Date saved: 2026-10-18 18:00 (PDT)
Sources: Aviatrix Threat Research Center, The Hacker News, SentinelOne, BleepingComputer, Europol, CoinDesk, Department of Defense
Key findings
Pentagon DMDC breach exposes 3 million records
- Aviatrix Threat Research Center (Oct 15, 2026): The Pentagon's Defense Manpower Data Center (DMDC) suffered a breach exposing personal data of 3 million military personnel and veterans, including Social Security numbers, names, birthdates, contact details, race, gender, and military assignment records. The breach affected 2.8 million living and 294,000 deceased service members. It was discovered in July 2026 but has been ongoing since October 2025. The exposure resulted from unencrypted data storage and inadequate access controls. An additional FBI recruitment platform was also compromised, exposing special agent personal data. (Source)
North Korean $387M cryptocurrency heist
- Aviatrix Threat Research Center (Oct 15, 2026): North Korean state-sponsored hackers (DPRK APT) exploited third-party zero-day vulnerabilities in security appliances and Oracle PeopleSoft systems (CVE-2024-47575, CVSS 9.8) to compromise Bitget cryptocurrency exchange's wallet infrastructure. Attackers escalated privileges through harvested credentials, moved laterally to production systems, maintained persistent command-and-control through web shells, and exfiltrated $387 million in cryptocurrency. The attack demonstrated sophisticated supply chain exploitation through third-party vulnerabilities. (Source)
- CoinDesk (Oct 15, 2026): Bitget exchange suffered a $387 million cryptocurrency heist, with North Korean actors suspected. The breach occurred through zero-day vulnerabilities in third-party security infrastructure. (Source)
KillSec ransomware dismantled, 16-year-old arrested
- Aviatrix / Europol (Oct 2026): International law enforcement successfully dismantled the KillSec ransomware operation under "Operation KillSwitch," arresting key members including a 16-year-old administrator. Police in Spain arrested the teenager on September 30, 2026, along with two others, and took control of KillSec's leak site. KillSec was accused of stealing data from organizations and threatening to publish it unless ransom was paid. (Source)
- The Hacker News (Sep 2026): Police in Spain arrested a 16-year-old suspected of running the KillSec ransomware group. The 16-year-old was one of three people arrested on September 30 when police also took control of the group's leak site. (Source)
ShinyHunters suspect detained in Jordan
- The Hacker News / Reuters (Sep 2026): A suspected member of the ShinyHunters digital extortion group, known by the alias "Rey" (real name Saif al-Din Khader), was detained by authorities in Jordan on September 29, 2026, and is cooperating with the FBI and law enforcement to identify other group members. (Source)
Ransomware fraud charges and other arrests
- The Hacker News (2026): The US Department of Justice charged Zohar Pinhasi (aka Zack Silver/Zack Green), a 50-year-old US and Israeli national, with two counts of wire fraud and one count of wire fraud conspiracy for allegedly defrauding ransomware victims by secretly paying attackers to obtain decryptors while claiming to use proprietary tools. (Source)
Nation-state threats and US responses
- The Hacker News (2026): The US DOJ charged 14 people and seized about 187 computers and KVM devices as part of efforts to disrupt North Korea's fraudulent remote IT worker scheme, affecting more than 70 US companies. The State Department is offering up to $10 million for information leading to Zhang Yu, a Chinese national charged in connection with the 2021 Microsoft Exchange Server attacks (HAFNIUM). The Salt Typhoon Chinese state-sponsored threat group continues to target critical organizations despite remediation of last year's telecom breaches. Cisco revealed that three distinct threat clusters linked to ransomware and state-sponsored attacks are exploiting two recently patched Secure Firewall Management Center (FMC) vulnerabilities. (Source)
- BleepingComputer (2026): The FBI recruitment platform was breached by the ShinyHunters group. The Pentagon DMDC breach notification was formally released by the Defense Department. (Source)
Vulnerabilities and zero-days
- Aviatrix (Oct 2026): Palo Alto Networks disclosed CVE-2026-0322, a high-severity remote code execution vulnerability in PAN-OS management interface enabling authenticated attackers to execute arbitrary code with root privileges. A zero-day vulnerability in Cleo's managed file transfer products is being exploited. A vulnerability called "SneakPeek" exposes critical AI development tool security gaps in Anthropic's Claude Code desktop. (Source)
Source links
- Aviatrix: Pentagon DMDC Breach, KillSec Takedown & $387M Bitget Hack (Week 40)
- The Hacker News: ransomware latest news
- The Hacker News: Nation-State latest news
- BleepingComputer: FBI recruitment platform breached by ShinyHunters
- Europol: Operation KillSwitch Dismantles KillSec Ransomware Gang
- Department of Defense: DMDC Data Breach Notification