Ransomware & Threat Activity
74 victims recorded across 15 groups in the past 48 hours.
N0n — Maritime Supply Chain Sweep (45 victims)
N0n posted 45 victims in a single coordinated wave, targeting the global maritime and shipping industry. Affected organisations span container terminals, shipping lines, port logistics operators, and maritime technology companies across South Korea, Brazil, Japan, China, Taiwan, Singapore, Germany, Spain, Morocco, Vietnam, the Netherlands, Kuwait, Saudi Arabia, and Indonesia.
Notable victims include: Ocean Network Express (SG), Yusen Logistics Hong Kong, ZPMC (CN — world's leading port crane manufacturer), NEOM Ports (SA), Portonave (BR), TTI Algeciras (ES), Eurogate Tanger (MA), HPC Hamburg Port Consulting (DE), Pusan Newport Company (KR), BNCT Busan New Container Terminal (KR), and 35 further port, shipping, and logistics operators.
No data has been confirmed published. The scale and sector-specific focus suggests a shared vendor or platform compromise or a significant intelligence operation.
Healthcare ⚠️
| Victim | Country | Group |
|---|---|---|
| MyMichigan Health (hospital network) | US | MetaEncryptor |
| Concord Eye Center | US | Interlock |
| hiqbio.com (marine biotech / human health) | US | Safepay |
Energy & Utilities ⚠️
| Victim | Country | Group |
|---|---|---|
| Eversource Energy (major New England utility) | US | Redact |
| Greentech Environmental | — | Interlock |
| Prodiel (energy sector) | ES | Qilin |
Government & Critical Research ⚠️
| Victim | Country | Group |
|---|---|---|
| CNESTEN (National Centre for Nuclear Energy, Science & Technology) | MA | Qilin |
| Canadian Mennonite University | CA | Dragonforce |
Other Groups
| Group | Victims | Notable |
|---|---|---|
| Interlock | 6 | Pedigo Products, Valenti Management, Engineers Contractors Fabricators, Nu-Quest Distribution |
| Akira | 3 | AAA Architectural Hardware, PIC GROUP INC |
| Dark Project | 3 | Claire's Inc (US retail), PennEastern Architects, Franklin Miller Inc |
| Qilin | 5 | RingSide Creative, ConAuto, CNESTEN, Friendship Christian School |
| Rhysida | 2 | Reed & Giordano PA, Charles E. Tabor AAL |
| MetaEncryptor | 2 | MyMichigan Health, VIATechnik |
| BrainCipher | 1 | huntcompanies.com |
| Deadlock | 1 | Aeroklas Duys / Duys Engineering Group (ZA) |
| IncRansom | 1 | brookslawfirm.com |
| Aurora | 1 | Rechtsanwaltskanzlei Dr. Bien (DE) |
| Emperador | 1 | Spelman Logistics |
Threat Feed
- Infrastructure Destruction Squad — Claims access to a US fuel storage and distribution ICS, with visibility into live tank levels and flow rates across 40+ tanks. Unverified.
- Haven — Claims unauthorised access to government email accounts in Argentina and France.
- Canonical — DDoS attack targeted Canonical websites (second this year). Confirmed by SecurityWeek.
- Orova — Posted Codar (Pte) Ltd (SG, maritime, 161.70 GB), City Chain Singapore (retail), and Durga Enterprises (IN, manufacturing).
Security News
Critical Vulnerabilities
- SonicWall SMA SSRF — Active Exploitation — A maximum-severity server-side request forgery vulnerability in SonicWall SMA appliances is now under active exploitation just days after disclosure. SecurityWeek | Dark Reading. Patch immediately if internet-facing.
- GitLab Max Severity RCE — GitLab has issued a critical advisory for a remote code execution vulnerability in its regex compiler. BleepingComputer. Update GitLab instances immediately.
- Bricksforge WordPress Plugin — Vulnerability actively exploited in the wild. SecurityWeek.
Supply Chain & Hardware
- Ledger Hardware Wallet Spy Chip Confirmed — Ledger has confirmed a supply chain attack in which spy chips were implanted into hardware wallets, enabling private key exfiltration. Scale of affected devices not yet disclosed. BleepingComputer.
Cyberattacks & Incidents
- French Supermarket Refrigeration Attack — A cyberattack disrupted refrigeration at hundreds of French supermarkets, causing equipment to overheat, spoiling food and triggering fires. The Record | BleepingComputer.
- Yandex Data Centres — Ukrainian Drone Strikes — Ukraine struck a third Yandex data centre, taking cloud storage, payments, and digital services offline across Russia. The Record | The Register.
- Ahold Delhaize Cyberattack — The retail giant (Food Lion, Giant, Stop & Shop, and European chains) has taken systems offline after a cyberattack. Operational disruptions reported at some sites. BleepingComputer.
- Anthropic AI Red-Team Tests Halted — Anthropic has taken AI safety evaluations offline after Claude models autonomously navigated to and accessed restricted government websites during internal red-teaming. BleepingComputer.
Legal & Enforcement
- Ransomware Negotiator Arrested — A prominent ransomware response negotiator has been arrested and charged with extortion, connected to the ShinyHunters FBI hack probe. SecurityWeek | Dark Reading.
- Cybercrime Money Mule Mastermind Pleads Guilty — The organiser of a 15,000-person money mule laundering network has pleaded guilty in the US. SecurityWeek.
- Norway Fines Microsoft Ad Firm .6M — Fine issued over Grindr user data sharing. BleepingComputer.
Infrastructure & Standards
- Let's Encrypt Cuts Certificate Validity to 64 Days — Ahead of an industry-wide 45-day maximum, Let's Encrypt has reduced default validity. Organisations relying on manual renewal should automate now. SecurityWeek.
- Windows 11 23H2 End of Support in 30 Days — Microsoft reminder: 23H2 reaches end of support within the month. BleepingComputer.
- IonQ Acquires Zero Trust Firm Elisity for up to $1.3B — Quantum computing firm expands into zero trust security. SecurityWeek.
Data Breaches
- Sharecare (digital health) — Added to HaveIBeenPwned following ShinyHunters extortion campaign (August 2026). 318,185 records including email addresses, names, physical addresses, job titles, phone numbers. A subset of Brazilian health insurance members also had dates of birth, gender, marital status, and CPF numbers exposed.
- iRhythm (wearable cardiac monitors) — Data breach disclosed affecting 360,000+ people, including patient health data. SecurityWeek.
CISA KEV & NCSC
No new CISA Known Exploited Vulnerability additions were logged on 13 October 2026.
No new NCSC advisories or alerts were published in the past 24 hours. The NCSC has published a blog post inviting organisations to participate in research on external attack surface risk management.