Cybersecurity News, Research Digest

Date saved: 2026-10-19 03:00 (PDT)

Sources: Aviatrix Threat Research Center, The Hacker News, Security Boulevard, FBI, CISA, Google Mandiant

Key findings

Aviatrix Threat Research Center (2026): The Pentagon's Defense Manpower Data Center (DMDC) suffered a breach exposing personal data of 3 million military personnel and veterans, including Social Security numbers and military records. The breach was discovered in July 2026 but has been ongoing since October 2025. The exposure was attributed to unencrypted data storage and inadequate access controls. (Source)

Aviatrix / The Hacker News (2026): North Korean state-sponsored hackers exploited third-party zero-day vulnerabilities to steal $387 million from the Bitget cryptocurrency exchange, escalating privileges through harvested credentials and maintaining persistent C2 through web shells. Simultaneously, international law enforcement successfully dismantled the KillSec ransomware operation, arresting key members including a 16-year-old administrator in Spain. Police in Spain arrested the suspected administrator and main operator of KillSec on September 30, taking control of the group's leak site and servers. KillSec is accused of stealing data from organizations and threatening to publish it unless they paid. (Source)

The Hacker News (October 1, 2026): The 16-year-old arrested in Spain was identified by Hamburg police as KillSec's suspected administrator and main operator. He was one of three people arrested. (Source)

The Hacker News (2026): The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent warning about CVE-2026-104935, a high-severity authentication bypass vulnerability in Ivanti Connect Secure (ICS) being actively exploited as a zero-day since October 1, 2026. The flaw (CVSS score: 8.6) impacts ICS versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior, allowing a remote unauthenticated attacker to execute arbitrary commands. CISA added the flaw to its Known Exploited Vulnerabilities catalog, requiring Federal Civilian Executive Branch agencies to apply fixes by October 16, 2026. The agency said cyber threat actors are exploiting the zero-day "to conduct credential theft and data exfiltration." (Source)

Aviatrix (2026): In October 2026, the FBI conducted Operation Lonestar Roundup, raiding 40 residences in Texas and seizing 187 laptops used by North Korean threat group Famous Chollima (WageMole) in fraudulent IT worker schemes. Authorities arrested two U.S. nationals and charged 14 individuals total, including 12 Chinese defendants, in schemes that affected over 70 companies and generated approximately $3 million since 2019. In a separate case, Abdulrahman Alfozan, a 35-year-old Saudi national and OpenAI engineering lead, was arrested by the FBI for allegedly planting a sophisticated recording device in an executive conference room at OpenAI's San Francisco offices. (Source)

Security Boulevard (October 2026): The FBI arrested Canadian cybersecurity expert Edward Dubrovsky, accusing him of conspiring with ShinyHunters in the breach of the agency's systems. The attack exposed sensitive information of thousands of FBI employees, including job details, specializations, and medical records, after hackers exploited an unpatched Oracle PeopleSoft vulnerability (CVE-2026-35273). ShinyHunters, a prolific extortion group, has breached more than 140 organizations since 2025 and extorted $70 million. Dubrovsky was arrested at a cybersecurity conference in Pennsylvania and is being charged in Texas with conspiracy to commit extortion. The FBI has also arrested other ShinyHunters associates including a Canadian citizen in Pennsylvania, Pepijn Van der Stap in the Netherlands, and teenager Saif al-Din Khader ("Rey") in Jordan, who is cooperating with law enforcement. (Source)

The Hacker News (2026): Hackers tied to a Chinese cybersecurity company stole email from government organizations, law enforcement agencies, healthcare systems, and religious institutions in Southeast Asia, the FBI and agencies in six other countries said on October 8. The U.S. State Department is offering up to $10 million for information leading to the identification or location of Zhang Yu, a Chinese national charged in connection with the 2021 Microsoft Exchange Server attacks known as HAFNIUM. Zhang remains at large. (Source)

The Hacker News (October 9, 2026): FBI Director Kash Patel announced the arrest of another suspected co-conspirator of ShinyHunters, a Canadian citizen arrested in Pennsylvania. (Source)