Ransomware Activity
56 victims across 17 groups in the last 24 hours.
N0n (15 victims)
⚠️ Heritage Senior Living 🇺🇸 — Healthcare (network maps and remote access credentials published)
Hanjin Information Systems & Telecommunication 🇰🇷 — IT services (999 staff accounts + client org charts exposed)
Performance Ford Inc 🇺🇸 — Automotive
TheHomeMag NorCal 🇺🇸 — Home services advertising
Companies #99–109 — Unidentified organisations (US, Bulgaria, Portugal) — pending exposure
BrainCipher (8 victims)
⚠️ prosomnus.com 🇺🇸 — Medical devices (sleep apnea)
⚠️ olyortho.com 🇺🇸 — Orthopaedics
⚠️ clinicaromero.com 🇦🇷 — Healthcare clinic
sodali.com 🇺🇸 — Corporate governance advisory
oflaherty-law.com 🇮🇪 — Law firm
novagroupgbc.com 🇬🇧 — Unknown sector
srsnodgrass.com 🇺🇸 — Unknown
mvjllp.com — Unknown
SilentRansomGroup (6 victims)
Kirkland & Ellis LLP 🇺🇸 — One of the world's largest law firms by revenue
Porter Hedges LLP 🇺🇸 — Houston energy/corporate law
M... C... / M...r — Redacted, timers active
K.r.a. ...s / K.r.. ...s — Redacted
LAMASHTU (6 victims)
Hecker Holzsystembau 🇩🇪 — Construction/manufacturing (40 GB)
MECA-PRECIS 🇫🇷 — Precision manufacturing (100 GB)
WEPOS Chemie 🇩🇪 — Chemical manufacturing (100 GB)
VERGI Muenster 🇩🇪 — Tax consulting (100 GB)
FuG-Gruppe 🇩🇪 — IT/ERP systems integrator (50 GB)
Gräfliches Hofbrauhaus Freising 🇩🇪 — Brewery (50 GB)
Everest (2 victims)
⚠️ PwC 🇬🇧 — Big Four accounting firm (UK operations claimed)
Linebarger Goggan Blair & Sampson 🇺🇸 — Government debt collection law firm
Qilin (4 + 2 from threat feed)
United Restaurant Supply 🇺🇸 — Hospitality supplies | Airtificial — Technology | Bathurst RSL 🇦🇺 — Hospitality | Creative Universe 🇦🇺 — Creative services
Coop Italia 🇮🇹 — Major supermarket cooperative | SEPIVER
Other Groups
⚠️ AMSAM (Association Médico-Sociale Anne Morgan) 🇫🇷 — BravoX ransomware (medical/social care)
⚠️ Rand Mutual Assurance (RMA) 🇿🇦 — Kazu ransomware
⚠️ Coastal Alabama Community College 🇺🇸 — Interlock (SSNs, health info, payment card data published)
Medienwerkstatt 🇩🇪 / Annapath — Akira
Westrock Coffee 🇺🇸 (~$1.2B) / Hypertherm 🇺🇸 (~$651M) — Helix
SGLA 🇺🇸 — SpaceBears | Smart & Biggar / Bereskin & Parr 🇨🇦 — INC Ransom | LEGAL-RECORDS.US 🇺🇸 — Clop
Adobe Insurance Brokers 🇺🇸 — Pear | istanbultrading.com 🇹🇷 — LockBit5 | DR.SCHNELL 🇩🇪 — Rhysida | Flextron Circuit Assembly 🇸🇬 / Cascade Flooring 🇺🇸 — Akira
Security News
Hackers got a four-day head start on PHP2Shell vulnerability (Ars Technica) — Amazon confirmed exploitation of CVE-2026-109618/109619 began October 17th, four days before patches; Cloudflare recording millions of attempts.
PHP2Shell puts dozens of UK government services out of service (The Register) — 32 services offline, 4 partially unavailable; disclosed in the House of Lords on Thursday.
PHP2Shell exploit bypasses ASLR on x86-64 servers (The Register) — VulnCheck demonstrated a new exploit bypassing Address Space Layout Randomisation, widening the attack surface beyond initial estimates.
Microsoft links Storm-0940 to ConnectWise supply chain attack using ARTEX AI (The Record) — China-state group used AI pen-test framework ARTEX to compromise 2,250+ Microsoft 365 tenants via ConnectWise.
GitLab patches max-severity RCE vulnerability (BleepingComputer) — Integer overflow allowing unauthenticated RCE; affects 12 years of releases. Patch immediately.
Arista patches VeloCloud Orchestrator zero-day exploited in attacks (BleepingComputer) — Actively exploited zero-day in on-premises VCO deployments; patch now.
333 Tor exit nodes hijacked to intercept SSH traffic (Ars Technica) — Campaign began late August; attackers used a valid Tor signing certificate to blend in, redirecting SSH through controlled servers and favouring unencrypted email.
APT41 revives BlackLotus UEFI bootkit against Central Asian diplomatic orgs (Securelist / Kaspersky GReAT) — UEFI bootkit bypasses Secure Boot and persists below the OS; deployed against diplomatic targets.
Linux kernel vulnerabilities accidentally posted to public mailing list (Slashdot/ZDI) — Two CVSS 9.0 flaws in SMB Direct and KSMBD disclosed publicly by Trend Micro ZDI by mistake; patches pending.
Capcom confirms data breach affecting 11.7 million accounts (BleepingComputer) — CAPCOM ID membership service breached; email addresses and associated info exposed.
Railway warns devs to rotate secrets after potential breach (BleepingComputer) — Suspicious access to encrypted customer environment variables; API keys and database credentials potentially exposed.
LiteLLM release pipeline hacked to distribute info-stealer (BleepingComputer) — Malicious PyPI packages and Docker images carrying credential stealer and RAT; check dependencies if you use LiteLLM.
Unvetted AI agents accessing US bank accounts (Slashdot/Axios) — Major US banks detecting unauthorised third-party AI agents acting independently inside customer accounts.
eMudhra exits TLS business after certificate debacle (Ars Technica) — Indian CA whose private keys included the literal number 4 has withdrawn from certificate issuance.
Operation Serengeti III: 1,462 arrests, $105M seized across Africa (BleepingComputer) — Interpol and Afripol disrupted nearly 11,000 cybercriminal networks targeting BEC, ransomware, and online fraud.
Notable Threat Feed Activity
Alleged breaches and data sales (authenticity unverified):
• Coinbase — alleged data sale • Flipkart 🇮🇳 — alleged data breach • Crypto.com — alleged data breach
• Volvo Group — alleged data breach • Ducati Motor Holding 🇮🇹 — alleged breach • Audi UK 🇬🇧 — alleged breach
• Altice Group — alleged breach (major telecoms/media) • Mistral AI — alleged unauthorized access for sale
• South Korean passports — alleged data leak • Punjab Information Technology Board 🇵🇰 — alleged data leak
• Brazilian Air Force 🇧🇷 — alleged data breach
⚠️ Cutlers Hill Surgery 🇬🇧 — UK GP practice cyberattack
• 18 website defacements by various groups