CloudSEK (Vikas Kundu; Adversary Intelligence; datePublished 21 September 2026, also dated 20 Sep on page) documents GHAPPIER, a previously unreported loader family spanning at least 65 public GitHub repositories, 73 infected files, and 22 accounts. The investigation began when an intruder used the maintainer account of legitimate npm package @dforge-core/dforge-mcp for ~105 minutes on 9 September 2026, inserted a remote loader, and abused the project’s GitHub Actions trusted-publishing workflow so malicious version 0.2.21 shipped with valid npm provenance/Sigstore attestation; it remained the latest release for ~35 minutes before the maintainer restored clean 0.2.22. CloudSEK maps wider infrastructure and links parts of the activity beside DPRK’s PolinRider campaign. Distinct from desk cards crowdsec-tanstack-source-20260917 and npm-indexed-btree-runtime-20260920. Primary: CloudSEK blog; wire: Cyber Security News 22 Sep 2026.
CloudSEK — GHAPPIER loader / npm trusted-publishing compromise (20–21 Sep 2026)
breaches cloud identity
BleepingComputer (21 September 2026) reports BigCommerce alerted merchants after attackers compromised credentials for third-party Ribon and Ribon 1.5 applications (owned/operated by Be A Part Of, a Fastr company) and used them to inject malicious scripts into a small number of merchant storefronts. BigCommerce told BleepingComputer it confirmed the credential compromise on 17 September 2026, uninstalled the apps from affected stores to revoke attacker access, notified merchants, and is providing log data for the developer investigation; it stated BigCommerce platform systems were not breached. UK spirits retailer Master of Malt says shopper data (full names, email, phone, shipping postal addresses) in its BigCommerce environment was accessed between 13 and 17 September and that it reported to the UK ICO; it attributes access to a compromised BigCommerce application key held by Ribon. BigCommerce says account passwords and payment card data are stored separately and were not exposed in this pattern. Wire-primary pending a public Be A Part Of / Fastr advisory. Australia relevance: BigCommerce merchants and any store using Ribon-class experience apps — rotate app keys, review storefront script injections, and run NDB assessment if Australian personal information was in scope.
BleepingComputer — BigCommerce alerts merchants (Ribon apps; 21 Sep 2026)
breaches cloud
Kaspersky Global Emergency Response Team (Securelist; published 21 September 2026) details an April 2026 incident at a Middle East manufacturing organisation where operators gained domain-admin-equivalent Active Directory control and linked a malicious Group Policy Object named PAYLOAD at the domain root — delivering enterprise-wide disruption without encrypting files or dropping a ransomware binary on endpoints. Initial access: compromised valid domain account authenticating to FortiGate SSL VPN (credential source unconfirmed — phishing, spraying/stuffing, or IAB considered). Impact via legitimate GPO client-side extensions: SYSVOL hello.txt staged as read-only README-payload.txt on desktops and C:\/D:\ roots; legal notice caption/text set to “Welcome to Payload!” plus ransom note; payload.jpg as lock-screen and wallpaper; administrator rights revoked via Security Settings CSE; a second domain-root GPO (“win Firewall Off”) disabled Windows Firewall across profiles. GPO written/cached 13 April with visible mass impact 14 April (typical GPO apply delay). Live hosts showed no encryptor processes, no .payload extensions, and no endpoint persistence — the persistence was the GPO link on the DC. Defensive focus: DS Access / gPLink change auditing, SYSVOL integrity (unexpected images/notes/registry.pol/GptTmpl.inf), and endpoint Group Policy Operational telemetry. Family-level PAYLOAD samples separately support log clearing, security-process kill, and VSS deletion — not confirmed executed in this GPO-only case. Amplify: Cyber Security News 21 September 2026. No CVE.
Kaspersky Securelist — PAYLOAD ransomware via Active Directory GPO (21 Sep 2026)
breaches identity network
Incidents
Sat 19 Sep
Updated Mon 26 Oct
Canny, a customer-feedback platform used by Sydney-based Canva, told Canva on 29 August 2026 that it was investigating unauthorised access to its systems. Canny was connected to Canva's Salesforce account, so the intruder reached limited information about some Canva enterprise customers, mainly larger customers handled by Canva's sales team. A Canva spokesperson told Capital Brief (21 September) that the exposed data included business contact details and contract information, that Canva immediately removed Canny's access and notified affected customers, and that Canva's own platform was not compromised and Canva accounts, passwords, designs and content were not accessed. Other Canny customers have published their own notices. VRChat (19 September, Perth time) said Canny told it on 28 August that an unauthorised party had accessed one of Canny's internal systems, and that Canny's investigation with an outside forensics firm found no further unauthorised activity after 28 August. Anaconda (12 October) said it rotated all credentials and integrations connected to Canny and has stopped using it. A group calling itself The Seven Deadly Sins has claimed the attack; Canva has not confirmed the group's claims. The case shows how a SaaS-to-SaaS integration token can carry a vendor breach into a customer's CRM. Primary: Canva statement via Capital Brief; vendor-side notices: VRChat, Anaconda. UPDATE 19 October 2026 (Cyber Daily): Canva gave a fresh statement after the leak-site listing, saying unauthorised access to Canny reached 'some enterprise customer records' through its Salesforce connection, including business contact details and routine business documentation; that it removed Canny's access, informed affected customers where required, complied with its obligations and worked with relevant agencies; and that Canva's own platform, accounts, passwords, designs and content were not affected. Correction (23 Oct 2026): removed The Seven Deadly Sins' own claims about record counts, data types, time inside Canva's systems and a sale; Canva has confirmed only that some enterprise customer records were exposed through Canny. (source: https://www.cyberdaily.au/security/14317-exclusive-aussie-software-giant-canva-confirms-third-party-data-incident) Correction (26 Oct 2026): the card date has moved from 16 October to 19 September 2026, the Perth date of the earliest source it cites, VRChat's Canny notice (18 September 16:27 UTC; 19 September 12:27 am Perth); Capital Brief's report with Canva's statement followed on 21 September (Perth). (source: VRChat)
Capital Brief — Canva enterprise customer data exposed in third-party breach (Canva statement, 21 Sep 2026)
australia cloud
Incidents
Sat 19 Sep
Updated Mon 26 Oct
Colorado Governor Jared Polis’s office said in a statement carried by KRDO (18 September 2026, 5:23 pm US Mountain time; 19 September, 7:23 am Perth) that foreign actors were involved in cybersecurity incidents at two small, private water providers serving fewer than 200 people. The incidents involved individuals changing equipment settings, disabling remote access and alarms, and altering pumping cycles. The governor’s office says the incidents were brief, the providers quickly addressed the risks and notified the state in late August, CDPHE followed up with each provider, and to its knowledge treatment processes and water quality were not affected and there was no impact to public safety; the providers were not named. It says it cannot confirm which foreign actors were involved but is aware, per CISA, of ongoing efforts by an Iranian-backed group to access US drinking water and wastewater systems. Broader context: FBI/EPA Public Service Announcement I-073026-PSA (30 July 2026) warns that malicious actors have been targeting internet-facing Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 PLCs in the water and wastewater sector across multiple US states since late July 2026, changing device IPs and passwords and degrading monitoring and control. Australia relevance: the same internet-facing PLC / weak remote-access pattern applies to AU water and wastewater operators — remove PLCs from direct internet exposure, enforce unique passwords and ACLs, and keep manual-operation readiness per FBI/EPA guidance. Correction (26 Oct 2026): removed the SecurityWeek credit and link; the incident details are credited to the governor’s office statement as carried by KRDO, and the card no longer says the systems were accessed in late August — the providers notified the state then. The card date has moved from 18 to 19 September 2026, the Perth date of KRDO's report (18 September, 23:23 UTC; 19 September, 7:23 am Perth time (AWST)). (source: KRDO)
KRDO — Colorado governor’s office statement (18 Sep 2026 US Mountain; 19 Sep Perth)
breaches ot ics
Incidents
Sat 19 Sep
Updated Mon 26 Oct
BleepingComputer (Lawrence Abrams; 19 September 2026) reports that the ShinyHunters extortion group breached the Clop (Cl0p) ransomware operation's data-leak Tor site. BleepingComputer says it confirmed that a text file taunting Clop and linking to ShinyHunters' leak site had been uploaded to Clop's server and could be downloaded from Clop's Tor site, and that several hours later the site had been replaced with ASCII art of Umbreon, the Pokémon ShinyHunters uses as its logo, with a link to ShinyHunters' Tor site. BleepingComputer says it has not independently verified ShinyHunters' further claims about how it got in and what it took. Crime-on-crime / threat-actor infrastructure compromise — not a victim organisation's breach notice. No ACSC/CISA primary. Primary wire: BleepingComputer. Correction (26 Oct 2026): removed ShinyHunters' own unverified claims (the access method, server access and stolen source code, logs and onion keys) from the title and summary; only what BleepingComputer confirmed remains. (source: BleepingComputer)
BleepingComputer — ShinyHunters hacks Clop leak site (19 Sep 2026)
breaches identity
CrowdSec statement (17 September 2026; informed 16 Sep) confirms a May 2026 leak of its private GitHub repositories (SaaS console, AWS cloud routines, connectors, automations). Public Security Engine repos are out of scope by design. CrowdSec says reports of ~300 repositories are accurate when 130+ intentionally public repos are included, and that the figure reflects code subdivision rather than 300 separate sensitive systems. Company assessment: TanStack npm supply-chain compromise (CVE-2026-45321; TanStack postmortem 11 May 2026 — 84 malicious versions across 42 @tanstack/* packages) is the very likely vector, similar to Mistral AI’s related case; a backdoored component appears to have extracted a CI/CD API key with read access to the private codebase during a short May window. CrowdSec says no client data, login/password, name, organisation, or PII/client logs were leaked; hunting for lateral-movement credentials found none so far; tokens/credentials rotated after confirmation. Thanks Fuites Infos for disclosure. Wire: The Hacker News 19 Sep summarises later CrowdSec reporting (~170 private repos copied 22 May via a former-employee GitHub OAuth token; 83 user emails / investor details in archive) — treat those extras as wire until mirrored on CrowdSec’s primary statement. Primary: CrowdSec; TanStack postmortem for CVE-2026-45321.
CrowdSec — Source Code Exposure in May 2026 (17 Sep 2026)
breaches cloud identity
Incidents
Thu 17 Sep
Updated Mon 26 Oct
CBS News (16 September 2026, 7:45 pm US Eastern; 17 September, 7:45 am Perth) reports, citing US officials, that US Coast Guard personnel and FBI agents boarded two Texas-bound energy tankers last month after cyberattacks struck the vessels while they were travelling toward the United States. One was the VL Prosperity, a 1,093-foot Liberian-flagged crude oil tanker; public vessel data cited by CBS shows it left Egypt's Sidi Kerir oil terminal on 1 August for Galveston, and US officials say it slowed near the Strait of Gibraltar around the time of the attack. Iran's Mehr News Agency reported on 20 August that the ship was attacked on 7 August in the Strait of Gibraltar and, citing an unnamed crew member, alleged hackers breached the engine room, reducing engine cooling flow, increasing engine speed and interfering with fuel systems; Iranian state media also claimed access to its propulsion, navigation and cargo systems and a 30-hour communications outage. The Coast Guard has not publicly attributed the attacks to Iran. On 21 August, the day after Mehr's report, Coast Guard cyber personnel, law enforcement officers, a vessel inspector and FBI Cyber Action Team operators boarded the ship for four days. Rear Adm. Amy Grable, commander of US Coast Guard Cyber Command, told CBS investigators found malicious cyber activity on the vessel's IT and other onboard systems but no evidence the ship had become unsafe to navigate; the boarding was one of roughly 40 to 50 Coast Guard Cyber Protection Team missions in the past year. The US is investigating whether the two attacks are connected and whether Iran or another foreign adversary was behind them. OT/maritime relevance for AU shippers and ports. Primary: CBS News. Correction (26 Oct 2026): the card now rests on CBS News's own report rather than SecurityWeek's summary of it, and a Wall Street Journal detail on when the second ship was boarded, which no source readable to this desk supports, has been removed. (source: CBS News)
CBS News — Coast Guard and FBI boarded two energy tankers after cyberattacks (16 Sep 2026 US Eastern; 17 Sep Perth)
tech ot ics network
Incidents
Thu 17 Sep
Updated Mon 26 Oct
BleepingComputer (17 September 2026) reports the US FBI seized nightmare-stresser[.]com and nightmarestresser[.]org used by NightmareStresser, a long-running DDoS-for-hire (booter) service. FBI Cyber Division said that since 2022 the service was used to launch hundreds of thousands of actual or attempted DDoS attacks worldwide. Seizure banners cite Operation PowerOFF, the international law-enforcement effort against DDoS-as-a-service infrastructure. Historical context: Searchlight Cyber (2023) previously assessed ~566k registered users and up to ~200 Gbps multi-layer attacks; DOJ had seized nightmarestresser[.]com once before in December 2022 with related arrests. Primary wire: BleepingComputer quoting FBI Cyber Division / PowerOFF seizure banner.
BleepingComputer — FBI seizes NightmareStresser (17 Sep 2026)
tech network
Incidents
Wed 16 Sep
Updated Sun 25 Oct
The US Department of Health and Human Services (HHS) Office for Civil Rights breach portal lists AngMar Management Services, a Texas business associate, with 126,196 individuals affected, in a report submitted on 16 September 2026 as a hacking/IT incident involving a network server. The portal entry does not describe what information was involved. Primary: HHS OCR breach portal. Correction (25 Oct 2026): the card now rests on the HHS breach portal entry; details from a wire report we cannot verify (the type of data, the timeline and a leak-site claim) have been removed. (source: HHS) Correction (25 Oct 2026): the card date has moved from 5 October to 16 September 2026, the breach report submission date the HHS portal lists; HHS gives a US date with no time. (source: HHS)
HHS Office for Civil Rights — breach portal: cases under investigation (AngMar Management Services, TX, 126,196, submitted 16 Sep 2026)
breaches
Incidents
Wed 16 Sep
Updated Mon 26 Oct
Helpfeel Inc. notice (16 September 2026 JST; Kyoto) confirms unauthorised access to Gyazo’s image-sharing service. On 11 September 2026 a third party exploited a vulnerability in Gyazo’s image upload server to run arbitrary commands; Helpfeel says it blocked access routes by early 12 September and remediated the flaw. Confirmed disclosure: ~23.62 million user-related records (fields vary — may include name/nickname, email, password hash, user/device/session IDs, X/Twitter token, Google SSO email, profile/language, registration/last-login, plan and billing status without card numbers) and ~490 million image metadata records primarily for images registered in/before January 2019 (~14.4% of image-related data), plus ~2.4 million further metadata records via filtering. Metadata includes values used to build Gyazo image URLs (upload IP, User-Agent, EXIF location, OCR text, titles, source URLs, hashed passphrases for private images); Helpfeel temporarily disabled access to files whose records were exposed and cannot rule out that some private images were viewed. Updated 17 Sep 2026 (The Hacker News, 3:30 pm Perth): The Hacker News reported the breach and noted that Helpfeel has not said what kind of flaw was exploited. Updated 19 Sep 2026 (BleepingComputer, 18 September US time; 12:00 am 19 September Perth): Gyazo service temporarily suspended for preventive maintenance while recovery continues; Helpfeel/Cosense not confirmed impacted beyond Gyazo; users being notified; no evidence of data deletion from this incident. No payment-card data confirmed disclosed. Users: change Gyazo passwords and any reused passwords; report filed with Japan’s Personal Information Protection Commission. Primary: Helpfeel corp notice; wires: The Hacker News 17 Sep / BleepingComputer 19 Sep (Perth). Updated 27 Sep 2026 (Helpfeel): Helpfeel says it resumed the Gyazo service on 27 September 2026 after a series of security measures and verification work (notice dated 26 September; first notice updated 27 September, 8:00 am JST, 7:00 am Perth). Updated 21 Oct 2026 (Helpfeel): Helpfeel published a further notice with its final investigation results (Update 3). (source: Helpfeel) Correction (26 Oct 2026): The Hacker News report is now linked, and The Hacker News, BleepingComputer and later Helpfeel notices now carry Updated lines with Perth dates. (source: Helpfeel; The Hacker News; BleepingComputer)
Helpfeel — Gyazo unauthorised access notice (16 Sep 2026)
breaches cloud identity
Incidents
Wed 16 Sep
Updated Fri 23 Oct
The Qilin ransomware group has claimed an attack on the Thorndale Foundation, a disability support organisation based in Werrington, NSW, that serves the lower Blue Mountains, Nepean and Hawkesbury regions. The foundation told Cyber Daily on 21 September 2026: "We are aware of the allegations referred to in your correspondence." It said the matter has been reported to the Australian Cyber Security Centre (ACSC) and relevant authorities and remains under investigation, and that it could not comment further while that process is ongoing. The foundation has not confirmed a breach or said whether any personal information was involved. According to Cyber Daily, Qilin posted its claim in a 15 September leak post. UPDATE 22 Oct 2026: re-sourced to the foundation's own statement; this card previously rested on a leak-site listing alone (source: Cyber Daily, 21 Sep 2026). Correction (23 Oct 2026): removed Qilin's own descriptions of the documents it says it took, which the foundation has not confirmed. (source: https://www.cyberdaily.au/security/14207-exclusive-aussie-not-for-profit-thorndale-foundation-investigating-qilin-breach-claims)
Cyber Daily — Aussie not-for-profit Thorndale Foundation investigating Qilin breach claims (21 Sep 2026; foundation statement)
australia
