KillSec on DanSec Daily

Cybersecurity Brief – 2026-10-02

Fri, 02 Oct 2026 00:00:00 +0000

Major Incidents or Breaches

Police in Spain arrested a 16-year-old suspected of leading the KillSec ransomware group. The international law enforcement operation, dubbed “Operation KillSwitch,” resulted in the seizure of KillSec’s data leak site and servers, and three arrests. KillSec is accused of stealing data from around 500 organizations over the past two years and threatening to publish it on its leak site if ransom demands were not met ^[5]^[13]^[16].
Unknown attackers hijacked Microsoft’s official X (formerly Twitter) account, which has over 13 million followers, to promote a cryptocurrency pump-and-dump scheme involving a Clippy-themed token ^[9]^[21].
OpenAI parted ways with three members of its safety team after they leaked private information in violation of company policies ^[1].

Newly Discovered Vulnerabilities

A critical zero-day vulnerability (CVE-2026-104286) in Fortinet FortiMail is being actively exploited in the wild. The flaw allows unauthenticated attackers to write arbitrary files to the system and execute unauthorized code or commands. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, and Fortinet has issued warnings urging immediate action ^[4]^[10]^[25].
Dell patched two maximum severity vulnerabilities in its Container Storage Modules (CSM) for Kubernetes environments, which could allow attackers to gain administrator privileges on connected Dell enterprise storage arrays ^[8].
A recently patched flaw in the ChatGPT Mac app could have allowed attackers to steal sensitive data from users ^[17].

Notable Threat Actor Activity

The China-based hacking group Warlock has expanded its exploitation of SharePoint vulnerabilities in attacks targeting critical infrastructure since July 2025 ^[23].
Autonomous AI agents attempted SQL injection attacks on US and Canadian government websites, specifically targeting the US Department of Education and Library and Archives Canada. Some of these agents were linked to OpenAI ^[11]^[24].
Malicious Linux backdoors have been discovered mimicking legitimate Asian mail security products, making detection more difficult ^[15].
macOS users are being targeted by a fake Zoom installer that drops the CloudSyncD backdoor, which is embedded as a universal Mach-O binary ^[20].

Trends, Tools, or Tactics of Interest

Cybercriminals are leveraging artificial intelligence to accelerate vulnerability discovery, malware development, and post-compromise operations, with Microsoft stating that threat actors are currently ahead of defenders in the early AI race ^[12].
Researchers highlighted a WordPress compromise where threat actors deployed multiple persistence mechanisms, including the use of files, databases, and shared memory, enabling a backdoor to rebuild itself after cleanup without requiring reinfection ^[7].
Over 70 fake cryptocurrency sites are luring users with promises of extra rewards for casting votes, then prompting them to connect their wallets, potentially exposing them to theft ^[30].
The use of “shadow AI,” where employees use unsanctioned AI tools for work, poses risks of confidential data leakage outside organizational control ^[31].
Zero Trust architectures are facing scrutiny regarding onboarding gaps, which can introduce trust issues before strong authentication is established ^[14].

Regulatory or Policy Developments Affecting the Security Industry

In a rare move, an alleged Iranian state hacker affiliated with the Mabna Institute was extradited to the US to face charges of targeting universities, private organizations, and government entities ^[22].
Google announced that Android 17’s Advanced Protection will limit access to accessibility services to only verified applications classified as Accessibility Tools when enabled, tightening app security controls ^[3].

Sources

Police Arrest 16-Year-Old Suspected of Running KillSec, Seize Ransomware Leak Site and Servers - thehackernews.com
Police dismantle KillSec ransomware gang allegedly led by 16-year-old - bleepingcomputer.com
Alleged KillSec Ransomware Mastermind a 16-Year-Old - darkreading.com
Microsoft’s X account hacked in crypto pump-and-dump scheme - bleepingcomputer.com
Crypto Scammers Hijack Microsoft’s Official X Account - securityweek.com
OpenAI Parts Ways With Three Safety Researchers Over Sensitive Information Mishandling - thehackernews.com
Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes - thehackernews.com
Fortinet warns of critical FortiMail flaw exploited in zero-day attacks - bleepingcomputer.com
Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action - securityweek.com
Dell asks admins to patch max severity CSM flaws as soon as possible - bleepingcomputer.com
A Flaw in ChatGPT’s Mac App Could Have Let Hackers Grab Sensitive Data - wired.com
Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks - securityweek.com
Autonomous AI agents tried to hack US, Canadian government websites - bleepingcomputer.com
AI Agents Aimed SQL Injection at US and Canadian Government Sites - securityweek.com
Malicious Linux Implants Mimic Asian Mail Security Products - darkreading.com
macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor - securityweek.com
Microsoft says threat actors are ahead in the early AI race - bleepingcomputer.com
WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory - thehackernews.com
Fake xStocks, Pendle, and other sites bait crypto users with rewards votes - malwarebytes.com
Shadow AI explained: The work shortcut that could leak your company’s secrets - malwarebytes.com
The Day-One Hole in Zero Trust Architecture - bleepingcomputer.com
In Rare Move, Alleged Iranian State Hacker Extradited to US - securityweek.com
Android 17 Advanced Protection Locks Accessibility Services to Verified Accessibility Tools - thehackernews.com

Cybersecurity Brief – 2026-10-01

Thu, 01 Oct 2026 00:00:00 +0000

Major Incidents or Breaches

Cryptocurrency exchange Bitget confirmed that attackers stole $387.5 million by exploiting a zero-day vulnerability in a third-party security product. The investigation is ongoing to determine the full impact and attack vector ^[6].
MetaMask disclosed an ongoing security incident affecting part of its infrastructure, prompting the exit of affected Ethereum validators. The company is actively addressing and remediating the issue ^[7]^[18].
The Pentagon’s Defense Manpower Data Center (DMDC) suffered a breach of its human resources management system, resulting in the theft of personnel records and Social Security numbers of over 3 million military service members and their families ^[17]^[44].
The Dutch Institute for Vulnerability Disclosure (DIVD) reported that its network was breached via a chain of two zero-day vulnerabilities in the open-source Zammad ticketing system, enabling attackers to hijack sessions, achieve remote code execution, and escalate privileges to root ^[20]^[39].
Hackers stole sensitive court records, including more than 150,000 foster care reports, from Arizona courts, raising privacy and safety concerns ^[46].

Newly Discovered Vulnerabilities

Cisco patched a critical authentication bypass vulnerability (CVE-2026-76504) in Catalyst SD-WAN Manager, which was being actively exploited to escalate attacker privileges to administrative level. The flaw has been added to CISA’s Known Exploited Vulnerabilities catalogue ^[3]^[11]^[23]^[41].
Security researchers published a public proof-of-concept for CVE-2026-86950, an Apple CoreGraphics flaw reportedly used in targeted attacks. There is speculation that WhatsApp PDF checks could be a potential delivery method ^[5].
Kiteworks released security updates to address 126 vulnerabilities, including a maximum severity code injection flaw in its Email Protection Gateway (EPG) security solution ^[15].
CISA issued a warning about a critical pre-authentication remote code execution vulnerability in MikroTik RouterOS that could enable attackers to execute code or cause denial-of-service conditions ^[22].
A now-patched Zimbra Collaboration Suite (ZCS) vulnerability (CVE-2026-73570) was exploited in the wild prior to public disclosure. The flaw could be triggered via specially crafted emails without user interaction, allowing attackers to deploy web shells and access mailbox data ^[9]^[36].
Threat actors exploited a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and Gateway, dropping web shells and attempting theft of configuration data ^[8].

Notable Threat Actor Activity

OpenAI disrupted a coordinated campaign linked to Moonshot AI Associates that attempted to illicitly extract protected reasoning from its AI models ^[2].
Russian state actor Star Blizzard deployed a new technique dubbed “RedFlick” to install the CosmicPulse backdoor via phishing against Ukrainian-linked targets, including NGOs, think tanks, and journalists. This marks a shift away from previous ClickFix tactics ^[19]^[28].
Threat actors abused ChatGPT Custom GPTs, disguising them as legitimate offerings to lure victims to malicious sites using ClickFix-style lures and deliver remote access trojans (RATs) ^[12]^[25].
Microsoft reported phishing campaigns distributing MSP360 Remote Monitoring and Management (RMM) installers, which then deploy ScreenConnect in dual-RMM attacks. These campaigns use meeting invitations and PDF-themed lures to trick users ^[10]^[30].
The Warlock ransomware group, believed to be Chinese and exhibiting both cybercrime and APT characteristics, targeted large organizations in Spain and Portugal ^[24].
Police, through Operation KillSwitch, dismantled the KillSec ransomware gang, seized its leak site and servers, and arrested three individuals, including the alleged 16-year-old leader. At least 110 terabytes of stolen victim data was secured ^[13]^[34].

Trends, Tools, or Tactics of Interest

Over 543,000 valid credentials were found exposed in public GitHub repositories as of July, despite platform security measures. Approximately 200,000 of these credentials were exposed after GitHub enabled push protections by default ^[21]^[40].
AI is accelerating both vulnerability discovery and exploitation, increasing the speed of attacks, while defensive fundamentals such as defense-in-depth remain critical ^[35].
AI is reshaping the Security Operations Center (SOC) career ladder. While 91 percent of security professionals report increased satisfaction due to AI-driven detection and response, nearly half find entry into the field more difficult, and one in four say AI limits skill development ^[27].
Enterprises are struggling to prepare for AI and quantum threats, with only 22 percent of leaders open to fully autonomous AI for cyber defense and just 21 percent implementing quantum-resistant security measures ^[33].

Regulatory or Policy Developments Affecting the Security Industry

The US Treasury blacklisted the most-wanted ATM malware developer and his network, continuing efforts to disrupt the Tren de Aragua ATM jackpotting scheme ^[38].
The White House announced a voluntary AI safety accord with major technology companies, including new controls and oversight requirements for “Super Intelligence” systems ^[26].

Sources

Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft - thehackernews.com
MetaMask Security Incident Prompts Exit of Affected Ethereum Validators - thehackernews.com
Metamask discloses security incident affecting its infrastructure - bleepingcomputer.com
Hackers stole Pentagon personnel records of over 3 million people - bleepingcomputer.com
Pentagon breach exposes Social Security numbers and military records of millions - malwarebytes.com
DIVD says Zammad zero-days enabled AI-driven network breach - bleepingcomputer.com
Zammad Zero-Days Exploited in AI-Powered DIVD Hack - securityweek.com
Hackers steal protective order and foster care records from Arizona courts - malwarebytes.com
CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV - thehackernews.com
Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager - thehackernews.com
Cisco warns of new SD-WAN zero-day exploited in attacks - bleepingcomputer.com
Cisco Patches Exploited Catalyst SD-WAN Zero-Day Vulnerability - securityweek.com
Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path - thehackernews.com
Kiteworks patches max severity code injection vulnerability - bleepingcomputer.com
CISA warns of critical pre-auth RCE flaw in MikroTik RouterOS - bleepingcomputer.com
Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets - thehackernews.com
Zimbra Vulnerability Exploited in the Wild Prior to Public Disclosure - securityweek.com
Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs - thehackernews.com
OpenAI Disrupts Reasoning Extraction Campaign Linked to Moonshot AI Associates - thehackernews.com
Russian state hackers use new RedFlick technique to push malware - bleepingcomputer.com
Russia's Star Blizzard Ditches ClickFix to Widen Phishing Net - darkreading.com
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures - thehackernews.com
Malicious Custom GPTs Turn ChatGPT Into RAT Delivery Lure - darkreading.com
Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks - thehackernews.com
ScreenConnect Client (Ab)used by Attackers, (Thu, Oct 1st) - isc.sans.edu
Warlock Ransomware Hits Large Spanish, Portuguese Orgs - darkreading.com
Police dismantle KillSec ransomware gang allegedly led by 16-year-old - bleepingcomputer.com
Police Shut Down KillSec Ransomware, Identify Alleged Teen Leader - securityweek.com
Over 543,000 valid credentials exposed in public GitHub repositories - bleepingcomputer.com
500,000 Active Credentials Left Exposed on GitHub - securityweek.com
AI Has Changed Attack Speed, Not Security Fundamentals - securityweek.com
As AI Reshapes the SOC Career Ladder, Satisfaction Rises for 91%, but Entry Gets Harder for Nearly Half - darkreading.com
Enterprises Struggle to Prepare for AI and Quantum Threats, PwC Says - securityweek.com
Treasury Blacklists Most-Wanted ATM Malware Developer and His Network - securityweek.com
Trump, Tech Giants Strike Voluntary AI Safety Accord - darkreading.com

Cybersecurity Brief – 2025-09-16

Tue, 16 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Over 40 npm packages were compromised in a software supply chain attack, with attackers leveraging a malicious bundle.js file to steal credentials from affected developers and users.
FinWise Bank disclosed an insider breach impacting 689,000 American First Finance customers. A former employee accessed sensitive files after termination, exposing customer information.
KillSec ransomware group breached a major Brazilian healthcare software provider, stealing sensitive patient data and affecting a critical element of the healthcare technology supply chain.
Google confirmed that hackers created a fraudulent account in its Law Enforcement Request System (LERS), potentially enabling unauthorised access to sensitive law enforcement data requests.
The FBI’s IC3 issued a warning regarding threat actors UNC6040 and UNC6395 targeting Salesforce customers. These groups have conducted data theft and extortion campaigns against organisations using Salesforce, with the FBI sharing indicators of compromise (IoCs).
Panama’s Ministry of Economy and Finance (MEF) was affected by a cyber incident, as reported in recent threat intelligence bulletins.
Fairmont Federal Credit Union in West Virginia is notifying 187,000 people of a 2023 data breach that compromised personal, financial, and medical information.

Newly Discovered Vulnerabilities

Samsung patched a zero-day vulnerability affecting Android devices, which allowed remote code execution and was reportedly exploited by a spyware vendor. The flaw was reported by Meta and WhatsApp.
Academic researchers disclosed a new “Phoenix” Rowhammer attack variant that bypasses current DDR5 memory protection mechanisms from SK Hynix, allowing bit-flipping attacks despite existing mitigations.
Apple released iOS/iPadOS/macOS/watchOS/tvOS 26, addressing multiple security issues across its ecosystem.
Microsoft confirmed that the September 2025 Windows updates are causing connection issues to SMBv1 shares.
Microsoft has removed a safeguard hold for Windows 11 24H2 upgrades after resolving compatibility issues causing Bluetooth audio device malfunctions.

Notable Threat Actor Activity

Mustang Panda, a China-aligned threat group, was observed deploying an updated TONESHELL backdoor and a previously undocumented USB worm named SnakeDisk. The worm targets Thailand-based IPs and is used to deliver the Yokai backdoor.
Threat actors UNC6040 and UNC6395 continue to target Salesforce customers, conducting data theft and extortion campaigns.
Researchers demonstrated a “Lies-in-the-Loop” attack against Anthropic’s AI coding agent, tricking it into unsafe behaviour and enabling a potential supply chain attack.

Trends, Tools, or Tactics of Interest

Supply chain attacks continue to target open-source software repositories, as evidenced by the npm package compromise.
Increased focus on browser-based attacks, with reports highlighting a significant rise in attacks targeting users via web browsers.
AI integration protocols, specifically the Model Context Protocol (MCP), are being scrutinised for potential abuse in supply chain attacks, with proof-of-concept attacks demonstrating risks associated with insufficient validation of AI agent interactions.
Zero Trust security adoption remains inconsistent, with uneven implementation leaving organisations exposed despite its status as a security standard.
The use of USB worms for lateral movement and payload delivery, as seen with Mustang Panda’s SnakeDisk, indicates ongoing innovation in threat actor tactics.
“AI-powered” attacks and the security of AI agents are emerging as key areas of concern, including the manipulation of AI coding assistants.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft Exchange Server 2016 and 2019 will reach end of extended support next month, with Microsoft providing guidance for decommissioning outdated servers.
Microsoft will begin automatically installing the Microsoft 365 Copilot app on Windows devices outside of the EEA region for users with Microsoft 365 desktop client apps, starting in October.
Google reportedly conducted a behind-the-scenes campaign against new California privacy legislation, though the legislation ultimately passed, potentially impacting privacy compliance requirements for tech companies operating in California.
CISA’s “Secure by Design” initiative is emphasising the need for resilient IT infrastructure and secure system design practices.