Above the Fold · What foreign press tells its own public · a Monadnock Cyber summary · 08 October 2026
Most foreign-cyber reporting is written for the domestic reader. This digest reads each monitored country’s own press, in its own language, and records what it tells its own people about cyber and AI — the key point first, then the reporting: named actors, figures, sectors, official statements. Framing is the source’s; state media is identified as such; a country’s silence is itself recorded. All items are filed and cross-indexed for correlation.
Global cyber weather remains turbulent, with AI-driven attacks intensifying and ransomware tempo steady.
Ransomware activity remains high, with 243 total victims reported in the past 7 days. The most active crews include thegentlemen, qilin, and nightspire. AI is increasingly being used inside the attack chain, with autonomous agents skimming payment cards and AI-accelerated exploitation recurring across multiple desks.
China remains the most active state-sponsored actor, with 115 APT reports on file, driven by the PRC 14th & 15th Five-Year Plans prioritizing technologies. Russia is also active, with a focus on cyber-kinetic precedent and Viasat/AcidRain. Iran is framing AI as a threat and governance priority, with the Iran CyberAv3ngers targeting US infrastructure. North Korea is also active, with a focus on economic espionage.
The underground picture is characterized by a substantial and continuously collected corpus of stealer logs, breach dumps, and PII. Exposure is substantial, but exact counts are strictly protected.
South Korea's press reported on a series of cyberattacks on financial institutions, while Japan's press reported on a vulnerability in the MyPresta Google Merchant Center Feed software. Poland's press reported on a vulnerability in the Fortinet FortiMail software. Taiwan's press reported on a game software company's operational information equipment being compromised. Russia's press reported on a recent FBI hack linked to contractor company Accenture. Pakistan's press reported on a cyber attack on the American investigative agency FBI.
Pressure is building in the Asia-Pacific region, with 87% of small and medium-sized enterprises (SMEs) in the region facing cybersecurity incidents in the past year.
Overall confidence is moderate, based on 2+ categories of high-reliability sources. Gaps in our collection include the lack of specific data on the number of credentials, PII, and stealer logs exposed.
The Iran Cryptography Society is set to hold a series of specialized workshops at its 23rd international conference, covering topics such as cryptography, cybersecurity, and new technologies.
The secretary of workshops announced the holding of the workshops, which aim to balance scientific topics and emerging technologies with the real needs of the industry and the country's infrastructures. The conference will cover fields such as artificial intelligence, banking, and infrastructure security.
The FBI removed a specialist from contractor company Accenture following an investigation into a recent hack. The specialist was believed to be responsible for the compromised system.
According to Reuters, citing two sources familiar with the investigation, a specialist employed by Accenture was removed from work. This individual was thought to be responsible for the system, reportedly Oracle PeopleSoft, which was compromised by hackers. The specialist's failure to install a patch in time allowed the ShinyHunters group to steal personal data of thousands of FBI employees.
A vulnerability has been discovered in Fortinet FortiMail, allowing an attacker to execute arbitrary code remotely.
The vulnerability, identified as CVE-2026-104286, is actively being exploited, according to Fortinet. The agency notes that indicators of compromise are available in the editor's advisory, and users are advised to refer to the security bulletin for patch information.
South Korea is investigating a series of cyberattacks on financial institutions after President Lee Jae Myung revealed indications of AI use in some of the invasions. The attacks have exposed personal information of clients and affected at least seven financial companies.
President Lee Jae Myung stated that in some cases of invasion, there were indications of AI use, causing considerable concern and anxiety among the population. He ordered a rapid investigation and requested that resources and teams be concentrated to reduce the damage. The police opened an investigation into the attacks, forming a team of 28 members to investigate the case and verify violations of network and information legislation. The Financial Services Commission identified a sequence of attacks against different types of institutions, including commercial banks, savings banks, and credit-specialized companies.
Yıldız Teknik Üniversitesi (YTÜ) has officially admitted that its data storage system and servers were affected by a ransomware attack.
The attack occurred on October 1 and affected the university's system, causing issues with student registration during the academic period.
The National Cybersecurity Organization (NCO) has released an updated handbook on cybersecurity-related laws and regulations, providing guidance for organizations and individuals in Japan.
The NCO's "Cybersecurity Related Laws and Regulations Q&A Handbook Ver.3.0" aims to clarify the complexities of Japanese cybersecurity laws and regulations. The handbook is designed to assist organizations and individuals in understanding and complying with relevant laws and regulations. The release of the updated handbook comes as Japan continues to prioritize cybersecurity and data protection.
CERT Polska received a report of a vulnerability in the MyPresta Google Merchant Center Feed software and coordinated the process of revealing the information. The vulnerability allows an unauthorized attacker to write any file.
The vulnerability, identified as CVE-2026-85520, is in the Google Merchant Center Feed (gmfeed) module for PrestaShop. It allows an attacker to write any file by sending a prepared request to the feed.php endpoint. The request can control the file name, path, extension, and content. Without authentication and input validation, the request is successfully processed, enabling an attacker to write and remotely execute any PHP code (RCE). The issue was resolved in version 2.3.9. CERT Polska thanks Today Group sp. z o.o. for reporting the vulnerability.
A staggering 87% of small and medium-sized enterprises (SMEs) in the Asia-Pacific (APAC) region faced cybersecurity incidents in the past year, highlighting the increasing risk for these companies.
According to Kaspersky's '2026 SMB Threat Landscape Report', released on the 7th, only 13% of APAC SMEs with fewer than 500 employees had not experienced a cybersecurity incident in the past year. The report surveyed 1,800 IT security experts from SMEs and large enterprises across 18 countries worldwide. The analysis suggests that attackers use similar techniques regardless of company size, making SMEs, which often lack security personnel and budget, more vulnerable to attacks.
International Games System (IGS), a game software company, announced that its operational information equipment was compromised, resulting in the leakage of partial operational data and player personal information.
The incident occurred in late September, and on October 7, the company released a major update, revealing that the breach caused the leakage of game operation data, including partial player names, phone numbers, and email addresses. The company has reported the incident to the relevant authorities and notified the affected individuals through email and SMS, offering dedicated customer service and support. Although the company did not disclose the cause of the incident, it emphasized that it will strengthen network isolation measures for its third-party systems and self-developed systems to reduce the risk of lateral movement and penetration.
A teenage hacker has been arrested in Jordan in connection with a cyber attack on the American investigative agency FBI. Saifuddin Khader is the teenager who was arrested.
Saifuddin Khader, a teenager, has been arrested in Jordan in connection with a cyber attack on the FBI. He is also suspected of being a member of the hacking group "ShinyHunters".
- Get link
- X
- Other Apps
Labels
Above the Fold- Get link
- X
- Other Apps
Comments
Post a Comment