Entrar
The Cyber Express Weekly Roundup: FBI Blames North Korea for $6B Binance Hack, Hackers Turn Up the Heat on Europe’s Fridges and More
Visualização de leitura
Ransomware Just Took New York’s Queens Library Offline, and It’s Not the First
What the Queens Public Library Ransomware Attack Shut Down
In a statement on Instagram, the library described a network outage affecting every location. All branches remain open on schedule, but several services are unavailable:- The library website, queenslibrary.org
- On-site computers
- Check-out and return machines
- Free Wi-Fi access
- The QPL mobile app
- Digital services, including digital media
Image source- Instagram[/caption]
Some virtual and in-person programmes may also be affected, and the library has asked visitors to check with their local branch. Renewals are unavailable during the outage. The library reminded customers that it does not charge late fines on borrowed materials.
"Our IT department is working to resolve the issue, and we will keep you informed," the library said, adding that people can call (718) 990-0728 for help.
When The Cyber Express tried to access the library's official website, it would not load and displayed the message "This site can't be reached." The Cyber Express reached out to the library for more information but had not received a response at the time of writing.
Why the Impact Reaches So Far
The scale of the system explains why an outage here matters. Queens Public Library is one of the largest library systems in the country, offering free access to more than 5 million books in 50 languages. Its reach also goes beyond its branches. It runs dozens of learning centres in public housing complexes across the borough, along with several mobile libraries. When on-site computers, free Wi-Fi and the website all go down at once, the services people come to a library for, beyond borrowing books, stop working too.Libraries Have Been Hit Before
The Queens Public Library ransomware attack follows a series of incidents at other libraries, and the pattern of disruption looks familiar. In 2024, the Seattle Public Library faced a ransomware attack that crippled its computer systems. On May 28, libraries across South Seattle were noticeably quiet, with signs telling patrons that all computer services were down. That included computer terminals, printing and in-building Wi-Fi, which many library users rely on. In December 2023, officials confirmed that a cyberattack was behind branch closures and service disruptions at the London Public Library. Three of its sixteen branches, Carpenter, Lambeth and Glanworth, were closed until January 2. The library said it experienced a systems outage early on December 13, 2023, and that cybersecurity experts were engaged immediately. It worked with a third-party security firm to repair the damage. In October 2023, the British Library faced a major outage that first looked like a technical glitch but quickly grew into a widespread disruption. It affected online systems, including the website, and onsite services such as public Wi-Fi and phone lines. Across all four cases, the same things tend to go dark: public computers, Wi-Fi and websites. Each library cyberattack shows how much everyday library services now depend on networks that can be taken down in one go.What Is Still Unknown About the Queens Public Library Ransomware Attack
Several key questions remain open. No ransomware gang has claimed responsibility, so it is not known who is behind the attack. The library has not said when services will be restored, whether any data was taken, or whether a ransom has been demanded. For now, the library's IT team is working on the issue, and updates are being shared through its social media channels.
Ransomware Attacks on Hospitals and Businesses Lead to 70-Month Sentence
A Ukrainian ransomware affiliate has been sentenced to 70 months in prison for participating in cyberattacks against hospitals, businesses, law firms and government entities across multiple countries. Artem Stryzhak, 36, was sentenced in the United States for his role in ransomware conspiracies linked to more than $100 million in losses, according to the U.S. Department of Justice (DOJ).
Stryzhak worked with the Nefilim ransomware and Hive ransomware groups, targeting computer networks and disrupting operations across different sectors. The attacks included incidents affecting healthcare providers during the COVID-19 pandemic, when hospitals faced disruptions to their ability to access digital systems and treat patients.
Ukrainian Ransomware Affiliate Linked to Two Groups
According to court documents, Stryzhak joined the Nefilim ransomware operation around June 2021 as an affiliate. He received access to the group's ransomware under an arrangement with administrator Volodymyr Tymoshchuk and agreed to pay the administrators 20% of the ransom proceeds collected from victims. One documented attack took place in June 2021, when Stryzhak stole data from a company operating in the oil and gas transportation industry. About a week later, he created email addresses that were incorporated into a ransom note sent to the company. The attackers used ransomware to encrypt victims' files and demanded payment. If a victim paid, the perpetrators provided a decryption key to restore access to the locked data. Stryzhak remained involved in the Nefilim conspiracy until at least October 2021, court records state. He separately joined the Hive ransomware group as one of its earliest affiliates. Between June 2021 and January 2023, Hive conspirators attacked approximately 1,500 victims worldwide, including government entities, hospitals and businesses.Hive Ransomware Attacks Disrupted Hospital Operations
The Hive ransomware operation caused significant disruption to organizations, including healthcare facilities responding to the COVID-19 pandemic. According to the DOJ, one hospital targeted by the group had to stop relying on digital technology to treat existing patients and was temporarily unable to accept new patients immediately following the attack. As a Hive affiliate, Stryzhak and his co-conspirators deployed ransomware against seven victims. These included law firms, a dental office and a healthcare provider during the pandemic. The attacks left victims unable to access encrypted data, affecting their day-to-day operations. The FBI had previously conducted a months-long disruption campaign against Hive. During that effort, investigators obtained a decryption key and provided it to one of Stryzhak's victims, enabling the organization to recover its encrypted data without paying a ransom.FBI Investigation Spanned Multiple Countries
The investigation involved several FBI field offices and international law enforcement partners. The FBI Springfield Field Office investigated the Nefilim ransomware case, while the FBI Tampa Field Office investigated the Hive operation. The FBI's New York Field Office, the Justice Department's Office of International Affairs and Spanish law enforcement authorities also assisted in locating, arresting and extraditing Stryzhak. He was arrested in Spain in June 2024 and extradited to the United States in April 2025. In December 2025, he pleaded guilty to two counts of conspiracy involving fraud, extortion and related activity connected to computers. The sentence follows a broader effort by U.S. authorities to pursue ransomware affiliates and their associates, including individuals operating outside the country.$11 Million Reward Offered for Co-Conspirator
Authorities are continuing to seek Volodymyr Viktorovych Tymoshchuk, identified by prosecutors as Stryzhak's co-conspirator and a ransomware developer. The U.S. Department of State's Transnational Organized Crime Rewards Program is offering up to $11 million for information leading to Tymoshchuk's arrest and/or conviction or location. Individuals with information can contact the FBI at +1-917-242-1407, email TymoTips@fbi.gov, contact a local FBI field office in the United States or approach the nearest U.S. Embassy overseas. The DOJ's Computer Crime and Intellectual Property Section, which investigates and prosecutes cybercrime in coordination with domestic and international partners, has secured more than 180 convictions involving cybercrime and intellectual property offenses since 2020. The department also reports obtaining court orders for the return of more than $350 million in victim funds during that period. Stryzhak's sentence highlights the consequences for individuals who participate in ransomware operations that target critical services and businesses. The investigation into his alleged co-conspirators remains ongoing.
Australian Data Breach Incidents Up 66% as AI Sharpens Scams
Australians filed a cybercrime report about every six minutes over the past year, and artificial intelligence is making the attacks behind those reports faster and more convincing. That is the main finding of the ASD Cyber Threat Report 2025-26. It is the seventh annual assessment from the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC).
In FY2025-26, the agency received more than 82,000 cybercrime reports through ReportCyber. It responded to over 1,500 cyber security incidents, up more than 20% on the previous year and 36% over five years. It also notified Australian entities of potentially malicious activity more than 4,400 times, almost 80% more than in FY2024-25.
What the ASD Cyber Threat Report Says About AI
The report calls AI the defining force in the threat environment this year. In his foreword, Deputy Prime Minister and Defence Minister Richard Marles wrote that AI is helping malicious actors find vulnerabilities faster and exploit them at greater scale, speed and sophistication. He also noted that new threats have emerged in recent weeks from the unintended actions of AI agents and from model testing.
ASD’s ACSC makes one clear distinction. AI has not created new kinds of threats. It has amplified and sped up existing ones. AI-enabled cyber threats are most visible in social engineering. Attackers are using AI to write phishing emails with no spelling or grammar errors and to automate targeted spearphishing. The Australian Securities and Investments Commission has also seen a sharp rise in scams that use deepfake videos of celebrities and politicians.
The time defenders have to respond is also shrinking. The agency has previously observed that most vulnerabilities are exploited within two weeks, and some within 48 hours of a patch being released. It expects AI-driven tools to shorten that window further over the next 12 months. Publicly reported vulnerabilities (CVEs) rose 30%. Old flaws are still a problem too: ASD’s ACSC recorded the successful exploitation of a vulnerability first identified in 2008.
Incident Severity Grows in ASD Cyber Threat Report Data
Only one Category 2 incident was recorded this year. However, extensive compromises rose from 26 to 40. ASD’s ACSC identified 362 incidents after proactively notifying organisations. A single notification about cPanel vulnerabilities, sent to 340 entities in May 2026, led to more than 60 confirmed incidents.
The number of ransomware incidents held steady at 139, but extensive ransomware incidents rose from 16 to 24. Health Care, Professional, Scientific and Technical Services, and Manufacturing remained the most affected sectors. Data breaches made up 98 incidents, a 66% increase on the previous year. Separately, the Office of the Australian Information Commissioner received 1,205 breach notifications in 2025. That is the highest yearly total since its Notifiable Data Breaches scheme began in 2018.
The financial impact is rising for businesses. The average self-reported cost of cybercrime per business report rose 16% to $93,500. For medium-sized businesses, it rose 45% to $141,300. The average cost for individuals stayed at $33,000. Identity fraud remained the most reported cybercrime, although reports fell 18%.
Stolen access is now a major entry point. Compromised accounts and credentials were among the most frequently reported incident categories, and phishing appeared in 39% of incidents. Government survey research cited in the report found that 55% of Australians reuse passwords across multiple accounts.
State Actors and Critical Infrastructure in the ASD Cyber Threat Report
State-sponsored actors continued to target Australian government, business and individuals to gain sensitive information. The report says these actors are increasingly pre-positioning inside networks to enable future disruption. Marles wrote that the line separating state-sponsored espionage from sabotage and cybercrime is becoming increasingly blurred.
In April 2026, ASD’s ACSC and international partners highlighted a shift by China-nexus actors. These actors are moving towards large covert networks built from compromised home and small office routers, Internet of Things devices and smart devices.
Critical infrastructure accounted for 154 incidents, or 10% of the total, a decrease of almost 7%. Phishing was the leading initial access technique at 36%, and Financial and Insurance Services was the most affected critical infrastructure division at 30%.
What the Threat Report Asks Organisations to Do
In October 2026, ASD’s ACSC released the Essentials series. It evolves the Essential Eight into a principles-based framework with three chapters: Enterprise IT, Operational Technology and Cloud.
Under its Cyber Action Year, the agency is pushing five priorities:
- Replacing or mitigating legacy technology.
- Implementing best-practice event logging.
- Managing supply chain risk.
- Preparing for AI-enabled threats.
- Preparing for post-quantum cryptography, including ceasing the use of traditional asymmetric cryptography by the end of 2030 or sooner.
The report also urges organisations to patch faster. For individuals, it recommends reviewing privacy settings and enabling multi-factor authentication or passkeys.
Suspicious activity, incidents and vulnerabilities can be reported at cyber.gov.au or through the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371).
The Cyber Express Weekly Roundup: PHP2Shell Knocks Wikipedia Offline, ASD Retires the Essential Eight and More
A decade-old flaw in the language behind much of the web, found by AI and serious enough to take Wikipedia offline. Driving licenses sold for AED 10,000 to people who never sat for a test. A police sweep across 21 African countries that ended in more than 1,400 arrests.
This weekly roundup covers stories where the weak point was not always a firewall, but the trust built into code libraries, license agreements, and the frameworks organizations use to measure their own security.
Here are the stories that shaped the week.
The Cyber Express Weekly Roundup
PHP2Shell Flaws Knock Wikipedia and Government Sites Offline
Two critical vulnerabilities in PHP, the scripting language that powers a large share of the web, have triggered urgent patching warnings from agencies around the world. Dubbed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, the flaws have already been linked to outages at Wikipedia and a number of government websites. Read more…
INTERPOL’s Operation Serengeti III Nets 1,462 Arrests Across Africa
An INTERPOL-coordinated crackdown spanning 21 countries has ended in 1,462 arrests. Operation Serengeti III ran from June to August 2026 and targeted fraud, ransomware, business email compromise and online scams. Investigators disrupted 10,909 malicious networks and recovered more than USD 105 million. The operation also identified nearly 66,000 victims, linked to combined losses of more than USD 385 million. Read more…
ASD Essentials Replaces the Essential Eight
The Australian Signals Directorate has launched ASD Essentials, a broader successor to the Essential Eight, the security baseline Australian organizations have long been measured against. Where the Essential Eight centered on a fixed set of mitigation strategies, the new framework extends its scope to enterprise IT, operational technology and cloud environments. Read more…
Dubai Police Bust AED 10,000 Fake Driving License Scheme
Dubai Police have arrested an eight-member gang that sold driving licenses for AED 10,000 each. Customers received licenses issued in a neighboring country without ever travelling there, taking a lesson or sitting a test. The gang then helped buyers convert those licenses into UAE licenses by exploiting legitimate license exchange agreements between the two countries. Read more…
Fintechs Urged to Treat Software Supply Chain Security as Enterprise Risk
Fintech firms vet their commercial vendors closely, but the open-source libraries, container images and third-party components inside their systems often arrive with far less scrutiny. That mismatch leaves a blind spot in how financial technology companies manage risk. Vijendra Katiyar of CleanStart points to examples such as a widely used Redis image that carried 185 known CVEs, and the Shai-Hulud worm, which spread through malicious npm packages. Read more…
Conclusion
Taken together, this week’s stories show how much of today’s risk comes from what organizations already trust: decade-old code, inherited software components, official exchange agreements and security checklists that measure effort rather than results. Follow The Cyber Express for next week’s weekly cybersecurity roundup and ongoing coverage of these stories.
Verify you are human
Checking your browser before accessing this site.
Click to verify →
Then you will be redirected to the requested content.
Ray ID: 8f3a2c1b9d4e5f6a · Performance & security by Cloudflare
Ray ID: 8f3a2c1b9d4e5f6a · Performance & security by Cloudflare
site-verification-ok
Verify you are human
Checking your browser before accessing this site.
Click to verify →
Then you will be redirected to the requested content.
Ray ID: 8f3a2c1b9d4e5f6a · Performance & security by Cloudflare
Ray ID: 8f3a2c1b9d4e5f6a · Performance & security by Cloudflare
site-verification-ok
FBI, CISA Warn SafePay Ransomware Has Hit 600+ Victims
The FBI, CISA and international partners have issued a warning about SafePay ransomware, a group that has impacted at least 600 victims across multiple critical infrastructure sectors since August 2024. Published on October 20, 2026, the joint cybersecurity advisory describes SafePay as among the most active ransomware groups in 2026, with operations affecting organizations in North America, South America, Europe and Australia.
The advisory was released by the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), the United States Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, the United Kingdom’s National Crime Agency and the UK’s North West Regional Organised Crime Unit. It draws on investigations conducted as recently as August 2026.
How SafePay Ransomware Gains Initial Access
According to the agencies, SafePay actors break into networks by stealing or guessing passwords, running brute force attacks, using phishing and exploiting VPN access. The group uses IP addresses from the VPN provider Mullvad and phished account profiles to exploit two flaws in edge devices: CVE-2020-3259 and CVE-2023-20269.
The actors also use automated scripts to exploit three vulnerabilities in internet-exposed systems: CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766.
Living Off the Land Inside Victim Networks
Once inside, SafePay actors establish persistence by gaining administrative privileges on existing accounts or creating new ones. They rely on built-in tools such as PsExec, Windows Remote Management and Remote Desktop Protocol to execute commands and move laterally.
To find valuable files, the group has used ShareFinder.ps1 and SharpShares.exe to enumerate network shares. Before moving laterally, the actors commonly disable security software. In some cases, they changed system users’ passwords, locking legitimate users out. The advisory also notes the use of a User Account Control bypass, token impersonation and the credential dumper Mimikatz.
Data Exfiltration Before Encryption
Data exfiltration is a central part of the group’s playbook. SafePay actors compress files using 7-Zip, WinRAR, FileZilla and RClone, then move stolen data out through WinSCP, RClone, OneDrive and the Backblaze command-line tool b2.exe. Remote desktop tools such as AnyDesk and TeamViewer have been installed to transfer ransomware onto victim systems.
To block recovery, the actors halt the Volume Shadow Copy Service and reset network attached storage holding backups to factory settings.
Files are then encrypted using a hybrid scheme combining the ChaCha20 stream cipher with RSA public-key cryptography. Encrypted files carry the .SafePay extension and, according to the advisory, cannot be recovered without the decryption key.
The group typically demands a portion of company revenue in cryptocurrency. A ransom note left on the desktop or root directory directs victims to a TOR chat portal, using a victim ID to log in. A representative also makes phone calls to pressure victims. If payment is refused, stolen data is posted to SafePay’s leak site. The ransomware may delete itself after encryption.
SafePay Ransomware Advisory: Recommended Defenses
To reduce the risk of ransomware attacks from SafePay, the agencies urge organizations to prioritize patching known exploited vulnerabilities, especially on firewalls and other internet-facing systems. They recommend requiring multifactor authentication for webmail, VPNs and accounts that access critical systems.
Other measures include passwords of 15 to 64 characters, account lockouts after failed logins, offline backups that are encrypted and immutable, network segmentation, least privilege access and time-based admin access. The advisory also recommends restricting command-line and scripting permissions.
The advisory lists IP addresses, file names, hashes and hostnames observed between November 2024 and August 2026. The agencies advise verifying these indicators before blocking, as some IP addresses may later be reassigned to benign services.
The authoring agencies do not encourage paying ransom, noting payment does not guarantee file recovery. Incidents can be reported to the FBI’s Internet Crime Complaint Center, a local FBI or Secret Service field office, or CISA. In the UK, victims can report through Report Fraud or their local police force.
Verify you are human
Checking your browser before accessing this site.
Click to verify →
Then you will be redirected to the requested content.
Ray ID: 8f3a2c1b9d4e5f6a · Performance & security by Cloudflare
Ray ID: 8f3a2c1b9d4e5f6a · Performance & security by Cloudflare
site-verification-ok
86,644 Firewalls in 194 Countries Breached With Stolen Passwords
The FBI and the U.S. Secret Service (USSS) have issued a joint cybersecurity advisory warning organizations about FortiBleed, an active global credential-compromise campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The advisory, published on October 6, 2026, cites SOCRadar data verifying more than 86,644 compromised devices across 194 countries.
According to the advisory, the campaign exploits reused or leaked credentials and legacy SHA-256 password storage, allowing threat actors to harvest and crack authentication data at scale. Attackers continue to scan exposed Fortinet firewalls using previously obtained credentials, and some affected organizations have been locked out of their own systems.
How the FortiBleed Attack Chain Works
The operation's internal workflow came to light after the threat actors unintentionally exposed their own backend server. The open directory revealed a mature, multi-stage campaign run as an initial access broker operation.
Attackers first scanned the internet for exposed FortiGate SSL VPN portals using automated scripts. They then gathered credentials through credential stuffing and password spraying, drawing on prior Fortinet leak dumps and infostealer logs.
Password hashes taken from compromised devices were exfiltrated and fed into a GPU-accelerated cracking cluster running on rented infrastructure, where Hashcat and Hashtopolis ran distributed jobs to convert stolen data into plaintext credentials.
[caption id="attachment_114628" align="aligncenter" width="800"]
Source: FBI[/caption]
Cracked credentials were then validated, with scripts filtering out honeypots, mapping organizations and ranking high-value targets by revenue and network structure. Attackers created new administrative accounts on firewalls to maintain persistence, then moved into victim networks to enumerate Active Directory and identify privileged accounts. The final stage involved selling access, including working VPN configurations and target lists, to downstream threat actors.
FortiBleed Lockouts and Ransomware Links
The advisory warns that victims may lose access to their Fortinet devices if attackers delete original accounts or change their passwords. In certain cases, threat actors removed existing accounts to block organizations from their devices while attempting lateral movement. Recovery may require steps beyond standard patching and password resets.
Reporting also indicates that initial access brokers using the FortiBleed attack chain have supplied access to ransomware affiliates, currently including INC/Lynx ransomware and Payload ransomware.
FortiBleed Indicators of Compromise
The agencies released indicators of compromise (IOCs) to help defenders review their environments. IP address 45.154.12.132 was observed as a command and control server, while 154.202.59.169 and 103.27.186.156 served as proxy nodes and 45.155.250.158 functioned as a beacon relay. The address 85.11.187.8 was linked to the Hashtopolis tool. The advisory also lists 13 IP addresses observed between June 18 and July 23, 2026, conducting brute force attacks or authenticating with compromised accounts.
Account names found on victim systems include adminin, fortiAdmin, forticloud-sync, fgtsecure, adminsslvpn, itadmin and roadmin. The agencies note that IP addresses may be reassigned over time and advise organizations to vet IOCs before acting on them.
Recommended Mitigations Against FortiBleed
The FBI and USSS recommend that organizations:
- Restrict external management through trusted hosts, a local-in policy, or by removing internet administration entirely.
- Terminate all active admin and VPN sessions and reset all Fortinet VPN and administrative passwords.
- Enforce phishing-resistant MFA on all remote access and administrative accounts.
- Review firewall and VPN configurations for unrecognized accounts and unauthorized changes.
- Check firewall, VPN, authentication and domain controller logs for unusual access.
- Use PBKDF2 to store administrator credentials and remove weaker legacy hashes, following Fortinet guidance for FortiOS v7.2.11 and later.
- Review all REST API keys, remove unknown ones and refresh legitimate keys.
Organizations that detect a compromise are urged to isolate affected hosts, scope the intrusion and report incidents to the FBI's Internet Crime Complaint Center (IC3), a local FBI field office or a local USSS field office.
Osaka Metropolitan University Hit by Ransomware, 130,000 Records at Risk
Data of 130,000 Students and Teachers May Be Exposed Due to Ransomware Attack
Japanese media reported that data belonging to at least 130,000 current and former students and teachers at the institution may have been exposed to unauthorized access following the cyberattack. The university has not yet confirmed whether personal information was leaked. It said an investigation is underway to determine whether any personal information was compromised and to establish the facts surrounding the incident. The university said it will report the matter to Japan’s Personal Information Protection Commission and proceed with further fact-finding based on an investigation by a specialized company.Osaka Metropolitan University Works to Restore Operations
Osaka Metropolitan University said it is prioritizing the investigation, damage assessment and restoration of affected systems. It is also using alternative measures to maintain essential operations and provide support to students, prospective students, business partners and other stakeholders. The university has temporarily established an announcement site because its official website, email system and other services remain unavailable. The temporary site is being used to publish information from Osaka Metropolitan University, the National College of Technology and affiliated hospitals. The university is also preparing for classes to resume from Friday, October 9, and has asked students to check the temporary announcements for information regarding the resumption of classes.Japanese Organizations Face Recent Cyber Incidents
The Osaka Metropolitan University ransomware attack comes amid several recent cyber incidents disclosed by organizations in Japan. Over the weekend, Japanese media giant Nikkei disclosed that a compromised employee account had been used to send approximately 9,000 malicious emails to internal and external contacts, including journalistic sources. Other Japanese organizations that have recently disclosed cyber incidents include brokerage Daiwa Securities, delivery companies Yamato Transport and Sagawa Express, insurer Dai-ichi Life and broadcast equipment manufacturer Ikegami Tsushinki. Osaka Metropolitan University said it has reported the incident to the Ministry of Education, Culture, Sports, Science and Technology, the Osaka Prefectural and Osaka City governments, and JPCERT. The university said it will provide further information as new facts emerge.
The Cyber Express Weekly Roundup: ShinyHunters’ FBI Breach Claim, North Korea’s WaterPlum Campaign, and the EU KIDS Act
The Cyber Express Weekly Roundup
Shiny Hunters Claims FBI Breach, Says FBIjobs Agent Data Exposed
The FBI is investigating an apparent breach after the cybercriminal group Shiny Hunters claimed to have stolen personal data belonging to thousands of federal agents, with the probe centering on the bureau's FBIjobs recruitment website. Read more...WaterPlum Hackers Steal $10.7M in Crypto From IT Workers
A North Korean cyber actor group known as WaterPlum, also referred to as "Contagious Interview," has infected at least 30,000 devices across more than 100 countries while stealing cryptocurrency from IT professionals worldwide. Read more...EU KIDS Act Sets New Social Media Rules for Children
The European Commission adopted the proposal on September 18, setting out rules that would prevent children under 13 from accessing social media and establish 15 as the minimum age for minors to open accounts independently. Users aged 13 to under 15 could instead access parent-managed mini accounts with limits on social contacts and up to 60 minutes of screen time per day, while platforms would bear the responsibility of proving their services are safe for children. Read more…Harness' Rahul Sood: AppSec in the Agentic Era Is About More Than Code. It's About Authority
In this conversation, The Cyber Express spoke with Rahul Sood, the General Manager for Application Security at Harness, who leads the company's AppSec portfolio and focuses on building security for the AI era, integrated directly into modern DevOps workflows. The conversation centers on a shift in how security teams must think about AI agents: the risk no longer lies only in the code being shipped, but in what authority autonomous agents are granted once they operate inside production systems. Read more…Ban on Discord Lifted After Platform Commits to Work With DICT and CICC
The Philippine government has lifted its ban on Discord after the platform's representatives met with officials from the Department of Information and Communications Technology (DICT) and the Cybercrime Investigation and Coordinating Center (CICC), with the restriction removed on Thursday, Sept. 24. Read more...Duelbits Hit by $7 Million Hack as Crypto Stolen Across Four Blockchains
Crypto casino Duelbits has shut down its platform after attackers took roughly $7 million from several of its wallets, with the stolen assets moved across four blockchains and mostly converted into Ether. The company says funds held in user accounts have not been affected, but it has not explained how the attackers got in or when the site will return. Read more...Weekly Cybersecurity Takeaway
This week's developments span the full spectrum of cyber risk, from a criminal group openly retaliating against the FBI over a public advisory, to a state-backed operation weaponizing job interviews against developers, to a crypto platform losing millions from the very hot wallets that keep it running. Meanwhile, the policy response is moving on multiple fronts: the EU is flipping the burden of proof onto platforms to demonstrate child safety by design, and the Philippines has shown how quickly a government can block, and then restore, a major platform in exchange for enforcement commitments. At the same time, security leaders are warning that AI agents are introducing an entirely new question of who, or what, holds authority inside enterprise systems. Taken together, the stories point to an increasingly confrontational threat landscape, where attackers are bolder, trust-based processes like hiring are being exploited at scale, and institutions are experimenting with more aggressive levers to hold platforms and adversaries accountable.
The Cyber Express Weekly Roundup: Hiscox’s SMB Warning, a Nintendo Switch Flaw, and a Record Deepfake Takedown
The Cyber Express Weekly Roundup
UK Small Businesses Face Higher Cyberattack Rates Than Global Peers, Hiscox Report Finds
UK small firms are being hit by cyberattacks at a rate well above the global average, according to Hiscox's 10th annual Cyber Readiness Report. The survey of nearly 7,000 smaller businesses worldwide, including 1,000 in the UK, found that 38% of UK firms suffered a successful attack in the past year, compared with a 29% global average — the highest rate among all markets surveyed. Read more…Cyble Signs MOU with UAE Cyber Security Council to Boost National Threat Intelligence
Cyble, an AI-native cybersecurity firm, has signed a Memorandum of Understanding with the UAE's Cyber Security Council to strengthen the country's national threat intelligence capabilities. Announced in Abu Dhabi in September 2026, the agreement centers on delivering advanced threat intelligence, early warning capabilities, and insights into emerging cyber risks facing government and critical infrastructure entities across the UAE. Read more…Nintendo Switch Flaw Let Nearby Attackers Run Code, Steal Data
Nintendo has patched a flaw in the original Switch that let nearby attackers hijack its QR-code-based "Send to Smartphone" feature to run unauthorized code or steal data, including account information stored on the console. Tracked as CVE-2026-82079, the bug affected consoles on firmware older than version 23.0.0; the Switch 2 is unaffected. Read more…Manhattan D.A. Seizes 12 Deepfake Porn Websites in Largest Known Takedown of Its Kind
The Manhattan District Attorney's Office has seized 12 websites allegedly used to create, sell, and distribute AI-generated deepfake pornography targeting roughly 1,200 real people without their consent. Announced by D.A. Alvin L. Bragg Jr., it's described as the largest known seizure of AI-generated celebrity deepfake websites to date, and the investigation is ongoing. Read more…Rahul Singh Choudhary on AI's Growing Role in Cryptanalysis and Offensive Security
In the latest episode of Security Pill Season 2.0, The Cyber Express interviewed cybersecurity analyst Rahul Singh Choudhary about how AI is reshaping cryptanalysis, vulnerability research, and penetration testing. The conversation opens with a key question: has AI moved from merely assisting security research to actively participating in it — particularly around the cryptographic assumptions underpinning wallets, exchanges, and smart contracts? Read more…US House Passes GUARD Act to Boost Law Enforcement Fight Against Elder Fraud, Crypto Scams
The U.S. House of Representatives has passed the bipartisan GUARD Act (H.R. 2978) on September 15, 2026, aimed at strengthening law enforcement's ability to combat elder financial fraud and cryptocurrency scams. Co-led by Representatives Josh Gottheimer, Zachary Nunn, and Scott Fitzgerald, the bill now heads to the Senate. Read more…Weekly Cybersecurity Takeaway
This week's developments span the full spectrum of cyber risk — from small UK businesses absorbing a disproportionate share of attacks, to a hardware-level flaw putting console owners at physical-proximity risk, to AI tools being weaponized for non-consensual imagery at unprecedented scale. Meanwhile, policy responses are accelerating on multiple fronts: US lawmakers are moving to arm local investigators against crypto-enabled elder fraud, and the UAE is deepening its national threat-intelligence posture through public-private partnership. Taken together, the stories point to a widening gap between the speed of exploitation — whether by scammers, deepfake operators, or nearby attackers exploiting hardware — and the pace of institutional response, even as that response visibly picks up.
The Cyber Express Weekly Roundup: Claude Session Hijacking, PaperCut Exploits, and Enterprise Cyberattacks
The Cyber Express Weekly Roundup
Anthropic Warns of Claude Session Hijacking
Anthropic has warned that common infostealer malware is being used to steal active Claude sessions, potentially allowing attackers to bypass passwords and two-factor authentication. The campaign involves malware such as Vidar, LummaC2, RedLine, and Atomic Stealer, which is often distributed through pirated software and illicit downloads. Attackers may also consume victims’ paid AI usage. Read more…PaperCut Releases Second Emergency Patch After First Fix Is Bypassed
PaperCut has released a second emergency patch for two actively exploited vulnerabilities affecting its NG and MF print management servers. Researchers discovered ways to bypass the initial security fix, potentially allowing attackers to chain the flaws and achieve pre-authentication remote code execution on exposed systems. Read more…Boston Scientific Cyberattack Limited to Certain On-Premises Systems
Boston Scientific says its ongoing cybersecurity incident is limited to certain on-premises systems, with no impact identified on its cloud-based applications. The company has also reported no confirmed data breach or evidence of unauthorized activity since August 25, as its investigation into the incident continues. Read more…DOJ Investigates Attempted Cyberattack on Hundreds of Thousands of X Users
The U.S. Department of Justice is investigating a large-scale cyberattack targeting hundreds of thousands of X accounts through the platform’s password-recovery system. Attorney General Todd Blanche said X detected and disrupted the campaign before the targeted accounts could be captured, preventing the attempted account takeover operation from succeeding. Read more…Two Citrix NetScaler Flaws Put Enterprise Edge Devices at Risk
Two vulnerabilities in Citrix NetScaler ADC and Gateway have prompted an urgent patching warning from Australia’s cybersecurity agency. CVE-2026-19489, a memory overflow flaw, and CVE-2026-19490, an authentication bypass, can affect systems with specific configurations involving SIP ALG, SAML, or VPN gateway functionality. Read more…Weekly Cybersecurity Takeaway
This week’s developments demonstrate that cybersecurity threats are increasingly targeting authentication systems, active user sessions, exposed enterprise infrastructure, and critical business applications. AI platforms, print management servers, healthcare environments, social media accounts, and network edge devices all remain potential targets for attackers. Organizations should prioritize rapid security patching, protection of active sessions, strong authentication controls, careful monitoring of exposed infrastructure, and timely investigation of suspicious activity. Security teams should also review systems that rely on password-recovery mechanisms and identify enterprise devices operating with vulnerable configurations. As businesses continue to rely on cloud services, AI platforms, remote access technologies, and internet-facing enterprise systems, attackers are finding new opportunities to exploit trusted sessions and security weaknesses. Organizations must maintain continuous monitoring and rapid response capabilities to reduce the impact of increasingly targeted cyberattacks.
The Cyber Express Weekly Roundup: Exploited Entra ID Flaw, AI Agent Risks, and Global Cybercrime Crackdown
The Cyber Express Weekly Roundup
Microsoft Confirms Exploited Entra ID Flaw
Microsoft confirmed that a critical vulnerability in Entra ID, CVE-2026-69836, was exploited before the flaw was fixed server-side. The vulnerability carries a CVSS score of 10.0 and could allow unauthenticated attackers to achieve remote code execution, potentially affecting Microsoft’s cloud-based identity infrastructure. Read more...New Zealand Proposes Social Media Ban for Under-16s
New Zealand has introduced legislation that would require high-risk social media platforms to prevent users under the age of 16 from accessing their services. Proposed age-verification methods could include digital identification, facial age estimation, or official identification documents. Read more...Cyble and DRONA Launch AI Cyber Defense Initiative in India
Cyble and DRONA Cyber Solutions have launched an AI-powered cybersecurity initiative in Ahmedabad aimed at helping mid-sized businesses detect, investigate, and contain cyber threats. The initiative combines threat intelligence, AI-driven investigations, and endpoint enforcement to provide organizations with faster and more coordinated responses to security incidents. Read more...AI Agents Could Create New Cybersecurity Risks
Adarsh Kant Sinha, CEO of ANVE.AI, warned that autonomous AI agents could introduce significant new cybersecurity risks as organizations increasingly allow them to interact with business-critical systems. AI agents may gain access to email, customer relationship management platforms, cloud infrastructure, and financial systems, potentially creating new avenues for misuse or compromise. Read more...Ledger Fixes Ethereum App Flaw Amid Disclosure Dispute
Ledger said it fixed a clear-signing vulnerability in its Ethereum application approximately two weeks before security firm TestMachine publicly disclosed the issue. The vulnerability could potentially allow a malicious application to display one transaction to a user while preparing a different transaction for signing. Read more...Global Crackdown Nets 58 Arrests in West African Crime Networks
An eight-month international law enforcement operation led by INTERPOL has resulted in 58 arrests and the identification of 263 suspects across 22 countries. Operation Jackal IV targeted West African criminal networks involved in cyber-enabled fraud, money laundering, romance scams, and investment scams. Read more...Weekly Cybersecurity Takeaway
This week’s developments demonstrate that cybersecurity threats are crossing organizational, technological, and geographical boundaries, affecting cloud identity systems, artificial intelligence, digital platforms, cryptocurrency applications, and international financial crime. Organizations should prioritize strong identity and access controls, rapid vulnerability remediation, careful management of AI-agent permissions, secure integrations, human oversight, and continuous threat monitoring. As autonomous technologies become more deeply integrated into business operations and cybercriminal networks continue to operate across borders, security teams must adapt to a threat landscape that is becoming broader, more interconnected, and increasingly difficult to contain.
Gunra Ransomware Builds a New Attack Network Through RaaS
Gunra Ransomware Shifts to Affiliate Model
By early 2026, the group had expanded through a formal ransomware-as-a-service affiliate program advertised on dark web forums. The program provides affiliates with a management panel, configurable ransomware builder, cross-platform locker payloads and affiliate documentation. The FBI also observed Gunra operating under new branding aliases, including Golden Community, while recruiting penetration testers and ethical hackers as initial access brokers. Gunra initially focused on Windows environments before introducing a Linux variant and moving toward broader cross-platform targeting. Victims observed on the group’s dedicated leak site include organizations across the Americas, Europe, the Middle East, Africa and the Asia-Pacific. Targeted sectors include healthcare and public health, financial services and insurance, critical manufacturing, transportation, government services, utilities, academia, media and communications, retail, and professional and nonprofit services.
VPN Vulnerabilities Used for Initial Access
According to the advisory, Gunra actors primarily gained initial access by exploiting known vulnerabilities in internet-facing devices, including firewall and VPN gateways. The FBI observed exploitation of CVE-2024-55591 and CVE-2025-24472, authentication bypass vulnerabilities affecting specific FortiOS and FortiProxy versions. The Republic of Korea’s National Police Agency also observed Gunra actors exploiting credential exposure and SSH access control weaknesses in internet-facing VPN gateways to obtain unauthorized remote access. After gaining access, attackers used tools including Impacket utilities to move laterally through victim networks using SMB. In one case, actors compromised an SSL-VPN appliance using default credentials where account lockout controls were absent. They later used stolen session information to access internal virtual desktop infrastructure and move through systems including Active Directory servers and IT personnel workstations.Data Theft Precedes Encryption
The double-extortion ransomware operation involves stealing sensitive information before encrypting systems. The FBI observed Gunra actors collecting business-critical documents, databases, personally identifiable information, and internal email communications. In at least one case, the actors used a malicious executable called main.exe to exfiltrate data from Microsoft OneDrive and SharePoint. Compressed archives containing sensitive information were also transferred to the Mega file-sharing service, with the volume of exfiltrated data reaching tens of terabytes. For encryption, Gunra uses ChaCha20 and RSA-4096 algorithms and has been observed using the.ENCRT extension for encrypted files. A documented sample from July 2025 used the .CRYPT extension. The ransomware also uses Windows Management Instrumentation to delete volume shadow copies before encryption, while one victim had backup and archived data deleted from both primary and disaster recovery infrastructure.
Agencies Urge Patching and Network Segmentation
The authoring agencies recommend that organizations prioritize patching known exploited vulnerabilities in internet-facing systems, including VPN gateways and RDP-exposed infrastructure. They also advise implementing and testing offline, immutable backups stored in physically separate and segmented locations. Network segmentation is another key recommendation, intended to restrict lateral movement and limit the spread of ransomware between systems. The agencies also recommend reviewing domain controllers, servers, workstations and Active Directory environments for unrecognized accounts, auditing administrative privileges, requiring MFA where possible and testing security controls against the Gunra techniques mapped to the MITRE ATT&CK framework. The joint advisory was published August 10, 2026, as part of the ongoing #StopRansomware initiative.
Ransomware Kingpin Gets 16 Years for Global Cyberattacks
Ransom Cartel Ransomware Operation
Beginning in May 2021, Silnikau developed the ransomware scheme and recruited participants through cybercrime forums. He distributed information and tools to participants, including stolen credentials linked to compromised computers and tools designed to encrypt or lock those systems. Silnikau also maintained a hidden website used by himself and his co-conspirators to monitor and control ransomware operations. According to the court documents, the website provided a platform for the group to communicate with one another, interact with victims, send and negotiate ransom demands, and manage the distribution of funds among the conspirators. The operation targeted companies between 2021 and 2023. During that period, Ransom Cartel ransomware conspirators carried out attacks against at least 18 companies around the world, including organizations based in California, New York, Nebraska, and other countries outside the United States.Ransomware Attacks Targeted Companies Worldwide
The ransomware attacks involved data theft and monetary demands. The attackers sought payment in exchange for providing keys to unlock stolen data or for promises not to publish the information taken from victims. The operation’s growth was disrupted following Silnikau’s arrest in July 2023. He was later extradited from Poland to face prosecution in the Eastern District of Virginia and the District of New Jersey. The sentencing announcement was made by Theophani K. Stamos, First Assistant U.S. Attorney for the Eastern District of Virginia; Acting Special Agent in Charge Andrew Forrest of the U.S. Secret Service Criminal Investigative Division; Chris Ormerod, Special Agent in Charge of the FBI Kansas City Field Office; and Craig L. Tremaroli, Special Agent in Charge of the FBI Albany Field Office.Maksim Silnikau Sentenced to 16 Years
The Justice Department’s Office of International Affairs provided substantial assistance with Silnikau’s extradition and the collection of evidence. The U.S. Attorney’s Office for the District of New Jersey and the Computer Crime and Intellectual Property section also assisted with the case. Assistant U.S. Attorney Jonathan S. Keim and former Assistant U.S. Attorney Zoe Bedell prosecuted the case. The 16 years in prison sentence follows the disruption of an international ransomware operation that targeted at least 18 companies during its active period. Silnikau’s role, according to court documents, extended across the development and administration of the ransomware strain, recruitment of participants, provision of attack tools, victim communications, and management of funds generated through the operation.
The Cyber Express Weekly Roundup: Ransomware Surge, Government Data Breaches, Logistics Disruptions, and Third-Party Security Risks
The Cyber Express Weekly Roundup
Qilin Dominated Ransomware Attacks in H1 2026
Qilin emerged as the most active ransomware group during the first half of 2026, targeting organizations worldwide through its ransomware-as-a-service (RaaS) operation. Manufacturing, healthcare, construction, and professional services were among the sectors most affected as the group continued expanding its global reach. Read more…Hackers Breach Beneficial Owners Registry, Expose Data of 31,000 Firms
Hackers breached the Register of Beneficial Owners (VwbP), gaining unauthorized access to data associated with approximately 31,000 legal entities. Authorities temporarily took the registry offline, launched an investigation, and established a crisis response team, stating there is currently no evidence that records were altered or deleted. Read more…PNLD Data Breach Leaks Police and Government Contact Details
A data breach involving the Police National Legal Database (PNLD) exposed names, organizations, and work email addresses belonging to police officers, government partners, criminal justice professionals, and some Ask the Police users after the information appeared on the dark web. Authorities are investigating the incident and assessing its potential impact. Read more…De Bijenkorf Logistics Cyberattack Delays Orders and Raises Data Exposure Concerns
A cyberattack targeting a third-party logistics provider disrupted deliveries, returns, and refunds for Dutch retailer De Bijenkorf. While the retailer confirmed its internal systems were not compromised, investigators are assessing whether customer contact details and order information were exposed. Payment information, passwords, and financial data were not affected, and customers have been advised to remain vigilant against phishing attempts. Read more…Updoc Data Breach Exposes Customer Contact Information
Australian telehealth provider Updoc disclosed a data breach after unauthorized access to a third-party operational platform exposed some customers' names, email addresses, and postal addresses. The company confirmed that its internal systems remained secure and that no medical records, payment information, or financial data were compromised. Read more…Weekly Cybersecurity Takeaway
This week's incidents highlight the continued evolution of cyber threats across ransomware operations, government data breaches, and third-party supply chain compromises. A common theme across these events is the growing risk posed by trusted third-party platforms and shared digital ecosystems. Attackers are targeting external service providers, government databases, and ransomware affiliate networks to expand their reach and maximize operational disruption. Organizations should prioritize stronger third-party risk management, continuous monitoring, robust access controls, and timely incident response to reduce the impact of supply chain attacks and data breaches. As businesses become more interconnected, strengthening the security of partner ecosystems is becoming just as important as protecting internal infrastructure.
How the World’s Most Active Ransomware Operation Expanded in H1 2026
Download the Cyble H1 2026 Cyber Threat Landscape Report for the full analysis.
Breaking Down the Qilin Ransomware Operation
Qilin’s activity was particularly significant in North America, where the group accounted for 370 ransomware attacks during H1 2026. This represented nearly one-fifth of all ransomware incidents recorded in the region.
The group also maintained a strong presence in Europe and the UK, claiming 158 attacks, while Asia-Pacific recorded 64 incidents linked to Qilin. In South America, the group was responsible for 40 attacks, further demonstrating its ability to operate across diverse geographic environments.
Rather than concentrating on a single market, Qilin followed a broad targeting strategy designed to maximize opportunities across industries.
