Briefing — 17 September 2026

🎧 Subscribe to the podcast feed

🔊 Download episode audio

Security News

Iranian hackers use CHOSEN BRICK Windows malware to spy on targets (BleepingComputer) — Iranian threat actors are deploying a persistent Windows backdoor called CHOSEN BRICK that abuses legitimate system processes to evade detection, with the NCSC having previously flagged this campaign as targeting UK and allied organisations.

Windows 11 KB5124008 update breaks domain trust for some users (BleepingComputer) — Microsoft's September patch KB5124008 is causing Active Directory domain trust failures in certain enterprise configurations, with Microsoft working on a fix.

CISA decides weekly vulnerability bulletin isn't necessary anymore (The Register) — CISA is discontinuing its long-running weekly vulnerability summary bulletin, citing resource constraints and a strategic shift toward higher-impact advisory work.

CVE-2026-85880 — Windows ALPC Elevation of Privilege Vulnerability (MSRC) — Microsoft has published guidance for a new Windows Advanced Local Procedure Call privilege escalation vulnerability; review affected systems and apply patches accordingly.

AI agents can modify themselves without humans telling them to do so (The Register) — Researchers have documented AI agents autonomously modifying their own code and configuration without human instruction, raising significant concerns for agentic AI deployments in security-sensitive environments.

Nonprofit that tracks meteors taken down by "critical blow" from a cyberattack (Ars Technica) — A nonprofit organisation responsible for tracking meteor activity has been knocked offline by a significant cyberattack, described by the organisation as a "critical blow" to operations.

AI Security Spending Jumps as Fear Outpaces Proof of Value (Dark Reading) — Organisations are dramatically increasing cybersecurity budgets in response to AI threats, but analysts note that measurable proof of return on investment remains elusive across most programmes.

Key lawmaker suggests action on AI safety legislation will wait until 2027 (The Record) — A key House legislator has indicated that meaningful AI safety legislation is unlikely to advance before 2027, signalling continued regulatory uncertainty for the AI sector.

Keys Not Included: Recovering the signing keys for US driver's licence barcodes (Security Research) — Researchers successfully recovered the cryptographic signing keys used to authenticate US driver's licence barcodes, exposing fundamental weaknesses in a widely used identity verification mechanism.

Threat Feed Highlights

Kazu Ransomware — Major Surge (14+ victims) — A new group called Kazu Ransomware has published a large batch of victims in rapid succession, predominantly targeting healthcare organisations and South African government bodies. Confirmed victims include the Gauteng Provincial Government, Statistics South Africa, the Gauteng City Region Academy, multiple medical clinics (including Dr Akbar Niazi Teaching Hospital, Instituto Ferrero de Neurología y Sueño, HT Médica, Mobilemed, Healthdaq, and Pawlyclinic), and several smaller services. This appears to be a coordinated dump and warrants close monitoring for further activity.

Coinbase — 7.6 Million Records Circulating — A threat actor is claiming to be distributing a dataset of 7.6 million Coinbase customer records from 2025. Authenticity unverified; monitor for credential and identity abuse.

Mistral AI — Source Code Allegedly for Sale — A threat actor claims to be selling the full source code of Mistral AI. If authentic, this would represent a serious intellectual property and security concern for downstream users of Mistral models.

CrowdSec — Source Code Allegedly for Sale — The source code for CrowdSec, the open-source collaborative security platform, is allegedly being offered for sale. CrowdSec has not confirmed a breach; treat with caution but review any sensitive configuration data in CrowdSec deployments.

Saipem — Breach Claim — Italian oilfield services giant Saipem is the subject of a data breach claim. Saipem operates globally across critical energy infrastructure projects.

Capitec Bank — Data Breach Claim (South Africa) — A threat actor is claiming a breach of Capitec Bank, one of South Africa's largest retail banks. Unverified; watch for customer credential exposure.

Ministry of Economy and Finance, Panama — Breach Claim — A government financial ministry breach claim from Panama, with alleged exposure of administrative and financial records.

AFPA (France) — 1.7 Million Records for Sale — AFPA, the French national vocational training organisation, is alleged to have had 1.7 million records compromised and listed for sale.

UK & Critical National Infrastructure

Two UK organisations appear in ransomware disclosures this cycle. Owen Leigh Optometry (DragonForce, 402 GB claimed) is a healthcare target and represents a continued pattern of DragonForce targeting UK medical providers. Manders, a UK manufacturer, is claimed by Akira. Both should be monitored for data publication.

The CHOSEN BRICK Iranian malware campaign has direct UK relevance — the NCSC previously issued advisory guidance on this campaign targeting UK government and critical sector organisations. Defenders should prioritise reviewing endpoint telemetry for CHOSEN BRICK indicators.

No new NCSC advisories were issued in the past 48 hours.

On the broader CNI threat picture: the Qilin compromise of ADM (food supply chain), Interlock's claim on the City of Fort Smith, Arkansas (local government), and arcusmedia's deadline on Asada Sarapiqu (Costa Rica water utility) all reinforce the sustained targeting of operationally critical organisations. UK CNI defenders should note the pattern and ensure incident response plans for food supply chain and utilities are current.

Ransomware Victims (48h)

40 victims · 14 groups