Briefing — 23 September 2026

🎧 Subscribe to the podcast feed

Security News

CLOSEDQUORUM: Windows malware uses LLMs to autonomously select post-compromise actions (The Register) — New malware queries Google Gemini, DeepSeek, Qwen, and Mistral at runtime to dynamically choose lateral movement, persistence, or exfiltration actions based on the compromised host — the first documented AI-directed adaptive malware.

Microsoft disrupts EvilTokens AI-powered device-code phishing platform (Ars Technica / Dark Reading) — Microsoft seized 50 websites and disabled 150+ domains of a PhaaS operation that used an AI chatbot to guide victims into compromising ~12,000 Microsoft 365 accounts via device-code phishing.

Chinese threat actor exploits ZyXEL switches and WordPress to steal government data (BleepingComputer) — 996 ZyXEL GS1900 managed switches and WordPress installations exploited to extract 18,500+ records from government targets; dual-vendor opportunistic campaign.

Rogue external MFA providers can capture cleartext passwords during login (BleepingComputer) — Researchers demonstrate that privileged access to an identity provider allows registration of a malicious external MFA provider that silently harvests passwords from normal authentication flows.

CVE-2026-85880 Windows SYSTEM privilege escalation exploit for sale — An actor on exploit.in is selling a bundled exploit + dropper framework targeting Windows 10 and 11 privilege escalation to SYSTEM. No public patch status confirmed at time of recording.

Kovo Healthtech Corp breach claim — 2.7 TB including patient records — A threat actor claims to have exfiltrated 2.7 terabytes of data from Kovo Healthtech Corp including financial details, patient records, and customer information.

Fresenius Medical Care breach claim — publication imminent — One of the world's largest kidney dialysis providers is the subject of a breach claim, with the actor stating publication within 2–3 days. Fresenius serves millions of patients globally.

INSS breach claim — 15.92 TB of Israeli national security documents — Threat actors claim to have exfiltrated 15.92 terabytes of material from the Institute for National Security Studies, including strategic papers, internal communications, and conference records.

Investigate Europe GlobаLeaks system breach claim — A 6 TB data claim against Investigate Europe reportedly includes their GlobаLeaks informant management system, raising direct source confidentiality concerns for cross-border investigative journalism.

'We hacked the FBI': Hackers claim data on all FBI employees (404 Media) — Threat actors claim to hold data on the entire FBI employee roster; scope and verification remain unconfirmed.

Macfinger ClickFix campaign: injected scripts on legitimate websites (SANS ISC) — Analysis of a persistent ClickFix social engineering campaign using malicious scripts injected into legitimate websites to direct users into running malicious commands via fake browser error prompts.

Sweden fines Miljödata $183,000 for breach affecting 2.2 million records (BleepingComputer) — Sweden's IMY data protection regulator imposes SEK 1.8 million fine on IT provider Miljödata for inadequate security measures leading to a 2.2 million-record breach in August 2025.

LockBit 5.0 victim claim: Taspen Life (Indonesia) — A claim has appeared on what is labelled a LockBit 5.0 dark web site, listing Taspen Life, an Indonesian insurer, with a 14–15 day publication deadline. LockBit variant claims require independent verification.

UK & Critical National Infrastructure

No new NCSC advisories have been issued in the past 48 hours.

CLOSEDQUORUM and UK Windows environments — CLOSEDQUORUM is directly relevant to all UK defenders operating Windows infrastructure. Malware that queries external LLM APIs at runtime to select post-compromise actions creates detection challenges for signature-based and behaviour-rule-based tools. Defenders should consider monitoring for unusual outbound HTTPS traffic to known AI API endpoints from endpoints that should not be making such calls.

SCADA and ICS threat activity — The threat feed today contains two entries of note for UK CNI teams: an alleged unauthorised access to a power monitoring SCADA system; and the active sale of a tool (TRK25 ADVANCED SCADA) explicitly marketed for attacking industrial control systems and HMI interfaces. Neither has confirmed UK impact, but both represent actionable intelligence items for CNI operators in energy, water, and utilities.

Rogue MFA provider technique — UK financial and public sector risk — The rogue external MFA provider attack documented today is particularly relevant to UK financial institutions and public sector entities using federated identity platforms. The technique allows password capture even in environments with ostensibly strong MFA controls, and does not require phishing end users — only privileged access to the identity provider.

Fresenius Medical Care breach — Fresenius operates renal care facilities in the UK. If the breach claim is confirmed and patient data is included, UK GDPR notification obligations and ICO reporting may apply.

Ransomware Victims — 48 Hours (22–23 September 2026)

44 victims · 22 groups

HaveIBeenPwned — New Breaches