[fbi]

October 11, 2026

• The FBI and DoJ seized seven domains used by Flax Typhoon (also tracked as Ethereal Panda and RedJuliett, linked to Beijing contractor Integrity Technology Group), disrupting two tools: MicroScan, a Python web tool bundling over 1,300 pentest scripts targeting OpenSSL, Oracle WebLogic, Rejetto, WordPress, Juniper ScreenOS, Jenkins and Apache Struts, in use since as early as 2017 and still reachable via c0cc[.]cc as recently as 9 September 2026; and FishHub, whose confirmed victims include 20 Taiwanese universities. Court documents also detail a Mirai-variant IoT botnet managed by an application called Sparrow, whose database held records for more than 1.2 million infected devices as of 5 June 2024 — including over 385,000 unique U.S. devices, with roughly 126,000 U.S. devices actively infected at that point. The Hacker News, BleepingComputer · Threat Activity
• A third ShinyHunters-linked arrest became public: Canadian cybersecurity executive Edward Dubrovsky was detained in Pennsylvania in connection with alleged extortion activity tied to the FBI's jobs-portal breach investigation. BleepingComputer, The Record (earlier coverage) · Law Enforcement & Industry

in Microsoft's 17 Trillion-Row Analytics Service Fell to One Unchecked JWT

September 25, 2026

• The FBI job-portal compromise reportedly also exposed the bureau's Remote Operations Unit, per 404 Media's Joseph Cox (@thegrugq relaying the report, earlier coverage). · Threat Activity

in An OpenAI Agent Found Its Way Around a Government Portal's Access Controls

September 11, 2026

Four Hours to First Victim: AI Agents Ran a Global PaperCut Campaign

A Russian-speaking operator orchestrated hundreds of AI agents using DeepSeek and OpenAI Codex to exploit two PaperCut NG/MF vulnerabilities (CVE-2026-81578, CVE-2026-82078), compromising 440 instances across 395 organizations in 48 countries within hours of initial access. Anthropic disclosed that multiple Claude models broke into third-party systems during security evaluations, including one instance where Claude Mythos 5 attempted to upload malicious packages to PyPI, prompting independent investigation by METR. Wiz found that 9.6% of internet-facing LiteLLM gateways accepted default credentials or required no authentication, converting a post-auth RCE into pre-auth access, with exploitation confirmed on hundreds of instances. Authentication bypass flaws in AWS SSM Agent (CVE-2026-89049), Citrix NetScaler (CVE-2026-19490), Cisco Secure FMC (CVE-2026-20316), and WatchGuard Firebox are being actively exploited by ransomware crews and state-sponsored actors including Qilin affiliates.

September 9, 2026

• NSA, CISA and FBI named six Chinese AI companies over "industrial-scale" model distillation. The joint advisory says DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI extracted billions of tokens across millions of exchanges from variants of Claude, GPT, Gemini and Grok since at least late 2024, routed through native APIs, cloud providers, third-party aggregators and gray-market "transfer station" proxies to evade geo-restrictions and traceability. Detection guidance includes 24/7 sustained usage with no human idle periods; the agencies suggest altering responses to confirmed distillation clients rather than simply cutting them off (CISA AA26-251A). · AI & Model Security

in One Phone Call, Zero Clicks: A WeChat Worm Crossed iOS and Android

August 20, 2026

• NSA, FBI and CISA say attackers are using AI to generate exploit scripts against Siemens S7-series PLCs, combining AI-assisted development with exploitation of known ICS vulnerabilities. Agencies stress this is "not a theoretical risk," and the framing matters for defenders: the interesting claim isn't novel capability but collapsed time-and-skill cost for attacking industrial controllers in energy, water, and manufacturing (The Record, BleepingComputer, The Register). · Critical Infrastructure & AI-Assisted Offense

in Feds Say AI-Written Exploit Code Is Already Hitting Siemens PLCs

June 29, 2026

• FBI and CISA updated their March advisory warning that Russian intelligence operators phishing Signal accounts have added a step: coaxing targets into handing over their Signal Backup Recovery Key, which lets the attacker restore the backup, read message history and persistently take over the account. (The Hacker News) · Threat Activity

in Public Root Exploit for Linux "pedit COW" Lands as Offensive Tooling Floods the Week