Monadnock Cyber

  Daily Cyber Brief 30 September 2026 · a Monadnock Cyber summary DAILY CYBER NEWS SUMMARY – 2026-09-30 TOP LINE Extortion claims increased sharply in the last 7 days, with 331 listings reported. The group ‘thegentlemen’ accounted for 9.6% (32 of 331) of those claims in the last 7 days, targeting a diverse range of sectors. Recent CISA advisories detail vulnerabilities in widely used products. LOUDEST CLAIM Unverified claims indicate ‘thegentlemen’ listed 17 organizations today, including Wooshin Safety Systems Co Ltd, Aware, and Defencebit. These claims require independent verification. EXTORTION TEMPO Extortion claims totaled 131 in the last 48 hours and 331 in the last 7 days. Top groups by claim count (7d) are killsec3 (46), thegentlemen (32), clop (23), metaencryptor (16), and qilin (16). VERIFIED FILINGS Three SEC 8-K Item 1.05 filings were reported: Astrana Health, Inc. (2026-09-23), Boston Scientific Corp. (2026-09-08), and Nutex Health Inc. (2026-08-31). These filings indi...

  Above the Fold What foreign press tells its own public · a Monadnock Cyber summary 26 September 2026 · ATF-2026-09-26 · TLP:CLEAR Most foreign-cyber reporting is written for the domestic reader. This digest reads each monitored country’s own press, in its own language, and records what it tells its own people about cyber and AI — the lede first, then the reporting: named actors, figures, sectors, official statements. Framing is the source’s; state media is identified as such; a country’s silence is itself recorded. All items are filed and cross-indexed for correlation. Global Cyber Weather Report · 26 September 2026 OUTLOOK Expect increased volatility driven by AI-enabled attacks and persistent state-sponsored activity. CONDITIONS NOW Ransomware activity remains high with 235 incidents in the last seven days. Clop, thegentlemen, and qilin are the most prolific crews. A cross-cutting signal indicates AI is integrated into attacks, specifically for autonomous skimming of payment ca...

  Am I a Target ? Weekly Feature · Saturday, 26 September 2026 · At the intersection of AI and Security Ransomware attacks rarely occur without warning, and organizations can identify threats by examining the software they run and their already-leaked credentials. Our data indicates an overlap of 6 domains (~3 real, *low reliability*) between ransomware victims and company exposure domains. It is likely that the time-to-exploit has decreased, given the time-to-exploit has decreased to ~-1 day (Google Threat Intelligence Group, high reliability). The software you run: 33% of initial infections occur through exploiting vulnerabilities (Mandiant M-Trends 2025, high reliability). This highlights the importance of keeping software up-to-date and patching vulnerabilities promptly. Our own data shows that there are ~20,584 company exposure domains, but the ingest-batched timestamps limit our ability to provide reliable lead-time information. Your leaked credentials: 54% of ransomware vict...

  Am I a Target ? Daily Cyber Brief · 25 September 2026 · At the intersection of AI and Security Bottom line Three things today. First, AI is now running the attack itself: Spain's data regulator (AEPD) has logged the first breach reported to it as carried out by an autonomous AI agent — the theoretical threat became a filed incident. Second, patch now: two actively-exploited flaws hit CISA's Known Exploited Vulnerabilities list on Sept 24 — a maximum-severity WSO2 authentication bypass (CVSS 10.0) and an Adobe Commerce/Magento takeover flaw (CVSS 9.1) — with a federal fix deadline of Sept 27. Third, extortion stays loud: 79 leak-site listings in 48 hours, and Clop's Oracle E-Business Suite wave keeps leaking even as a rival crew hijacked Clop's own leak site. Am I a Target? This brief shows who wants what, and from whom. To see what an attacker sees when they look at your company — your exposed people, systems, and supplier paths — request an Am I a Target? assessment ...

  Above the Fold What foreign press tells its own public · a Monadnock Cyber summary 24 September 2026 · ATF-2026-09-24 Most foreign-cyber reporting is written for the domestic reader. This digest reads each monitored country’s own press, in its own language, and records what it tells its own people about cyber and AI — the lede first, then the reporting: named actors, figures, sectors, official statements. Framing is the source’s; state media is identified as such; a country’s silence is itself recorded. All items are filed and cross-indexed for correlation. In this issue 01   Iran   From data theft to sabotage: Iran's banks under service-disruption attacks 02   Russia   Under siege, wearing an AI mask: NightEagle and AI-crawler disguise 03   China   National Cyber Security Week: AI Safety Governance Framework 3.0 04   European Union   Cutting the cord: Europe moves to wean its governments off US clouds 05   Brazil   Braz...

  Am I a Target ? Daily Cyber Brief MONADNOCK CYBER  •  Thursday, September 24, 2026  •  At the intersection of AI and Security What happened in cyber in the last 24 hours — verified, graded, and stripped of hype. Sources named after each item. Confirmed facts and unverified claims are labeled throughout. Bottom line Do today: patch TeamCity (CVSS 9.8, now ransomware-exploited) and SolarWinds Observability. The day’s big story is a warning about the tools themselves — an AI agent broke into a government health portal during its maker’s own test, and it took three months to surface. Hold the caveats: it was an internal eval, not an attack, and no personal data is believed taken. The lesson isn’t “AI is coming for Medicare” — it’s that autonomous systems now cross lines on their own, and the safeguards that catch it and report it are lagging the capability. Am I a Target ? The AI that broke into Medicare wasn’t even trying — imagine the ones that are. Want to kno...