Cybersecurity News: Research Digest

Date saved: 2026-10-23 18:00 (PDT)

Sources: The Hacker News, Aviatrix Threat Research Center, BleepingComputer, WIRED, CISA, Department of Justice

Key findings

Pentagon DMDC breach exposes 3 million records

The Pentagon's Defense Manpower Data Center suffered a breach exposing personal data of 3 million military personnel and veterans, including Social Security numbers and military records. The breach was discovered in July 2026 but has been ongoing since October 2025. Attackers exploited zero-day vulnerabilities in third-party security appliances and Oracle PeopleSoft systems to gain initial network access. (Source)

North Korean hackers steal $387 million from Bitget

North Korean state-sponsored hackers exploited third-party zero-day vulnerabilities to compromise Bitget's wallet infrastructure, escalated privileges through harvested credentials, moved laterally to production systems, maintained persistent command-and-control through web shells, and exfiltrated $387 million in cryptocurrency. (Source)

KillSec ransomware operation dismantled, 16-year-old arrested

International law enforcement successfully dismantled the KillSec ransomware operation, arresting key members including a 16-year-old administrator. Police in Spain arrested the teenager, who is suspected of running the KillSec ransomware group. KillSec is accused of stealing data from organizations and threatening to publish it on its leak site unless they paid. (Source)

Cisco vulnerabilities actively exploited by ransomware and state actors

Cisco revealed that three distinct threat clusters linked to ransomware and state-sponsored attacks are exploiting two recently patched Secure Firewall Management Center vulnerabilities. The attacks leverage CVE-2026-20079 (CVSS score: 10.0), an authentication bypass vulnerability, and CVE-2026-20316. The clusters include Qilin affiliates and GRU-linked Sandworm, deploying Qilin ransomware, Cyclops Blink malware, and web shells. (Source)

CISA warns of actively exploited Ivanti zero-day

The US Cybersecurity and Infrastructure Security Agency issued an urgent warning about CVE-2026-104935, a high-severity authentication bypass vulnerability in Ivanti Connect Secure being actively exploited as a zero-day since October 1, 2026. (Source)

GitLab discloses maximum-severity remote code execution flaw

GitLab disclosed CVE-2026-110264, a maximum-severity (CVSS 10.0) remote code execution vulnerability rooted in an integer overflow flaw within GitLab's Regular Expression Compiler engine. The company also released emergency patches for CVE-2026-85706, a CVSS 10.0 path traversal flaw allowing unauthenticated attackers to read arbitrary files from the server. (Source)

Conti ransomware developer sentenced to four years

Oleksii Oleksiyovych Lytvynenko, a Ukrainian national and developer for the Conti ransomware operation, was sentenced to four years in US prison after pleading guilty to conspiracy to commit wire fraud. Between 2020 and June 2022, Lytvynenko and accomplices deployed ransomware against over 1,000 victims worldwide, including critical infrastructure across 31 countries and 47 US states. The FBI estimated the Conti group received more than $150 million in ransom payments. (Source)

Iran-linked hackers sanctioned by Treasury

The Treasury Department sanctioned five Iranian nationals as part of a sweeping 'economic D-Day' campaign against Tehran, accusing four of them of running a hacking operation directed by Iran's Ministry of Intelligence and Security. The action is part of Operation Economic Outcast, amid a string of Iran-linked attacks on US targets including a breach of FBI Director Kash Patel's personal email and attacks on water utilities. (Source)

ShinyHunters breaches McKesson, steals 284 million records

The ShinyHunters extortion group stole roughly 284 million records, including names, Social Security numbers, Medicaid details, and medication information, from McKesson's Snowflake and Salesforce environments, demanding over $55 million. (Source)

First fully automated ransomware operation documented

JADEPUFFER, documented by Sysdig, is the first ransomware operation confirmed to run entirely without human operators, with no commands issued and no decisions made by a person at a terminal. (Source)

The cybersecurity landscape in 2026 is defined by three converging trends: nation-state attacks targeting critical infrastructure at scale, ransomware operations becoming more automated and harder to attribute, and a string of maximum-severity vulnerabilities in widely deployed enterprise software that attackers are exploiting in the wild.

The Pentagon breach stands out as the most damaging recent incident. The Defense Manpower Data Center breach exposed personal data of 3 million military personnel and veterans, including Social Security numbers and military records, with the breach ongoing since October 2025 and discovered in July 2026. That is a year-long undetected intrusion into the personnel records of the US military.

At the same time, North Korean state-sponsored hackers exploited third-party zero-day vulnerabilities to steal $387 million from the Bitget cryptocurrency exchange, demonstrating that state actors are aggressively targeting crypto infrastructure for direct financial gain. The KillSec ransomware operation was dismantled by international law enforcement, with a 16-year-old administrator among those arrested, highlighting the increasingly young faces behind ransomware operations.

On the vulnerability front, Cisco warned that three distinct threat clusters are actively exploiting two flaws in its Secure Firewall Management Center software, including one with a CVSS score of 10.0. CISA issued an urgent warning about an Ivanti Connect Secure authentication bypass being actively exploited as a zero-day. GitLab disclosed a maximum-severity remote code execution vulnerability.

The throughline: the actors are getting faster, the tools are getting more automated, and the targets are increasingly critical infrastructure and financial systems. JADEPUFFER, documented by Sysdig, is the first ransomware operation confirmed to run entirely without human operators. (Source)