🔴 ShinyHunters' Rey detained in Jordan and cooperating with the FBI, 🇰🇷 South Korea's president orders emergency probe into bank data leaks, 🍎 Fake Zoom installer drops CloudSyncD macOS backdoor, 🇩🇰 DTU breach exposes up to 200,000 people via stolen IAM credentials, 🔁 Sygnia publishes NetScaler CVE-2026-88771 exploitation IOCs, 🔐 Bouncy Castle ships critical BC-JAVA crypto fixes

[NEW] ShinyHunters may have lost its operational edge: Reuters reports that suspected member Saif al-Din Khader, known as "Rey" and "Hikki-Chan," has been detained in Jordan and is cooperating with the FBI, walking investigators through his devices. The group claimed the theft of 2TB to 3TB of FBI employee and applicant records reached through PeopleSoft zero-day exploitation (CVE-2026-35273) into FBI-managed AWS GovCloud, a breach the FBI confirmed it was investigating via FBIjobs.gov. If the cooperation reports hold, the most vocal crew in this cycle's extortion scene could be handing the bureau its own case file.

[UPDATE] The NetScaler zero-day response gained new hunting material: Sygnia has published what it calls novel and credible indicators for CVE-2026-88771 exploitation, giving defenders their first solid sweep list while the SAML reboot loop on patched builds remains unrevised. Admins juggling exploitation risk on old builds against reboot loops on new ones should run the IOCs before the next emergency build lands.

[REVISIT] The KillSec takedown added a detail since the weekend began: a second suspect faces extradition to Puerto Rico, and Europol has reaffirmed that the crew's suspected administrator and primary operator is just sixteen. Operation KillSwitch seized the leak site and extortion servers on September 30, and affiliate rebrands remain the usual sequel.

[NEW] macOS users are the target of CloudSyncD, a backdoor Jamf researchers watched move from development in mid-September to active deployment within days, delivered through a fake Zoom installer. The dropper mounts a disk image named Zoom and writes a universal Mach-O payload to an anonymous file descriptor, and when System Integrity Protection blocks execution it falls back to a disk write launched with sudo, armed with an administrator password hidden in zero-width Unicode characters. The rapid jump from testing to deployment points at live social engineering campaigns rather than automated spraying.

[NEW] Denmark's Technical University confirmed a breach affecting up to 200,000 people after attackers used compromised credentials to enter DTUBasen, the university's identity and access management system. Potentially exposed data spans Danish CPR numbers, names, home addresses, work information and next-of-kin details across roughly 40,000 active and 160,000 former users, with access reaching back over two decades, and DTU cannot yet confirm exactly what was downloaded.

[NEW] South Korean President Lee Jae Myung has ordered an emergency probe into recent personal data leaks at top banks including Shinhan and Woori, directing a thorough investigation and response measures, with early reporting describing broad scanning of the banks' services before the breaches. A head of state personally ordering a bank breach probe signals the political weight data leaks now carry in Seoul.

[NEW] The Bouncy Castle team has pushed critical fixes for BC-JAVA: CVE-2026-71885, a critical flaw in the Messaging Layer Security (RFC 9420) implementation in versions before 1.86, and CVE-2026-71887, improper verification of cryptographic signatures. No exploitation is claimed against either bug, but BC-JAVA sits underneath countless Java stacks, so operators should move to 1.86 and audit any MLS or signature-verification dependency paths.

[NEW] Cisco Talos has documented Antino, a previously undocumented Windows backdoor used by a suspected China-nexus actor against government and policy organizations in Taiwan, India and the Philippines. Its command channel runs through Microsoft Graph, parking commands and stolen data inside Outlook mail and OneDrive files so the traffic is indistinguishable from ordinary Microsoft 365 activity, and reporting couples the delivery phishing with DMARC spoofing. No CVEs or named victims exist yet, so the scope is exactly what Talos published.

[NEW] China-nexus group TA419 is running reply-triggered adversary-in-the-middle phishing against US AI policy experts, with emails impersonating prominent figures to intercept communications. The narrow target set says the goal is policy insight, not volume.

[NEW] France's tax authority was breached through stolen staff passwords, and per The Hacker News the intrusion went unnoticed even though the security team had caught red flags it failed to connect until afterward. Credential hygiene plus alert triage failed in the same incident, which is the least exotic and most common breach recipe there is.

[NEW] The UK's Cyber Security and Resilience Act adds powers to block high-risk technology suppliers from critical infrastructure, aimed squarely at supply chain risk in essential services. Suppliers to UK critical infrastructure should expect heightened scrutiny of their own security posture as the regime takes shape.

[NEW] Fortra analysts have profiled N0n, a newly emerged extortion gang first spotted in mid-September that posted roughly a dozen claimed victims to its dark web leak site within days. No CVE, country or confirmed breaches are attached yet, so watch the leak site for victim confirmations.

[NEW] Frontline Education is notifying school districts after attackers exploited a vulnerability in third-party software to breach its systems and access employee records including SSNs. The vendor and the intrusion window remain undisclosed, leaving districts waiting on scope details.

[NEW] A malware-traffic analysis from September 30 traces SmartApeSG using the ClickFix playbook, fake CAPTCHA prompts and PowerShell commands the victim executes themselves, to deploy the CNCmachineRMS remote access trojan. It is a targeted delivery chain rather than a broad spray, worth tracking for IOCs.

Watchlist: Fortinet's FortiMail fixed builds 7.4.9, 7.6.7 and 8.0.2 against the exploited CVE-2026-104286 while the KEV clock runs, Citrix's revised NetScaler build that ends the SAML reboot loop as defenders sweep with Sygnia's CVE-2026-88771 IOCs, the federal BOD 26-04 deadline on the Zammad pair hitting October 5, what Rey's devices yield on the claimed 2-3TB FBI trove, and primary-source confirmation of the "actively exploited" claim circulating around GitLab's CVE-2026-90970.

Generated by zai/glm-5.3-flash. Input tokens: 82,364, output tokens: 25,477, cache read: 1,219,328, cache write: 0.