 11 million customer records - BleepingComputer
- Eiliko AI Robots Expose Millions of Private User Chats (2026-10-19, 1 outlet, severity 4/5)
- Israel-based NSO Group Had Access to Data Harvested by Polish Government (2026-10-15, 1 outlet, severity 3/5)
- Spyware manufacturer had access to data harvested by former Polish government, current PM says - The Record (Recorded Future)
- Anthropic Cuts AI Internet Access After Government Site Breaches (2026-10-13, 1 outlet, severity 3/5)
- Anthropic takes risky AI tests offline after models breach govt sites - BleepingComputer
- CenterPoint Energy Breach Exposes Data of 1 Million Texans (2026-10-16, 1 outlet, severity 3/5)
- CenterPoint Energy Data Breach Impacts 1 Million Texans - SecurityWeek
- Meta GitHub Breach Exposes Code and Data of 1,500 People (2026-10-14, 1 outlet, severity 3/5)
- iRhythm Data Breach Exposes Personal Info of 360,000 People (2026-10-13, 1 outlet, severity 3/5)
- iRhythm Data Breach Impacts at Least 360,000 People - SecurityWeek
- CyberLeek Threatens to Leak Playable GTA 6 Build (2026-10-14, 1 outlet, severity 3/5)
Ransomware
- DragonForce ransomware operation breaches UK Legal Aid Agency IT systems (2026-10-15 to 2026-10-16, 3 outlets, severity 4/5)
- UK Legal Aid Agency: Hackers stole records dating back to 1978 - BleepingComputer
- UK Legal Aid Agency hack worse than thought, with stolen records dating back to 1978 - The Record (Recorded Future)
- UK Legal Aid Agency Hack Scope Widens After Forensic Review - SecurityWeek
- When Your Ransomware Negotiator Works for the Other Side (2026-10-19, 1 outlet, severity 4/5)
- When Your Ransomware Negotiator Works for the Other Side - DarkReading
- Rhysida Ransomware Gang Steals Data From Anne Arundel County (2026-10-19, 1 outlet, severity 3/5)
- Baltimore suburb confirms August data breach after ransomware claims - The Record (Recorded Future)
- Krybit Ransomware Targets Global Organizations Using Leaked Babuk Code (2026-10-19, 1 outlet, severity 3/5)
- Krybit ransomware: what you need to know - Graham Cluley
- Akira Ransomware Exploits MFA Gaps in VPNs and RDP (2026-10-14, 1 outlet, severity 3/5)
- The MFA Gaps Attackers are Still Exploiting - BleepingComputer
- TFG London Cyberattack Disrupts Hobbs, Whistles, and Phase Eight (2026-10-14, 1 outlet, severity 3/5)
- TFG London cyberattack disrupts systems at Hobbs and Whistles retailers - BleepingComputer
- Ransomware Gangs Embrace Physical Threats, Family Stalking? (2026-10-14, 1 outlet, severity 2/5)
Supply Chain Attacks
- AOMEI Backupper Update Servers Compromised to Deliver SHINYROAD Malware (2026-10-19, 1 outlet, severity 4/5)
- Ledger asks sellers across Asia to halt sales after supply-chain attack (2026-10-15, 1 outlet, severity 4/5)
- Ledger asks sellers across Asia to halt sales after supply-chain attack - BleepingComputer
- Midnight Mimosa Malware Preinstalled on Low-Cost Android Devices (2026-10-13, 1 outlet, severity 3/5)
- MALFEX 'imgdecode' npm Package Deploys Shellcode and Overlord RAT (2026-10-19, 1 outlet, severity 3/5)
- Arch Linux AUR Packages Impersonating yay and paru Spread Malware (2026-10-16, 1 outlet, severity 3/5)
- Fake Arch Linux packages push malware with root privileges - BleepingComputer
- UK Housing Ombudsman Investigates Security Incident at IT Provider (2026-10-14, 1 outlet, severity 3/5)
- UK Housing Ombudsman Service investigates 'security incident' - BleepingComputer
- European Bank Breached via Misconfigured Third-Party Gateway Appliance (2026-10-14, 1 outlet, severity 3/5)
Nation-State / APT
- UNC5820 Compromised Telecommunications MSP via FortiManager CVE-2024-47575 and PEERSTITCH Implant (2026-10-15 to 2026-10-16, 2 outlets, severity 4/5)
- Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant - Palo Alto Unit 42
- PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions - The Hacker News
- Ukrainian forces conduct drone attacks against three Yandex data centers (2026-10-13, 2 outlets, severity 4/5)
- Yandex confirms service outage as users lose access to cloud files - BleepingComputer
- Ukraine strikes third Yandex data center, disrupting digital services across Russia - The Record (Recorded Future)
- TAG-217 Uses ARTEX to Breach South Korean Financial Institutions (2026-10-19, 1 outlet, severity 4/5)
- TAG-217 Targets South Korean Financial Services with ARTEX - Recorded Future
- Starshield Service Partially Restored After Disrupting Ukrainian Drone Missions (2026-10-16, 1 outlet, severity 4/5)
- Ukraine says Elon Musk's Starshield service partially restored after restrictions disrupted drone missions - The Record (Recorded Future)
- North Korean Kimsuky Targets Ukrainian Experts in Operation GitPower Intelligence Gathering Campaign (2026-10-14, 2 outlets, severity 3/5)
- North Korean hackers target Ukrainian experts for possible intelligence on Russia's war - The Record (Recorded Future)
- North Korea Phishes Ukrainians for War Intel - DarkReading
- AI Slop Degrades Cyberattacks From TA4903, Kimsuky, and APT36 (2026-10-16, 1 outlet, severity 2/5)
Malware & Botnets
- ThreatFabric Identifies Hirudo Android Trojan Targeting Banking Apps in Multiple Countries (2026-10-15, 2 outlets, severity 3/5)
- New Android RATs Use Discord and App Spoofing for Attacks (2026-10-16, 1 outlet, severity 3/5)
- AvisLoader Uses Tox P2P Network to Evade Takedowns (2026-10-13, 1 outlet, severity 3/5)
- Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption - BleepingComputer
- Panchan Worm Uses Discord C2 to Spread Crypto Mining Botnet (2026-10-15, 1 outlet, severity 3/5)
- Panchan's Mining Island [Guest Diary], (Wed, Oct 14th) - SANS Internet Storm Center
- Cloudflare to Track and Report Verified Bot Behavior Trust (2026-10-19, 1 outlet, severity 2/5)
- Continuous accountability for Verified bots - Cloudflare Security
- D-Link and Ubiquiti Devices Hijacked to Resell Stolen Bandwidth (2026-10-16, 1 outlet, severity 2/5)
- Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth - BleepingComputer
- Malware IoCs: Enhancing Threat Detection Through Context and Automation (2026-10-14, 1 outlet, severity 1/5)
- Malware Indicators of Compromise (IoCs) | Recorded Future - Recorded Future
Phishing & Social Engineering
- Fake Claude and ChatGPT Tools Target Developers in Cyberattacks (2026-10-16 to 2026-10-19, 2 outlets, severity 3/5)
- UAT-11985 Targets Taiwan Researchers With Google AitM Phishing (2026-10-19, 1 outlet, severity 3/5)
- Fake Meta Careers Calendly Pages Steal Google and Facebook Logins (2026-10-15, 1 outlet, severity 2/5)
- Irish Garda Síochána Twitter Account Hacked for Cryptocurrency Scam (2026-10-19, 1 outlet, severity 2/5)
- Irish police force has its Twitter hacked in cryptocurrency scam - Graham Cluley
- AI-Driven Mass Job Applications Increase Risk of Recruitment Scams (2026-10-19, 1 outlet, severity 2/5)
- Text Scammers Use Personal Data to Lure Victims via SMS (2026-10-13, 1 outlet, severity 2/5)
- Your “Who’s this?” reply is exactly what text scammers want - Malwarebytes
- Deepfake Readiness Drills: Protecting Teams From AI Voice Cloning (2026-10-15, 1 outlet, severity 1/5)
- F-Secure Launches Scam Encyclopedia to Combat 50+ Fraud Types (2026-10-16, 1 outlet, severity 1/5)
- Malwarebytes Launches Free Scam Link Check Tool to Fight Phishing (2026-10-16, 1 outlet, severity 1/5)
Cloud & Infrastructure Security
- Hotejka and Help TDS Use Cloudflare Pages for Scams (2026-10-16, 1 outlet, severity 3/5)
- Censys Reports Surge in Exposed AI Tools and ICS Devices (2026-10-16, 1 outlet, severity 3/5)
- Internet exposure of AI tools, ICS devices continues to grow - Cybersecurity Dive
- Windows Server 2022 Enters Extended Support Phase (2026-10-16, 1 outlet, severity 1/5)
- Microsoft: Windows Server 2022 reached end of mainstream support - BleepingComputer
- Biomemory Launches DNA Shield for Synthetic DNA Data Storage (2026-10-19, 1 outlet, severity 1/5)
Identity & Access Management
- Threat Actors Compromise ConnectWise Application Identities to Access Microsoft 365 Tenants (2026-10-19, 2 outlets, severity 4/5)
- GhostAction Compromises 1,900 GitHub Accounts to Target 30,000 Repositories (2026-10-16, 1 outlet, severity 4/5)
- IonQ to Acquire Zero-Trust Security Firm Elisity for $1.3 Billion (2026-10-13, 2 outlets, severity 1/5)
- Check Point Advocates Least Privilege for Small AI Agents (2026-10-16, 1 outlet, severity 1/5)
- Small Agents, Smaller Blast Radius: Controlling What AI Can Do, (Fri, Oct 16th) - SANS Internet Storm Center
- IAM Resilience Is Essential for Effective Cyber Recovery (2026-10-13, 1 outlet, severity 1/5)
AI & Machine Learning Security
- OpenAI models hacked crypto wallets and websites to complete tasks (2026-10-19, 3 outlets, severity 4/5)
- OpenAI models hacked a crypto wallet and breached more websites - Ars Technica Security
- OpenAI Research Model Spent 3rd-Party Test ETH Without Permission to Deploy Smart Contract - The Hacker News
- OpenAI Models Hacked Data Portals, Raided a Crypto Wallet to Finish Tasks - SecurityWeek
- CL-UNK-1211 Uses AI Payloads to Target Government Linux Infrastructure (2026-10-16, 1 outlet, severity 4/5)
- AI-Powered Espionage Campaign Targets Government Linux Infrastructure - Palo Alto Unit 42
- CERT-In Warns AI Agents Exposed Sensitive Data in India (2026-10-16, 1 outlet, severity 4/5)
- Anthropic researchers test small AI models for self-replication on IoT devices (2026-10-14 to 2026-10-15, 6 outlets, severity 2/5)
- Anthropic warns self-replicating AI could spread to your smart devices - BleepingComputer
- Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns - SecurityWeek
- Anthropic Warns Small AI Models Could Soon Form Self-Propagating IoT Botnets - The Hacker News
- Anthropic Finds Ingredients for Future AI Worms - DarkReading
- Anthropic warns small AI models could self-replicate through IoT devices - Ars Technica Security
- AI worms could spread across your smart devices, Anthropic warns - Malwarebytes
- Booz Allen AI agents manipulate physical equipment in OT lab tests (2026-10-15 to 2026-10-19, 2 outlets, severity 3/5)
- Dark Clark AI Campaign Targets Latin American Political Entities (2026-10-15, 1 outlet, severity 3/5)
- VisionHeight Reveals AI Chatbot Manipulation in U.S. Local Elections (2026-10-16, 1 outlet, severity 3/5)
- Anthropic’s Claude AI Sends Fake Murder Tip to Police (2026-10-15, 1 outlet, severity 3/5)
- Police receive fake murder tip from Anthropic’s Claude AI - Malwarebytes
- Raven AI Helps Police Locate Homes From Interior Photos (2026-10-16, 1 outlet, severity 3/5)
- Raven AI lets cops find your home from a photo taken inside - Malwarebytes
- Reflectiz AI Agent Finds Critical OTP Bypass for Major Insurer (2026-10-15, 1 outlet, severity 3/5)
- NVIDIA Launches Safety Platform to Secure AI Agent Dependencies (2026-10-13, 1 outlet, severity 2/5)
- Android Uses Gemini AI to Block Messaging and Call Scams (2026-10-16, 1 outlet, severity 2/5)
- Android gets AI defenses against messaging scams, fake calls - BleepingComputer
- Barracuda Warns of Phishing via AI Indirect Prompt Injection (2026-10-13, 1 outlet, severity 2/5)
- Phishing emails are baiting your AI assistant - Malwarebytes
- BYOA Risks: Personal AI Agents Threaten Corporate System Security (2026-10-13, 1 outlet, severity 2/5)
- Bring Your Own Agent: Your Employees' Assistants Are Already Logged In - The Hacker News
- SANS Launches AI Frameworks to Ensure Human-Led Forensic Validation (2026-10-16, 1 outlet, severity 2/5)
- Why AI Confidence Is Not Validation - The Hacker News
- Intruder's Daniel Thatcher Compares AI and Human Pentesting Performance (2026-10-16, 1 outlet, severity 2/5)
- Is AI pentesting as good as a human pentester? - BleepingComputer
- Grant Thornton Warns Risk Gaps Fuel AI Fraud, Cyberattacks (2026-10-14, 1 outlet, severity 1/5)
- Harmonic Security Raises $50 Million to Secure Workforce AI (2026-10-15, 1 outlet, severity 1/5)
- AI Decision Models and Their Impact on AI SOC Platforms (2026-10-19, 1 outlet, severity 1/5)
- AI Decision Models and Their Impact on AI SOC Platforms - The Hacker News
- SecTor 2026 Highlights Agentic AI and Spotlight Security Win (2026-10-16, 1 outlet, severity 1/5)
- CompTIA: Enterprises Shift AI Focus Toward Risk and Security (2026-10-19, 1 outlet, severity 1/5)
- Bitdefender Launches GravityZone AI Visibility and Control for Endpoints (2026-10-14, 1 outlet, severity 1/5)
- Product Walkthrough: Bitdefender AI Visibility and Control - The Hacker News
- Picus Security Outlines Strategy to Fix Agentic Pentesting Gaps (2026-10-15, 1 outlet, severity 1/5)
- The Blind Spots of Agentic Pentesting and How to Close Them - BleepingComputer
- NordLayer AI Scout Helps Admins Manage Personal ChatGPT Use (2026-10-19, 1 outlet, severity 1/5)
- Employees using personal ChatGPT at work? Here's what IT admins need to do - BleepingComputer
Legal & Law Enforcement
- North Macedonia arrests alleged operator of OLVX cybercrime marketplace (2026-10-15, 2 outlets, severity 4/5)
- Authorities charge alleged OLVX cybercrime marketplace operator in North Macedonia - CyberScoop
- North Macedonian police arrest alleged administrator behind OLVX cybercrime market - The Record (Recorded Future)
- UK Sanctions Cryptomus and Other Crypto Firms Over Russian Aid (2026-10-15, 1 outlet, severity 4/5)
- U.K. Sanctions Cryptomus for RU Money Laundering - Krebs on Security
- Oleg Korniev Pleads Guilty to Leading YMCO Money Mule Network (2026-10-13, 1 outlet, severity 4/5)
- Dmitry Belkin and businesses defrauded sextortion victims of $60 million (2026-10-14 to 2026-10-16, 3 outlets, severity 3/5)
- FTC says ‘sextortion’ protection companies deceived customers about services - CyberScoop
- FTC: Company netted at least $60 million charging sextortion victims for help it didn’t provide - The Record (Recorded Future)
- Sextortion “help” firm took $60 million from victims, FTC alleges - Malwarebytes
- OpenAI Engineer Arrested for Planting Spy Device in Office (2026-10-14, 3 outlets, severity 3/5)
- OpenAI engineer arrested for allegedly planting spy device in office - BleepingComputer
- Employee Arrested After Listening Device Found in OpenAI Conference Room, FBI and the Company Say - SecurityWeek
- OpenAI Employee Arrested for Allegedly Planting Hidden Recorder in Executive Conference Room - The Hacker News
- INTERPOL Operation Confluencia Arrests 95 Suspects in Global CSAM Crackdown (2026-10-16, 1 outlet, severity 3/5)
- Police arrests 95 suspects in international CSAM crackdown action - BleepingComputer
- Moscow police detain suspected DataSuckers hackers linked to breaches in Ukraine and Russia (2026-10-19, 1 outlet, severity 3/5)
- Moscow police detain suspected DataSuckers hackers linked to breaches in Ukraine and Russia - The Record (Recorded Future)
- Brooklyn DA and FBI Disrupt Crypto Scam Targeting Russians (2026-10-15, 1 outlet, severity 3/5)
- Brooklyn DA’s office disrupts crypto scam targeting Russian community - The Record (Recorded Future)
- OpenAI Sued by Eight States Over Child Safety and Data (2026-10-19, 1 outlet, severity 3/5)
- OpenAI sued over children safety and data use - Malwarebytes
- Smashing Security podcast #488: How a ransomware negotiator ended up arrested at his own conference (2026-10-15, 1 outlet, severity 2/5)
Policy & Regulation
- Cantwell and Rounds Urge Trump Admin to Prioritize AI Safety (2026-10-15, 1 outlet, severity 4/5)
- Xandr Fined €8.6M for Sharing Sensitive Grindr User Data (2026-10-13 to 2026-10-14, 3 outlets, severity 3/5)
- OpenAI, Meta, and Anthropic Face AI Agent Liability Debate (2026-10-19, 1 outlet, severity 3/5)
- CISA, NSA, and Commerce Issue Security Guidance for Frontier AI (2026-10-19, 1 outlet, severity 3/5)
- India Mandates Registered Caller Name Display to Combat Spam (2026-10-16, 1 outlet, severity 3/5)
- Russia Tightens Internet Controls, Increasing Operational Risks for Entities (2026-10-16, 1 outlet, severity 2/5)
- Russia Is Tightening Internet Controls, Leading to Operational Risks - Recorded Future
Other Cybersecurity
- Cyberattack on BAE Systems disrupts US federal bankruptcy court noticing center (2026-10-16 to 2026-10-19, 4 outlets, severity 3/5)
- BAE Systems cyberattack disrupts US federal court operations - BleepingComputer
- Federal bankruptcy courts dealing with outages after contractor cyberattack - The Record (Recorded Future)
- Cybersecurity incident at BAE Systems disrupts US bankruptcy court system - CyberScoop
- BAE Systems Security Incident Stalls Notices From US Bankruptcy Courts - SecurityWeek
- Ahold Delhaize Takes Systems Offline Following a Major Cybersecurity Incident (2026-10-13 to 2026-10-15, 2 outlets, severity 3/5)
- Retail giant Ahold Delhaize takes systems offline after cyberattack - BleepingComputer
- Ahold Delhaize experiencing cybersecurity issue - Cybersecurity Dive
- Ahold Delhaize USA banners remain offline - Cybersecurity Dive
- Attackers Use Hardware Implants to Steal Ledger Wallets From CryptoBilis (2026-10-13, 2 outlets, severity 3/5)
- Anywayanyday Suspends Bookings Following Cyberattack on IT Infrastructure (2026-10-15, 1 outlet, severity 3/5)
- Russian travel booking platform suspends reservations after cyberattack - The Record (Recorded Future)
- Flock Becomes CVE Authority, Sparking Security Conflict Concerns (2026-10-13, 1 outlet, severity 2/5)
- Microsoft Ends Support for Windows 11 24H2 Home and Pro (2026-10-14, 1 outlet, severity 2/5)
- Microsoft: Windows 11 24H2 Home and Pro reached end of support - BleepingComputer
- VirusTotal Launches macOS Mirage for Apple Silicon Dynamic Analysis (2026-10-14, 1 outlet, severity 2/5)
- Proofpoint to Acquire Varonis in $6.3 Billion Cash Deal (2026-10-16 to 2026-10-19, 3 outlets, severity 1/5)
- Proofpoint to buy Varonis for $6.3 billion - CyberScoop
- Proofpoint Inks $6.3 Billion All-Cash Deal to Acquire Varonis - SecurityWeek
- Proofpoint lines up $6.3 billion deal for Varonis’ data security - The Record (Recorded Future)
- Canonical Websites Hit by Second DDoS Attack This Year (2026-10-13, 1 outlet, severity 2/5)
- Canonical Websites Disrupted in Second DDoS Attack This Year - SecurityWeek
- Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026 (2026-10-19, 1 outlet, severity 2/5)
- Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026 - Palo Alto Unit 42
- Satellite Images Show Extent of Trump Admin’s Tree-Felling at DC Golf Course (2026-10-16, 1 outlet, severity 1/5)
- US Cyber Job Postings Drop as AI Security Demand Surges (2026-10-19, 1 outlet, severity 1/5)
- Netskope CISO James Robinson on Career Growth and Leadership (2026-10-15, 1 outlet, severity 1/5)
- Context Is King in the Fight Against Modern Cyberattacks (2026-10-16, 1 outlet, severity 1/5)
- Context Is King in the Fight Against Modern Cyberattacks - SecurityWeek
- NIST NICE Program Launches Cybersecurity Career Week 2026 (2026-10-15, 1 outlet, severity 1/5)
- Kicking off Cybersecurity Career Week with NIST! - NIST Cybersecurity Insights
- Dark Reading Names Fahmida Y Rashid as Editor-in-Chief (2026-10-13, 1 outlet, severity 1/5)
- Quarkslab Opens Security Research Internships for 2026-2027 Season (2026-10-16, 1 outlet, severity 1/5)
- Internship Offers for the 2026-2027 Season - Quarkslab
Reported Data Breaches
Breaches reported via Have I Been Pwned this period.