MSP360 on DanSec Daily

Cybersecurity Brief – 2026-10-15

Thu, 15 Oct 2026 00:00:00 +0000

Major Incidents or Breaches

The UK Legal Aid Agency confirmed that attackers who breached its IT systems in April 2025 stole records dating back to 1978, affecting sensitive data managed by the country’s Public Defender Service ^[18].
CenterPoint Energy disclosed a data breach impacting 1 million Texans, with compromised personal information including names, addresses, Social Security numbers, and driver’s license numbers ^[39].
GhostAction, a credential-theft campaign, compromised about 1,900 GitHub accounts and targeted over 30,000 repositories across 3,000 users and organizations, with a spike in activity observed on October 9 ^[9].
Ledger requested resellers across multiple Asian markets to halt sales and remove products from shelves following a supply-chain attack ^[21].
U.S. authorities disrupted North Korean IT worker fraud by shutting down over 40 “laptop farms,” charging 14 individuals, and seizing 187 computers and KVM devices. The operation targeted the Famous Chollima threat group ^[15]^[20].
Law enforcement in 17 countries arrested 95 suspects in an INTERPOL-coordinated operation targeting the distribution of child sexual abuse material ^[16].

Newly Discovered Vulnerabilities

Drupal patched a critical remote code execution flaw in its Field UI module, fixed in versions 11.4.10, 11.3.19, and 10.6.19 ^[4].
Palo Alto Networks released security updates for a high-severity PAN-OS authenticated remote code execution vulnerability (CVE-2026-0322) under active exploitation ^[6]^[19]^[41].
Cisco patched a critical zero-day in Secure Email Gateway that allows unauthenticated attackers to write files and execute commands with root privileges, with evidence of active exploitation ^[12]^[22]^[42].
Langflow, an open-source AI development platform, is being actively exploited via a critical authenticated RCE flaw, with 1,423 honeypot exploit attempts observed ^[10].
AhsayCBS backup software received new security fixes after previously incomplete patches for two flaws that were exploited to deploy web shells and XMRig cryptocurrency miners ^[11].
Ivanti Connect Secure (ICS) is impacted by a high-severity authentication bypass and RCE vulnerability (CVE-2026-104935), exploited as a zero-day. CISA issued a warning for immediate patching, and reports note that the vulnerability was only partially discovered and patched in July ^[26]^[28].
A bug in Anthropic’s Claude Code Desktop ‘SneakPeek’ feature allows silent zero-click credential theft from developers, including SSH private keys and AWS credentials ^[30].

Notable Threat Actor Activity

Multiple phishing campaigns are leveraging AI-themed lures and business-related themes to deliver malware, including the abuse of legitimate RMM tools such as MSP360 ^[2]^[3]^[5].
Attackers exploited a flaw in Nextcloud’s optional Collabora Online - Built-in CODE Server app to backdoor servers with web shells, as reported by administrators ^[13].
The CikaBika Bot RAT, delivered via phishing, uses Discord for command and control, offering reconnaissance, remote execution, and data exfiltration capabilities ^[37].
The novel Android RAT ‘Hirudo’ replaces legitimate banking apps with trojanized versions, combining banking trojan and RAT functionalities ^[38].
Russian actors conducted an AI-enabled influence operation targeting Latin America, using spoofed emails, fake government documents, and the creation of local organizations to target schools ^[31].
Microsoft, in collaboration with global partners, disrupted three phishing kits responsible for over 1 billion scam messages targeting more than 75,000 organizations in 150 countries ^[14]^[25]^[29].

Trends, Tools, or Tactics of Interest

Threat actors are increasingly impersonating popular AI products in malware campaigns to steal browser sessions and compromise business accounts, with over 1,200 public sandbox analyses linked to such activity ^[5].
Citizen Lab published technical evidence of sophisticated mercenary spyware infecting mobile phones via targeted online advertising, demonstrating a zero-click infection vector ^[32].
Researchers warn that small AI models could soon spread autonomously across vulnerable smart devices, highlighting the risk of AI worms ^[49].
AI-powered penetration testing is noted to have blind spots due to safety restrictions and network limitations, leaving some assets and vulnerabilities untested ^[24].
Booz Allen research found that AI agents can rapidly navigate unfamiliar OT systems and reach industrial control networks from a perimeter compromise in just over 16 minutes ^[43].
Picus Security and other sources note the growing use of AI and agentic tools in digital forensics, incident response, and pentesting, though concerns remain about the reliability and validation of AI-generated outputs ^[7]^[24].
The CikaBika Bot RAT’s use of Discord for command and control reflects a continued trend of leveraging legitimate cloud-based services for malicious communications ^[37].
The ‘Hirudo’ Android RAT demonstrates a tactic of replacing installed banking apps with malicious versions to maintain persistence and facilitate credential theft ^[38].

Regulatory or Policy Developments Affecting the Security Industry

The UK government imposed sanctions against Cryptomus, a cryptocurrency platform alleged to facilitate Russian money laundering and ransomware payments ^[33].
The NIS2 Directive holds tens of thousands of European organizations legally accountable for the security of third-party suppliers within their supply chains, regardless of direct control ^[1].
India mandated telecom providers to display registered caller names for all incoming calls on 4G and newer networks starting November 1, 2026 ^[8].

Sources

UK Legal Aid Agency: Hackers stole records dating back to 1978 - bleepingcomputer.com
CenterPoint Energy Data Breach Impacts 1 Million Texans - securityweek.com
GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories - thehackernews.com
Ledger asks sellers across Asia to halt sales after supply-chain attack - bleepingcomputer.com
U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud - thehackernews.com
FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested - bleepingcomputer.com
Police arrests 95 suspects in international CSAM crackdown action - bleepingcomputer.com
Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules - thehackernews.com
Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation - thehackernews.com
Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks - bleepingcomputer.com
Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution - securityweek.com
Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability - thehackernews.com
Cisco patches new Secure Email Gateway zero-day exploited in attacks - bleepingcomputer.com
Cisco Warns of Exploited Secure Email Gateway Vulnerability - securityweek.com
Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts - thehackernews.com
AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches - thehackernews.com
CISA warns admins to immediately fix Ivanti flaw exploited as zero-day - bleepingcomputer.com
Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles - darkreading.com
Anthropic 'SneakPeek' Flaw Is a Silent Zero-Click Threat - darkreading.com
Warning: Phishing Attacks Are Using AI-Themed Ad Lures - blog.knowbe4.com
Business-Themed Phishing Lures Deliver RMM Tools - blog.knowbe4.com
Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early - thehackernews.com
Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App - thehackernews.com
CikaBika Bot RAT Uses Discord for C&C - securityweek.com
Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies - securityweek.com
Russian Influence Operation Widely Targeting Latin America - darkreading.com
Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages - thehackernews.com
Global takedown hits network behind 1 billion phishing messages - bleepingcomputer.com
Yam Store: The Phishing Network Behind a Billion Messages - darkreading.com
‘Nightmare Scenario’: Zero-Click Spyware Is Infecting Phones via Targeted Ads - wired.com
AI worms could spread across your smart devices, Anthropic warns - malwarebytes.com
The Blind Spots of Agentic Pentesting and How to Close Them - bleepingcomputer.com
AI Agents Navigate Unfamiliar OT Systems and Move Equipment in Minutes, Booz Allen Finds - securityweek.com
Why AI Confidence Is Not Validation - thehackernews.com
U.K. Sanctions Cryptomus for RU Money Laundering - krebsonsecurity.com
NIS2 Part One: Why Your NIS2 Supply Chain Strategy Is Already Falling Short - blog.knowbe4.com
India Mandates Registered Caller Name Display on 4G and Newer Networks From November 1 - thehackernews.com

Cybersecurity Brief – 2026-10-01

Thu, 01 Oct 2026 00:00:00 +0000

Major Incidents or Breaches

Cryptocurrency exchange Bitget confirmed that attackers stole $387.5 million by exploiting a zero-day vulnerability in a third-party security product. The investigation is ongoing to determine the full impact and attack vector ^[6].
MetaMask disclosed an ongoing security incident affecting part of its infrastructure, prompting the exit of affected Ethereum validators. The company is actively addressing and remediating the issue ^[7]^[18].
The Pentagon’s Defense Manpower Data Center (DMDC) suffered a breach of its human resources management system, resulting in the theft of personnel records and Social Security numbers of over 3 million military service members and their families ^[17]^[44].
The Dutch Institute for Vulnerability Disclosure (DIVD) reported that its network was breached via a chain of two zero-day vulnerabilities in the open-source Zammad ticketing system, enabling attackers to hijack sessions, achieve remote code execution, and escalate privileges to root ^[20]^[39].
Hackers stole sensitive court records, including more than 150,000 foster care reports, from Arizona courts, raising privacy and safety concerns ^[46].

Newly Discovered Vulnerabilities

Cisco patched a critical authentication bypass vulnerability (CVE-2026-76504) in Catalyst SD-WAN Manager, which was being actively exploited to escalate attacker privileges to administrative level. The flaw has been added to CISA’s Known Exploited Vulnerabilities catalogue ^[3]^[11]^[23]^[41].
Security researchers published a public proof-of-concept for CVE-2026-86950, an Apple CoreGraphics flaw reportedly used in targeted attacks. There is speculation that WhatsApp PDF checks could be a potential delivery method ^[5].
Kiteworks released security updates to address 126 vulnerabilities, including a maximum severity code injection flaw in its Email Protection Gateway (EPG) security solution ^[15].
CISA issued a warning about a critical pre-authentication remote code execution vulnerability in MikroTik RouterOS that could enable attackers to execute code or cause denial-of-service conditions ^[22].
A now-patched Zimbra Collaboration Suite (ZCS) vulnerability (CVE-2026-73570) was exploited in the wild prior to public disclosure. The flaw could be triggered via specially crafted emails without user interaction, allowing attackers to deploy web shells and access mailbox data ^[9]^[36].
Threat actors exploited a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and Gateway, dropping web shells and attempting theft of configuration data ^[8].

Notable Threat Actor Activity

OpenAI disrupted a coordinated campaign linked to Moonshot AI Associates that attempted to illicitly extract protected reasoning from its AI models ^[2].
Russian state actor Star Blizzard deployed a new technique dubbed “RedFlick” to install the CosmicPulse backdoor via phishing against Ukrainian-linked targets, including NGOs, think tanks, and journalists. This marks a shift away from previous ClickFix tactics ^[19]^[28].
Threat actors abused ChatGPT Custom GPTs, disguising them as legitimate offerings to lure victims to malicious sites using ClickFix-style lures and deliver remote access trojans (RATs) ^[12]^[25].
Microsoft reported phishing campaigns distributing MSP360 Remote Monitoring and Management (RMM) installers, which then deploy ScreenConnect in dual-RMM attacks. These campaigns use meeting invitations and PDF-themed lures to trick users ^[10]^[30].
The Warlock ransomware group, believed to be Chinese and exhibiting both cybercrime and APT characteristics, targeted large organizations in Spain and Portugal ^[24].
Police, through Operation KillSwitch, dismantled the KillSec ransomware gang, seized its leak site and servers, and arrested three individuals, including the alleged 16-year-old leader. At least 110 terabytes of stolen victim data was secured ^[13]^[34].

Trends, Tools, or Tactics of Interest

Over 543,000 valid credentials were found exposed in public GitHub repositories as of July, despite platform security measures. Approximately 200,000 of these credentials were exposed after GitHub enabled push protections by default ^[21]^[40].
AI is accelerating both vulnerability discovery and exploitation, increasing the speed of attacks, while defensive fundamentals such as defense-in-depth remain critical ^[35].
AI is reshaping the Security Operations Center (SOC) career ladder. While 91 percent of security professionals report increased satisfaction due to AI-driven detection and response, nearly half find entry into the field more difficult, and one in four say AI limits skill development ^[27].
Enterprises are struggling to prepare for AI and quantum threats, with only 22 percent of leaders open to fully autonomous AI for cyber defense and just 21 percent implementing quantum-resistant security measures ^[33].

Regulatory or Policy Developments Affecting the Security Industry

The US Treasury blacklisted the most-wanted ATM malware developer and his network, continuing efforts to disrupt the Tren de Aragua ATM jackpotting scheme ^[38].
The White House announced a voluntary AI safety accord with major technology companies, including new controls and oversight requirements for “Super Intelligence” systems ^[26].

Sources

Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft - thehackernews.com
MetaMask Security Incident Prompts Exit of Affected Ethereum Validators - thehackernews.com
Metamask discloses security incident affecting its infrastructure - bleepingcomputer.com
Hackers stole Pentagon personnel records of over 3 million people - bleepingcomputer.com
Pentagon breach exposes Social Security numbers and military records of millions - malwarebytes.com
DIVD says Zammad zero-days enabled AI-driven network breach - bleepingcomputer.com
Zammad Zero-Days Exploited in AI-Powered DIVD Hack - securityweek.com
Hackers steal protective order and foster care records from Arizona courts - malwarebytes.com
CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV - thehackernews.com
Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager - thehackernews.com
Cisco warns of new SD-WAN zero-day exploited in attacks - bleepingcomputer.com
Cisco Patches Exploited Catalyst SD-WAN Zero-Day Vulnerability - securityweek.com
Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path - thehackernews.com
Kiteworks patches max severity code injection vulnerability - bleepingcomputer.com
CISA warns of critical pre-auth RCE flaw in MikroTik RouterOS - bleepingcomputer.com
Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets - thehackernews.com
Zimbra Vulnerability Exploited in the Wild Prior to Public Disclosure - securityweek.com
Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs - thehackernews.com
OpenAI Disrupts Reasoning Extraction Campaign Linked to Moonshot AI Associates - thehackernews.com
Russian state hackers use new RedFlick technique to push malware - bleepingcomputer.com
Russia's Star Blizzard Ditches ClickFix to Widen Phishing Net - darkreading.com
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures - thehackernews.com
Malicious Custom GPTs Turn ChatGPT Into RAT Delivery Lure - darkreading.com
Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks - thehackernews.com
ScreenConnect Client (Ab)used by Attackers, (Thu, Oct 1st) - isc.sans.edu
Warlock Ransomware Hits Large Spanish, Portuguese Orgs - darkreading.com
Police dismantle KillSec ransomware gang allegedly led by 16-year-old - bleepingcomputer.com
Police Shut Down KillSec Ransomware, Identify Alleged Teen Leader - securityweek.com
Over 543,000 valid credentials exposed in public GitHub repositories - bleepingcomputer.com
500,000 Active Credentials Left Exposed on GitHub - securityweek.com
AI Has Changed Attack Speed, Not Security Fundamentals - securityweek.com
As AI Reshapes the SOC Career Ladder, Satisfaction Rises for 91%, but Entry Gets Harder for Nearly Half - darkreading.com
Enterprises Struggle to Prepare for AI and Quantum Threats, PwC Says - securityweek.com
Treasury Blacklists Most-Wanted ATM Malware Developer and His Network - securityweek.com
Trump, Tech Giants Strike Voluntary AI Safety Accord - darkreading.com