Cyber Threat Intelligence 12 October 2026

NCSA_THAICERT

Financial Sector

PCI SSC Calls For Human Approval Of AI Agent Actions Involving Cardholder Data
"The PCI Security Standards Council (PCI SSC) has published Security Considerations for AI Systems, guidance covering the protection of data supplied to AI systems in payment environments and defenses against AI-assisted attacks. Developed with industry stakeholders, the document addresses governance, deployment, access controls, testing and the application of PCI standards. Its recommendations are advisory, and existing PCI requirements take precedence. “As AI is increasingly used in payment environments, there is an obligation for all parties to ensure the technology is used responsibly,” said Gina Gobeyn, Executive Director, PCI SSC. “This additional guidance provides a practical starting point for secure AI implementation.”"
https://www.helpnetsecurity.com/2026/10/09/pci-ssc-payment-environments-ai-security-guidance/

Industrial Sector

Thousands Of Wind And Solar Park Systems Sit Exposed On The Internet Across Europe
"Modat and NCSC-NL, the Dutch government’s cybersecurity center, found 8,547 internet-facing systems at wind farms and solar parks in 35 countries in and around the EU that should not be reachable from the internet. The systems range from login screens to a turbine control page that offers a Stop button to anyone with a browser. Operators in Spain, Greece, Italy and Germany account for most of the confirmed systems. The real number is higher. A system only made the list once the team could link it to a specific solar or wind site."
https://www.helpnetsecurity.com/2026/10/09/eu-renewable-energy-cybersecurity/
Super Intelligence Reached OT Systems And Moved Equipment
"Just 16 minutes and change. That is how long it took frontier super intelligence models in one controlled test to move from a perimeter compromise to actions inside an industrial control network. In another scenario, a model found a robotic arm, mapped its protection zones and motion limits, and moved it within minutes. The models did this without source code, engineering documents, or advanced OT guidance. Across eight scenarios, every defined test objective was achieved. More important, the models connected work that usually spans multiple people and stages, including asset discovery, device research, attack planning, troubleshooting, and execution. Building on Booz Allen’s Cyber Weapon Index, this research extends our examination of super intelligence-enabled offensive capabilities beyond enterprise networks and into operational technology (OT), where cyber actions can directly affect machinery and industrial processes."
https://www.boozallen.com/insights/cyber/frontier-si-reaches-ot-systems.html
https://www.boozallen.com/assets/home/docs/cyber/frontier-ai-models-in-ot-environments.pdf
https://www.theregister.com/security/2026/10/11/ai-systems-are-fully-capable-of-carrying-out-nightmare-attacks-against-infrastructure-and-nobodys-ready/5302450

New Tooling

Launching An Opt-In Vulnerability-Finding Service For Open-Source Software
"We’re launching OSS Scanner, an opt-in vulnerability scanner for the open-source ecosystem informed by our experience using Claude to find vulnerabilities during Project Glasswing. Projects that join will receive thorough, periodic security scans by our strongest models at no cost. Language models have rapidly advanced in their ability to discover vulnerabilities, as we have reported extensively on this blog. On CyberGym, one academic vulnerability-finding benchmark, LLMs have gone from finding under 20% of vulnerabilities at the beginning of last year to finding over 85% this year. As a result, open source maintainers have gone from receiving mostly slop from LLMs to receiving high-quality bug reports."
https://www.anthropic.com/research/launching-opt-in-vuln-finding-service-for-open-source
https://github.com/anthropics/oss-scanner
https://thehackernews.com/2026/10/anthropic-launches-free-ai.html
https://securityaffairs.com/200685/ai/claude-helps-secure-open-source-as-anthropic-offers-free-vulnerability-scanning.html

Vulnerabilities

Citrix Warns Admins To Patch New NetScaler RCE Flaw Immediately
"Citrix has warned IT administrators to patch systems immediately against a new critical vulnerability affecting NetScaler ADC networking appliances and NetScaler Gateway secure remote access solutions. Tracked as CVE-2026-107406, this flaw stems from a memory overflow weakness that attackers can exploit to gain remote code execution (RCE) on targeted devices or trigger a denial-of-service state that can cause crashes. To be vulnerable, NetScaler ADC and NetScaler Gateway appliances must be configured as a Security Assertion Markup Language (SAML) Identity Provider (IdP) or Service Provider (SP)."
https://www.bleepingcomputer.com/news/security/citrix-warns-admins-to-patch-new-netscaler-rce-flaw-immediately/
https://community.citrix.com/techzone-blogs/110_security-updates/protecting-customers-immediate-guidance-for-cve-2026-107406-in-netscaler-adc-and-netscaler-gateway-r1631/
https://thehackernews.com/2026/10/citrix-patches-critical-netscaler-flaw.html
https://www.securityweek.com/citrix-urges-immediate-patching-of-critical-netscaler-vulnerability/
https://www.theregister.com/security/2026/10/09/citrix-gives-netscaler-admins-another-critical-reason-to-patch/5302212
https://securityaffairs.com/200670/security/cve-2026-107406-citrix-fixes-critical-netscaler-adc-and-gateway-vulnerability.html
Researchers Publish Working Exploit For Pre-Auth AnyDesk Linux Flaw That Gives Root Access
"Security researchers have published a full working exploit for a pre-authentication remote code execution flaw in AnyDesk Linux that gives attackers root access before anyone approves the connection. AnyDesk patched the flaw in version 8.0.3 in June, but its changelog described the fix only as "fixed a bug that could lead to a crash," with no CVE assigned and no security advisory. The exploit, called AnyPwn, targets a heap buffer overflow in AnyDesk's session protocol, a remote desktop tool. The code was released on GitHub on October 8."
https://thehackernews.com/2026/10/researchers-publish-working-exploit-for.html
GoBalance Flaw Lets Attackers Hijack .onion Addresses By Recovering Tor-Format Keys
"A bug in GoBalance, a tool many dark-web sites use to stay reachable during attacks, lets anyone work out the secret key that controls a site's .onion address using only public information, and then take that address over. Searchlight Cyber, which disclosed the flaw on October 8, says an attacker who recovers the key can redirect the site's visitors to a copy of the site they control. Taking over the address does not grant the attacker access to the site's servers, database, or stored user data."
https://thehackernews.com/2026/10/gobalance-flaw-lets-attackers-hijack.html

Malware

Adception: Malvertising Another Search Engine’s Search Results To Redirect To a Malicious Page
"Push recently detected an attack that began with a Google search ad for "claude mac" whose destination was a Bing search result, which passed the victim through a compromised retail website to a fake Claude installer. This led us to discover a crafty redirect and cloaking technique that we’re (unseriously) referring to as “Adception”."
https://pushsecurity.com/blog/adception-malvertising-another-search-engines-search-results
https://www.bleepingcomputer.com/news/security/hackers-abuse-google-ads-bing-redirects-to-push-claude-clickfix-attacks/
Threat Actors Exploit Critical AhsayCBS Flaws To Drop Webshells And XMRig Cryptominer
"On October 4, 2026, NVD disclosed two CVEs impacting the AhsayCBS backup utility: CVE-2026-105133 and CVE-2026-105134. Starting October 7 (23:20:15 UTC), Huntress began seeing threat actors exploiting the flaws to perform remote code execution on impacted hosts. As of October 8, Huntress has seen five organizations targeted via these flaws. Post-exploitation, threat actors are conducting reconnaissance, dropping webshells, planting XMRig cryptominers masquerading as Microsoft Edge, and more. They also dropped what appears to be an AI-assisted PowerShell script that monitors the Windows Task Manager and shuts it down if it remains open for too long in the middle of the night. AhsayCBS versions up through 10.3.4 are affected by this issue."
https://www.huntress.com/blog/ahsaycbs-flaws-exploit
https://www.bleepingcomputer.com/news/security/unpatched-ahsaycbs-flaws-exploited-to-deploy-webshells-mine-crypto/
https://thehackernews.com/2026/10/attackers-exploit-ahsaycbs-flaws-to.html
https://www.securityweek.com/unpatched-ahsaycbs-vulnerabilities-exploited-in-the-wild/
Max Severity SonicWall SMA1000 Flaw Now Exploited In Attacks
"Attackers are exploiting a maximum-severity vulnerability in SonicWall SMA1000 appliances (CVE-2026-102255) that was patched on Tuesday, three days ago. Tracked as CVE-2026-102255, the flaw affects the Appliance WorkPlace interface on SMA1000 6210, 7210, and 8200v models, but does not affect the SMA 100 Series product line or SSL-VPN running on SonicWall firewalls. "By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations," SonicWall explained."
https://www.bleepingcomputer.com/news/security/max-severity-sonicwall-sma1000-flaw-now-exploited-in-attacks/
How Luna Moth Runs Data Extortion Like a Business
"Around October 5, 2026, an anonymous onion site called “The Luna Moth Files” claimed to expose internal material from Silent Ransom Group (SRG), also tracked as Luna Moth and UNC3753. The package includes chat exports, a vishing document, screenshots, and a purported fake employee résumé. Nobody knows who published it or how the archive was obtained, so we treat its claims as unverified unless independent sources back them up. The material contains no new exploit and no new malware. It does offer a view of how a social engineering-led extortion operation may organize its work."
https://blog.checkpoint.com/security/how-luna-moth-runs-data-extortion-like-a-business/
GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials From Entire Git Histories
"On October 8, 2026, attackers operating the GhostAction GitHub Actions credential-theft campaign compromised two high-profile open-source maintainer accounts and swept 345 repositories in two automated windows lasting minutes. Using the account of Takashi Kitao, author of the 18,400-star game engine pyxel, the attacker pushed a malicious workflow to 27 repositories starting at 13:20 UTC. Eight hours later, the account of Henry Wu (henrywoo), the original author of Uber's athenadriver, was used to push the same workflow to 318 repositories in a 16-minute window, 21:10–21:26 UTC."
https://www.stepsecurity.io/blog/ghostaction-returns
https://thehackernews.com/2026/10/credential-stealing-github-actions.html
Sleep, Beacon, Steal, Repeat - The Story Of P7 DarkSword Variant
"In August 2026 we investigated a DarkSword infection that turned out to be a previously unseen variant, which we call P7 DarkSword. The name P7 comes from the threat actor’s use of the p7_ variable prefix in modifications to original DarkSword’s code. Compared with the variants we usually observe, P7 reduces its on-device footprint, adds on-device keychain and crypto-wallet theft, and adds two way C2 communication with the attacker's infrastructure. This post describes the investigation, the variant's capabilities, and the indicators that can be used to detect it."
https://www.iverify.com/blog/darksword-variant-threat-research
https://thehackernews.com/2026/10/p7-darksword-ios-exploit-kit-adds.html
Disrupting AI-Enabled “false Front” Operations
"Over the past two and a half years, we’ve reported on many of the ways in which threat actors tried to use our models to conduct cyber attacks, covert influence operations (IO), scams, and other violations of our Usage Policies. We publish these reports to inform regulators, our industry peers, and wider society of how we see threat actors trying to leverage AI, and to shine a light on the vulnerabilities they try to exploit. We recently banned two IO—one from Russia and one from Iran—that used our models in combination with more traditional techniques and technologies to support sophisticated “false front” entities. They used those entities to launder geopolitical, conflict-related messaging into their target audiences."
https://openai.com/index/disrupting-ai-enabled-false-front-operations/
https://therecord.media/openai-disrupts-russian-iranian-operations-chatgpt
Dire Wolf Ransomware Attacks: How To Test And Strengthen Your Defenses
"Dire Wolf Ransomware is a double-extortion ransomware first observed in April 2025. By August 2026, it had claimed 100 victims across 32 countries, including the United States and Brazil, mainly in professional services, manufacturing, healthcare, technology, and financial services. Its Go-based, UPX-packed encryptor gives every file a unique ChaCha20 key derived through Curve25519 and SHA-256, and encrypts only the first 1 MB of larger files for speed. Before encryption, it kills the Event Log service, deletes shadow copies and backups, disables Windows Recovery, and stops up to 75 services [1]. Afterward, it forces a reboot and deletes itself."
https://www.picussecurity.com/resource/blog/dire-wolf-ransomware-attacks-how-to-test-and-strengthen-your-defenses
Turning IDN Edge Cases Into Typosquats
""Check the address bar" is the one piece of security advice everybody has heard. It assumes the name there can be read correctly, which held while domain names could only contain English letters, digits, and a hyphen. Since 2003 they can use almost any writing system, so a Berlin bookshop can be bücher.de. Many of those characters look identical to Latin ones. Cyrillic has its own а, е, о, р, and с, which most fonts draw like Latin a, e, o, p, and c but applications treat as different characters. A name can therefore look like apple.com without being it."
https://haveibeensquatted.com/blog/turning-idn-edge-cases-into-typosquats
https://www.theregister.com/security/2026/10/10/two-characters-open-up-a-world-of-typosquatting-opportunities-in-chromium-browsers/5302383
Can You Really Make More Than $200M In Six Months Without Encrypting Victims? It Seems Silent Ransom Group Can. (1)
"DataBreaches has reported on Silent Ransom Group (SRG) since 2022, with particular interest in their numerous attacks on law firms. Those interested in the group should review our past coverage, which often includes exclusive material and details. Do you remember the Conti leaks in 2022 that were variously ascribed to either a Ukrainian researcher or a disgruntled member of Conti? Well, now Conti’s offspring, Silent Ransom Group, has experienced a leak, too, although we do not yet know to whom to ascribe it. This new leak includes material from two servers during the period August 27, 2025 – September 29, 2026 (slplsskdj2836v2jjsx[.]com and aim6umein3kee[.]com)."
https://databreaches.net/2026/10/07/can-you-really-make-more-than-200m-in-six-months-without-encrypting-victims-it-seems-silent-ransom-group-can/
https://securityaffairs.com/200719/cyber-crime/silent-ransom-group-allegedly-extorted-207-million-without-encrypting-files.html

Breaches/Hacks/Leaks

Hundreds Of Thousands Impacted By Data Breach At Biosensor Firm iRhythm
"Medical device maker iRhythm said the data of at least 360,000 people was breached in a June cyberattack. The company began filing breach notices in multiple states this week, telling regulators and victims that the incident occurred on June 8 and involved unauthorized access to third-party systems. iRhythm is best known for Zio Patch — a sensor that patients wear on their chest for long-term continuous cardiac monitoring and heart arrhythmia detection."
https://therecord.media/irhythm-data-breach-reports
Belarusian Hacktivists Admit To 2023 Breach Of Russian State Healthcare Network
"Belarusian activist hackers have claimed responsibility for a years-old breach of Moscow's healthcare network, confirming their involvement in an intrusion recently disclosed by a Russian cybersecurity company. In a statement on Friday, the Belarusian Cyber Partisans said they infiltrated the Moscow Department of Health in 2023 and obtained administrator-level access to its infrastructure, including systems connected to other government agencies. The group said it spent months inside the network before abandoning the operation."
https://therecord.media/belarusian-cyber-partisans-claim-2023-russia-healthcare-hack
Nippon Columbia Malware Incident Exposes 8.6 Million Karaoke Fan Records
"Daiichi Kosho, a major Japanese entertainment system maker, disclosed that a malware infection at its contractor, Nippon Columbia, exposed more than 8.7 million customer and employee records. The company is the largest karaoke maker in Japan, operating 521 karaoke venues nationwide, including the Big Echo chain, one of the most popular karaoke box chains in the country. Daiichi Kosho outsources the handling of its customers’ personal information to Nippon Columbia Group (NCG), a Japanese entertainment group whose businesses include music, video and game software production and distribution, as well as artist management."
https://www.bleepingcomputer.com/news/security/nippon-columbia-malware-incident-exposes-86-million-karaoke-fan-records/

General News

FBI Arrests Executive At Ransomware Negotiation Firm
"Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested an executive at a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of agents, multiple sources tell KrebsOnSecurity. The New York Times reported today that the FBI has arrested a Canadian man in Pennsylvania on suspicion of assisting ShinyHunters. The Times story did not identify the man, nor did a statement on Twitter/X about the arrest from FBI Director Kash Patel."
https://krebsonsecurity.com/2026/10/fbi-arrests-founder-of-ransomware-negotiation-firm/
https://www.bleepingcomputer.com/news/security/fbi-arrests-another-suspected-shinyhunters-hacker-after-agency-breach/
https://www.bleepingcomputer.com/news/security/cyber-exec-arrested-in-case-allegedly-tied-to-shinyhunters-hackers/
https://thehackernews.com/2026/10/fbi-arrests-another-shinyhunters.html
https://therecord.media/shinyhunters-arrest-fbi-data-breach-investigation
https://www.bankinfosecurity.com/suspected-shinyhunters-extortion-hacker-arrested-by-fbi-a-33059
https://cyberscoop.com/edward-dubrovsky-cypfer-arrested-fbi-extortion-charges/
Ukrainian-Russian Dual Citizen Pleads Guilty To Running International Money Laundering Organization For Cybercriminals
"Oleg Korniev, 42, a dual citizen of Ukraine and Russia, pleaded guilty today to running a sophisticated international money laundering organization that laundered millions of dollars stolen from United States victims by cybercriminals around the world. In total, this international criminal organization recruited over 15,000 U.S.-based money mules to launder at least $10 million stolen by hackers from over 750 U.S. bank accounts."
https://www.justice.gov/opa/pr/ukrainian-russian-dual-citizen-pleads-guilty-running-international-money-laundering
https://www.bleepingcomputer.com/news/security/ukrainian-russian-dual-citizen-admits-to-laundering-millions-for-cybercriminals/
https://therecord.media/leader-of-money-mule-operation-for-cybercriminals-pleads-guilty
Hackers Get $1,262,000 For 98 Zero-Days At Pwn2Own Ireland
"The Pwn2Own Ireland 2026 hacking contest has concluded, with hackers collecting $1,262,000 in rewards after exploiting 98 zero-day flaws. Ikotas Labs security researchers won this year's Pwn2Own Ireland edition with 42.5 Master of Pwn points and $361,000 earned over the three-day contest after hacking the Samsung Galaxy S26, OpenAI Codex, and the Oracle Autonomous AI Database. They also collected the competition's top reward of $300,000 on the third day after chaining multiple zero-days to hack the Google Pixel 10."
https://www.bleepingcomputer.com/news/security/hackers-earn-1262000-for-98-zero-days-at-pwn2own-ireland/
https://thehackernews.com/2026/10/three-teams-demonstrate-remote-hacks-of.html
https://www.securityweek.com/google-pixel-10-exploits-earned-hackers-560000-at-pwn2own/
ASOS Breach Reveals The Risks In Customer-Facing SaaS
"The hackers who breached ASOS this week unearthed a serious security gap around customer-facing marketing and notifications platforms. On Oct. 6, a threat actor identifying itself as "Xuanye Group" announced that it had breached the multibillion-dollar British retailer. The group claimed to have stolen a wealth of personally identifying information (PII) about ASOS customers, of which there are around 17 million, according to the company. Remarkably, of ASOS's 2,800 employees, the threat actor only needed access to one's login credentials to snowball an attack that eventually led them to compromising multiple, deep-seated corporate systems. One of those systems allowed it to broadcast messages to all of ASOS' mobile app users."
https://www.darkreading.com/cyberattacks-data-breaches/asos-breach-risks-customer-facing-saas
Security Threats Don't Stop At The Office: Why Executives' Families Need Training, Too
"An attacker attempts to breach an executive's personal laptop, but effective multifactor authentication (MFA) blocks them. Actually, it was only a deterrent. The attacker then discovers that the executive's son did not enable MFA on his gaming console and uses that compromised box to move laterally on the home network to eventually reach the corporate network. Cybercriminals' increasingly brazen techniques have expanded beyond office walls to target top executives' family members and friends who may not know how to protect themselves. Worse, these people don't even know that the attackers are coming for them."
https://www.darkreading.com/cyber-risk/security-threats-don-t-stop-at-the-office-why-executives-families-need-training-too
Social Engineering AI Agents: The New BEC For 2026
"Cybersecurity Awareness Month traditionally focuses on teaching employees how to recognize social engineering efforts and how to avoid consequences associated with business email compromise (BEC). But as companies give AI agents authority to interact with business systems, threat actors can target AI agents and manipulate them into taking authorized actions instead — which should reshape how organizations train on BEC attacks. Consider a classic BEC scenario: an accounts-payable employee receives what appears to be a legitimate message from a vendor saying its banking information has changed. The employee believes the request and, using their own legitimate access, redirects a future payment to an attacker-controlled account. The attacker must convince an employee with authority to take the wrong action."
https://www.darkreading.com/cybersecurity-operations/social-engineering-ai-agents-bec-2026
What The BPFDoor Backdoor Tells Us About Attacks On The Network Edge
"A backdoor that makes no noise is hard to catch, and that’s the point of BPFDoor. The Linux malware waits for a special “magic packet” before it acts. In this interview with Help Net Security, Christiaan Beek, VP of Rapid7 Intelligence, explains why its operators go after mail gateways and other edge devices that can’t run endpoint agents, and why a hacked telecom network can put a whole nation at risk. Beek also covers how CISOs should report “no findings” to the board and which simple Linux checks teams can run this week."
https://www.helpnetsecurity.com/2026/10/09/christiaan-beek-rapid7-bpfdoor-backdoor/
Companies Want Autonomous IT Operations But Hesitate To Let AI Act Alone
"Ninety percent of companies want to move toward autonomous IT operations over the next two years, with agentic AI, software that plans and carries out multi-step tasks on its own, doing the work. Yet 77 percent say their own organization hesitates to let AI make an operational decision without a human approving it. Most of those companies mean autonomy with a person at the approval step, and few have the groundwork for even that. Only 41 percent say their IT environment is prepared for autonomous operations, and 19 percent of their IT operations are automated. Businesses are planning around a technology their own environments cannot support."
https://www.helpnetsecurity.com/2026/10/09/move-toward-autonomous-it-operations/
Q3 2026 Sets New Record For Ransomware Attacks
"Ransomware attacks reached their highest ever quarterly volume in the third quarter of 2026, according to an analysis by Comparitech. The firm identified a total of 2627 claimed attacks during the three-month period from July to September 2026. This is a 27% increase on the previous quarter, Q2 2026, and a 61% rise compared to Q3 2025."
https://www.infosecurity-magazine.com/news/q3-new-record-ransomware/
Formula Predicts When AI Chatbots Are At Risk Of Turning Bad
"Researchers from George Washington University have published a paper examining whether the time and cause of AI going rogue can be predicted; and if predicted, prevented. Since 50% of the world’s population carry devices that can run personal AI companions with no internet connection and limited security, they focused their research here. The lack of cloud-based safety filters, real-time telemetry, live monitoring, or the ability to patch weights once deployed provides a good test bed for analyzing AI’s chat-style transformer behavior when left to its own devices."
https://www.securityweek.com/formula-predicts-when-ai-chatbots-are-at-risk-of-turning-bad/
https://www.cell.com/patterns/fulltext/S2666-3899(26)00175-3
AI Transformation Across The Infrastructure Lifecycle: From Supply Chain To Fleet Operations
"AI infrastructure is a system, and every part of that system is connected. Decisions made in silicon and systems design influence how infrastructure is sourced, deployed, and operated across the fleet. And what we learn once that hardware is running can inform what we build next. This feedback matters because the system never stands still. Demand shifts, component constraints emerge, new capacity comes online, and hardware requirements evolve across the fleet. Keeping infrastructure reliable means continually learning and adapting as requirements change."
https://azure.microsoft.com/en-us/blog/ai-transformation-across-the-infrastructure-lifecycle-from-supply-chain-to-fleet-operations/
Former Employee Of Industrial Company Sentenced To 32 Months In Prison For Computer Attack And Extortion
"A Kansas City, Missouri man was sentenced to 32 months in prison for crimes related to his intentional damage to computer networks and extortion of employees, U.S. Attorney Robert Frazer announced. Daniel Rhyne, 59, previously pleaded guilty before U.S. District Judge Michael A. Shipp to a two-count Information that charged him with extortion in relation to a threat to cause damage to a protected computer and intentional damage to a protected computer. Judge Shipp imposed the sentence on September 28, 2026 in Trenton federal court."
https://www.justice.gov/usao-nj/pr/former-employee-industrial-company-sentenced-32-months-prison-computer-attack-and
https://www.securityweek.com/insider-cyber-extortion-plot-against-industrial-firm-lands-engineer-in-prison/

อ้างอิง
Electronic Transactions Development Agency (ETDA)