Above the Fold · What foreign press tells its own public · a Monadnock Cyber summary · 07 October 2026
Most foreign-cyber reporting is written for the domestic reader. This digest reads each monitored country’s own press, in its own language, and records what it tells its own people about cyber and AI — the key point first, then the reporting: named actors, figures, sectors, official statements. Framing is the source’s; state media is identified as such; a country’s silence is itself recorded. All items are filed and cross-indexed for correlation.
Global cyber weather remains turbulent, with AI-driven attacks and ransomware campaigns intensifying.
Ransomware tempo remains high, with 191 total victims and most active crews including qilin, lamashtu, and safepay. AI is increasingly used inside the attack chain, with autonomous agents skimming payment cards and AI-accelerated exploitation recurring across multiple desks.
China is actively engaged, prioritizing technologies aligned with the 14th and 15th Five-Year Plans. Russia is framing AI as both a threat and a governance priority, with a focus on cyber-kinetic precedents. Iran is investigating attacks on banks, revealing indications of AI use. North Korea is linked to the ~$350M Bitget crypto-exchange theft, reported by Russia's press. Standing adversary intent includes China's Military-Civil Fusion and intelligentized warfare.
The underground picture is characterized by substantial and continuously collected credential, stealer-log, and PII exposure.
South Korea's press reported on AI-driven attacks on financial institutions, while Brazil's press reported on the investigation. Japan's press reported on cybersecurity-related laws and regulations. Pakistan's press reported on a cyber attack on the FBI, and Poland's press reported on a vulnerability in Ghostscript software.
Pressure is building around AI-driven attacks, with multiple states framing AI as both a threat and a governance priority. The use of AI inside the attack chain is a growing concern.
Confidence level: moderate (2+ categories). Gaps: Our collection does not cover the full extent of AI-driven attacks, and the underground picture remains opaque due to the protected nature of our holdings.
Researchers in Iran have used artificial intelligence to identify beneficial agricultural bacteria, a breakthrough that improves crop yields and reduces the need for pesticides.
A new study has applied artificial intelligence to the management of Iran's natural resources, including beneficial microscopic organisms. The research focused on identifying beneficial agricultural bacteria, leading to more efficient and sustainable farming practices. The study's findings improve crop yields and reduce reliance on pesticides.
R-Vision, a cybersecurity firm, has identified three vulnerabilities that are already being exploited in real attacks. The vulnerabilities affect Windows Kerberos, the Advanced Local Procedure Call (ALPC) mechanism in Windows, and the Zimbra Collaboration Suite.
According to R-Vision, four vulnerabilities were identified as the most critical, with three of them already being exploited in real attacks. The vulnerabilities include CVE-2026-69676, a Windows Kerberos vulnerability that allows an attacker to execute arbitrary code with minimal privileges; CVE-2026-85880, a Windows ALPC vulnerability that allows an attacker to elevate privileges to SYSTEM; and CVE-2026-73570, a Zimbra Collaboration Suite vulnerability that allows an attacker to execute arbitrary code with the privileges of the zimbra user. The vulnerabilities were included in the CISA's Known Exploited Vulnerabilities (KEV) catalog.
The European Union's CSIRT-IT has detected multiple compromises of Zimbra Collaboration Suite systems exposed to the public network, attributed to the exploitation of the CVE-2026-73570 vulnerability and, to a lesser extent, other known flaws on unpatched or obsolete instances.
The CSIRT-IT found that the majority of compromised systems were running non-updated or obsolete versions of Zimbra Collaboration Suite, with the CVE-2026-73570 vulnerability being the primary vector of attack. The exploitation of this vulnerability led to various malicious activities, including the encryption of files using ransomware, the abuse of computational resources for cryptomining, and the exfiltration of sensitive data. In some cases, the attackers used the compromised systems to conduct scans and brute-force attacks against third-party infrastructure. The CSIRT-IT identified a total of 10 vulnerabilities exploited in the compromised systems, including CVE-2026-73570, CVE-2024-45519, CVE-2022-41352, CVE-2022-27925, CVE-2022-37042, and CVE-2023-38750.
South Korea is investigating a series of cyberattacks on financial institutions after President Lee Jae Myung revealed indications of AI use in some of the invasions. The attacks have exposed personal information of clients.
The attacks, which targeted at least seven financial institutions, including Shinhan, KB Kookmin, and Hana banks, have exposed personal information of clients, including names, phone numbers, and annual income. President Lee Jae Myung expressed concern and anxiety among the population, citing AI use in some cases. The police have formed a team of 28 members to investigate the case and verify violations of network and information legislation. The Financial Services Commission identified a sequence of attacks against different types of institutions, including commercial banks, savings banks, and credit-specialized companies.
The rapid advancement of AI is transforming the landscape of cyberattacks, allowing hackers to automate tasks and increasing the speed and scale of attacks.
Professor Kim Seung-ju highlights the impact of AI on cybersecurity, noting that AI can replace tasks such as reconnaissance, vulnerability searching, attack code writing, privilege escalation, and lateral movement, allowing hackers to attack numerous systems 24/7 without rest. The professor emphasizes that the defender cannot win by responding in the same way as in the past, as the human bottleneck in speed and scale is disappearing.
Anthropic has expanded its Cyber Verification Program (CVP) by integrating Project Glasswing, a vulnerability detection program that has found over 120,000 verified software vulnerabilities in just half a year.
The expanded CVP now has three access levels: Defense Access, Red Team Access, and Specialized Access. Defense Access is for cybersecurity teams performing defensive work, while Red Team Access is for authorized penetration testing and red team operations. Specialized Access has the fewest restrictions and is for organizations that have undergone deep verification, allowing them to test high-risk systems such as flight systems, power grids, and financial networks. Anthropic's testing of the access levels showed that Claude Opus 5.5 was blocked 46 times during Defense Access testing, but not at all during Red Team Access testing. The testing also found that over 3.3 million of the detected vulnerabilities were rated as major or high-severity.
The National Cybersecurity Organization (NCO) has released an updated handbook on cybersecurity-related laws and regulations, providing guidance for individuals and organizations in Japan.
The NCO's "Cybersecurity Related Laws and Regulations Q&A Handbook Ver.3.0" aims to provide clarity on the country's cybersecurity laws and regulations. The handbook is designed to help individuals and organizations in Japan understand and comply with relevant laws and regulations. The release of the updated handbook comes as Japan continues to prioritize cybersecurity and data protection.
A teenage hacker has been arrested in Jordan in connection with a cyber attack on the American investigative agency FBI.
Saifuddin Khader, a teenager, has been arrested in Jordan in connection with a cyber attack on the FBI. Khader is suspected of being a member of the notorious hacking group "ShinyHunters". The FBI was targeted in the cyber attack, but no further details about the nature of the attack or its impact were provided.
CERT Polska received a report of a vulnerability in Ghostscript software and coordinated the process of revealing the information.
The vulnerability, identified as CVE-2026-19547, was found in the Ghostscript software for Windows. It allows a local, authenticated attacker to create a directory and place a malicious file in it. When another user or service runs Ghostscript, the file is automatically executed.
- Get link
- X
- Other Apps
Labels
Above the Fold- Get link
- X
- Other Apps
Comments
Post a Comment