US Treasury OFAC (press release sb0624) designated Xinbi Guarantee, a Chinese-language illicit marketplace supporting cyber scams, fraud, money laundering, and related crime targeting Americans, plus two supporting digital-currency entities — coordinated with DoJ Scam Center Strike Force infrastructure and wallet seizures. THN (9 September 2026) reports ~$52.8M in cryptocurrency frozen across 52 wallets and ~$12M held in two seized payment wallets; Telegram channels hosting the market dismantled. Xinbi acted as escrow between scam-center operators and vendors (pig-butchering sites, laundering, trafficking labour). Treasury notes reported use by North Korean hackers and OFAC-designated entities including Jin Bei Group and Prince Group TCO affiliates. Primary: Treasury OFAC; wire: THN.
Proofpoint (9 September 2026) documents BlueMoon, chaining CVE-2026-85046 (Chrome V8 type confusion), CVE-2026-87491 (V8 sandbox escape; patch-gap 0-day), and CVE-2026-85880 (Windows ALPC heap overflow LPE / AppContainer escape; Microsoft September Patch Tuesday + CISA KEV). First in-the-wild use attributed to China-aligned APT31 (Proofpoint: TA412, aka JungleBamboo / Violet Typhoon) from 28 August 2026; other espionage clusters rapidly reused the kit. UPDATE 15 September 2026 desk (Volexity blog 9 Sep; THN wire 15 Sep): Volexity details two China-nexus clusters using the same byte-identical exploit chain against NGOs via spearphishing through reflected XSS on a legitimate US university site. UTA0560 deploys GRIMWEDGE (obfuscated JavaScript backdoor via MSI custom actions; C2 ocr.opusaccel[.]top). JungleBamboo/APT31 deploys SUPERSTOMP loader then LONGTALE (aka GemStone) credential-stealing Chrome extension. UPDATE 23 September 2026 desk (Volexity Part 2 blog 21 Sep; THN wire 23 Sep): third China-nexus cluster UTA0565 used the same BlueMoon chain on 3–4 Sep 2026 via multiple fake websites (chinadigitaltimes[.]top; americanprgoress[.]top typosquat of Center for American Progress) with hidden iframe loading config.html; final payload chrome_cleanup.exe is previously undocumented CLEANGULP (MSVC; control-flow flattening). CLEANGULP installs to %LOCALAPPDATA%/Microsoft/IME/MicrosoftIME.exe with scheduled task “MicrosoftIME”; commands shell/ps/upload/download/bof; C2 thecovnresation[.]com over HTTP (AES-256-GCM + custom Base64 alphabet). Targeting included Asian government entities (Hong Kong activist lure) and CAP-themed phishing. Distinct from desk cards cve-2026-85046 / cve-2026-87491 / ms-september-2026-patch-tuesday — this card is the shared kit and post-exploitation. Primary: Volexity Part 2; also Proofpoint; wire: THN 23 Sep 2026.
Volexity — Mind the (Patch) Gap, Part 2 / UTA0565 CLEANGULP (21 Sep 2026)
BleepingComputer (9 September 2026) covers Veradigm's SEC disclosure of a third-party vendor incident: an attacker obtained vendor credentials for a Veradigm customer-services API and copied patient personal details including some Social Security numbers; clinical/medical content and the broader Veradigm network were not accessed per the filing. Veradigm says a small number of customers were affected, notified law enforcement, and is offering credit monitoring where applicable. According to BleepingComputer, Veradigm's disclosure did not identify the attacker; The Gentlemen ransomware group claimed the intrusion on 5 September. Distinct from desk card sharp-office-thegentlemen-20260907 (AU Sharp Office listing). Primary: BleepingComputer (SEC filing). Updated 24 Oct 2026: the gang's claimed record count has been taken out of the headline and the unverified claimed leak deadline removed. (source: BleepingComputer) Correction (25 Oct 2026): removed the ransomware group's own claim to be holding 3.5 million patient records; no company, regulator or outlet has confirmed that figure. (source: BleepingComputer)
BleepingComputer (9 September 2026) reports AdaptHealth confirmed about 4.1 million people were exposed in a cyberattack discovered in July. SEC filing 2 July 2026 disclosed access to cloud business apps including patient management, document storage, and EHR portals. Company update: compromise on 5 June 2026 via social engineering of a third-party contractor's privileged account; an unnamed threat actor demanded a ransom on 15 June in exchange for not leaking the stolen data; data classes named include names, contact and demographic data, health insurance, and health information. HHS submission lists 4,115,802 individuals. Notifications and 12-month credit monitoring offered. No Australian nexus identified this pass. Primary: BleepingComputer (company filings). Correction (24 Oct 2026): Removed the ShinyHunters attribution: BleepingComputer says it rested on the group listing AdaptHealth on its leak site (as reported by HIPAA Journal), which is not independent confirmation; AdaptHealth refers only to an unnamed threat actor. (source: BleepingComputer)
SOCRadar (8 September 2026, 13:00 Turkey time; 6:00 pm Perth) reports active exploitation of CVE-2025-25249, a heap-based buffer overflow in the FortiOS / FortiSwitchManager cw_acd CAPWAP daemon (UDP 5246), delivering PivotC2 — a Node.js post-exploitation RAT for FortiGate with interactive shell, tunnelling, scanning and config/credential harvesting. SOCRadar cites NVD's CVSS 3.1 score of 9.8. Per SOCRadar: exploitation since at least July 2026; more than 30,000 IP addresses targeted and 178 of them confirmed exploited and infected with PivotC2, with the highest concentration in the US, where two full intrusions resulted in confirmed data exfiltration; tradecraft assessed with high confidence as Russian-speaking cybercrime; the actor highly likely used AI to develop the RAT. Affected per SOCRadar: FortiOS 7.6.0–7.6.3, 7.4.0–7.4.8, 7.2.0–7.2.11, 7.0.0–7.0.17 and all 6.4 versions; FortiSwitchManager 7.2.0–7.2.6 and 7.0.0–7.0.5. Fixed: FortiOS 7.6.4 / 7.4.9 / 7.2.12 / 7.0.18; FortiSwitchManager 7.2.7 / 7.0.6. Fortinet's advisory FG-IR-25-084 (published 13 January 2026, updated 23 February 2026) lists the same affected and fixed versions, tells FortiOS 6.4 users to migrate to a fixed release, and rates the flaw CVSSv3 8.1 (High); Fortinet's CVE record uses high attack complexity (AC:H), lower than NVD's 9.8. CISA added CVE-2025-25249 to its Known Exploited Vulnerabilities catalog on 9 September 2026 (per NVD and the CVE record). Distinct from desk card fortinet-fortimonitoronsight-20260909. Primary: SOCRadar; vendor: Fortinet advisory FG-IR-25-084; scores: NVD and Fortinet. Correction (26 Oct 2026): removed the SecurityWeek credit and link; every fact is now credited to SOCRadar, NVD or Fortinet's CVE record, and FortiOS 6.4 has been added to the affected versions. The card date has moved from 10 to 8 September 2026, the Perth date of SOCRadar's report (8 September, 10:00 UTC; 6:00 pm Perth time (AWST)), the earliest report of this exploitation cited. (source: SOCRadar) Correction (26 Oct 2026): affected versions, fixed versions and Fortinet's CVSSv3 8.1 rating are now cited directly to Fortinet's advisory FG-IR-25-084. (source: Fortinet)
CrowdStrike (covered by The Hacker News, 8 September 2026) tracks Slim Spider, a Brazil-based e-crime cluster active against Brazilian financial institutions since at least March 2026. In a late-March 2026 multi-stage intrusion at a Brazilian financial institution, the actor targeted crypto custody assets and Pix instant-payment infrastructure: custom Bash scripts queried cloud instance metadata for temporary credentials, enumerated secrets in the cloud credential manager, used Foundry cast to derive an Ethereum wallet address from a stolen private key, and implemented cloud-native signing via OpenSSL. The actor also pivoted to Azure DevOps to run malicious pipelines that deployed implants across a managed Kubernetes cluster, including backdoors mimicking legitimate infrastructure binaries (e.g. "spi" impersonating Sistema de Pagamentos Instantâneos). Primary: CrowdStrike adversary page; wire: The Hacker News.
UPDATE 11 September 2026: the Florida Department of Highway Safety and Motor Vehicles (FLHSMV) confirmed a DAVID driver-database breach; according to BleepingComputer, the confirmation came after the ShinyHunters extortion group claimed it had breached the database. In a statement posted to X (status 2098239548660514979), FLHSMV said it learned of the breach on 4 September 2026, that it was quickly mitigated, and that no further breach is ongoing. Investigation found attackers used compromised credentials of a single Plant City Police Department user that had been improperly stored on the employee’s personal electronic device. FLHSMV notified the Florida Office of the Attorney General and is working with the Florida Digital Service and Florida Department of Law Enforcement; further detail withheld pending the criminal investigation. FLHSMV has not disclosed how many records were accessed. According to BleepingComputer, FLHSMV's finding that a single user's stolen credentials were used differs from how ShinyHunters claimed to have got in. No Australian nexus identified. Primary: FLHSMV X statement; wire: BleepingComputer (11 Sep). UPDATE 16 October 2026: FLHSMV issued a public notice saying its investigation with the Florida Digital Service and the Florida Department of Law Enforcement found the potentially affected information includes driver licence and motor vehicle data, including document images, and other personal information. It is mailing letters this week to current driver licence and ID card holders who may be affected, offering one year of identity and credit monitoring plus $1 million identity-theft insurance through Sontiq, a TransUnion company. Because it may not have current addresses for former licence, ID or title holders, it also issued a substitute notice under Florida's breach law (s. 501.171) and asks them to contact the department if no letter arrives. FLHSMV still has not said how many people are affected and says it has no evidence the data has been misused. Primary updated to the FLHSMV public notice (16 Oct). Correction (25 Oct 2026): removed the extortion group's own claims about how many records it took, how it got in and the screenshot it offered as proof; FLHSMV has not confirmed any of them. (source: BleepingComputer)
FLHSMV — Public Notice Regarding September Security Incident (16 Oct 2026)
BleepingComputer (8 September 2026) reports Sophos analysis of a Linux rootkit targeting F5 BIG-IP APM environments that intercepts PHP loading and injects a fileless web shell in memory so on-disk PHP files stay unchanged. ESET tracks the family as PoisonedRefresh. Sophos describes a separate installer/propagation stage that tampers with Apache /usr/sbin/httpd, SELinux policy, and persistence across BIG-IP upgrade images; the second stage uses RC4 string hiding, hooks __libc_start_main and apr_dso_load, and injects into APM webtop scripts such as apm_css.php3, full_wt.php3, and webtop_popup_css.php3. The web shell accepts magic requests, eval()s decrypted content, and returns HTTP 201 disguised as text/css; a password-protected local UNIX socket can spawn Bash without a TCP listener. Sophos says the payload was likely deployed after exploitation of CVE-2025-53521 (critical RCE that F5 reclassified from DoS in March). Shadowserver reportedly tracked about 795 internet-exposed BIG-IP APM endpoints still vulnerable to that CVE at time of writing. Hunt: Apache workers reading /proc/self/maps, changing libphp memory protections, creating /run/bigtlog.pipe, launching /bin/bash, unusual POSTs to targeted .php3 paths, or HTTP 201 + text/css responses. Wire: BleepingComputer; research: Sophos / ESET.
BleepingComputer exclusive (8 September 2026): Kinryū Labs found an internet-reachable Elasticsearch cluster named "pax-info" (Viettel-assigned IP space, Hanoi) holding Advance Passenger Information System (APIS) data — 210,318,069 passenger and 10,465,631 crew records (220,783,700 entries, ~107 GB across 29 indices) spanning January 2017 to April 2026. Fields included names, dates of birth, sex, nationalities, passport/travel-document numbers and expiry, issuing countries, plus flight numbers/dates, airlines, origin/destination/transit airports, seats, baggage refs, and scheduled/estimated/actual times. Sample records reviewed included Korean, Chinese, Canadian, and New Zealand nationalities among others; many international carriers across Asia-Pacific, Europe, and the Middle East appear, so travellers who flew to/from/through Vietnam may be affected (counts are travel records, not unique people). Access path: open internet returned HTTP 401, but a cloud-based path reached the cluster which then accepted default credentials (FOFA saw the host/port from Oct 2022; exposure duration via the second path unknown). Kinryū reported to Vietnamese authorities, airlines, and national CERTs from 3 June 2026; access remediated 8 June 2026 after Singapore Airlines security helped coordinate containment. No ransom notes or sales listings found; without server logs, prior copying cannot be ruled out. Operator organisation not confirmed. Kinryū Labs published its own report on 9 September 2026. Primary wire: BleepingComputer; researcher: Kinryū Labs.
Sophos analysis (published ~7 September 2026; THN 9 September) describes malware on compromised F5 BIG-IP Access Policy Manager appliances that injects a PHP web shell into memory when Apache loads APM webtop scripts apm_css.php3, full_wt.php3 or webtop_popup_css.php3 — so on-disk file hashes can look clean. F5 previously tracked related activity as malware family c05d5254 and warned those three scripts can be modified or hold in-memory-only shells (IoC list from March). Defenders must not rely on disk-only webshell scans; compare runtime/Apache memory and hunt the F5 IoCs. Sophos says F5 associates the related c05d5254 activity with BIG-IP APM systems affected by CVE-2025-53521, an exploited unauthenticated remote code execution flaw. Watchlist: F5. Primary research: Sophos; wire: THN; vendor IoC context: F5.
Sophos — in-memory PHP web server rootkit (BIG-IP APM)
CloudSEK (7 September 2026) details BigBear 2.0, an Evilginx2-based phishing-as-a-service panel targeting Microsoft 365 with an "offy" phishlet. Researchers obtained admin access to the operator panel (alias "General Boss"): 42 VPS nodes over the campaign lifecycle (many on Vultr/The Constant Company), geo-matched residential proxies, Telegram exfiltration bots for at least five affiliates, and cookie replay after victims complete MFA. Panel telemetry cited by CloudSEK: 5,137 credential records (474 complete MFA-bypassed authentications, 1,032 plaintext passwords, 4,148 session cookies) across 3,331 unique victim IPs in 40+ countries; BleepingComputer notes 258 organisations with at least one completed MFA-bypass compromise (461 in the broader targeting set). Custom JS can weaken phishing-resistant MFA (FIDO2/WebAuthn) toward weaker methods. Operation still active at publish time. Primary: CloudSEK blog; wire: BleepingComputer (7 Sep 2026).
Cyber Daily (9 September 2026) quotes a Sharp Office spokesperson confirming a cyber incident affecting some parts of its systems: the Broadmeadow office-technology supplier engaged external responders, contained and restored business systems (operational at time of quote), and said it notified the Australian Cyber Security Centre. According to Cyber Daily, The Gentlemen ransomware group listed Sharp Office in a 7 September leak post; the spokesperson said the company is aware of claims made online by a malicious actor and that its investigation is ongoing. Investigation ongoing; no public headcount or OAIC notice fetched this pass. Distinct from earlier Sharp Motor Group third-party incident. Primary: Cyber Daily with company statement. Correction (25 Oct 2026): removed the ransomware group's own publish deadline and the leak-site tracker link; the listing is now attributed to Cyber Daily, alongside the company's statement that it is aware of claims made online. (source: Cyber Daily)
