Cyber Security

▶Watch the video on YouTube

Date saved: 2026-10-18 18:00 (PDT)

Sources: Aviatrix Threat Research Center, The Hacker News, SentinelOne, BleepingComputer, Europol, CoinDesk, Department of Defense

Key findings

Pentagon DMDC breach exposes 3 million records

• Aviatrix Threat Research Center (Oct 15, 2026): The Pentagon's Defense Manpower Data Center (DMDC) suffered a breach exposing personal data of 3 million military personnel and veterans, including Social Security numbers, names, birthdates, contact details, race, gender, and military assignment records. The breach affected 2.8 million living and 294,000 deceased service members. It was discovered in July 2026 but has been ongoing since October 2025. The exposure resulted from unencrypted data storage and inadequate access controls. An additional FBI recruitment platform was also compromised, exposing special agent personal data. (Source)

North Korean $387M cryptocurrency heist

• Aviatrix Threat Research Center (Oct 15, 2026): North Korean state-sponsored hackers (DPRK APT) exploited third-party zero-day vulnerabilities in security appliances and Oracle PeopleSoft systems (CVE-2024-47575, CVSS 9.8) to compromise Bitget cryptocurrency exchange's wallet infrastructure. Attackers escalated privileges through harvested credentials, moved laterally to production systems, maintained persistent command-and-control through web shells, and exfiltrated $387 million in cryptocurrency. The attack demonstrated sophisticated supply chain exploitation through third-party vulnerabilities. (Source)

• CoinDesk (Oct 15, 2026): Bitget exchange suffered a $387 million cryptocurrency heist, with North Korean actors suspected. The breach occurred through zero-day vulnerabilities in third-party security infrastructure. (Source)

KillSec ransomware dismantled, 16-year-old arrested

• Aviatrix / Europol (Oct 2026): International law enforcement successfully dismantled the KillSec ransomware operation under "Operation KillSwitch," arresting key members including a 16-year-old administrator. Police in Spain arrested the teenager on September 30, 2026, along with two others, and took control of KillSec's leak site. KillSec was accused of stealing data from organizations and threatening to publish it unless ransom was paid. (Source)

• The Hacker News (Sep 2026): Police in Spain arrested a 16-year-old suspected of running the KillSec ransomware group. The 16-year-old was one of three people arrested on September 30 when police also took control of the group's leak site. (Source)

ShinyHunters suspect detained in Jordan

• The Hacker News / Reuters (Sep 2026): A suspected member of the ShinyHunters digital extortion group, known by the alias "Rey" (real name Saif al-Din Khader), was detained by authorities in Jordan on September 29, 2026, and is cooperating with the FBI and law enforcement to identify other group members. (Source)

Ransomware fraud charges and other arrests

• The Hacker News (2026): The US Department of Justice charged Zohar Pinhasi (aka Zack Silver/Zack Green), a 50-year-old US and Israeli national, with two counts of wire fraud and one count of wire fraud conspiracy for allegedly defrauding ransomware victims by secretly paying attackers to obtain decryptors while claiming to use proprietary tools. (Source)

Nation-state threats and US responses

• The Hacker News (2026): The US DOJ charged 14 people and seized about 187 computers and KVM devices as part of efforts to disrupt North Korea's fraudulent remote IT worker scheme, affecting more than 70 US companies. The State Department is offering up to $10 million for information leading to Zhang Yu, a Chinese national charged in connection with the 2021 Microsoft Exchange Server attacks (HAFNIUM). The Salt Typhoon Chinese state-sponsored threat group continues to target critical organizations despite remediation of last year's telecom breaches. Cisco revealed that three distinct threat clusters linked to ransomware and state-sponsored attacks are exploiting two recently patched Secure Firewall Management Center (FMC) vulnerabilities. (Source)

• BleepingComputer (2026): The FBI recruitment platform was breached by the ShinyHunters group. The Pentagon DMDC breach notification was formally released by the Defense Department. (Source)

Vulnerabilities and zero-days

• Aviatrix (Oct 2026): Palo Alto Networks disclosed CVE-2026-0322, a high-severity remote code execution vulnerability in PAN-OS management interface enabling authenticated attackers to execute arbitrary code with root privileges. A zero-day vulnerability in Cleo's managed file transfer products is being exploited. A vulnerability called "SneakPeek" exposes critical AI development tool security gaps in Anthropic's Claude Code desktop. (Source)

Source links

• Aviatrix — Pentagon DMDC Breach, KillSec Takedown & $387M Bitget Hack (Week 40)
• The Hacker News — ransomware latest news
• The Hacker News — Nation-State latest news
• BleepingComputer — FBI recruitment platform breached by ShinyHunters
• Europol — Operation KillSwitch Dismantles KillSec Ransomware Gang
• Department of Defense — DMDC Data Breach Notification

• The CyberHub Podcast — Pentagon Breach Hits 3M Military Records, ShinyHunters Hacker Arrested for Murder Plot, Spectre v2

Compiled by Hermes scheduled research — saved 2026-10-18

Date saved: 2026-10-18 14:33 (PDT)

Sources: The Hacker News, BleepingComputer, Infosecurity Magazine, Cyber Security News

Ransomware

• Q3 2026 set a new record: Comparitech counted 2,627 claimed ransomware attacks in Q3 2026 — finance, technology, education, healthcare saw significant increases (Oct 9).
• Physical violence threats rising: Ransomware gangs increasingly threaten employees, executives, and their families to force payment — beyond file encryption and data theft (Infosecurity, Oct 16). (Source)
• Silent Ransom Group: Leaked chat logs suggest $206.95M extorted from 27 firms in ~6 months without encrypting files (Oct 9).
• MonsterCloud CEO charged (Oct 8): DOJ charged Zohar Pinhasi with wire fraud for billing victims $19M+ while secretly paying attackers for decryptors, claiming proprietary recovery tools.
• Backup targeting: Ransomware groups increasingly target backup infrastructure to eliminate recovery options (Kaseya advisory).

Major breaches / incidents

• FBI / ShinyHunters crackdown: Group claimed a breach of the FBI jobs portal (data on nearly all agents/applicants). Multiple arrests: a Canadian cybersecurity executive (Edward Dubrovsky) arrested in Pennsylvania; suspect "Rey" detained in Jordan, cooperating with FBI; Dutch police arrested an alleged leader; FBI Director Kash Patel urging members to surrender. ShinyHunters also allegedly hacked Clop's own leak site, defacing it and stealing onion service private keys.
• KillSec dismantled — "Operation KillSwitch": International operation seized leak site/servers, 3 arrests; alleged admin is a 16-year-old arrested in Spain.
• Berlin state government: Confirmed extortion attempt (Rhysida gang listed it) after August compromise of the state administrative network; refuses to pay.
• Japan: Ransomware hit IDCF Cloud (IDC Frontier) — data center outage affecting east Japan; Keio Corporation railway hit; Daiichi Kosho karaoke chain breach exposed 8M+ customers (supply chain).
• UK Legal Aid Agency: Hackers stole records dating back to 1978 (April 2025 breach disclosed Oct 15, 2026).
• KFC named in Gentlemen ransomware group's breach claim (Oct 10).
• Advantest (semiconductor test firm) confirming PII stolen in ransomware attack.
• ASOS data breach linked to stolen employee credentials (Oct 8).

Threats / vulnerabilities

• FortiBleed (FBI warning): Ongoing attacks on exposed Fortinet FortiGate firewalls & SSL VPN gateways locking out legitimate admins.
• Palo Alto GlobalProtect CVE-2026-0257: Months-old auth-bypass flaw in PAN-OS GlobalProtect/Prisma Access actively exploited by multiple ransomware groups for stealthy VPN access (ReliaQuest).
• China-nexus attacks: Actor exploiting Microsoft SharePoint flaws to deploy Warlock ransomware against essential services/public sector; Chinese hacker used AI in a campaign against South Korean banks; UK + allies warned of cyber threat from China's Integrity Technology Group.
• Kimsuky deploying Funhouse ransomware via malicious résumé documents.
• ClickFix + Python tunnels used to stage systems for ransomware (Oct 15).
• Aoki Infostealer targeting AI coding assistant credentials (Oct 15); separately, a ransomware affiliate used an AI coding assistant as an attack channel inside enterprise networks (Oct 6).
• Microsoft disrupted the "Yam" phishing network — one billion phishing messages (Oct 15).
• Luna Moth leaks shed light on ransomware group internals (Oct 12).

Policy / other

• G7: Planning tabletop exercises simulating AI cyberattacks on banks.
• New Aoki Infostealer and Socradar's new white-label threat-intel API suite for MSSPs (industry note).

Source links

• The Hacker News — Ransomware latest
• BleepingComputer — Ransomware tag
• Infosecurity Magazine — Data breaches
• Cyber Security News — Ransomware
• The Hacker News — Data breach latest
• BleepingComputer — Data theft tag

Compiled by Hermes scheduled research — saved 2026-10-18