According to iTnews (23 October 2026), Australia has imposed targeted financial sanctions and travel bans on two North Korean individuals, Yu Pu Ung and Sim Hyon Sop, and two companies, Korea Mangyongdae Computer Technology Company and Chinyong Information Technology Cooperation Company, which help the regime place IT workers in remote jobs abroad to bring in foreign currency. iTnews says all four were already under United States Treasury sanctions. iTnews reports that the Australian government said the workers obtained remote employment while posing as nationals of other countries, breaching UN Security Council resolutions that prohibit North Korea's export of labour, and that the listings act on findings by the Multilateral Sanctions Monitoring Team (MSMT), which the government said had exposed North Korea's sanctions-evasion networks and 'the serious cyber security risks those networks pose to affected businesses'. Foreign Minister Penny Wong said in a statement, as quoted by iTnews: 'We are taking this action in coordination with international partners, including the European Union.' According to iTnews, the listings follow a warning from the Australian Sanctions Office (ASO) that North Korean workers are using stolen and doctored Australian drivers' licences and passports to win remote contracts. iTnews reports the ASO said Australia's competitive salaries and demand for contract IT staff make the country an attractive target, that local companies have been approached through LinkedIn, Fiverr and Freelancer as well as through recruitment firms, and that businesses should not rely on recruiters' due diligence and should watch for warning signs such as AI-generated interview answers, face-swap filters on video calls and logins from several countries in quick succession. iTnews says making an asset available to a listed person or entity without ministerial authorisation is a criminal offence: individuals face up to 10 years' jail and fines of up to $910,000 or three times the value of the transactions, whichever is greater, and companies face fines of up to $3.64 million on the same basis, though a business can defend itself by showing it took reasonable precautions and exercised due diligence. Primary: iTnews. Correction (24 Oct 2026): this card previously credited the DFAT notice, the Foreign Minister's media release and the ASO advisory note directly; those pages could not be loaded to verify, so the card now credits iTnews and drops details iTnews does not report (the penalty-unit figures, the advisory note's publication dates and further red flags and advice). It also corrects the spelling of Mangyongdae. (source: iTnews)
iTnews — Australia sanctions North Korean IT worker bosses and financiers (Juha Saarinen, 23 Oct 2026)
On 22 October 2026 Microsoft's Security Update Guide published CVE-2026-110063, 'VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability': improper link resolution before file access ('link following', CWE-59) in VM Inspector for Azure Virtual Machines allows an unauthorised attacker to elevate privileges over a network. Microsoft rates it Critical with a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Microsoft's FAQ says the vulnerability has already been fully mitigated by Microsoft, there is no action for users of the service to take, and the CVE is published to provide further transparency. Microsoft lists it as not publicly disclosed and not exploited. It was one of six Microsoft cloud-service CVEs published that day; the others are on their own desk cards. Primary: Microsoft Security Response Center; CVE record.
Microsoft Security Response Center — CVE-2026-110063, VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability (22 Oct 2026)
On 22 October 2026 Microsoft's Security Update Guide published CVE-2026-96185, 'Microsoft Exchange Online Remote Code Execution Vulnerability': a stack-based buffer overflow (CWE-121) in Microsoft Exchange Online allows an authorised attacker to execute code over a network. Microsoft rates it Critical with a CVSS 3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Microsoft's FAQ says the vulnerability has already been fully mitigated by Microsoft, there is no action for users of the service to take, and the CVE is published to provide further transparency. Microsoft lists it as not publicly disclosed and not exploited. It was one of six Microsoft cloud-service CVEs published that day; the others are on their own desk cards. Primary: Microsoft Security Response Center; CVE record.
Microsoft Security Response Center — CVE-2026-96185, Microsoft Exchange Online Remote Code Execution Vulnerability (22 Oct 2026)
On 22 October 2026 Microsoft's Security Update Guide published CVE-2026-105014, 'Azure Pipelines Remote Code Execution Vulnerability': command injection (CWE-77) in Azure Pipelines allows an unauthorised attacker to execute code over a network. Microsoft rates it Critical with a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Microsoft's temporal metrics mark exploit code maturity as proof-of-concept (E:P). Microsoft's FAQ says the vulnerability has already been fully mitigated by Microsoft, there is no action for users of the service to take, and the CVE is published to provide further transparency. Microsoft lists it as not publicly disclosed and not exploited. It was one of six Microsoft cloud-service CVEs published that day; the others are on their own desk cards. Primary: Microsoft Security Response Center; CVE record.
Microsoft Security Response Center — CVE-2026-105014, Azure Pipelines Remote Code Execution Vulnerability (22 Oct 2026)
On 22 October 2026 Microsoft's Security Update Guide published CVE-2026-83938, 'Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability': missing authentication for a critical function (CWE-306) in Azure Kubernetes Configuration Service allows an unauthorised attacker to elevate privileges over a network. Microsoft rates it Critical with a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Microsoft's FAQ says the vulnerability has already been fully mitigated by Microsoft, there is no action for users of the service to take, and the CVE is published to provide further transparency. Microsoft lists it as not publicly disclosed and not exploited. It was one of six Microsoft cloud-service CVEs published that day; the others are on their own desk cards. Primary: Microsoft Security Response Center; CVE record.
Microsoft Security Response Center — CVE-2026-83938, Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability (22 Oct 2026)
On 22 October 2026 Microsoft's Security Update Guide published CVE-2026-108456, 'Azure AI Foundry Elevation of Privilege Vulnerability': server-side request forgery (CWE-918) in Azure AI Foundry allows an authorised attacker to elevate privileges over a network. Microsoft rates it Critical with a CVSS 3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). Microsoft's FAQ says the vulnerability has already been fully mitigated by Microsoft, there is no action for users of the service to take, and the CVE is published to provide further transparency. Microsoft lists it as not publicly disclosed and not exploited. It was one of six Microsoft cloud-service CVEs published that day; the others are on their own desk cards. Primary: Microsoft Security Response Center; CVE record.
Microsoft Security Response Center — CVE-2026-108456, Azure AI Foundry Elevation of Privilege Vulnerability (22 Oct 2026)
On 22 October 2026 Microsoft's Security Update Guide published CVE-2026-97785, 'AAD App Proxy Elevation of Privilege Vulnerability': improper authentication (CWE-287) in AAD App Proxy allows an unauthorised attacker to elevate privileges over a network. Microsoft rates it Critical with a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N), and the CVE record names the affected product Microsoft Entra application proxy. Microsoft's FAQ says the vulnerability has already been fully mitigated by Microsoft, there is no action for users of the service to take, and the CVE is published to provide further transparency. Microsoft lists it as not publicly disclosed and not exploited. Primary: Microsoft Security Response Center; CVE record. Updated 24 Oct 2026: this card previously covered six Microsoft cloud-service CVEs published the same day; the other five now have their own desk cards (Azure Kubernetes Configuration Service CVE-2026-83938, VM Inspector for Azure Virtual Machines CVE-2026-110063, Azure Pipelines CVE-2026-105014, Azure AI Foundry CVE-2026-108456 and Exchange Online CVE-2026-96185). (source: Microsoft Security Response Center)
Microsoft Security Response Center — CVE-2026-97785, AAD App Proxy Elevation of Privilege Vulnerability (22 Oct 2026)
CISA said on 22 October 2026 that it, the Canadian Centre for Cyber Security (Cyber Centre) and partners are releasing joint guidance, Managing AI Token Consumption for Operational Resilience, to help organisations understand and manage token usage. CISA says unmanaged token consumption may contribute to rising and unpredictable costs, reduced service availability, degraded performance, token exhaustion, and denial-of-tokens or denial-of-wallet attacks. The Cyber Centre's version (ITSM.00.125) describes a denial-of-tokens attack as threat actors deliberately generating excessive AI usage to exhaust token allocations, consume budgets or trigger rate limits, and a denial-of-wallet attack as exploiting usage-based pricing to cause financial harm, for example with complex prompts or AI loops. The authoring agencies recommend a tiered model that ranks token allocation by business impact, with cyber defence, incident response and threat intelligence in the mission-critical tier, and risk assessments before letting AI agents operate autonomously. They also recommend monitoring unusual increases in token consumption as a potential indicator of data exfiltration, feeding AI token telemetry into a SIEM alongside identity, cloud and API logs, progressive usage alerts (the guide's example: 70%, 80% and 90% of quota), multi-provider architectures, and planning for reduced AI availability in critical infrastructure, including keeping non-AI and manual capabilities. Sources: CISA (22 Oct 2026); Canadian Centre for Cyber Security ITSM.00.125 (October 2026).
CISA — Managing AI Token Consumption for Operational Resilience (22 Oct 2026)
The FBI, CISA, the US Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the UK National Crime Agency and the UK North West Regional Organised Crime Unit published joint advisory AA26-293A on 20 October 2026 on the SafePay ransomware group. They say SafePay has been highly active since August 2024 and was among the most active ransomware groups of 2026, hitting at least 600 victims in multiple critical infrastructure sectors across North America, South America, Europe and Australia. The tactics and indicators come from FBI, Secret Service and German investigations as recently as August 2026. SafePay gets in with exposed or brute-forced credentials and VPN access, often from Mullvad VPN addresses, using phished accounts against Cisco ASA and Firepower Threat Defense flaws CVE-2020-3259 and CVE-2023-20269, and automated scripts that exploit internet-facing systems through Veeam Backup & Replication CVE-2023-27532 and CVE-2024-40711 and SonicWall SonicOS CVE-2024-40766. Once inside, the actors create accounts or take over existing ones, use living-off-the-land tools (PsExec, WinRM, RDP, remote management software and ScreenConnect), enumerate shares with ShareFinder.ps1 and SharpShares, dump credentials with Mimikatz and DCSync tools, bypass User Account Control, turn off security software and sometimes change users' passwords to lock them out. They compress data with 7-Zip or WinRAR and exfiltrate it with WinSCP, RClone, FileZilla, OneDrive or the Backblaze b2 tool, use AnyDesk or TeamViewer to drop the ransomware, stop Volume Shadow Copy and reset backup NAS devices to factory settings, then encrypt files with ChaCha20 and RSA (extension .SafePay). The ransom note points to a Tor chat portal, a representative phones victims to pressure them, and stolen data is posted on the SafePay leak site if they do not pay. The advisory includes IP addresses, file names, hashes and STIX files for indicators seen between November 2024 and August 2026. Primary: CISA AA26-293A (20 Oct); wire: The Record (20 Oct).
CISA, FBI, USSS, LKA Rheinland-Pfalz, NCA and NWROCU — #StopRansomware: SafePay Ransomware (AA26-293A, 20 Oct 2026; PDF and STIX IoCs)
