{ "updated": "2026-11-08", "sectors": { "manufacturing": "Manufacturing", "technology": "Technology and IT services", "healthcare": "Healthcare", "government": "Government", "education": "Education", "finance": "Finance", "critical": "Critical infrastructure", "retail": "Retail and food", "professional": "Professional services", "crypto": "Crypto and Web3", "defense": "Defense and telecom" }, "overview": { "ransomware": { "title": "Ransomware in Q3 2026", "stats": [ { "n": "2,627", "t": "attacks claimed on leak sites in Q3, up 29% on Q2. Only 247 were confirmed by victims.", "s": { "l": "Comparitech: ransomware roundup, Q3 2026", "u": "https://www.comparitech.com/news/ransomware-roundup-q3-2026-stats-on-attacks-ransoms-and-active-gangs/", "d": "2026-10-06" } }, { "n": "857", "t": "victims from 82 groups in September, down 21% from 1,086 in August.", "s": { "l": "Brandefense: ransomware in September 2026", "u": "https://brandefense.io/blog/ransomware-september-2026-victims-groups-sectors-countries/", "d": "2026-10-27" } }, { "n": "$400,000", "t": "median ransom paid in Q3, with an average near $1.03 million. About 80% of incidents ended without a payment.", "s": { "l": "Veeam: Coveware Q3 2026 extortion payment trends", "u": "https://www.veeam.com/blog/cyber-extortion-payment-trends-q3-2026.html", "d": "2026-10-28" } } ], "entry": { "title": "How attackers got in, Q3 2026", "note": "Share of incidents handled by Coveware.", "rows": [ { "l": "Phishing and social engineering", "v": "about 29%" }, { "l": "Remote-access compromise", "v": "22% to 23%" }, { "l": "Stolen credentials", "v": "14% to 15%" }, { "l": "Unpatched edge devices", "v": "11% to 12%" } ], "s": { "l": "Veeam: Coveware Q3 2026 extortion payment trends", "u": "https://www.veeam.com/blog/cyber-extortion-payment-trends-q3-2026.html", "d": "2026-10-28" } }, "sectors": { "title": "Claimed victims by sector, Q3 2026", "note": "The two trackers group sectors differently, so a dash means the source did not report that sector.", "rows": [ { "l": "Manufacturing", "a": 478, "b": 457 }, { "l": "Technology", "a": 262, "b": 354 }, { "l": "Finance", "a": 199, "b": null }, { "l": "Healthcare", "a": 188, "b": 264 }, { "l": "Government", "a": 124, "b": null }, { "l": "Education", "a": 75, "b": null }, { "l": "Business services", "a": null, "b": 378 } ], "ha": "Comparitech", "hb": "CyberMaxx", "sa": { "l": "Comparitech: ransomware roundup, Q3 2026", "u": "https://www.comparitech.com/news/ransomware-roundup-q3-2026-stats-on-attacks-ransoms-and-active-gangs/", "d": "2026-10-06" }, "sb": { "l": "CyberMaxx: Q3 2026 ransomware report", "u": "https://www.cybermaxx.com/resources/cybermaxxs-q3-2026-ransomware-research-report-reveals-surge-in-attacks/", "d": "2026-10-22" } }, "note": "Claims are posted by criminals and many are never confirmed. CyberMaxx counted 3,133 claims in Q3, so totals differ by tracker. The United States has about 30% to 41% of victims depending on the tracker." }, "crypto": { "title": "Crypto theft in Q3 2026", "stats": [ { "n": "$1.26 billion", "t": "lost to hacks across 247 incidents in Q3, according to CertiK.", "s": { "l": "CoinInsider: crypto lost $1.26 billion to hacks in Q3 (CertiK data)", "u": "https://www.coininsider.org/news/crypto-lost-1-26-billion-to-hacks-in-q3-even-as-bitcoin-posted-its-best-quarter-since-2024/", "d": "2026-10-02" } }, { "n": "$768.5 million", "t": "stolen in September alone, the worst month of 2026, across 99 incidents.", "s": { "l": "CoinInsider: crypto lost $1.26 billion to hacks in Q3 (CertiK data)", "u": "https://www.coininsider.org/news/crypto-lost-1-26-billion-to-hacks-in-q3-even-as-bitcoin-posted-its-best-quarter-since-2024/", "d": "2026-10-02" } } ], "note": "Hacken counts $1.18 billion across 107 incidents and says about 77% came from compromised suppliers, developer tools or infrastructure rather than flaws in smart contracts. Totals differ by tracker." } }, "campaigns": [ { "id": "qilin", "name": "Qilin", "domain": "it", "kind": "Ransomware-as-a-service", "summary": "One of the two most active ransomware operations of 2026. Criminal affiliates rent Qilin's tools and split the ransom with its operators. Its leak site claimed 357 victims in Q3 and 75 in September.", "sectors": [ "professional", "government", "healthcare", "finance", "manufacturing", "technology", "retail" ], "targets": "Professional services, public services, healthcare, financial services, manufacturing, high tech, retail and hospitality.", "regions": "Mostly North America.", "entry": [ "Fortinet FortiGate firewalls", "WatchGuard Firebox, flaw CVE-2025-14733", "Stolen login credentials" ], "note": "The service offers affiliates a \"Call Lawyer\" feature to add legal pressure on victims.", "help": [ "Keep offline backups and test a restore.", "Turn on multi-factor authentication for every remote-access and VPN account.", "Patch or replace internet-facing firewalls and VPN gateways first, and take management pages off the internet." ], "event": "", "sources": [ { "l": "Arete: Qilin ransomware spotlight", "u": "https://areteir.com/resources/malware-spotlight-qilin-ransomware", "d": "2026-08-19" }, { "l": "Comparitech: ransomware roundup, Q3 2026", "u": "https://www.comparitech.com/news/ransomware-roundup-q3-2026-stats-on-attacks-ransoms-and-active-gangs/", "d": "2026-10-06" }, { "l": "Brandefense: ransomware in September 2026", "u": "https://brandefense.io/blog/ransomware-september-2026-victims-groups-sectors-countries/", "d": "2026-10-27" } ] }, { "id": "gentlemen", "name": "The Gentlemen", "domain": "it", "kind": "Ransomware-as-a-service", "summary": "A fast-growing operation that pays affiliates 90% of each ransom. It builds for Windows, Linux and VMware ESXi servers. It claimed 342 victims in Q3 and led all groups in September with 105.", "sectors": [ "manufacturing", "technology", "healthcare" ], "targets": "Manufacturing first, then technology and healthcare.", "regions": "United States, United Kingdom and Germany.", "entry": [ "Internet-facing VPNs", "Remote-access gateways", "Firewall login portals that are unpatched or badly configured" ], "note": "Check Point had counted more than 320 victims on its leak site by April 2026.", "help": [ "Keep offline backups and test a restore.", "Turn on multi-factor authentication for every remote-access and VPN account.", "Patch or replace internet-facing firewalls and VPN gateways first, and take management pages off the internet." ], "event": "", "sources": [ { "l": "Check Point: The Gentlemen ransomware", "u": "https://blog.checkpoint.com/research/the-gentlemen-a-new-ransomware-threat-climbing-the-charts-fast/", "d": "2026-04-20" }, { "l": "Comparitech: ransomware roundup, Q3 2026", "u": "https://www.comparitech.com/news/ransomware-roundup-q3-2026-stats-on-attacks-ransoms-and-active-gangs/", "d": "2026-10-06" }, { "l": "Brandefense: ransomware in September 2026", "u": "https://brandefense.io/blog/ransomware-september-2026-victims-groups-sectors-countries/", "d": "2026-10-27" } ] }, { "id": "akira", "name": "Akira", "domain": "it", "kind": "Ransomware-as-a-service", "summary": "A long-running group that CISA says has taken in about $244 million. Its claims fell 23% in Q3 compared with Q2 but it remained active, with 36 victims in September. It has expanded to attack Nutanix virtual machines.", "sectors": [ "manufacturing", "education", "technology", "healthcare", "finance", "retail" ], "targets": "Manufacturing, education, IT, healthcare, financial services, and food and agriculture.", "regions": "Not stated in the sources we checked.", "entry": [ "SonicWall flaw CVE-2024-40766", "Stolen VPN credentials and password spraying", "Veeam backup flaws CVE-2023-27532 and CVE-2024-40711" ], "note": "Entry details come from CISA's advisory update, reported in November 2025, so check them against newer advice.", "help": [ "Keep offline backups and test a restore.", "Turn on multi-factor authentication for every remote-access and VPN account.", "Patch or replace internet-facing firewalls and VPN gateways first, and take management pages off the internet." ], "event": "", "sources": [ { "l": "The Register: CISA update on Akira ransomware", "u": "https://www.theregister.com/2025/11/14/cisa_akira_ransomware/", "d": "2025-11-14" }, { "l": "Comparitech: ransomware roundup, Q3 2026", "u": "https://www.comparitech.com/news/ransomware-roundup-q3-2026-stats-on-attacks-ransoms-and-active-gangs/", "d": "2026-10-06" }, { "l": "Brandefense: ransomware in September 2026", "u": "https://brandefense.io/blog/ransomware-september-2026-victims-groups-sectors-countries/", "d": "2026-10-27" } ] }, { "id": "safepay", "name": "SafePay", "domain": "it", "kind": "Ransomware group", "summary": "CISA and the FBI warned on 20 October 2026 that SafePay has listed more than 600 victims since August 2024, including critical infrastructure. The group also telephones victims to pressure them.", "sectors": [ "government", "manufacturing", "technology", "finance", "healthcare" ], "targets": "Businesses, critical infrastructure and government bodies, including government bodies in Latin America.", "regions": "United States, Europe (including Germany) and Latin America.", "entry": [ "Password guessing", "Old flaws in Cisco, Veeam and SonicWall products (CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, CVE-2024-40766)", "Phishing and network scanning", "Abuse of AnyDesk and TeamViewer remote tools" ], "note": "", "help": [ "Keep offline backups and test a restore.", "Turn on multi-factor authentication for every remote-access and VPN account.", "Patch or replace internet-facing firewalls and VPN gateways first, and take management pages off the internet.", "Block remote-support tools you do not use, and be wary of unexpected phone calls from \"IT support\"." ], "event": "", "sources": [ { "l": "The Record: FBI says SafePay is among the most active, 600 victims", "u": "https://therecord.media/fbi-says-safepay-ransomware-gang-among-most-active-600-victims", "d": "2026-10-20" }, { "l": "Brandefense: ransomware in September 2026", "u": "https://brandefense.io/blog/ransomware-september-2026-victims-groups-sectors-countries/", "d": "2026-10-27" } ] }, { "id": "medusa", "name": "Medusa", "domain": "it", "kind": "Ransomware-as-a-service", "summary": "More than 500 victims since June 2021. A joint CISA, FBI and HHS update in August 2026 warns that Medusa affiliates buy access from brokers and exploit new flaws within a day of disclosure.", "sectors": [ "healthcare", "manufacturing", "government", "technology", "finance", "education", "professional" ], "targets": "Healthcare, defense, manufacturing, government services, IT and financial firms, plus education, insurance and law.", "regions": "Not stated in the source.", "entry": [ "Access bought from brokers (reported prices from $100 to $1 million)", "Phishing", "New flaws in ScreenConnect, Fortinet EMS, GoAnywhere and BeyondTrust, sometimes within 24 hours" ], "note": "", "help": [ "Keep offline backups and test a restore.", "Turn on multi-factor authentication for every remote-access and VPN account.", "Patch or replace internet-facing firewalls and VPN gateways first, and take management pages off the internet.", "Apply security updates to remote-support and file-transfer tools within days, not weeks." ], "event": "", "sources": [ { "l": "Help Net Security: Medusa ransomware, CISA warning", "u": "https://www.helpnetsecurity.com/2026/08/19/medusa-ransomware-cisa-warning/", "d": "2026-08-19" } ] }, { "id": "gunra", "name": "Gunra", "domain": "it", "kind": "Ransomware-as-a-service", "summary": "A service operating since April 2025, built on leaked code from the Conti ransomware. An FBI and CISA advisory on 10 August 2026 describes attacks on government bodies and critical infrastructure.", "sectors": [ "government", "healthcare", "finance", "manufacturing", "critical" ], "targets": "Government and critical infrastructure, including healthcare, finance, manufacturing, construction, transport and utilities.", "regions": "Not stated in the source.", "entry": [ "Fortinet flaws CVE-2024-55591 and CVE-2025-24472 (FortiOS and FortiProxy)", "SSL-VPN accounts left on default passwords", "Weak SSH passwords" ], "note": "", "help": [ "Keep offline backups and test a restore.", "Turn on multi-factor authentication for every remote-access and VPN account.", "Patch or replace internet-facing firewalls and VPN gateways first, and take management pages off the internet.", "Change default passwords on every network device." ], "event": "", "sources": [ { "l": "FBI and CISA advisory on Gunra ransomware (PDF)", "u": "https://www.ic3.gov/CSA/2026/260810.pdf", "d": "2026-08-10" } ] }, { "id": "clop-windchill", "name": "Clop: Windchill and FlexPLM data theft", "domain": "it", "kind": "Data theft and extortion", "summary": "Attackers broke into PTC Windchill and FlexPLM product-design servers using flaw CVE-2026-12569 (severity 9.3) and stole files. CISA listed the flaw as exploited in late June 2026. Clop made 110 claims in Q3 and 24 in September.", "sectors": [ "manufacturing", "retail", "technology" ], "targets": "Manufacturing, automotive, aerospace and retail firms, and the engineering and product-design data they keep in these systems.", "regions": "Not stated in the sources.", "entry": [ "Unpatched PTC Windchill and FlexPLM servers exposed to the internet" ], "note": "ReliaQuest could not confirm that Clop is behind this wave, although Ransom-ISAC confirmed the attacks.", "help": [ "Patch Windchill and FlexPLM now, and check whether the servers are reachable from the internet.", "Look for signs of past intrusion, because data theft leaves little visible damage." ], "event": "", "sources": [ { "l": "BleepingComputer: Clop targets Windchill and FlexPLM", "u": "https://bleepingcomputer.com/news/security/clop-ransomware-targets-windchill-flexplm-in-data-theft-attacks", "d": "2026-07-24" }, { "l": "The Hacker News: Cl0p affiliates target internet-exposed systems", "u": "https://thehackernews.com/2026/07/cl0p-affiliates-target-internet-exposed.html", "d": "2026-07-25" }, { "l": "CyberMaxx: Q3 2026 ransomware report", "u": "https://www.cybermaxx.com/resources/cybermaxxs-q3-2026-ransomware-research-report-reveals-surge-in-attacks/", "d": "2026-10-22" } ] }, { "id": "direwolf", "name": "Dire Wolf", "domain": "it", "kind": "Ransomware group", "summary": "A human-operated group that steals data and then encrypts, a tactic called double extortion. It had listed 137 victims in 37 countries by late October 2026, and its Q3 claims rose about 1,450% on Q2.", "sectors": [ "technology", "healthcare", "professional" ], "targets": "Technology, healthcare and professional services, each about 15% of victims.", "regions": "Victims in 37 countries.", "entry": [ "Not covered by the sources we checked" ], "note": "", "help": [ "Keep offline backups and test a restore.", "Turn on multi-factor authentication for every remote-access and VPN account.", "Patch or replace internet-facing firewalls and VPN gateways first, and take management pages off the internet." ], "event": "", "sources": [ { "l": "Provendata: Dire Wolf ransomware", "u": "https://www.provendata.com/blog/dire-wolf-ransomware", "d": "2026-01-21" }, { "l": "Comparitech: ransomware roundup, Q3 2026", "u": "https://www.comparitech.com/news/ransomware-roundup-q3-2026-stats-on-attacks-ransoms-and-active-gangs/", "d": "2026-10-06" } ] }, { "id": "rhysida", "name": "Rhysida", "domain": "it", "kind": "Ransomware group", "summary": "Claims rose about 200% in Q3. Examples from Comparitech's quarterly roundup: the Government of Berlin (about $2.3 million demanded, 5.79 TB claimed) and a hospital in the Philippines.", "sectors": [ "government", "healthcare" ], "targets": "Government bodies and hospitals, in the examples reported.", "regions": "Germany and the Philippines in the examples.", "entry": [ "Not covered by the sources we checked" ], "note": "", "help": [ "Keep offline backups and test a restore.", "Turn on multi-factor authentication for every remote-access and VPN account.", "Patch or replace internet-facing firewalls and VPN gateways first, and take management pages off the internet." ], "event": "", "sources": [ { "l": "Comparitech: ransomware roundup, Q3 2026", "u": "https://www.comparitech.com/news/ransomware-roundup-q3-2026-stats-on-attacks-ransoms-and-active-gangs/", "d": "2026-10-06" } ] }, { "id": "shai-hulud", "name": "Poisoned software packages and developer tools", "domain": "it", "kind": "Supply chain", "summary": "In May 2026 attackers published about 170 booby-trapped npm and PyPI packages (404 malicious versions), including TanStack, Mistral AI, UiPath and OpenSearch libraries. A message on the attacker's site was signed \"TeamPCP\", the group behind the March 2026 Trivy compromise. The malware steals cloud and developer keys, then plants files so that the next developer who opens an infected project is also infected. On 21 October a separate incident hijacked the LiteLLM release pipeline. On 29 October a tampered Claude Code extension was served from Cursor's extension marketplace for about 11 hours, planting an SSH backdoor on developer machines. Anthropic says it did not build or publish that extension and that its own channels are unaffected.", "sectors": [ "technology" ], "targets": "Software developers, build servers and companies that use AI and cloud tooling.", "regions": "Worldwide.", "entry": [ "Installing or importing a poisoned package", "Opening a project that contains planted .claude/settings.json or .vscode/tasks.json files", "A tampered editor extension installed from a marketplace" ], "note": "", "help": [ "Check lockfiles for the affected packages and versions listed by SafeDep, and rotate any keys a build server held.", "Delay adopting brand-new package versions for a few days.", "Review unexpected .claude and .vscode files in repositories.", "If you installed the Claude Code extension from Cursor's marketplace on 29 October, treat the machine as compromised and follow the removal steps in Phorion's advisory." ], "event": "it-cursor-extension", "sources": [ { "l": "Phorion: official Claude Code extension compromise, security advisory", "u": "https://phorion.io/blog/offical-claude-code-vsx-compromise/", "d": "2026-10-30" }, { "l": "The Register: Anthropic says the Claude Code extension compromise was not its own", "u": "https://www.theregister.com/cyber-crime/2026/10/30/anthropic-that-claude-code-extension-compromise-couldnt-be-us/5306682", "d": "2026-10-30" }, { "l": "SafeDep: mass npm and PyPI supply chain attack", "u": "https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral", "d": "2026-05-12" } ] }, { "id": "silent-train", "name": "Volt Typhoon: Silent Train", "domain": "it", "kind": "State-linked espionage", "summary": "On 29 October 2026 Lumen's Black Lotus Labs described Silent Train, a rotating relay network of hijacked home routers and IoT devices that the Chinese state-backed group Volt Typhoon uses to hide its most sensitive intrusions. The group exploits zero-day flaws in management systems, so it needs little lateral movement.", "sectors": [ "government", "critical", "defense" ], "targets": "US government bodies, telecom and satellite providers, defense contractors, managed service providers, IT firms, military-linked universities, and water, energy, transport, aviation and emergency services.", "regions": "Hawaii, California and Texas were targeted most often, with links to military bases and Indo-Pacific logistics.", "entry": [ "Versa Director CVE-2024-39717", "N-able N-Central CVE-2025-8875 and CVE-2025-8876", "Cisco Catalyst SD-WAN CVE-2026-20127", "VeloCloud Orchestrator CVE-2026-16812", "Possibly a Quest KACE zero-day" ], "note": "The source article gives no defensive advice. The steps below are general guidance.", "help": [ "Patch management, SD-WAN and remote-management platforms first, and keep their admin pages off the internet.", "Send logs to a separate system that device administrators cannot edit.", "Replace end-of-life home and small-office routers that could serve as relay hops." ], "event": "", "sources": [ { "l": "Help Net Security: Volt Typhoon and the Silent Train relay network", "u": "https://www.helpnetsecurity.com/2026/10/29/volt-typhoon-silent-train-relay-network/", "d": "2026-10-29" } ] }, { "id": "storm-0940", "name": "Storm-0940 and AI-driven attacks on cloud backup", "domain": "it", "kind": "State-linked espionage", "summary": "Microsoft says the China state-aligned group Storm-0940 used an open-source AI penetration-testing framework against ConnectWise Cloud Backup and tried to sign in to more than 2,250 customer Microsoft 365 tenants. Most attempts failed, but it gained privileged access at several organizations, sometimes in under three hours.", "sectors": [ "technology" ], "targets": "IT service providers and the businesses whose Microsoft 365 data they back up.", "regions": "Not stated.", "entry": [ "Scanning and password spraying", "Abuse of OAuth app permissions inside customer tenants" ], "note": "", "help": [ "List the third-party apps with permission in your Microsoft 365 tenant and remove those you do not use.", "Ask your IT provider whether it uses ConnectWise Cloud Backup or SkyKick, and what it found." ], "event": "it-connectwise", "sources": [ { "l": "Dark Reading: Microsoft links Storm-0940 to ConnectWise attack", "u": "https://darkreading.com/cyberattacks-data-breaches/microsoft-storm-0940-connectwise-supply-chain-attack", "d": "" }, { "l": "Redmondmag: hackers used AI to speed up the ConnectWise attack", "u": "https://redmondmag.com/articles/2026/10/22/hackers-used-ai-to-speed-up-connectwise-cloud-backup-attack.aspx", "d": "2026-10-22" } ] }, { "id": "armory-castle", "name": "Armory Castle: remote-support zero-day", "domain": "it", "kind": "State-linked espionage", "summary": "A China-nexus espionage group, tracked as Armory Castle (also UNC5221 or Warp Panda), used a zero-day in BeyondTrust Remote Support (CVE-2026-102764, severity 9.3) against one self-hosted appliance on 29 August. CISA listed the flaw as exploited on 16 October.", "sectors": [ "technology", "government" ], "targets": "Organizations that run self-hosted BeyondTrust Remote Support, a tool with privileged reach into many computers.", "regions": "Not stated.", "entry": [ "A flaw in the appliance's internal messaging component" ], "note": "", "help": [ "Self-hosted customers should patch at once and check for earlier compromise.", "Keep remote-support appliances off the open internet where possible." ], "event": "it-beyondtrust", "sources": [ { "l": "The Hacker News: China-linked hackers exploited BeyondTrust zero-day", "u": "https://thehackernews.com/2026/10/china-linked-hackers-exploited.html", "d": "" } ] }, { "id": "ivanti-uta0576", "name": "UTA0576: Ivanti Connect Secure zero-day chain", "domain": "it", "kind": "Zero-day exploitation", "summary": "Volexity found an attacker, tracked as UTA0576, chaining flaws in Ivanti Connect Secure VPN gateways to take root control of an appliance that was fully patched at the time. Exploitation began on 3 October. CISA lists CVE-2026-111357 and CVE-2026-118527 as exploited, with federal deadlines of 2 and 13 November, and Help Net Security reports that Ivanti has now fixed all three flaws.", "sectors": [], "targets": "Organizations that run Ivanti Connect Secure. Volexity described one appliance at one customer, and no sectors or victim counts have been published.", "regions": "Not stated.", "entry": [ "CVE-2026-104935: authentication bypass and code execution on the VPN appliance", "A privilege escalation to root, and a file-upload flaw (CVE-2026-118527) that CISA lists as exploited" ], "note": "Volexity assessed with low confidence that the motive is criminal rather than espionage. The operation was disrupted, so the attacker's final goal is unknown. Volexity says the activity gets past Ivanti's Integrity Checker Tool.", "help": [ "Install the fixed Connect Secure release from Ivanti's advisory, then investigate for compromise instead of relying on the Integrity Checker Tool.", "Preserve memory and logs before rebooting, and use the indicators and YARA rules Volexity published.", "Rotate credentials the appliance could reach, including domain logins, and keep its admin pages off the internet." ], "event": "it-ivanti-ics", "sources": [ { "l": "The Hacker News: attacker chains three Ivanti Connect Secure flaws", "u": "https://thehackernews.com/2026/10/attacker-chains-three-ivanti-connect.html", "d": "2026-10-13" }, { "l": "Help Net Security: CISA tells federal agencies to remediate exploited Ivanti Connect Secure vulnerabilities", "u": "https://www.helpnetsecurity.com/2026/11/02/cisa-to-federal-agencies-remediate-exploited-ivanti-connect-secure-vulnerabilities-cve-2026-111357-cve-2026-118527/", "d": "2026-11-02" } ] }, { "id": "gheist", "name": "Gheist: stolen GitHub tokens used to dump secrets", "domain": "it", "kind": "Supply chain", "summary": "Wiz has tracked Gheist since 15 September. Attackers use stolen GitHub tokens to push a workflow file to every private repository the token can reach. The workflow prints the repository's secrets in an encoded form that GitHub's log masking does not catch, and the tool downloads the log and deletes the run seconds later. As of 24 October Wiz had seen more than 13,500 planted branches from more than 850 compromised accounts, and about two-thirds of the accounts had since disappeared from GitHub. Around 19 October a second job appeared that targets self-hosted runners; Wiz describes it as buggy and reports no successful run.", "sectors": [ "technology" ], "targets": "Developers and companies that keep code and cloud credentials in GitHub, especially those with production secrets in repository settings or self-hosted runners.", "regions": "Worldwide.", "entry": [ "Stolen GitHub tokens, which Wiz traced to infostealer logs and to tokens exposed in earlier supply-chain attacks such as the March Trivy compromise" ], "note": "", "help": [ "Rotate every secret the affected repositories could read and revoke the tokens that pushed the commits.", "Look for ci-sync- branches that add only a sync-check workflow, and do not approve held runs of it.", "Use GitHub Apps or short-lived fine-grained tokens, require reviewers on environments that hold production secrets, and run self-hosted runners as short-lived machines." ], "event": "", "sources": [ { "l": "The Hacker News: Gheist uses stolen GitHub tokens to harvest secrets", "u": "https://thehackernews.com/2026/10/gheist-uses-stolen-github-tokens-to.html", "d": "" } ] }, { "id": "water-plc", "name": "Attacks on US water and wastewater controllers", "domain": "ot", "kind": "Attacks on industrial controllers", "summary": "On 26 to 27 July 2026 attackers hit more than 30 community water systems in Minnesota. The FBI and EPA reported incidents at utilities in at least seven states since 27 July, and Michigan found nine more systems. Effects included lost visibility and control, pressure loss, flooding, communications outages and boil-water notices. Public reporting shows no confirmed contamination.", "sectors": [ "critical" ], "targets": "Small and mid-sized water and wastewater utilities that leave controllers reachable from the internet.", "regions": "Minnesota, Michigan and at least five other US states. Separate unverified claims relate to Canadian water systems.", "entry": [ "Controllers exposed to the internet, mainly Rockwell Allen-Bradley MicroLogix 1100 and 1400", "Earlier related activity also involved Rockwell CompactLogix and Micro850, Schneider BMX P34 and Modicon M340, and Siemens S7-1200 controllers", "Attackers changed IP addresses and passwords to lock operators out and, in at least one case, altered the controller's project file" ], "note": "No one has formally been blamed. The pattern resembles Iranian-affiliated activity described in advisory AA26-097A, which LevelBlue treats as a working hypothesis. Pro-Russian hacktivist claims in Canada are unverified.", "help": [ "Take controllers, operator screens and cellular modems off the public internet; use a hardened VPN or private cellular network.", "Change default and shared passwords, and compare controller programs with known-good copies.", "Keep the ability to run wells, pumps and valves by hand, and rehearse it." ], "event": "", "sources": [ { "l": "LevelBlue SpiderLabs: July 2026 attacks on US water systems", "u": "https://www.levelblue.com/blogs/spiderlabs-blog/review-of-the-july-2026-cyberattacks-against-u.s.-water-and-wastewater-systems", "d": "2026-08-04" } ] }, { "id": "french-fridges", "name": "European supermarket refrigeration attacks", "domain": "ot", "kind": "Process manipulation", "summary": "On the night of 11 to 12 October 2026 attackers remotely forced refrigeration controllers into defrost mode at hundreds of French supermarkets. Cold rooms reached 50 degrees Celsius, food was spoiled and some fires started. France's CERT-FR widened its alert from Danfoss controllers to Copeland and Dixell devices. On 2 November a second wave hit food stores in Sweden, Belgium, Ireland, Luxembourg, the Netherlands, Finland and Estonia. Danfoss said its products were involved, and a Belgian refrigeration firm confirmed a cyberattack. On 29 October Reuters had reported that US investigators are treating freezer failures at military base stores as a suspected cyberattack. No link between the cases has been established. On 5 November CISA, the FBI and partner agencies issued joint guidance on attacks against refrigeration and cold-storage controllers, without naming products or a culprit.", "sectors": [ "retail" ], "targets": "Supermarket chains and other users of internet-connected commercial refrigeration controllers.", "regions": "France, then Sweden, Belgium, Ireland, Luxembourg, the Netherlands, Finland and Estonia.", "entry": [ "Remote controllers exposed to the internet, many of them end-of-life models that no longer get updates", "In the Dutch cases, DutchNews reports systems that were not on a secure network and still used a default password", "Possibly shared maintenance infrastructure, which is still an open question" ], "note": "No group has claimed either wave and authorities have not blamed anyone. Reporting finds no evidence yet that the waves, or the US base failures, are linked.", "help": [ "Remove building and refrigeration controllers from direct internet exposure.", "Replace controllers that no longer receive updates.", "Keep independent temperature sensors that the control system cannot switch off." ], "event": "ot-french-fridges", "sources": [ { "l": "OCCRP: hackers turn French supermarket refrigerators into furnaces", "u": "https://www.occrp.org/en/news/hackers-turn-french-supermarket-refrigerators-into-furnaces", "d": "" }, { "l": "The Next Web: Pentagon suspects hackers behind freezer failures at US base stores", "u": "https://thenextweb.com/news/pentagon-military-base-freezer-failures-suspected-cyberattack", "d": "" }, { "l": "DutchNews: hackers tamper with fridges at 17 Dutch firms as attacks spread", "u": "https://www.dutchnews.nl/2026/11/albert-heijn-sister-chain-hit-as-fridge-hacks-spread-in-europe/", "d": "2026-11-02" }, { "l": "AP via Claims Journal: supermarkets across Europe report new suspected freezer hack", "u": "https://www.claimsjournal.com/news/national/2026/11/02/341078.htm", "d": "2026-11-02" }, { "l": "CISA, FBI and partners: hardening industrial refrigeration and cold chain monitoring systems", "u": "https://www.ic3.gov/CSA/2026/261105.pdf", "d": "2026-11-05" } ] }, { "id": "waterplum", "name": "WaterPlum: fake job interviews", "domain": "crypto", "kind": "State-linked theft", "summary": "Law enforcement and security agencies from Australia, Germany, Japan and the US warned on 18 September 2026 about a North Korean campaign in which fake recruiters ask job seekers to download a \"coding test\". The file installs a backdoor. The agencies counted more than 30,000 infected devices, more than 7,000 compromised crypto wallets and at least $10.71 million stolen.", "sectors": [ "crypto", "technology" ], "targets": "Web designers, engineers, and crypto and Web3 specialists who are looking for work.", "regions": "Worldwide.", "entry": [ "A \"coding assignment\" or recruitment test sent by a fake recruiter", "Remote-access trojans and information stealers that stay on the machine after the interview ends" ], "note": "If a victim later gets a real job, the infected computer may give the attackers a path into the new employer.", "help": [ "Never run a coding test on your work or wallet computer. Use a separate, disposable device or virtual machine.", "Verify recruiters through the company's official site.", "Warning signs of fake candidates: claims that do not hold up, refusal to meet in person, video glitches and requests to be paid in crypto." ], "event": "", "sources": [ { "l": "The Register: North Korea's fake job interviews infected 30,000 devices", "u": "https://www.theregister.com/security/2026/09/18/north-koreas-fake-job-interviews-infected-30000-devices/5297461", "d": "2026-09-18" } ] }, { "id": "dprk-heists", "name": "North Korea-linked exchange and protocol heists", "domain": "crypto", "kind": "State-linked theft", "summary": "On October 31 the FBI said North Korea was responsible for the theft of more than $6 billion from Binance on or about October 29, naming its TraderTraitor group and publishing 628 addresses for exchanges to block. Binance says the way in was a compromised DevOps engineer's laptop. Earlier in 2026, Chainalysis attributed more than $1 billion of crypto theft to North Korea-linked actors, and Elliptic counts more than 51 suspected incidents. On the firms' assessment this includes the Bitget hack (about $388 million, September 24), where the exchange says attackers used a flaw in third-party security software to obtain credentials and insert fraudulent withdrawals.", "sectors": [ "crypto" ], "targets": "Crypto exchanges, DeFi protocols and their staff, often through patient social engineering.", "regions": "Worldwide.", "entry": [ "A compromised engineer's laptop that reached a service container, according to Binance's preliminary account", "Long, patient social-engineering approaches to staff", "Third-party security software, according to Bitget (not independently verified)" ], "note": "The Binance attribution is an FBI finding. Earlier attributions come from private analytics firms and company statements, not from a government.", "help": [ "Verify job offers, investor meetings and support contacts through a second channel.", "Require independent approval for withdrawals so one set of stolen credentials is not enough.", "Keep the management pages of your security tools off the internet." ], "event": "cr-binance", "sources": [ { "l": "BleepingComputer: FBI links $6.3 billion Binance crypto heist to North Korean hackers", "u": "https://bleepingcomputer.com/news/security/fbi-links-63-billion-binance-crypto-heist-to-north-korean-hackers", "d": "2026-11-01" }, { "l": "Startup Fortune: North Korean hackers pushed 2026 crypto theft past $1 billion", "u": "https://startupfortune.com/north-korean-hackers-pushed-2026-crypto-theft-past-one-billion-dollars/", "d": "" }, { "l": "CryptoSlate: Bitget's hack pushes September losses to a 2026 high", "u": "https://cryptoslate.com/bitgets-351-6-million-hack-pushes-september-crypto-losses-to-2026-high/", "d": "" } ] }, { "id": "ledger-implants", "name": "Tampered hardware wallets", "domain": "crypto", "kind": "Hardware supply chain", "summary": "From about 9 October 2026, thefts hit more than 300 wallets, mostly in Southeast Asia, with estimates of $90 to $93 million. Ledger confirmed that an affected customer's device held an unauthorized hardware implant. Ledger says a criminal group bought genuine devices, fitted implants able to read recovery phrases, and fed them back into the market through resellers.", "sectors": [ "crypto" ], "targets": "Individuals who bought a hardware wallet from a reseller instead of the maker.", "regions": "Mostly Southeast Asia. One report mentions a modified device at a German retailer.", "entry": [ "Physically altered devices sold through resellers (confirmed cases involved the reseller CryptoBilis)" ], "note": "Ledger says its own chip, operating system, servers and sales channel were not compromised. No attacker has been identified.", "help": [ "Buy hardware wallets only directly from the maker and check the packaging for tampering.", "If you bought from a reseller recently, follow the maker's integrity-check steps before using the device." ], "event": "cr-ledger", "sources": [ { "l": "The Crypto Times: Ledger CryptoBilis hack explained", "u": "https://www.cryptotimes.io/2026/10/12/ledger-cryptobilis-hack-explained-93m-stolen-wallets-tampered/", "d": "2026-10-12" } ] } ] }