Most foreign-cyber reporting is written for the domestic reader. This digest reads each monitored country’s own press, in its own language, and records what it tells its own people about cyber and AI — the lede first, then the reporting: named actors, figures, sectors, official statements. Framing is the source’s; state media is identified as such; a country’s silence is itself recorded. All items are filed and cross-indexed for correlation.
Expect increased volatility driven by AI-enabled attacks and persistent state-sponsored activity.
Ransomware activity remains high with 235 incidents in the last seven days. Clop, thegentlemen, and qilin are the most prolific crews. A cross-cutting signal indicates AI is integrated into attacks, specifically for autonomous skimming of payment card data and accelerating exploitation attempts.
China maintains a consistent focus on intelligentized warfare and priority technologies as outlined in its Five-Year Plans; Cobalt holdings contain 115 reports on Chinese-nexus actors. Russia continues targeting Ukraine’s supply chain and demonstrates a precedent for cyber-kinetic operations. Iran exhibits destructive activity against US operational technology infrastructure and operates within a climate of active US-Iran cyber retaliation. North Korea is active, as evidenced by the ~$350 million theft from Bitget.
The underground landscape reveals substantial and continuously collected exposure of credentials, stealer logs, and personally identifiable information. This data is actively traded and leveraged for malicious purposes.
China’s press reported AI-powered attacks resulting in the compromise of 600,000 credit card records. Russia’s press reported a $350 million theft from Bitget, attributed to North Korean actors. Iran’s press announced OpenAI’s forthcoming GPT-6 Cyber model. The European Union’s press flagged critical vulnerabilities in GitLab and Microsoft Office. No reports came from India, Brazil, Venezuela, or Türkiye this cycle.
The convergence of AI development (OpenAI’s GPT-6 Cyber) with its weaponization in attacks represents increasing pressure. The geopolitical climate surrounding Iran and Russia suggests continued disruptive activity.
Our confidence is moderate, based on multiple data categories (press, ransomware, APT tracking, cyber-news). We lack reporting from India, Brazil, Venezuela, and Türkiye, limiting our visibility into those regions. An alternative explanation for the observed activity is increased criminal sophistication independent of state sponsorship, though this is not supported by the data. We do not know the full scope of AI integration into attacks beyond what is reported.
OpenAI prepares to unveil GPT-6 Cyber, a new AI model focused on cybersecurity. The launch coincides with the Dev Day event on September 29th. This model represents a broader strategy to transform AI cybersecurity capabilities into enterprise products. Google’s DeepMind is also pioneering proactive cyber defense strategies.
plaza.ir reports that OpenAI intends to introduce its latest artificial intelligence model, GPT-6 Cyber, with a specific focus on cybersecurity, during the Dev Day event on September 29th. faradeed.ir states GPT-6 Cyber can be seen as part of OpenAI’s wider strategy to convert AI cybersecurity capabilities into enterprise products. Simultaneously, nexiino.com details Google DeepMind’s unveiling of new strategies and tools for “Proactive Cyber Defense” aimed at governments and critical infrastructure.
THEMES: cobalt-sourced
Cybercriminals drained $350 million from the Bitget crypto exchange in under an hour. Funds moved from both hot and cold storage to a newly created address. The attack occurred on September 24th, impacting multiple blockchains.
On the evening of September 24, approximately $350 million in various crypto assets were stolen from wallets linked to the Bitget crypto exchange, according to Xakep. The funds transferred from both hot and cold storage across several blockchains to a single, recently created address. Unusual activity was first detected at that time, Xakep reports.
THEMES: cobalt-sourced
Hackers are weaponizing artificial intelligence. A coordinated assault leveraged three AI tools. Over 600,000 valid credit card records were compromised. Attackers initiated 105 projects in just six days.
Hackers combined three sets of AI tools to launch large-scale attacks on e-commerce, compromising at least 27 companies, iThome Security reports. The attacks, spanning six days, resulted in the theft of over 600,000 valid credit card records. The report details 105 attack projects initiated during this period.
THEMES: cobalt-sourced
CERT-MC flags critical weaknesses. GitLab, Microsoft Office are affected. CERT-MC urges immediate action.
On September 24th and 25th, 2026, CERT-MC issued multiple advisories – CERTFR-2026-AVI-1225 through CERTFR-2026-AVI-1231 – detailing vulnerabilities in GitLab, Microsoft Office, Zabbix Agent, PHP, and the Linux kernels of SUSE, Red Hat, and Ubuntu. These alerts report multiple vulnerabilities within each identified product.
THEMES: cobalt-sourced
Collections revealed nothing of note to report.
This is a statement about our collection coverage, not the threat environment. Our monitoring surfaced no in-country cyber or AI reporting of note for Brazil this cycle. Absence of collection is not evidence of absence of activity. Confidence: low — a collection gap, not observed quiet.
THEMES: collection-gap
Collections revealed nothing of note to report.
This is a statement about our collection coverage, not the threat environment. Our monitoring surfaced no in-country cyber or AI reporting of note for Venezuela this cycle. Absence of collection is not evidence of absence of activity. Confidence: low — a collection gap, not observed quiet.
THEMES: collection-gap
Collections revealed nothing of note to report.
This is a statement about our collection coverage, not the threat environment. Our monitoring surfaced no in-country cyber or AI reporting of note for India this cycle. Absence of collection is not evidence of absence of activity. Confidence: low — a collection gap, not observed quiet.
THEMES: collection-gap
Collections revealed nothing of note to report.
This is a statement about our collection coverage, not the threat environment. Our monitoring surfaced no in-country cyber or AI reporting of note for Türkiye this cycle. Absence of collection is not evidence of absence of activity. Confidence: low — a collection gap, not observed quiet.
THEMES: collection-gap
Comments
Post a Comment