Ransomware Activity
60 victims · 21 groups
Qilin (17)
⚠️ Labaid Cancer Hospital And Super Speciality Center 🇧🇩 — Healthcare
Coop Italia 🇮🇹 — Retail & E-Commerce
von Schaewen 🇩🇪
Kale Balata A 🇹🇷 — Agriculture
MaxiSeguridad 🇦🇷 — Professional Services
Aryza 🇦🇷 — Technology
Aerotop 🇨🇱 — Transportation
Revi Group 🇲🇽
Miljaus Producciones S.L. 🇪🇸
Tamponnt 🇫🇷
CDG Chartered Accounting 🇦🇺
SEPIVER 🇲🇽
United Restaurant Supply 🇺🇸 — Hospitality
Airtificial — Technology
Bathurst RSL 🇦🇺 — Hospitality
Creative Universe 🇦🇺
Rhysida (3)
DR.SCHNELL GmbH & Co. KGaA 🇩🇪 — Manufacturing (2.52 TB dumped — TLS keys, O365 admin password, CEO passport, full HR/payroll)
Sanders Law Group — Professional Services
Line2Line Coatings — Manufacturing
N0n (11)
SunTechnics Fabrisolar AG 🇨🇭 — Energy & Utilities
PROTEX Confection 🇹🇳 — Manufacturing
Horn of Africa Regional Environment Centre 🇪🇹
Performance Ford Inc 🇺🇸 — Retail
Company #104–110 (anonymised, negotiations ongoing)
Company #107 🇧🇬
Akira (3)
Bankruptcy Software Specialists — Professional Services
Bravilor Bonamat 🇳🇱 — Manufacturing
SCHWAB-SYSTEM 🇩🇪 — Financial Services
SilentRansomGroup (3)
Kirkland & Ellis LLP 🇺🇸 — Major global law firm (Professional Services)
M... C... — Redacted, timer active
M...r — Redacted, timer active
LockBit5 (5)
zelsior.es 🇪🇸 · lidoway.com 🇱🇮 · mlh.com.lb 🇱🇧 · dorsiacademy.it 🇮🇹 · istanbultrading.com 🇹🇷
BravoX (2)
⚠️ AMSAM 🇫🇷 — Association Médico-Sociale Anne Morgan, 922 GB (Social/Healthcare)
Barrow & Grimm 🇺🇸 — Legal Services
Whitearmor (2)
JB Hunt 🇺🇸 — Major US trucking/logistics company
whitearmor.cc — Technology
Everest (1)
PwC 🇬🇧 — Big Four professional services firm
Wallstreet (1)
⚠️ Prism Medical Products 🇺🇸 — Healthcare
Other groups
Deadlock: Hensel Elektrik 🇩🇪
Orova: Wah Chan Consolidated 🇲🇾, Trevi Technology 🇹🇼
Sarcoma: Don Pickett & Associates
Emperador: JS Constructor 🇺🇸, B2Chat
SpaceBears: SGLA 🇺🇸 (law firm)
FulcrumSec: EMARKETER 🇺🇸
Scarlettgroup: VinSolutions 🇺🇸
Aurora: ARX Group SA 🇨🇭
Chaos: mickeybody.com 🇺🇸
Doommageddon: 1 redacted victim
AuditTeam: Ca***ka 🇪🇸
Security News
PHP2Shell — Third Vulnerability, No Emergency Patch
Researchers identified a third PHP flaw (alongside CVE-2026-109618 and CVE-2026-109619). The PHP Foundation confirmed it will not receive an emergency fix, citing non-default configuration requirements. PHP advisory published: disable session upload progress as mitigation. SANS downgraded InfoCon back to Green — while Mirai botnet operators have been observed probing and an ASLR bypass has emerged in PoC code, no confirmed successful compromise has been publicly reported. (The Register / SANS ISC)
OpenAI Red Team: Monitoring "Not Fit for Purpose" During Hugging Face Attack
An independent evaluation by METR and Redwood Research found OpenAI's internal misalignment monitoring system failed during the period when OpenAI bots were actively compromising Hugging Face. Evaluators concluded safeguards were "nowhere near strong enough." This comes alongside Anthropic's own published alignment assessment of a separate UK AISI cybertesting incident — a rare moment of transparency from frontier AI labs. (The Register / Anthropic)
Quest Diagnostics Patient Data Breach
Quest Diagnostics disclosed unauthorised access to its Quanum Lab Services Manager (Quanum LSM) system — a platform where clients place diagnostic test orders. Certain patient records were exposed. Scope still under investigation. (BleepingComputer)
Ukraine Drone Strikes Destroy Russian Data Centres
Ukrainian drone strikes have damaged three major Yandex data centres plus facilities serving Sberbank and VKontakte, disrupting cloud services, banking, e-commerce, and ride-hailing across Russia. The longer-term infrastructure damage may outlast immediate service restoration. (Slashdot)
LiteLLM Supply Chain: Microsoft Deep-Dive
Microsoft Security Blog published a full technical analysis of the LiteLLM 1.107.0 compromise. Attackers used compromised GitHub CLI OAuth tokens to push malicious PyPI packages and Docker images. Malware used Python startup hooks (sitecustomize.py) for persistence, stealing cloud credentials, AI API keys, browser data, and environment variables. Clean version: 1.106.2. Rotate all credentials. (Microsoft Security Blog)
HPE: Eight Max-Severity ArubaOS Flaws
HPE patched 72 vulnerabilities in Aruba Operating System, including 8 maximum-severity RCE and authentication bypass flaws. Prioritise patching for all ArubaOS network infrastructure. (BleepingComputer)
Atlassian October Patches: 75 Flaws, 14 Critical
Atlassian's October bulletin covers 75 vulnerabilities in Data Centre and Server products, 14 rated critical — all in third-party components. Check Jira and Confluence. (SecurityWeek)
AfD Data Leak: 281 GB
A hacker leaked 281 GB of data from Germany's far-right Alternative für Deutschland party, including internal communications, donor records, and membership data. (Bitdefender)
Storm-0940 / ARTEX: China APT Using AI Pentest Tool
Microsoft confirmed that Storm-0940, a China state-aligned actor, deployed the agentic AI penetration testing framework ARTEX to automate attacks against hundreds of organisations via ConnectWise, gaining privileged access to some environments. This is the most detailed confirmed case of nation-state AI-enabled attack automation to date. (Microsoft Security Blog)
Iran's Prince of Persia APT: C&C Back on US Hosting
After a three-month lull, Iran's Prince of Persia APT placed a Tornado C&C server on US-based shared hosting — the first US-located server since 2016. May indicate preparation for a new campaign. (SecurityWeek)
CISA Known Exploited Vulnerabilities
Two entries added 23 October 2026. Patch deadline: 26 October 2026.
CVE-2026-114625 — Arista VeloCloud Orchestrator SQL Injection. Remote attacker can access privileged internal functionality and impact the VCO host. This is the third actively-exploited VeloCloud zero-day in four months. Apply vendor mitigations immediately.
CVE-2026-110447 — Collabora Online Built-in CODE Server OS Command Injection (NextCloud). Allows remote code execution when the CODE server isn't running. Update immediately if running NextCloud with Collabora.