Espionage
According to F5 Labs, the Russian state sponsored group APT29, also known as Cozy Bear, is exploiting an Apple pointer authentication bypass that Apple fixed in 2024, chaining it with a WebKit remote code execution flaw. The attackers deliver information stealing malware, named AndroSnatch, AndroSnitch, and DarkSword, that grabs browser
Ransomware
NCC Group says reported ransomware victim claims rose 23 percent in the third quarter of 2026, from 2,325 to 2,865, with North America and Europe taking the largest share. Qilin was the most active group for a sixth straight quarter with 365 victims, followed closely by The Gentlemen
Data Breach
CM Alliance's October roundup reports that an anonymous hacker gained access to Denmark's Central Person Register through a former employee's account, which was reportedly protected only by the password 123456. About 8.8 million people had names, addresses, and personal registration numbers exposed. The
Ransomware
A joint advisory from CISA and the FBI, issued on October 22, says the SafePay ransomware gang has compromised at least 600 organizations since August 2024. According to the advisory as summarized in CM Alliance's October roundup, the group uses double extortion, which means it steals data before
News
According to Symantec and Carbon Black researchers, suspected China-linked threat actor Warlock is exploiting Microsoft SharePoint vulnerabilities to target critical infrastructure, government, and education organizations in Portuguese- and Spanish-speaking countries. The attackers use web shells to steal cryptographic keys and maintain access, abuse legitimate tools for remote connections,
News
According to Proofpoint, China-aligned espionage group TA419 is targeting U.S. AI policy experts with phishing emails impersonating trusted researchers and policymakers. The attackers first build trust through seemingly harmless outreach, then send links to convincing fake Microsoft OneDrive sign-in pages. Using adversary-in-the-middle (AitM) techniques,