Ransomware Activity
42 victims across 14 groups in the past 48 hours. Healthcare and CNI flagged below.
N0n — 14 victims
Vormittag Associates, Froggys Fog, ⚠️ Hotel DuPont, ⚠️ Kingwood Endoscopy, The Akeeli Group, Finzly Corp, Amagi Media Labs, SMIC US Company, Telecom Egypt, All Business Technologies, and others.
Qilin — 11 victims
Note: Unit 42 confirms Qilin is actively exploiting CVE-2026-0257 (PAN-OS) for initial access. Victims include Toyota Canarias, Johnson & Pace 🇬🇧, ⚠️ Dental Team FL, ⚠️ Pengurusan Aset Air Berhad (water authority, Malaysia), Belcorp, Llano ISD, GardaWorld, and others.
LockBit 5.0 — 1 victim
⚠️ Ultimate Health Plans — US health insurance provider.
Redact Group — 1 victim
Baker Donelson — major US law firm, 355 GB claimed.
Storm — 3 victims
Baltimore Tank Lines, Merit Financial Group, Patriot Maritime.
Helix — 2 victims
American Campus Communities, Southwire.
Other Groups
Cloak, Emperador, Global Secret Group, SilentRansomGroup, Incransom, Aurora, iah6477, fulcrumsec.
Security News
Ahold Delhaize cyberattack — US and European grocery brands hit
Dutch multinational Ahold Delhaize (Food Lion, Giant Food, Stop & Shop) proactively took IT systems offline across US and European operations following a confirmed cyberattack.
Rank Math PRO WordPress plugin supply chain attack
Downloads from the vendor's official site between October 15–16 contained malware planting hidden backdoors. Treat any site that updated during this window as potentially compromised.
ConnectWise Cloud Backup suspended after supply chain attack
Attackers used ConnectWise credentials to authenticate into downstream Microsoft 365 tenants. MSPs should audit M365 access logs immediately.
PAN-OS CVE-2026-0257 — Actively exploited by Qilin and Inc ransomware
Unit 42 confirms both Qilin and Inc ransomware operators are exploiting this critical PAN-OS flaw for initial access. Patch immediately if internet-exposed.
AI agents used to breach 100+ organisations including John Deere and SharkNinja
Security firm Norforge documented a hacker deploying autonomous AI agents to independently identify and exploit vulnerabilities across 100+ targets including Cummins.
Plex2Shell — Actively exploited hours after disclosure
Exploit chain targeting recently patched Plex Media Server vulnerabilities weaponised within hours. Cryptominers and proxy software being deployed. Update Plex immediately.
Nikkei — third breach in a month, 1.83M records
Japanese media giant discloses another breach. Third incident in approximately one month.
Florida DMV breach — ShinyHunters linked
Driver licence and motor vehicle data exposed after a police officer stored credentials insecurely on a personal device. ShinyHunters linked to the September intrusion.
F5 NGINX — critical RCE vulnerabilities, out-of-band patches
Three critical flaws allowing remote code execution. Out-of-band release signals urgency. Patch NGINX deployments now.
DeepSeek banned from all US federal civilian agencies
DHS order directs removal of all DeepSeek products from federal civilian IT systems immediately.
Breaches
Assurance Retraite (France)
Added to HaveIBeenPwned today. Breach date: September 2024. 70,372 accounts exposed — data includes dates of birth, email addresses, family members' names, and government-issued IDs.
CISA KEV
No new entries to the Known Exploited Vulnerabilities catalogue in the past 48 hours.