Cybersecurity News: Research Digest

Date saved: 2026-10-27 18:00 (PDT)

Sources: CISA, FBI, U.S. Secret Service, BleepingComputer, The Record, KrebsOnSecurity, Reuters, Palo Alto Networks Unit 42, Mandiant, ESET, Volexity, Microsoft, N2K Networks, packet-autopsy, CyberScoop, Terabitweb, N2K, Cleartext, The Hacker News, Kaspersky, DOJ, FBI, Proofpoint

Key findings

SafePay ransomware: 600+ critical infrastructure victims

CISA / FBI / U.S. Secret Service / German and UK law enforcement (Oct 20-21, 2026): A joint advisory says SafePay ransomware has breached at least 600 critical infrastructure organizations worldwide since August 2024. The advisory's figure draws on law enforcement investigations, not the group's own leak site, which lists only victims who do not pay. SafePay operates as a closed group that does not work with affiliates. The group gains access through stolen credentials, brute force attacks, vulnerable VPNs, and exposed network devices. Once inside, attackers escalate privileges, move laterally using legitimate administrative tools, disable security software, and steal sensitive data before encrypting systems. SafePay employs double extortion and also calls victims directly to pressure them into paying. The advisory urges organizations to strengthen identity controls, restrict administration tools, patch edge systems, and protect offline immutable backups. (Source)

packet-autopsy (Oct 23, 2026): A 14-minute case file walkthrough of SafePay's timeline from August 2024 to August 2026 . how the group gets in through exposed credentials, VPNs, and edge-device flaws, how it moves with legitimate tools, and how it uses double extortion. The episode dissects the July 2025 attack on IT distributor Ingram Micro, from the first Reddit reports to the ransom notes and supply-chain fallout. The most recent case in the file happened in August 2026. Who is behind SafePay remains an open question . experts have said parts of its code resemble LockBit, and Bitdefender reported the ransomware won't run on systems with a Cyrillic keyboard, a possible sign of Russian involvement. (Source)

N2K Networks / Cybersecurity SysOps (Oct 21, 2026): A 28-minute weekly roll-up covering SafePay's 600+ critical infrastructure victims, the FBI suspect that a ransom negotiator ran the ShinyHunters extortion site, and the broader ransomware landscape. (Source)

China-linked attacks: Warlock disables security tools, Storm-0940's ARTEX framework

CyberScoop / Cleartext (Oct 27, 2026): A China-linked ransomware group (Storm-2603, dubbed Warlock) disabled security tooling at a critical infrastructure operator before deploying the encryptor . a sophisticated pre-positioning tactic. The EDR, the SIM connectors, the visibility stack were all dark before the encrypter ever touched a disk. The campaign exploited SharePoint as an initial access vector. Most enterprise security budgets do not account for adversary-induced blind spots preceding encryption events. (Source)

Microsoft (Oct 16, 2026): Storm-0940 began using the ARTEX agentic framework in September against hundreds of organizations. Microsoft assesses it was behind the ConnectWise multi-tenant application compromise disclosed October 16, and that it used stolen application identities to try to authenticate to more than 2,250 Microsoft 365 tenants without any interactive sign-in. ConnectWise says it has no indication stored backup archives were compromised. (Source)

FBI / Seven-country advisory (Oct 8, 2026): The FBI and agencies from six partner countries said hackers tied to a Chinese cybersecurity company stole email from government, law enforcement, healthcare, and religious organizations in Southeast Asia, and also targeted the United States. Tools included the MicroScan scanner (in use since at least 2017), password spraying, and a PHP email-harvesting bot. Access to stolen data was sometimes restricted to Xiamen IP addresses, and the actors ran a portal that let third parties browse stolen mail. (Source)

Nation-state operations: FBI seizures, DOJ indictments, and North Korean activity

DOJ / FBI / TechCrunch (Oct 13, 2026): "Operation Lonestar Roundup" . a federal grand jury in Ohio indicted 14 people: two Americans, ten Chinese nationals, and two under seal; two were arrested. FBI searches of more than 40 suspected Texas laptop farms from September 21 to 25 seized about 187 computers and KVM devices. The scheme reached more than 70 U.S. companies, used the identities of 25 Americans, and generated at least $3 million. (Source)

FBI / CISA / NSA / partners (Oct 8, 2026): The FBI, CISA, NSA, and partners in the UK, Australia, Canada, Japan, New Zealand, and Spain attributed Flax Typhoon activity to Beijing contractor Integrity Technology Group. The FBI seized seven domains, disabling MicroScan (a scanner with 1,300+ exploit scripts run through a Mirai-variant botnet) and FishHub (spear-phishing and remote access). (Source)

Kaspersky (Oct 27, 2026): The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors. The campaign has been active since at least July 2025 and is assessed to pick up from where Operation SyncHole left off. (Source)

ShinyHunters, FBI website hack, and the ransom negotiation scandal

KrebsOnSecurity (Oct 2026): U.S. federal investigators pursuing the ShinyHunters hacking group that stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group. Sources close to the investigation say one of the executives in the United States even helped ShinyHunters operate a website that pressured victims into paying a ransom. In late September, ShinyHunters hacked the FBI recruitment website fbijobs.gov and taunted the agency by threatening to publish stolen files, which reportedly included medical and psychological records, Social Security numbers, home addresses, and information about each employee's unit and specialization. Reuters reported October 5 that the FBI removed a contractor at Accenture over their failure to patch the FBI recruitment website. (Source)

Terabitweb / Cyber Security Training (Oct 23, 2026): A weekly cyber news round-up covering the PHP2Shell critical alert, the ConnectWise AI hack tied to Storm-0940, and the SafePay ransomware warning from CISA and the FBI affecting 600+ organizations since August 2024. (Source)

Vulnerabilities, UEFI bootkits, and consumer-device implications

Palo Alto Networks Unit 42 (Oct 20, 2026): Qilin and INC ransomware groups are exploiting Palo Alto Networks PAN-OS and Prisma Access flaw CVE-2026-0257 (CVSS 7.8), an authentication bypass flaw that could be exploited to set up unauthorized VPN connections. The activity relates to a now-patched security flaw. Ransomware operators exploiting the flaw include Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka INC). (Source)

Kaspersky (Oct 23, 2026): A sophisticated new UEFI bootkit called BlackX bypasses Secure Boot on patched Windows systems missing revocations. The activity singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026 and is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41. (Source)

Palo Alto Networks Unit 42 (Oct 25, 2026): PHP2Shell exploitation attempts continue amid suspected North Korean global scanning activity. Palo Alto Networks is retracting its earlier assessment that post-compromise activity targeting a European government agency involved exploitation of the PHP2Shell flaws. (Source)

SafePay ransomware is now the headline cyber incident of the week. A joint advisory from CISA, the FBI, the U.S. Secret Service, German, and British law enforcement says the group has breached at least 600 critical infrastructure organizations worldwide since August 2024 . spanning healthcare, energy, transportation, and government sectors across four continents. This is not a vendor's weekly roundup figure. It comes from law enforcement investigations, and the group's own leak site counts only victims who don't pay, meaning the real number is higher. SafePay operators call victims directly to pressure them into paying, on top of the standard double-extortion playbook. The advisory covers activity observed between November 2024 and August 2026. Who is behind SafePay remains an open question . Bitdefender noted the ransomware won't run on systems with a Cyrillic keyboard, which it read as a possible sign of Russian involvement.

The other major story is China's escalation. A China-linked ransomware group . dubbed Warlock, with the campaign tracked as Storm-2603 . disabled security tools at a critical infrastructure operator before deploying the encryptor. That's a sophisticated pre-positioning tactic: the EDR, the SIM connectors, the visibility stack . all dark before the encrypter ever touched a disk. Most enterprise security budgets and response playbooks don't account for adversary-induced blind spots preceding encryption events. Separately, China-aligned Storm-0940 began using the ARTEX agentic framework in September against hundreds of organizations, and Microsoft assesses it was behind the ConnectWise multi-tenant application compromise disclosed October 16 . using stolen application identities to try to authenticate to more than 2,250 Microsoft 365 tenants.

On the nation-state front, the FBI and partners seized seven domains tied to Beijing contractor Integrity Technology Group, disabling MicroScan (a scanner with 1,300+ exploit scripts run through a Mirai-variant botnet) and FishHub (spear-phishing and remote access). The DOJ charged 14 people over a North Korean IT-worker scheme managed in part from China . "Operation Lonestar Roundup" . with FBI searches of more than 40 suspected Texas laptop farms seizing about 187 computers. And the FBI recruitment website hack by ShinyHunters, which exposed sensitive data on more than 5,000 FBI personnel including medical and psychiatric records and unit specializations, led Reuters to report that the FBI removed a contractor at Accenture over failure to patch the vulnerable site.