Date saved: 2026-10-20 18:00 (PDT)
Sources: Verdice News, Aviatrix Threat Research Center, The Hacker News, SentinelOne, CISA, Europol, CoinDesk, Defense.gov, BleepingComputer
Key findings
Pentagon DMDC breach: 3 million military records exposed
- Aviatrix Threat Research Center / Defense.gov (Week 40, 2026): The Pentagon's Defense Manpower Data Center (DMDC) suffered a breach exposing personal data of 3.09 million military personnel and veterans, including 2.8 million living and 294,000 deceased service members. Exposed data includes Social Security numbers, names, birthdates, contact details, race, gender, and military assignment records. The breach was discovered in July 2026 but was ongoing since October 2025. Notification was issued via Defense.gov Release Article 3598234. The exposure was attributed to unencrypted data storage and inadequate access controls. The breach also affected FBI recruitment platform administrative records and special agent personal data. (Source)
North Korean $387M cryptocurrency heist
- Aviatrix / CoinDesk (Oct 15, 2026): North Korean state-sponsored hackers exploited third-party zero-day vulnerabilities to steal $387 million from Bitget cryptocurrency exchange. The attack path: exploitation of zero-day vulnerabilities in third-party security appliances and Oracle PeopleSoft systems for initial access, privilege escalation through harvested credentials, lateral movement to production systems, persistent C2 via web shells, and exfiltration of $387M in cryptocurrency. CVE-2024-47575 (CVSS 9.8) (a zero-day in Oracle PeopleSoft allowing remote code execution through authentication bypass) was exploited in the wild. (Source)
KillSec ransomware takedown and teen arrests
- Europol / The Hacker News / Aviatrix: International law enforcement successfully dismantled the KillSec ransomware operation, arresting key members including a 16-year-old administrator. Police in Spain arrested the 16-year-old, who was one of three people arrested on September 30, 2026, when police also took control of KillSec's leak site. KillSec was accused of stealing data from organizations and threatening to publish it unless ransom was paid. Operation KillSwitch was the coordinated law enforcement action. (Source)
- The Hacker News: A suspected member of the ShinyHunters digital extortion group, "Rey" (real name Saif al-Din Khader), was detained by authorities in Jordan on September 29, 2026, and is cooperating with the FBI and law enforcement to identify other group members. (Source)
Verizon/CISA Ivanti zero-day warning
- CISA: Issued an urgent warning about CVE-2026-104935, a high-severity authentication bypass vulnerability in Ivanti Connect Secure (ICS), being actively exploited as a zero-day since October 1, 2026. (Source)
Cisco Secure Firewall vulnerabilities actively exploited
- Cisco / The Hacker News: Three distinct threat clusters linked to ransomware and state-sponsored attacks are exploiting two recently patched Secure Firewall Management Center (FMC) vulnerabilities. CVE-2026-20079 (CVSS 10.0) is an authentication bypass vulnerability in the FMC web interface allowing unauthenticated remote attackers to execute script files and obtain root access. CVE-2026-20316 (CVSS 5.3) allows unauthenticated remote attackers to log in using a low-privilege account to access sensitive data. (Source)
Broader threat landscape, identity attacks dominate
- Verdice News (July 27, 2026 intelligence briefing): The center of gravity in cyber threats has shifted from technical exploitation to identity compromise and AI-enabled deception. The dominant lesson of 2026 incident data: "attackers did not break in; they logged in" (credential theft, SSO token phishing, and inherited vendor access drive nearly every major intrusion. 87% of CEOs identify AI-related vulnerabilities as the fastest-growing cyber risk (Global Cybersecurity Outlook 2026, Amtivo). Government ransomware incidents reached 187 in H1 2026, a 13% global increase, with "The Gentleman" the most active group. The Colonial Pipeline lesson), a single inactive account without MFA enabled a national crisis, remains largely unlearned across operational technology environments. (Source)
- ShinyHunters group: Responsible for the January 2026 Match breach and the June 2026 NAIC (National Association of Insurance Commissioners) credit-rating compromise that forced suspension of investment-risk designations. FBI recruitment platform was breached by ShinyHunters. (Source)
- Nation-state blurring: CSIS documented the June 2026 Tata Electronics breach implicating Apple and Tesla data, with Russia's FSB responding by opening a criminal investigation but providing no technical evidence or specific country attribution, illustrating how state agencies use attribution claims as narrative instruments. (Source)
- 14 charged in cybercrime schemes: Authorities arrested two U.S. nationals and charged 14 individuals total, including 12 Chinese defendants, in schemes affecting over 70 companies and generating approximately $3 million since 2019. (Source)
Source links
- Aviatrix Threat Research Center: Pentagon DMDC Breach, KillSec Takedown & $387M Bitget Hack, Week 40 2026
- Verdice News: Strategic Intelligence Briefing: Cybersecurity (July 27, 2026)
- The Hacker News: Nation-State Attacks: Latest News & Analysis
- The Hacker News: Ransomware: Latest News & Analysis
- SentinelOne: The Good, the Bad and the Ugly in Cybersecurity: Week 40 2026
- Europol: Operation KillSwitch Dismantles KillSec Ransomware Gang