Date saved: 2026-10-26 03:01 (PDT)
Sources: CISA, FBI, SOCRadar, Group-IB, NyxLab, The Hacker News, BleepingComputer, The Verge, Security Affairs, PC Gamer, DW Documentary, CISA Known Exploited Vulnerabilities Catalog
Key findings
SafePay ransomware: CISA/FBI joint advisory, 600+ victims
- CISA / FBI / Joint Agencies (October 20, 2026): The CISA, FBI, U.S. Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency, and the UK's North West Regional Organised Crime Unit released a joint advisory on SafePay ransomware. Since August 2024, SafePay actors have targeted businesses and critical infrastructure across North America, South America, Europe, and Australia, affecting approximately 600 victim organizations. The advisory names five CVEs exploited by SafePay: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766. SafePay actors gain access by stealing or guessing passwords, exploiting vulnerabilities in security systems, and using phishing tactics. They then use legitimate system tools to move through networks, disable security protections, and encrypt files. Investigators collected TTPs and IOCs through August 2026. (Source)
- CISA press release (October 21, 2026): The FBI and partners are giving network defenders clear, actionable guidance to protect their organizations from one of 2026's most active ransomware groups. Public-facing devices with known vulnerabilities continue to be frequently targeted by threat actors like SafePay. CISA urges organizations to urgently patch the known exploited vulnerabilities in the advisory and conduct forensic triage. (Source)
AI-driven ransomware and firewall/VPN breaches
- SOCRadar / The Hacker News (October 23, 2026): Cybersecurity researchers discovered an artificial intelligence-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is an "Autonomous Red Team Kill Chain Framework" referred to as Phantom. The threat actor is assessed to be Russian-speaking and functions as both an intrusion and data-extortion operator, as well as an infrastructure provider supporting different partners across the ransomware ecosystem. The operators exploited edge and remote-access systems at scale, including FortiClient EMS, SimpleHelp, cPanel, and VPN gateways, and used AI-managed knowledge bases to track victims, stolen credentials, and campaign progress. SOCRadar estimates the campaign targeted 62 organizations, with 36 located in the United States. (Source)
- Group-IB / NyxLab / The Hacker News (October 23, 2026): A large-scale campaign has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. Artifacts from the investigation indicate that operators have obtained access to numerous organizations worldwide and have attempted to further compromise some victims, resulting in persistent remote access and data exfiltration. (Source)
Capcom data breach: 11.7 million email addresses exposed
- Security Affairs (October 22, 2026): Capcom disclosed a data breach exposing 11,774,247 email addresses and account details after hackers accessed its CAPCOM ID service. The breach was discovered on October 19. For 43 cases, hackers exposed date of birth, gender, country/region, and nickname. Attackers illegally changed passwords on 196 accounts, and the company has already reset them. Credit card details were not affected. Capcom notified the police and Japan's Personal Information Protection Commission on October 21. (Source)
- The Verge (October 22, 2026): Capcom data breach leaks over 11 million email addresses. The breach was discovered on October 19th. 196 passwords were changed but no existing passwords were leaked. 43 cases involved date of birth, gender, country, and nicknames being revealed. (Source)
- BleepingComputer (October 22, 2026): Japanese gaming giant Capcom confirmed that hackers breached its membership service, CAPCOM ID, exposing more than 11.7 million customer email addresses and associated information. Passwords for all other registered members have not been exposed. Credit card information remained unaffected. (Source)
Other major incidents: Japan emergency, Idaho schools, PHP2Shell, monster cloud fraud
- Breach Signal / Japan CERT (October 2026): Japan declared a cyberspace emergency as ransomware attacks exposed millions of records. The declaration follows a wave of AI-accelerated ransomware attacks that compromised personal data of over 14 million citizens and disrupted nearly 500 businesses. (Source)
- Cybernews / Breach Signal (October 2026): Hackers seized Idaho school cameras, locks, and HVAC systems, closing all schools for two days. District officials said attackers accessed student data and demanded a ransom that has not been disclosed. (Source)
- Google News (October 23, 2026): Critical PHP2Shell exploit code went public as hackers attempted to deploy botnet malware, enabling widespread exploitation of PHP-based web shells. (Source)
- The Hacker News (October 8, 2026): The U.S. Department of Justice announced charges against a 50-year-old U.S. and Israeli national for allegedly defrauding ransomware victims by secretly paying the attackers to obtain decryptors while claiming to use proprietary tools to recover their data. The MonsterCloud owner is accused of billing over $19 million while secretly paying ransoms. (Source)
- Spain / The Hacker News (October 1, 2026): Police in Spain arrested a 16-year-old whom investigators suspect of running the KillSec ransomware group, which is accused of stealing data from organizations and threatening to publish it on its leak site unless they paid. (Source)
The week's cybersecurity news is anchored by a joint advisory from CISA, the FBI, the U.S. Secret Service, German and British law enforcement, and other partners on SafePay ransomware, which the agencies say has targeted more than 600 organizations across North America, South America, Europe, and Australia since August 2024. The advisory names five known exploited vulnerabilities that SafePay actors exploit -- CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766 -- and documents the group's tactics: stealing or guessing passwords, exploiting edge device vulnerabilities, using VPN provider IP addresses to attain initial access, then moving through networks with legitimate system tools, disabling security protections, and encrypting files. This is not a vendor newsletter. It is a government alert with specific CVEs, specific TTPs, and specific mitigation guidance. The difference matters because the SafePay story is the week's headline cybersecurity incident in the sense that the government chose to name it publicly and jointly, across four countries.
The second throughline is the convergence of AI and ransomware. SOCRadar disclosed an AI-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups, using what it called an "Autonomous Red Team Kill Chain Framework" named Phantom. The operators exploited edge and remote-access systems at scale -- FortiClient EMS, SimpleHelp, cPanel, and VPN gateways -- and used AI-managed knowledge bases to track victims, stolen credentials, and campaign progress. Group-IB and NyxLab documented a separate large-scale campaign targeting exposed Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls, with operators obtaining access to numerous organizations worldwide and attempting further compromise. The AI acceleration of ransomware is no longer a projection. It is documented in the tools these groups are using.
The third major story is the Capcom data breach, which exposed 11.7 million email addresses and account details after hackers accessed the CAPCOM ID service. The breach was discovered on October 19. For 43 accounts, dates of birth, gender, country, and nicknames were also exposed. For 196 accounts, hackers changed passwords to lock owners out. Credit card information was not affected. The breach affects users of Capcom's Resident Evil, Monster Hunter, and Street Fighter online services. It is a reminder that even major game companies with dedicated security teams are vulnerable to the same credential theft and edge-device exploitation that the CISA advisory warns about.
Source links
- CISA: #StopRansomware: SafePay Ransomware Advisory AA26-293A
- CISA: CISA, FBI and Partners Warn Organizations of SafePay Ransomware
- The Hacker News: Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents
- The Hacker News: Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
- Security Affairs: Capcom Data Breach Exposes 11.7 Million Email Addresses
- The Verge: Capcom data breach leaks over 11 million email addresses
- BleepingComputer: Capcom confirms data breach affecting 11.7 million accounts
- DW Documentary: Cyberattacks, data encryption, extortion - How cybercriminals operate
- Ryan Doc: The Teenage Hacker the FBI Couldn't Catch - True Story Documentary
- Patriot Docs: The Hacker Who Accidentally Started A Cyber War