Date saved: 2026-10-20 03:00 (PDT)
Sources: The Hacker News, Aviatrix Threat Research, Krebs on Security, Cisco, Reuters
Key findings
KillSec ransomware takedown and arrests
- The Hacker News (September 30, 2026): Police in Spain arrested a 16-year-old suspected of running the KillSec ransomware group, one of three people arrested when police also took control of KillSec's leak site. KillSec is accused of stealing data from organizations and threatening to publish it unless they paid. In a separate development, a suspected member of the ShinyHunters digital extortion group known as "Rey" (real name Saif al-Din Khader) was detained in Jordan on September 29 and is cooperating with US authorities. (Source)
Pentagon DMDC breach, 3 million records exposed
- Aviatrix Threat Research (Week 40, 2026): The Pentagon's Defense Manpower Data Center suffered a breach exposing personal data of 3 million military personnel and veterans, including Social Security numbers and military records. The breach was discovered in July 2026 but has been ongoing since October 2025, a full year of exposure. Simultaneously, North Korean state-sponsored hackers exploited third-party zero-day vulnerabilities to steal $387 million from the Bitget cryptocurrency exchange. (Source)
Cisco firewall vulnerabilities being actively exploited
- The Hacker News (2026): Cisco revealed that three distinct threat clusters linked to ransomware and state-sponsored attacks are exploiting two recently patched Secure Firewall Management Center (FMC) vulnerabilities. CVE-2026-20079 (CVSS 10.0) is an authentication bypass vulnerability allowing unauthenticated remote attackers to execute script files and obtain root access. CVE-2026-20316 (CVSS 5.3) allows low-privilege account login to access sensitive data. Multiple espionage-motivated threat clusters have also been found deploying a previously undocumented exploit kit called BlueMoon that chains vulnerabilities in Microsoft Windows and Google Chrome. (Source)
Ransomware negotiation fraud and international crackdowns
- Krebs on Security (2026): Brian Krebs reported the arrest of a ransomware negotiation firm's founder, tied to the investigation into ShinyHunters' breach of FBI data. Japan confirmed the arrest and extradition of a Qilin ransomware operative to Germany, a rare example of international cooperation against ransomware gangs. An Iranian national accused of breaching American universities to steal academic data and IP was extradited from Montenegro. A US Army soldier was sentenced to 70 months for hacking into AT&T and Verizon systems and stealing metadata on more than 100 million customers. (Source)
- Cisco / The Hacker News (2026): The international seizure of tools used by Integrity Tech, the firm behind the Flax Typhoon campaign, represents a notable multinational effort to disrupt Chinese state-linked hacking infrastructure. CISA's Known Exploited Vulnerabilities catalog added three entries: a Citrix NetScaler memory-corruption bug, two Zammad vulnerabilities (session fixation and privilege management), and a FortiMail path traversal flaw. (Source)