Incidents
Thu 15 Oct
Updated Thu 22 Oct
The Administrative Office of the US Courts said on 15 October 2026 that a cybersecurity incident has hit BAE Systems IT and the websites that support the Bankruptcy Noticing Center (BNC), which BAE Systems operates on behalf of the Federal Judiciary. The BNC produces and transmits bankruptcy notices for every federal bankruptcy court in the United States. As a result of the incident, all access to the BNC systems and websites BAE runs for the judiciary is unavailable, including bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov and the National Creditor Registration Service, and the BNC has stopped producing and distributing bankruptcy notices. The AO says it is in contact with the affected courts and coordinating with BAE Systems, which is investigating and working to restore operations. Neither the courts nor BAE has said what kind of attack it was, who is behind it, or whether any data was taken. BleepingComputer notes the federal judiciary separately disclosed attacks on its CM/ECF case management system last year. Primary: US Courts news release (15 Oct 2026); wire: BleepingComputer.
US Courts — Cybersecurity Incident Disrupting Bankruptcy Court Operations (15 Oct 2026)
breaches
GreyNoise published research, reported by BleepingComputer on 15 October 2026, on a proxyjacking campaign by an actor it tracks as skynox7. The actor breaks into internet-facing edge devices and installs Pawns.app, a legitimate bandwidth-sharing app (a rebrand of IPRoyal Pawns that feeds IPRoyal's residential proxy pool), without the owners' consent, so the attacker is paid for the victims' internet connections. GreyNoise counted at least 143 compromised devices in 34 countries. The exploits used were CVE-2024-3272 and CVE-2024-3273 in end-of-life D-Link NAS devices, CVE-2021-44228 (Log4Shell) in Ubiquiti UniFi Video NVR, and CVE-2025-31324 in SAP NetWeaver Visual Composer; Hikvision and Dahua DVR/NVR devices were also targeted, but GreyNoise did not say which flaws. In some cases the actor added SSH key authentication as a backup way back in. GreyNoise found the activity while helping an organisation that had spotted GreyNoise-flagged residential IPs in its Entra ID sign-in logs, which turned out to be a real intrusion. Its point is that residential proxies defeat 'impossible location' and VPS-reputation checks, and that an IP can carry both legitimate logins and an attacker's traffic. GreyNoise has not published a per-country list. Primary: GreyNoise; wire: BleepingComputer.
GreyNoise — skynox7: Proxyjacking edge devices into residential proxies
vulnerabilities network
Infoblox Threat Intelligence published research on 15 October 2026 linking the long-running Help Traffic Distribution System (Help TDS), active since at least April 2017, to the Russian-language affiliate program Hotejka, which Infoblox assesses is a rebrand of the older ROI777 traffic operation. Help TDS sells PHP templates that affiliates plant on compromised websites to steer visitors into tech-support scams: full-screen fake Microsoft/Windows security alerts and exit-prevention tricks urge the victim to phone a 'support' number; operators then push free remote-desktop tools such as UltraViewer so they can take over the machine. Since April 2026 the scam landers have been hosted on free Cloudflare Pages (*.pages.dev). Infoblox says Hotejka's Telegram channel announces nearly 300 new Pages destinations a day and that researchers detected more than 20,000 such domains in six months, plus about 10,000 more pages that look like phishing or decoys. Each destination typically resolves for about a week. Infoblox also ties Help TDS traffic to prolific website malware actors including Detour Dog, Balada Injector and DollyWay. Primary: Infoblox; wire: The Hacker News (15 Oct).
Infoblox — Inside Help TDS: Hotejka and Cloudflare Pages abuse (15 Oct 2026)
breaches cloud
Incidents
Thu 15 Oct
Updated Sat 17 Oct
The Citizen Lab (University of Toronto) published report 195 on 15 October 2026, which it calls the first public technical confirmation of zero-click mercenary spyware delivered through targeted online advertising. It names the technique AdFection. Devices at the international news network Al Jazeera were infected with spyware from Candiru, the Israeli vendor now rebranded as Integrity Labs, through ads bought by Discover-Tech, an Israeli company that presents itself as an ordinary ad firm. Each ad carried a small script that sent the device's advertising ID and IP address to a Discover-Tech server as soon as the ad rendered, sometimes out of sight. Selected devices were then sent attack code; others got nothing, so the ad networks had nothing harmful to detect. Al Jazeera's network logs showed the same sequence on infected devices: a Discover-Tech ad server, then a Candiru screening server, then command-and-control. Per The Hacker News, at least 45 Al Jazeera devices were targeted in 2024 and 2025, and a recovered Windows sample matches Candiru tooling Citizen Lab analysed in 2021. The browser or app exploit used for the first break-in was not recovered, and Citizen Lab has not named the government customer. Discover-Tech's bidding records (about four billion bids, March to June 2026) show ads carrying the attacker script on 75,373 Android and iOS apps and 120,768 websites; Confiant, which investigated alongside Citizen Lab, puts its traffic at roughly 10 million ads a day. Impressions appeared on networks of NATO, the UN, EU institutions, defence and government bodies in dozens of countries, and critical infrastructure. Australian angle: the report describes a 'substantial cluster' of impressions in Australia, including government and private-sector networks in critical infrastructure such as grid and power companies, and university and research networks including the Australian Nuclear Science and Technology Organisation (ANSTO) and the Australian Synchrotron. Citizen Lab stresses that an impression alone does not confirm targeting or infection, but says these networks warrant urgent investigation. Google and IAB Europe had listed Discover-Tech as a certified or approved ad vendor since 2020. After the findings were shared they removed it in early October (IAB Europe on 8 October), Google cut its ad-exchange access, Beeswax removed it, Vungle (Liftoff) paused it and Eskimi blocked its accounts. Primary: Citizen Lab report; technical indicators: Confiant; wire: The Hacker News. Update 16 Oct (iTnews): ANSTO said it is aware of the reports including the Australian Synchrotron reference, is following standard response processes, and has not identified any impact to its facilities, systems or information from the techniques described. The ads also appeared on networks of three Australian media organisations (unnamed in the Citizen Lab report). Further detail (iTnews, 16 Oct): Confiant, which published its own report alongside Citizen Lab, said the ads it linked to Candiru were a tiny fraction of Discover-Tech's activity, and Australia was not among the nine countries where it saw devices handed over to Candiru's systems. Citizen Lab's data shows Discover-Tech bid 3.77 billion times between March and June 2026 and won about 442 million auctions.
Citizen Lab — Exposing AdFection: How Discover-Tech turned targeted ads into a pipeline for zero-click mercenary spyware (Report 195, 15 Oct 2026)
breaches australia
Incidents
Thu 15 Oct
Updated Sun 25 Oct
The n0n ransomware group initially listed a New South Wales neurology practice on the gang's leak site as 'Company 27' and has since named it as East Maitland-based Hunter Neurology, according to Cyber Daily (15 October). Hunter Neurology told Cyber Daily it is aware of the claim and, based on its investigation so far, understands it relates to an incident affecting the environment of a third-party technology provider that hosts and supports its systems. It has engaged cyber security and forensic experts to verify the claims, says it is operating normally with no interruption to patient services, and has notified the Australian Cyber Security Centre. If personal information is found to be affected, it will contact those individuals directly and notify the OAIC. Primary: Cyber Daily (practice statement). Correction (23 Oct 2026): removed n0n's own claims about how many scans, letters and backups it holds and its payment deadline; none has been confirmed by the practice. (source: https://www.cyberdaily.au/security/14305-exclusive-hunter-neurology-investigating-patient-data-breach-claims) Correction (25 Oct 2026): removed a leak-site tracker link and its listing date; the listing is now credited to Cyber Daily. The card date has moved from 11 to 15 October 2026, the Perth date of Cyber Daily's report (15 October 04:07 UTC, 12:07 Perth time (AWST)); the earlier date came from the tracker. (source: Cyber Daily)
Cyber Daily — Exclusive: Hunter Neurology investigating patient data breach claims (15 Oct 2026)
australia
Cisco Talos published joint research with Recorded Future's Insikt Group on 14 October 2026 on UAT-6275 (Recorded Future: TAG-193), activity that overlaps with the group publicly known as Silent Lynx. Talos assesses with medium confidence that the group has a Kazakhstan nexus, based on infrastructure access, language artefacts, sample submissions, working-hours analysis and targeting. Between June 2025 and August 2026 Talos saw four infection chains against government organisations across the Commonwealth of Independent States: macro-enabled Word documents (June 2025); PS2EXE-built downloaders that fetch reverse shells and add scheduled tasks (July 2025); LNK shortcuts in RAR archives that run a GitHub-hosted PowerShell script (October 2025); and, from April 2026, RAR archives exploiting the WinRAR path-traversal flaw CVE-2025-8088 to drop the PickleShell reverse shell into the Windows Startup folder. That is the first vulnerability exploit Talos has seen in the group's malware delivery. Payloads are lightweight custom reverse shells (FoalShell, Chvost, Laplas, PickleShell). Victims and lure themes span nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus. Lures included a diplomatic letter to Armenia's Ministry of Foreign Affairs, a Turkmenistan airspace application form and a proposal involving Russia's Orsk Oil Refinery, with additional interest in water resources, the environment and energy. Phishing emails were sent from compromised government accounts. Three publicly exposed staging directories and an unreported GitHub repository revealed payload builds and C2 changes. They also held Linux tooling and a public exploit for the FortiWeb SQL injection CVE-2025-25257, suggesting plans to target Linux hosts and internet-facing appliances. Talos believes UAT-6275 and YoroTrooper are likely part of the same broader cluster but tracks them separately. Primary: Cisco Talos; also Recorded Future Insikt Group; wire: The Hacker News (15 Oct).
Cisco Talos — Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations (14 Oct 2026)
breaches
The UK Ministry of Justice published an update on 14 October 2026 on the cyber-attack it identified on 23 April 2025 against the Legal Aid Agency (LAA), the executive agency that runs legal aid in England and Wales. By 16 May 2025 the MoJ had established that the criminal group behind the attack had exfiltrated a large amount of personal data about legal aid applicants and providers. Further forensic analysis now shows that most of the stolen data relates to applications, claims or payments submitted between January 2007 and 16 May 2025, or cases live in that period, but about 250,000 records predate 2007. Most of those are from the 1990s and 2000s, a very small number predate 1990, and the earliest verified record is from 1978. The analysis also found that probation data from HM Prison and Probation Service was in the exfiltrated material; the MoJ says none of it relates to victims of crime. Earlier disclosures listed applicant contact details, dates of birth, national ID numbers, criminal history, employment status and financial details such as contributions, debts and payments, plus provider contracts, financial information and LAA Online Portal credentials. The MoJ says the data involved varies greatly between individuals, a pre-2007 record does not mean everyone who dealt with legal aid back then is affected, and it has no indication the stolen data has been published or shared. It is working with the National Crime Agency, the NCSC and the Information Commission. A Ministry of Justice spokesperson told BleepingComputer it is now investing more than £200 million in modernising legal aid digital services and cyber security. Primary: GOV.UK notice; wire: BleepingComputer.
GOV.UK (Ministry of Justice) — Legal Aid Agency cyber security incident data update October 2026 (14 Oct 2026)
breaches
Incidents
Wed 14 Oct
Updated Sun 25 Oct
On 14 October 2026 Microsoft's Digital Crimes Unit, with Health-ISAC, said a US District Court for the Southern District of Florida order let them seize and redirect domains powering YAM Store (Storm-3119), CoGUI and Iron Man (Storm-2990 phishing kits) — a Chinese-language cybercrime marketplace that sold compromised or fraudulently obtained Microsoft and Google environments, accounts, licences and storage, plus ready-made phishing kits. Since January 2026 the three services enabled more than one billion malicious messages targeting over 75,000 organisations and consumers in more than 150 countries, including more than 750 million messages aimed at Microsoft customers, generating tens of millions of dollars for operators. Microsoft has disabled more than 20,000 accounts tied to YAM Store and is blocking more than 100,000 impersonation domains. The investigation began in late 2025 after Japan's National Police Agency flagged campaigns against Japanese victims; JC3, Resecurity, Cloudflare, Oracle, Proofpoint, TRM Labs and US/international law enforcement later joined. YAM Store acted as an access broker: operators bought expired organisation domains (often non-profit and education), rebuilt sites to look live, fraudulently obtained Microsoft 365 tenants, and resold them; AI tools were also used to invent fake organisations. Iron Man (advertised on YAM Store from June 2026) overtook CoGUI with more than 2,300 lure templates across 130+ countries/areas — Microsoft and Resecurity both cite Australia Post package-delivery SMS templates among the samples, alongside ANZ rewards web lures in Microsoft's illustration set. Kits support device-code phishing, geofencing, fake CAPTCHA and live OTP capture. Primary: Microsoft DCU blog 14 Oct; wire: BleepingComputer.
Microsoft Digital Crimes Unit — Disrupting the service economy behind transnational cybercrime operations (14 Oct 2026)
breaches identity australia
Incidents
Wed 14 Oct
Updated Sun 25 Oct
According to The Verge (13 October 2026, US time; 14 October, 5:59 am Perth), citing SecurityWeek, Meta says its GitHub was hacked, exposing the personal data of 1,500 people. The Verge reports, citing SecurityWeek, that Meta says "99% of the data the hackers took was business data, in the form of software code related to some of its products. The remaining 1% was personal data," some of which was "synthetic or anonymized", and that most of that personal data reportedly belonged to Meta employees in the US. No Australian impact has been stated. Primary: The Verge, citing SecurityWeek. Correction (25 Oct 2026): the card now rests on The Verge's report; details The Verge does not state (stolen employee credentials, detection timing, Meta's response steps, credit monitoring, regulator notification and notification dates) have been removed, and the card date has moved from 13 to 14 October 2026, the Perth date of The Verge's report (13 October, 21:59 UTC; 14 October, 5:59 am Perth). (source: The Verge)
The Verge — Meta says its GitHub was hacked, exposing 1,500 people's personal data (13 Oct 2026 US time; citing SecurityWeek)
breaches identity
Incidents
Wed 14 Oct
Updated Thu 22 Oct
Have I Been Pwned (HIBP) added Crunchbase on 14 October 2026 (06:01 UTC; 14:01 Perth time). HIBP says the private company intelligence platform was targeted in a ShinyHunters 'pay or leak' extortion attempt in January 2026, and that data allegedly obtained from the company was then published, including about 560,000 unique email addresses, largely of leads and business contacts, along with names, physical addresses, phone numbers, job titles, employers and LinkedIn profiles. In a statement reported by Security Affairs on 26 January 2026, Crunchbase said it "detected a cybersecurity incident where a threat actor exfiltrated certain documents from our corporate network", that no business operations were disrupted, that the incident was contained, that it engaged cybersecurity experts and contacted federal law enforcement, and that it was reviewing the impacted information to decide whether any notifications were required. Australian contacts are not separately stated. UPDATE 22 Oct 2026: re-sourced Crunchbase's acknowledgement to Security Affairs and attributed the data details to Have I Been Pwned (source: Security Affairs, 26 Jan 2026).
Have I Been Pwned — Crunchbase breach (added 14 Oct 2026 UTC; breach January 2026)
breaches identity
Incidents
Wed 14 Oct
Updated Sun 25 Oct
Mandurah State Emergency Service has confirmed the incident to Cyber Daily (14 October). A spokesman said the WA Office of Digital Government's Cyber Security Operations Centre (WASOC) notified it on 5 October of a cyber security incident involving unauthorised access to one of its servers. That server held only historical records from before 2022, and there is no evidence any other systems were affected. Operations continue as normal. The unit says it is aware further data was published online as of 13 October. Per Cyber Daily, the leak includes several zip files of compressed backups and a backup folder of historical operations and planning data. Mandurah SES is contacting past and present members who are affected and, with DGov's guidance, advising them on how to protect their personal information. DFES is supporting the unit, and the WASOC-supported investigation into the extent of the incident is ongoing. Mandurah SES, a DFES volunteer SES unit in Western Australia, was listed on The Gentlemen ransomware gang's leak site, according to Cyber Daily. The Gentlemen emerged in September 2025 and, per Cyber Daily, is now second only to Qilin by victim count; Cyber Daily says its most recent Australian victim was All Souls St Gabriels School in Charters Towers. Primary: Cyber Daily (unit statement). Correction (25 Oct 2026): removed leak-site tracker links and the listing and attack dates they gave; the listing is now credited to Cyber Daily. The card date has moved from 2 to 14 October 2026, the Perth date of Cyber Daily's report (13 October 23:52 UTC, 14 October 07:52 Perth time (AWST)). (source: Cyber Daily)
Cyber Daily — Exclusive: Mandurah SES confirms operations unaffected by ransomware attack (14 Oct 2026)
australia
The US Department of Justice and Meta announced on 13 October 2026 the results of a 'Joint Disruption Week' against scam networks operating from West Africa, the first coordinated operation focused on the region. The UK National Crime Agency hosted it in London from 6 October with the DOJ, FBI, US Secret Service, Treasury, Homeland Security Investigations, Nigerian and Ghanaian cybercrime units, INTERPOL, and law enforcement from Australia, Canada, New Zealand and India. Industry partners including Meta, Google, Microsoft, OpenAI, Coinbase, Binance, Adobe, Starlink, Chainalysis, Elliptic, TRM Labs, Flashpoint, Silent Push and Cyjax shared intelligence and acted on their own platforms. Meta removed more than 3.7 million Facebook and Instagram accounts, Pages and Groups based in West Africa, most posing as American and British users; Microsoft suspended linked accounts; partners shared leads on more than 30 suspected scam centres and identified over US$11 million in potentially freezable funds, and Coinbase says it stopped more than US$415,000 in losses to 65-plus active victims. Authorities made 28 arrests: in Sasaabi near Accra, Ghana, 19 people were arrested, 303 devices seized, 117 human-trafficking victims identified for repatriation to Nigeria and 89 scam victims with about US$8.3 million in losses found; Nigeria made nine arrests and seized 53 devices. The schemes included law-enforcement impersonation, 'digital arrest' extortion and cryptocurrency investment fraud (pig butchering). Neither announcement names Australian victims.
US Department of Justice — Results of law enforcement and private industry Joint Disruption Week targeting West African scam networks (13 Oct 2026)
breaches
