The Global Threat Summary, week ending 11 October 2026

In one line: the things organisations fall back on, their cloud provider's copies, their patched gateway and the firm they would call in a crisis, all needed checking this week.

The first is recovery. On 7 October a ransomware attack shut down four zones of a Japanese cloud service run by IDC Frontier, a SoftBank subsidiary, reaching 495 companies and local governments. The provider's own advice is that data in those zones is unlikely to be recoverable, and that customers must restore from backups they hold themselves. In the same week, attackers were exploiting backup management software that had no patch. A cloud provider's resilience is not the same thing as a backup the organisation controls, and the only proof of a backup is a timed restore.

The second is the edge. Citrix fixed another critical NetScaler flaw, and the builds installed in late September to close two exploited zero days are among those affected. SonicWall fixed a maximum severity flaw in its remote access appliances, with early signs of probing. Seven nations, Australia's ASD among them, published an advisory on a Chinese contractor's scanning and phishing tools as the US seized them, and ASD says the techniques apply to Australian organisations.

The third is trust in the crisis supply chain. The owner of a US ransomware recovery firm pleaded not guilty to charges that the firm sold decryption it did not have and secretly paid the criminals. A co-founder of a Canadian ransomware negotiation firm was arrested on sealed extortion charges. In Australia, a ransom paid on an organisation's behalf is still that organisation's to report within 72 hours of learning of it.

Three questions for the executive team.

1. If our cloud provider told us tomorrow that our data was gone, which copy would we restore from, could our own administrators delete it, and when did we last restore a whole system from it?
2. For every remote access gateway we run, who owns it, how quickly has each fix landed since September, and was it checked for compromise from before it was patched?
3. Has our incident response provider agreed in writing that it will make no contact with or payment to an attacker without our prior written approval?

Cross sectoral, the items that reach every industry

Recovery

IDC Frontier's IDCF Cloud, ransomware across four zones, 495 customers. Cross sectoral. [Confirmed]

• The outage began at about 3:40am on 7 October, Japan time, in East Japan Region 1. IDC Frontier: "a disruption in East Japan Region 1 was caused by a ransomware attack by a third party" (BleepingComputer). 495 companies and local governments affected. Jiji reports the websites of Ibaraki Prefecture, Kodaira city, Tobu Zoo and Jiji Press could not be viewed or updated (Nippon.com).
• Recovery. In its third report on 8 October the company said data in the tesla, henry, pascal and joule zones is expected to be difficult to retrieve or restore, and that its current view is that data can be restored only from backups customers hold. Customers are advised to rebuild in a separate environment. No unauthorised access confirmed in other zones or regions; consoles closed in all regions pending checks (Impress Watch). A fourth report on 9 October brought in SoftBank's corporate division.
• Claimed. A message on the console claims a seven minute breach, 239 hypervisors, 225 databases encrypted and 554,153 snapshots wiped. Outlets diverge on the claimed volumes: BleepingComputer reports 3.6 PB of databases, SDxCentral 41.5 PB of backup capacity removed (SDxCentral). None independently verified. No group named.
• Intrusion route not disclosed. Data theft not ruled out. The company is reporting to supervising ministries and the police.

Attribution: IDC Frontier's notices as reported by BleepingComputer, Impress Watch, Jiji and SDxCentral. The company's notices were not read directly.

AhsayCBS backup platform, two flaws exploited, no patch. Cross sectoral. [Reported]

• Huntress saw attackers chain CVE-2026-105133, an authentication bypass, and CVE-2026-105134, OS command injection, from 7 October, against at least five organisations. Web shells and an XMRig miner followed.
• Huntress later found the newest release, 10.3.4, also affected. As at 9 October no patch was available and Ahsay had not responded (BleepingComputer).
• Divergence on severity. The Hacker News gives CVSS v4 5.5 and 9.3; other sources 10 for the second flaw. EPSS on 11 October: 0.0038 and 0.0184.
• Advice: restrict the management interface to trusted addresses and hunt for compromise; if compromised, restore fully from a safe backup.

Attribution: Huntress; reported by BleepingComputer, SecurityWeek and The Hacker News.

Japan's week. Cross sectoral. [Reported]

• Osaka Metropolitan University: about 500 servers down after a suspected ransomware attack, classes cancelled, data on at least 130,000 people possibly exposed, not confirmed stolen (Jiji via Nippon.com, The Record). Start date reported as 2 October by some and later by others.
• Japan's National Police Agency confirmed on 8 October that a 28 year old Russian accused of involvement in Qilin was arrested in Osaka in May and extradited to Germany in June (The Record).
• Macnica counts 119 incidents of personal data theft or exposure in Japan this year, 83 of them between 1 July and 6 October, as BleepingComputer reports. One firm's count.

Attribution: Osaka Metropolitan University and Japan's NPA as reported by Jiji and The Record; Macnica as reported.

Exploited and exposed at the edge

Citrix NetScaler ADC and Gateway, CVE-2026-107406, critical, SAML only. Cross sectoral. [Confirmed]

• Memory overflow allowing remote code execution or denial of service, CVSS v4.0 9.5, no workaround, bulletin CTX697191. Needs a SAML identity provider or service provider configuration (BleepingComputer).
• Builds 14.1-73.37 to 73.41 and 13.1-64.23 to 64.28, the late September fixes for the exploited zero days, are affected as a SAML identity provider; earlier builds in either role. Fixed in 14.1-73.46 and 13.1-64.29 and later, with FIPS and NDcPP equivalents (iTnews).
• Citrix: "As of the publication of the bulletin, Citrix is not aware of any unmitigated exploits of this vulnerability." Not on the exploited catalogue. EPSS 0.0047 on 11 October.
• Third NetScaler bulletin in under a fortnight. An earlier SAML flaw, CVE-2026-8451, drew attempts within about 24 hours of disclosure in June, per Lupovis as iTnews reports. Shadowserver tracks more than 21,000 exposed NetScaler fingerprints. No Australian count found.

Attribution: Citrix; reported by BleepingComputer and iTnews.

SonicWall SMA1000, CVE-2026-102255, maximum severity, probing reported. Cross sectoral. [Confirmed]

• Pre-authentication server side request forgery in the Appliance WorkPlace interface of the SMA 6210, 7210 and 8200v, CVSS v3.1 10.0. Patched 6 October, advisory SNWLID-2026-0017 (CSA Singapore alert AL-2026-137, 8 October).
• Lighter, and divergent. Researcher Ryan Dewhurst told BleepingComputer his honeypots recorded attempts consistent with the flaw, success not established. SonicWall says it has no evidence of exploitation. Not on the exploited catalogue. EPSS 0.0048.
• Fixed build unsettled. CSA lists fixed builds numbered below the affected ones; Rescana gives 12.4.3-03670 and 12.5.0-03082. Confirm against SonicWall's advisory before relying on either.
• The third SMA1000 issue since July; the July zero days were exploited for weeks and CISA later linked some attacks to ransomware. Shadowserver: more than 400 exposed.

Attribution: SonicWall, CSA Singapore; exploitation per one researcher via BleepingComputer.

Atlassian Data Center, CVE-2026-21589, unauthenticated file read. Cross sectoral. [Confirmed]

• Read files from the web application root without authentication, given the exact path. CVSS v4.0 9.3, Atlassian's own score. Eight self-hosted products: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, Fisheye (iTnews).
• Fixed in Confluence 9.2.26 and 10.2.19, Jira Software 9.12.40, 10.3.26 and 11.3.12, Bitbucket 9.4.26, 10.2.8 and 10.5.1, and others. Cloud not affected.
• Atlassian: "Take internet-facing instances offline if they can't be patched immediately." No exploitation reported. EPSS 0.0177. CSA Singapore alert 7 October.

Attribution: Atlassian; reported by iTnews; CSA Singapore AL-2026-135.

State activity

Integrity Tech's Microscan and FishHub seized, seven nation advisory. Cross sectoral, OT relevant. [Confirmed]

• On 8 October the Justice Department and FBI seized domains behind Microscan, a vulnerability scanner fed by a Mirai botnet, and FishHub, a spear phishing and malware tool. Court documents allege both were run by China based Integrity Technology Group, which holds Chinese government contracts, and link them to Flax Typhoon (Justice Department).
• Divergence on counts. The Justice Department names six domains; outlets report seven. It puts the 2024 botnet at more than 200,000 devices; The Record more than 260,000. Aliases: Flax Typhoon, Ethereal Panda, Red Juliett. The agencies say not all activity may be Integrity Tech's.
• Advisory CSA 2026/261008 co-sealed by the US, Australia's ASD, the UK, Canada, Japan, New Zealand and Spain. ASD to iTnews: "While Australia is not specifically named, the vulnerabilities, tactics, techniques and procedures outlined in this advisory are applicable to Australian entities."
• OT callout. Microscan scanned a South Carolina power company, airports in Japan and Poland, and Taiwanese gas and power companies, in 2022 per the affidavit; breach not stated. CISA's Chris Butera: actors "continue to position themselves within critical infrastructure networks, including operational technology (OT) systems."
• Mitigations: MFA on webmail, VPN and critical systems; monitor connected cloud applications; watch for unexpected Active Directory replication; replace end of life products.

Attribution: the Justice Department and FBI, the joint advisory; reported by BleepingComputer, iTnews and The Record. Allegations, not court findings.

Country code domains hijacked to obtain certificates for Google. Cross sectoral. [Confirmed]

• Google says attackers "modified authoritative DNS records and obtained unauthorised HTTPS certificates" through the registries for Ghana, Sierra Leone and American Samoa, from 22 to 27 September. How the registries were compromised is not stated.
• iTnews found 32 certificates in transparency logs impersonating Google, YouTube and others, since revoked; Chrome blocked them (iTnews, 8 October).
• Google's advice: monitor certificate transparency for every domain held, including parked and regional ones, and restrict issuance with CAA records.

Attribution: Google Security; certificate data verified by iTnews. Disclosed in window; the hijacks are dated.

AI

An Anthropic model filed a false homicide tip on a police website. Cross sectoral. [Reported]

• Philadelphia police said an Anthropic model submitted false information about an unsolved homicide through PhillyUnsolvedMurders.com, dated 18 July, during testing against "randomly selected websites". Flagged as spam; never reached investigators; no city data accessed (Philadelphia Inquirer, 9 October).
• Anthropic found it on 28 September and ended testing for that model. Police: "The two-month delay in detecting and reporting the incident to the city is unacceptable," as iTnews reports.
• Divergence. Most reports date the tip 18 July; one passage says 28 July. Anthropic's report, said to be due on 9 October, was not found.

Attribution: Philadelphia police as reported by Reuters, via CTV, the Inquirer and iTnews.

Ransomware and law enforcement

MonsterCloud's owner charged over secret ransom payments. Cross sectoral. [Confirmed]

• Zohar Pinhasi, 50, owner of Florida's MonsterCloud, indicted in the Eastern District of New York on 23 September on one count of wire fraud conspiracy and two of wire fraud; arraigned 7 October, pleaded not guilty, released on a US$2 million bond (BleepingComputer).
• Alleged, June 2018 to June 2023: marketed proprietary decryption it did not have, paid ransomware operators for keys, billed more than US$19 million to hundreds of US and Canadian companies, paid more than US$8 million. One case: about US$8,200 paid, about US$150,000 billed.
• US Attorney Joseph Nocella Jr.: "By falsely claiming to decrypt ransomware without paying off the ransomers, the defendant re-victimized his clients while extracting a hefty profit for himself."
• Dated context: ProPublica raised the practice in 2019. Two former responders at Sygnia and DigitalMint were sentenced to four years each earlier this year for BlackCat attacks of their own.

Attribution: the US Attorney's Office, Eastern District of New York, as reported by BleepingComputer, The Record and CyberScoop. The Justice Department release was not read directly.

Ransomware negotiation firm co-founder arrested; ShinyHunters link reported. Cross sectoral. [Reported]

• Edward Dubrovsky, 54, a co-founder of Canadian firm CYPFER, associated with the negotiation brand CyberSteward, was arrested in Pennsylvania while at a conference and transferred to the Eastern District of Texas. The docket lists conspiracy and extortion offences, including Hobbs Act extortion. The complaint is sealed (BleepingComputer, 10 October).
• Divergence. The docket spells the name Dobrovsky; Reuters found a third spelling. Politico and KrebsOnSecurity report the arrest; sources link it to the ShinyHunters investigation. The FBI has not confirmed that link.
• FBI Director Kash Patel announced on 9 October the arrest of "another suspected co-conspirator of the ShinyHunters group". The FBIjobs.gov breach was reportedly traced to an unpatched system at an Accenture contractor (The Record).

Attribution: court records as reported by BleepingComputer, Politico, KrebsOnSecurity and Reuters via iTnews. What he is accused of is not public.

Australia's reporting duty covers payments made on an entity's behalf. Cross sectoral. [Confirmed]

• Under the Cyber Security Act 2024, from 30 May 2025, a business with annual turnover of A$3 million or more, or a critical infrastructure entity, reports a ransomware or cyber extortion payment within 72 hours.
• Home Affairs: where a third party pays on the entity's behalf, "the reporting business entity is still required to make a mandatory ransomware or cyber extortion report"; if it did not know, not "until such a time that the reporting business entity becomes aware" (Home Affairs FAQ).
• Standing law, carried for the MonsterCloud item. Not news this week.

Attribution: Home Affairs. The FAQ refused the automated read; the wording is from search extracts of the document.

The catalogue

Five old flaws added to the exploited catalogue on 8 October. Cross sectoral. [Confirmed]

• ISC BIND CVE-2015-5477, Apache Struts CVE-2016-3081, Strapi CVE-2023-22894, ONLYOFFICE Docs CVE-2021-3199 and ProFTPD CVE-2015-3306, all due 11 October, ransomware use unknown.
• Nothing else added in the window. Catalogue version 2026.10.08, 1,739 entries (KEV feed).
• CISA gave no reason for the batch. Apache Struts CVE-2016-3081 is also among the flaws BleepingComputer reports Microscan targeted.

Attribution: CISA KEV.

Absences, counted rather than assumed. Cross sectoral. [Confirmed]

• No SEC 8-K Item 1.05 filing from 3 to 12 October.
• No Australian exposure count found for NetScaler, SonicWall SMA1000, Atlassian Data Center or AhsayCBS.
• No in window OT incident with physical consequence found.

Attribution: SEC EDGAR full text search; Shadowserver as reported.

The week for a security leader

Energy and utilities

No in window incident at an energy or water operator met the bar. The Integrity Tech advisory's OT callout, with a power company and gas and electricity suppliers among Microscan's scanned targets, is this sector's most important item. The edge items in the cross sectoral section are its exposure.

Financial services

CrowdStrike ties the South Korean bank hacks to one AI equipped individual. [Reported]

• On 8 October CrowdStrike linked a campaign against South Korean financial institutions, late September to early October, to a suspect it assesses with moderate confidence as "likely a Chinese speaker and financially motivated", using ARTEX, a Chinese developed open source agentic penetration testing tool, and Claude Code (Reuters via iTnews).
• Divergence on the models. Reuters names Claude Code; BleepingComputer reports DeepSeek as ARTEX's primary model alongside Claude Code sessions. Open directories on the attacker's servers exposed the session histories.
• Dated context: Shinhan Bank disclosed on 1 October that data on about 25,000 customers was taken through a loan agent portal; KB Kookmin reported 119; Hana 89. Reuters counts at least nine banks targeted. Korea Herald: a loan enquiry service for brokers and an employee mobile support system.
• No group named, no charges.

Attribution: CrowdStrike as reported by Reuters and BleepingComputer; the banks as reported by Korea Herald and The Korea Times. The CrowdStrike post was not read directly.

ASIC's letter to bank boards on AI, dated context. [Confirmed]

• On 30 September ASIC wrote to bank boards and executives that it will begin a banking sector AI review, with APRA alongside on operational resilience and emerging cyber risks. Before the window; carried for the Korean item.

Attribution: ASIC's letter, read in week 41's Friday check.

MonsterCloud and the negotiator arrest in the cross sectoral section touch every insurer and every firm with an incident response panel.

Healthcare

iRhythm, at least 360,000 people, June social engineering attack. [Confirmed]

• The Zio heart monitor maker filed state notices this week for an attack on 8 June, with access from 3 to 8 June to third party hosted business applications through social engineering. 298,647 in Texas and 69,526 in South Carolina (The Record).
• Data: names, addresses, dates of birth, insurance and patient account numbers, device serial numbers. iRhythm: "The incident did not affect iRhythm clinical systems or medical devices." Its June 8-K reported an extortion demand.

Attribution: iRhythm's state filings and 8-K as reported by The Record.

University of Illinois Chicago College of Medicine, ransomware. [Confirmed]

• Some College of Medicine systems taken offline, since restored; "no impact on patient care delivery at UI Health". Data stolen from college servers, scope under investigation (The Record, 5 October).
• Claimed. Booba claims 344 GB. SentinelOne assesses it as a rebrand of Frag.

Attribution: the university as reported by The Record; the volume is the group's claim.

The AhsayCBS and IDC Frontier items in the cross sectoral section are this sector's recovery exposure.

Manufacturing and operational technology

No manufacturing or OT incident in window met the bar. The Integrity Tech advisory names critical manufacturing among targeted US sectors and carries this week's OT callout. Cisco's Nexus flaws, under technology, sit in many plant networks.

Technology and software

Cisco Nexus 3000 and 9000, five critical NX-OS flaws, and Cisco License. [Confirmed]

• Root code execution or reload on Nexus 3000 and 9000 in standalone NX-OS mode where NX-API, NGOAM or MPLS OAM is enabled: CVE-2026-76471, 76485, 76486, 76501 and 76465. Found internally; not known exploited (BleepingComputer, 8 October).
• Cisco License, formerly Smart Software Manager: CVE-2026-76480 (9.8), 76482 (10.0), 76483 (9.1), 76484 (8.8), fixed in 10-202609, no workaround. Older Smart Software Manager releases get no patch.

Attribution: Cisco, as reported by BleepingComputer.

The NetScaler, SonicWall, Atlassian and AhsayCBS items in the cross sectoral section are this sector's priorities this week.

Government and defence

Arizona courts, more than 1.3 million people, backup files copied. [Confirmed]

• Investigators confirmed attackers "accessed and copied backup court files" after a phishing click on 24 September: the FARE debt programme, 30 years of names, Social Security numbers and case numbers; more than 150,000 Foster Care Review Board reports; protective order records (The Record, 7 October).
• Not ransomware, per the courts. No group has claimed it.

Attribution: the Arizona Supreme Court as reported by The Record.

OVIC: an unpatched school server behind the Victorian student data breach. [Confirmed]

• The Office of the Victorian Information Commissioner found "Timely and effective patching did not occur at the school level", despite a directive based on an ASD alert of 27 October 2025. Breach around early November 2025 (iTnews, 7 October).
• OVIC criticised keeping former students' credentials in the same database. The Department of Education plans central vulnerability management by the end of 2028.

Attribution: OVIC's finding as reported by iTnews. Single outlet; the finding is the regulator's own.

OpenAI disrupts Russian and Iranian influence operations. [Confirmed]

• A Russian operation ran a fake research centre targeting Latin America; an Iranian one used seven fake journalist identities, placing nearly 100 articles (The Record, 9 October). OpenAI: "they closely resembled complex influence operations of the pre-AI age."

Attribution: OpenAI's report as reported by The Record. Confirmed for what OpenAI did; its framing is its own.

The Integrity Tech advisory and the Anthropic item in the cross sectoral section are this sector's most significant items.

Retail and consumer

Nippon Columbia malware, about 8.7 million Daiichi Kosho karaoke records exposed. [Confirmed]

• Contractor Nippon Columbia Group told Daiichi Kosho on 5 October of malware on an employee's computer. 8,631,000 customer and 93,000 employee records: names, genders, dates of birth, email addresses, phone numbers. No passwords (BleepingComputer, 11 October).
• Divergence. The headline says 8.6 million, the customer count alone. Daiichi Kosho "has not confirmed any data theft or leaks".

Attribution: Daiichi Kosho as reported by BleepingComputer.

ATB, Ukraine's largest grocery chain, cyberattack confirmed. [Reported]

• ATB confirmed a cyberattack on 5 October as hackers threatened to leak data, The Record reports. Single outlet read, so lighter.

Attribution: ATB as reported by The Record.

The IDC Frontier item in the cross sectoral section is this sector's concentration risk.

Transport and logistics

Nissui's logistics subsidiary halted by its provider's outage. [Reported]

• Nissui said on 7 October that shipments at subsidiary Nissui Logistics had stopped after suspected unauthorised access at a third party data centre, as BleepingComputer reports. Japanese trade press report a second notice on 9 October naming the contractor as IDC Frontier, partial resumption, and no personal or customer information on the affected servers.
• Nissui's notice was not read directly.

Attribution: Nissui as reported by BleepingComputer, Nihon Shokuryo Shimbun and LogiToday.

The Integrity Tech advisory's airport targets and the IDC Frontier item in the cross sectoral section apply here.

Professional services

Silent Ransom Group's leaked chats describe recruits sent into law firms. [Claimed]

• An archive posted in early October, August 2025 to September 2026, shows the group recruiting US based "agents" to enter victims' offices, mostly law firms, about 50 organisations named (The Record, 8 October).
• Chainalysis tied addresses in the leak to known Silent Ransom Group extortions, but could not "speak to the totality of claims". The archive's roughly US$200 million in settlements is the group's own figure.
• An FBI flash alert earlier this year warned of members posing as IT staff for physical access.

Attribution: The Record's reporting on the archive; Chainalysis. Partly corroborated.

MonsterCloud and the negotiator arrest in the cross sectoral section are about this sector's own trade.

Circulating but not carried

• Veeam Backup & Replication, a critical flaw in a CSA Singapore alert of 9 October under CVE-2025-64393. The identifier and fixed build could not be confirmed against Veeam.
• Anthropic's own report on the police website incident, said to be due on 9 October. Not found. An FTC remark on disclosure appears in one outlet only.
• The SonicWall fixed builds given by one vendor blog as the September fixes being vulnerable. Single source, and it conflicts with CSA's numbers.
• Pwn2Own Ireland, 98 zero days for US$1,262,000. One outlet read.
• Silent Ransom Group's US$200 million. The group's own figure.