SOCRadar's Threat Research Unit published research on 6 October 2026 into CyberXero, a Russian-speaking, financially motivated initial access broker that pairs common attack tools with an AI orchestration layer on its own servers. Everything surfaced through one mistake: an open directory served the actor's live working folder, more than 90,000 files including AI session logs, scripts with plaintext tokens and stolen data, and the actor stayed active while researchers watched. On one workstation it configured up to 51 Claude Code agents for discovery, password testing, exploitation and data theft; a second setup connected PentAGI, an open-source AI penetration-testing framework, to a Cobalt Strike team server through an AI provider's API, with model choice and token budgets set per task. Session logs show the operator telling the model the targets were its own systems under authorised testing and, when refused, opening a fresh session with the same cover story; some refusals held, including requests to install a backdoor, disable a firewall, move across a network and plant a webshell. The broad campaign used an internal wp2shell package that abuses the WordPress REST API batch endpoint to inject SQL, create a rogue administrator and drop a WSO-family webshell, and it also hit Magento and used Support Board CVE-2026-4815 within 30 days of disclosure; one automated run scanned 4,708 targets, found 429 reachable WordPress admin panels and placed 32 shells in 61 seconds. A separate hand-picked pipeline mapped seven Ukrainian energy and utility organisations, including the national transmission operator; four Ukrainian organisations had confirmed data theft, a Kharkiv district-heating provider lost 564,073 subscriber records, and data on more than 628,000 Ukrainians was found. More than 40 organisations were affected worldwide, with activity also seen in Poland, China and Pakistan; SOCRadar found no direct proof of an access sale. Infrastructure was first seen in July 2026 across eight nodes in European hosting and Tencent Cloud. Primary: SOCRadar; wire: Cyber Security News (7 Oct).
SOCRadar — CyberXero: an AI-augmented initial access broker targeting Ukrainian critical infrastructure (6 Oct 2026)
ai
MVSEP, an online service that separates music and voice tracks, published a security incident notice (last updated 6 October 2026) saying an attacker was in its servers between 4 and 6 October and could read its database and stored files. Automated probing began on 4 October; at about 01:30 UTC on 5 October the attacker abused a flaw in how the website read one of its browser cookies to run commands on the web server, found login details for MVSEP's other servers and signed in to them as an administrator. The 5 October database outage was the attacker restarting the database. MVSEP fixed the flaw on all servers at 03:25 UTC on 6 October, removed the access, moved servers to key-only logins and replaced its encryption key, database and payment-provider keys, and Google, GitHub, Google Drive and Yandex Disk credentials. It is treating everything as exposed: names, email addresses, sign-in method, plan and credit balance; passwords as salted bcrypt hashes; API keys, which were stored as-is and work until replaced; processing history including file names, transcriptions, job IP addresses and webhook URLs; audio uploads still on the servers; payment records (card details are entered on Paddle and YooKassa pages and never reached MVSEP); support tickets; and cloud-storage tokens, now revoked. All saved logins were signed out. MVSEP has not said how many users are affected. Primary: MVSEP incident notice.
MVSEP — Security incident: 4–6 October 2026 (last updated 6 Oct 2026)
breaches identity
Advantest Corporation, a Japanese maker of automated test equipment for the semiconductor industry, has begun notifying people that their personal information was taken in the ransomware attack it disclosed in February 2026. An attacker broke into its network on 15 February and deployed ransomware; at the time the company could not say whether customer or employee data was affected. In a notification letter dated 6 October 2026, Advantest says an unauthorised third party accessed its systems and extracted data from its servers, including the recipient's personally identifiable information. The letter does not say how many people are affected or whether they are customers, employees or partners, and BleepingComputer had no answer to those questions at publication. Advantest says it has no information that the data has been leaked or misused, and is offering 18 months of identity, credit and web monitoring through Kroll, with enrolment open until 4 January 2027. BleepingComputer found no public claim by a ransomware group. Source: BleepingComputer (7 Oct), which quotes the notification; Advantest's own notice is not yet linked publicly.
BleepingComputer — Advantest confirms personal information stolen in ransomware attack (7 Oct 2026)
breaches
Google said on 6 October 2026 that the previous week it became aware of hijacks of three country-code top-level domains: .gh (Ghana), .sl (Sierra Leone) and .as (American Samoa). The attackers compromised the third-party registries rather than Google or the domain owners, changed the authoritative DNS records for selected domains under those suffixes, and used that control to pass certificate authority domain validation and obtain HTTPS certificates covering several Google domains and domains of other organisations. Google says it has no reason to believe the issuing certificate authorities did anything wrong. Chrome blocked the certificates through CRLSets and Google worked with the issuing CAs to revoke them; Certificate Transparency data pointed to more affected organisations, including leading global brands and widely used services, which Google also blocked and contacted where it could. Update 8 Oct: The Hacker News reviewed Certificate Transparency logs and found at least 12 unauthorised certificates for seven Google and YouTube names, including google.com.gh, google.sl and google.as, logged one ccTLD at a time: .gh on 22 September, .sl on 25 September and .as on 27 September. Let's Encrypt issued 11 and ZeroSSL one, and a Let's Encrypt staff member confirmed on its community forum on 7 October that Google and YouTube certificates were issued and revoked. All 12 showed as revoked by 1 October, between about a day and a half and nearly a week after first being logged. Only a small set of names was searched, so the total is likely higher. Google has not named the attackers, said how the registries were breached, whether any certificate was used to impersonate a site, or whether the registries are now secure, and warns its analysis may have missed affected domains and that Chrome's blocking does not protect other browsers. Primary: Google (Chrome Security blog); wires: The Hacker News, Ars Technica.
Google — Chrome's response to recent ccTLD registry hijacks (6 Oct 2026)
breaches network identity
Browser security company Island published research on 6 October 2026 on a phishing platform dressed up as a range of AI advertising products, from campaign optimisation and spend audits to business-account connections, using the names ChatGPT, Gemini, Claude, Perplexity and Manus. Eight days after Meta launched its Muse AI agent on 8 September, museads.ai appeared (by 16 September) offering a fake "Muse Ads" manager. Every page leads to a Connect button that draws a fake browser window inside the page, with an address bar showing accounts.google.com or an Okta tenant, styled to match Windows, macOS, iOS or Android. Behind it a human operator watches in real time: the platform keeps every password attempt, fingerprints the device, can ask for the password up to three times, then chooses whether to show an SMS or authenticator code request, an Okta push, a Google approval prompt or a QR code, and can reject codes or hold the victim on a waiting screen. It supports Google, Meta, TikTok and Okta sign-in flows. Targets are agency staff, media buyers and administrators whose accounts reach many client ad accounts, which can be drained on fraudulent campaigns or resold. Older source code left in misconfigured public GitHub repositories traced the operation back to March and showed the same kit reused for refund and recruitment lures; Island saw hundreds of victim submissions to its Telegram control channel, and activity was ongoing at publication. Primary: Island; wire: BleepingComputer.
Island — Behind the Connect Button: The Fake AI Ads Campaign (6 Oct 2026)
breaches identity ai
UK education software provider Bromcom has notified customers of a personal data breach involving legacy single sign-on (SSO) registration functionality in its Communication Server environment, The Register reported on 6 October 2026. In a 24 September post on the EduGeek forum, a Bromcom account said an unauthorised third party had accessed and retrieved email addresses and limited information tied to affected SSO registrations. Bromcom identified the incident on 6 September after reports of SSO access problems. The service held email addresses linked to SSO registrations, the sign-in provider used (such as Microsoft or Google), registration and last sign-in dates where recorded, and internal user and registration reference numbers; Bromcom says it held no passwords or authentication tokens and did not allow access to Microsoft or Google accounts. The superseded component had stayed in production because an internal system still called it, and has now been withdrawn. Bromcom says it found no evidence its school Management Information System (MIS), which holds student, attendance and behaviour data, was compromised, and it is working with forensic specialists and liaising with schools, trusts and the authorities. Bromcom software is used by more than 5,000 schools and 390 multi-academy trusts. Primary: The Register (Bromcom statement and FAQ); switch primary when a public Bromcom notice is available.
The Register — Legacy sign-on service comes back to bite school software provider Bromcom (6 Oct 2026)
breaches identity
Incidents
Tue 6 Oct
Updated Fri 23 Oct
On 6 October 2026, from about 5am US Eastern time, users of the ASOS shopping app, mainly in the UK, received a push notification addressed to the British online fashion retailer's data protection officer and IT team: "we have fully compromised the Snowflake instance. Engage with us, or we will leak it", with a link to a Telegram channel run by a group calling itself Xuanye, which has no known track record. Later the same day ASOS confirmed a data breach: it says third-party platforms it uses to communicate with customers were accessed without authorisation and that basic personal information, including names and contact details, may have been exposed. ASOS says it does not believe payment card details or account passwords were affected, and it is showing an in-app notice telling customers to ignore the alert and not to open its link. ASOS has not confirmed the claim that its Snowflake environment was compromised and has not said how many customers are affected. Researchers quoted by the BBC said sending the notification needed access to ASOS's own messaging systems. Sources: BleepingComputer (ASOS confirmation), BBC News. UPDATE (8 Oct 2026): ASOS now says the breach began with social engineering. In a security notification shared with BleepingComputer it says an unauthorised party got into an ASOS employee account by impersonating a trusted contact to obtain login credentials, then used those credentials to reach information on certain third-party platforms ASOS uses. ASOS locked down the affected platforms, is investigating with external experts, law enforcement and regulators, and repeats that payment card details and account passwords were not accessed and customers need take no action beyond watching for unexpected messages or calls claiming to be from ASOS. It still has not addressed the Snowflake claim or given a customer count. Source: ASOS customer update (linked) and BleepingComputer (8 Oct). UPDATE (8 Oct, BBC News): BBC News reported that ASOS later told customers hackers hold detailed customer profiles of potentially millions of users, beyond the "basic contact details" in the first LSE and customer notices. Fields now confirmed or shown in samples include names, addresses, phone numbers, emails, customer numbers, dates of birth and on-site search terms. ASOS said no bank details or passwords were accessed, urged caution about unexpected messages or calls claiming to be from ASOS, and said it will contact customers directly where more support is needed. BBC News notes Snowflake has previously said its own platform was not breached. Primary confirmation of the wider profile set is ASOS's customer email as reported by the BBC (article held so ASOS could notify customers first). Wire: BBC News (Joe Tidy, 8 Oct). CORRECTION (21 Oct 2026): removed an unsourced line about the ASOS share price, removed The Register from the sources (not linked), and corrected the date of the BBC report from 13 to 8 October. Correction (23 Oct 2026): removed the extortion group's own statements about what it holds and how it got in; Australian impact is now attributed to Cyber Daily's 8 October report. (source: https://www.bbc.com/news/articles/c3zxjdw5ywgpo)
BleepingComputer — ASOS confirms data breach after "HACKED" in-app notifications (6 Oct 2026)
breaches cloud
Incidents
Mon 5 Oct
Updated Sun 25 Oct
TrendAI Research published a report on 5 October 2026 linking more than four years of espionage campaigns to Earth Sirrush, a Russia-aligned intrusion set previously tracked as SHADOW-EARTH-065 that overlaps with CERT-UA's UAC-0099. Since at least 2022 it has sent tailored spear-phishing to Ukrainian government agencies, defence organisations, border guard units and logistics operators, using malicious archives and documents that impersonate police, border, tax and justice authorities and, more recently, a drone-parts supplier with a convincing download site and a fake antivirus check. Earlier waves exploited the WinRAR flaw CVE-2023-38831. The group has built more than 10 malware families, moving from PowerShell and Go to C# loaders and .NET implants. In 2026 it leaned on steganography, hiding payloads in PNG images either appended after the image data or pulled out of the pixels with PowerShell, including the border-guard-themed CINDERBLOT (also called BadPaw) campaign. In July 2026 CERT-UA documented a chain that starts with LUNCHPOKE, a malicious Notepad++ plugin (NppExport.dll) that runs through DLL proxying when the editor opens and drops the BURNYBEAR and MATCHBOIL.V2 loaders, kept running by renamed copies of schtasks.exe. The newest tool, ASHVEIN ("TelemetryBrowser" to its developers), is a .NET stealer and remote access trojan that takes Chrome and Firefox credentials, screenshots and files, runs PowerShell, fingerprints the machine, checks for analysis tools, hides tasking in invisible web page elements and can fall back to GitHub to find its server. TrendAI tied the campaigns together through shared encryption code, identical system queries, reused artefacts and infrastructure, with many command servers registered through the same registrar behind Cloudflare. In one case an implant kept its foothold through a month with no server contact. Primary: TrendAI Research.
TrendAI Research — Earth Sirrush: a Russia-aligned intrusion set with 4 years of evolving espionage tooling (5 Oct 2026)
breaches
Incidents
Mon 5 Oct
Updated Fri 23 Oct
Tellter SAS, which runs the Discord server protection bot Double Counter, published an incident report (version 2.0, last updated 21 October 2026) on a multi-stage attack on 4 October 2026. The way in was an old server from its previous OVH hosting that was no longer used but still ran a publicly reachable self-hosted Metabase analytics instance; a Metabase vulnerability let the attacker forge an administrator session and reach the host. The company does not name a CVE. That server held a cloud service-account key with administrator rights and an administrator's saved command-line session. With them the attacker added an SSH key, exported a database to a bucket, read the bot's Discord token from a running container, gave itself admin on the support server and posted links to its own Discord server in about 50 large servers using the bot. It read a replacement token within two minutes, deleted backups, changed the database admin password and copied about 12 GB before being cut off around 17:55; the service was restored at 19:19 with new credentials. Exposed data includes IP-address records for alt detection (about 5.4 million copied in full) and a verified-users table (about 21.7 million rows, treated as wholly exposed though about 20% left). The attacker also used a stolen Stripe key for Tellter's separate Atis product to charge 'the cards saved by 11 existing customers of that product, one of them a company card of ours': 23 charges went through, for $7,331, of which '$7,322 was refunded the same day', and the remaining $9 has since been refunded. According to the report, the copied data also includes de-duplicated email addresses for about 1.0 million accounts (Doogle accounts, about 840k, and Double Counter dashboard, server-manager, customer and advertiser contacts, about 240k), and payment-provider customer records for about 5,000 Doogle and Atis customers (name, email address, Discord ID and username, billing address, plan and payment history, card brand, expiry date and last four digits), marked 'Copied, partly published'. Tellter says full card numbers and security codes were never accessible. It notified France's data protection authority, the CNIL, on 5 October, filed a criminal complaint with the Paris public prosecutor on 21 October, and since 21 October has been emailing everyone whose email address was in the affected data (about 1 million people). Have I Been Pwned loaded the published data on 7 October: 274,922 unique email addresses with Discord usernames, plus names, countries and postcodes for a small number of paying subscribers. Discord passwords and stored card numbers were not exposed. Correction (23 Oct 2026): this card previously said three cards were charged; Double Counter's report version 2.0 (21 October) says the saved cards of 11 customers were charged, for $7,331, almost all refunded the same day, and adds the copied email addresses and the Doogle customers' billing records. Primary: Double Counter incident report.
Double Counter — Targeted attack on Double Counter’s infrastructure (Security incident report INC-2026-10-04, version 2.0, updated 21 Oct 2026)
breaches cloud identity
CloudSEK published research on 5 October 2026 on a Russian-speaking affiliate of the Gentlemen ransomware group who calls himself Azazel. An exposed open directory and a misconfigured storage server revealed more than two dozen victim directories and about 6TB of stolen data from organisations in logistics, insurance, pharmaceuticals, AI, medical devices and government-adjacent services across six countries (CloudSEK does not name them), with one exfiltration still running during the investigation. Most victims were reached the same way: tokens, database credentials, API keys and SSH keys harvested from GitLab CI/CD variables and git history. One CI/CD token at a SaaS provider reached more than 150 databases, payment gateways and hundreds of repositories across more than a dozen client companies; at a platform hosting a government-linked financial registry, more than 120,000 records were taken before the attacker killed the live PostgreSQL process and deleted the production data. A separate intrusion at an AI company began with an AI medical imaging API that fetched user-supplied URLs without validation (server-side request forgery). CloudSEK found a reverse-shell handler registered as a tool in an AI coding assistant through the Model Context Protocol (MCP), and a script that used that MCP channel to confirm ransom notes had landed on six internal hosts, which it calls the first public report of MCP used this way as a criminal control channel. Azazel published victims on his own leak site, LEAKNED, and did not share proceeds with the Gentlemen operator. CloudSEK says it notified identified victims before publication. Primary: CloudSEK; wire: Cyber Security News.
CloudSEK — Caught in 4K: The Gentlemen Files (5 Oct 2026)
breaches cloud ai
The US Attorney's Office for the District of New Jersey announced on 5 October 2026 that Daniel Rhyne, 59, of Kansas City, Missouri, was sentenced on 28 September to 32 months in prison. He had pleaded guilty on 1 April 2026 to extortion involving a threat to damage a protected computer and to intentionally damaging a protected computer. Rhyne was a core infrastructure engineer at a US industrial company headquartered in New Jersey. In November 2023 he used unauthorised remote desktop sessions and scheduled tasks on the domain controller to delete network administrator accounts, change passwords on other accounts and shut down servers, then on 25 November 2023 emailed staff threatening to keep shutting down servers unless he was paid about 20 bitcoin (then about US$750,000). BleepingComputer, citing the criminal complaint, reports the tasks deleted 13 domain admin accounts, reset 301 domain user passwords, and locked staff out of 254 servers and 3,284 workstations, and that the ransom email claimed backups had been deleted. Investigators traced searches for the commands he used to a hidden virtual machine and his work laptop. Primary: BleepingComputer (6 Oct) and the DOJ District of New Jersey releases.
BleepingComputer — Engineer sentenced for locking over 3,000 devices on employer network (6 Oct 2026)
breaches identity
Incidents
Mon 5 Oct
Updated Fri 23 Oct
A group calling itself BYOD posted data to its dark web leak site that it says came from Trump Mobile, the US mobile service owned by T1 Mobile under a brand licensed from the Trump Organization. Straight Arrow News reported that the leak exposed personal data for 3,615 customers. Straight Arrow News reported on 5 October 2026 that its analysis of the data found first and last names, email addresses, phone numbers, home addresses and order details. Straight Arrow says one customer it called confirmed he had paid Trump Mobile a $100 deposit, several other people it contacted confirmed their exposed personal data was accurate but denied being customers, and a Trump Organization employee listed in the data confirmed he had previously used Trump Mobile. Straight Arrow says its review found no member of the Trump family among the customers, but the data includes Trump Organization CIO Eric Brunnett. Trump Mobile did not immediately respond to Straight Arrow's request for comment. UPDATE 22 Oct 2026: cut the group's unverified claims about how it got in and about continuing access; this card now keeps only what Straight Arrow News says it verified (source: Straight Arrow News, 5 Oct 2026). Correction (23 Oct 2026): the 3,615-customer figure was attributed to the BYOD group; it is Straight Arrow News's own reporting. (source: https://san.com/cc/trump-mobiles-latest-problem-hackers-just-released-customer-information/)
Straight Arrow News — Trump Mobile's latest problem: hackers just released customer information (5 Oct 2026)
breaches identity
