Date saved: 2026-10-18 14:33 (PDT)
Sources: The Hacker News, BleepingComputer, Infosecurity Magazine, Cyber Security News
Ransomware
- Q3 2026 set a new record: Comparitech counted 2,627 claimed ransomware attacks in Q3 2026, finance, technology, education, healthcare saw significant increases (Oct 9).
- Physical violence threats rising: Ransomware gangs increasingly threaten employees, executives, and their families to force payment, beyond file encryption and data theft (Infosecurity, Oct 16). (Source)
- Silent Ransom Group: Leaked chat logs suggest $206.95M extorted from 27 firms in ~6 months without encrypting files (Oct 9).
- MonsterCloud CEO charged (Oct 8): DOJ charged Zohar Pinhasi with wire fraud for billing victims $19M+ while secretly paying attackers for decryptors, claiming proprietary recovery tools.
- Backup targeting: Ransomware groups increasingly target backup infrastructure to eliminate recovery options (Kaseya advisory).
Major breaches / incidents
- FBI / ShinyHunters crackdown: Group claimed a breach of the FBI jobs portal (data on nearly all agents/applicants). Multiple arrests: a Canadian cybersecurity executive (Edward Dubrovsky) arrested in Pennsylvania; suspect "Rey" detained in Jordan, cooperating with FBI; Dutch police arrested an alleged leader; FBI Director Kash Patel urging members to surrender. ShinyHunters also allegedly hacked Clop's own leak site, defacing it and stealing onion service private keys.
- KillSec dismantled, "Operation KillSwitch": International operation seized leak site/servers, 3 arrests; alleged admin is a 16-year-old arrested in Spain.
- Berlin state government: Confirmed extortion attempt (Rhysida gang listed it) after August compromise of the state administrative network; refuses to pay.
- Japan: Ransomware hit IDCF Cloud (IDC Frontier), data center outage affecting east Japan; Keio Corporation railway hit; Daiichi Kosho karaoke chain breach exposed 8M+ customers (supply chain).
- UK Legal Aid Agency: Hackers stole records dating back to 1978 (April 2025 breach disclosed Oct 15, 2026).
- KFC named in Gentlemen ransomware group's breach claim (Oct 10).
- Advantest (semiconductor test firm) confirming PII stolen in ransomware attack.
- ASOS data breach linked to stolen employee credentials (Oct 8).
Threats / vulnerabilities
- FortiBleed (FBI warning): Ongoing attacks on exposed Fortinet FortiGate firewalls & SSL VPN gateways locking out legitimate admins.
- Palo Alto GlobalProtect CVE-2026-0257: Months-old auth-bypass flaw in PAN-OS GlobalProtect/Prisma Access actively exploited by multiple ransomware groups for stealthy VPN access (ReliaQuest).
- China-nexus attacks: Actor exploiting Microsoft SharePoint flaws to deploy Warlock ransomware against essential services/public sector; Chinese hacker used AI in a campaign against South Korean banks; UK + allies warned of cyber threat from China's Integrity Technology Group.
- Kimsuky deploying Funhouse ransomware via malicious résumé documents.
- ClickFix + Python tunnels used to stage systems for ransomware (Oct 15).
- Aoki Infostealer targeting AI coding assistant credentials (Oct 15); separately, a ransomware affiliate used an AI coding assistant as an attack channel inside enterprise networks (Oct 6).
- Microsoft disrupted the "Yam" phishing network, one billion phishing messages (Oct 15).
- Luna Moth leaks shed light on ransomware group internals (Oct 12).
Policy / other
- G7: Planning tabletop exercises simulating AI cyberattacks on banks.
- New Aoki Infostealer and Socradar's new white-label threat-intel API suite for MSSPs (industry note).