Skip to main content

Daily Cyber Brief · 17 October 2026 · a Monadnock Cyber summary

Monadnock Cyber
Daily Cyber Brief
17 October 2026 · a Monadnock Cyber summary
THE BOTTOM LINE

N0n targets transportation firms with shipping data. Edge device flaws remain actively exploited by attackers. Supply chain compromise affects Microsoft 365 tenants.

WHAT IT MEANS

New Gang Targets Transportation Sector With Shipping Data The N0n group posted 38 victims in one batch on October 12, all sharing a deadline of October 19. Thirty-five of these victims are transportation organizations across 18 countries. The stolen data consists of electronic shipping messages (EDI archives). This is likely one campaign, not separate attacks. If the gang publishes the files as scheduled, the sector faces public exposure. We do not know how the gang entered these systems. One entry point these victims share, such as a common software supplier or IT provider, fits the data; so does one gang working through a target list with the same method. The evidence does not separate the two: roughly even chance either way, low confidence, because it rests on the gang's own leak-site descriptions alone. Another explanation: older thefts posted together.

Edge Device Vulnerabilities Remain Actively Exploited CISA added nine actively exploited flaws to its KEV catalog in the last seven days. Four of these affect edge devices like firewalls and VPNs. Two affect backup and recovery software, which attackers use to prevent victim recovery. Attacks on backup software are a common precursor to ransomware, because they remove the victim's ability to recover. Organizations running these specific products face immediate risk.

Supply Chain Compromise Affects Microsoft 365 Tenants Hackers breached Microsoft 365 tenants via a ConnectWise supply-chain attack. The attackers accessed application identities and compromised customer environments. ConnectWise shut down customer access to its Cloud Backup service in response. This incident demonstrates how third-party tools can serve as entry points for broader network compromise.

WHAT TO DO

1. Verify if your organization shares an IT provider or software supplier with the N0n victims; patch edge devices and backup software immediately (Source: Monadnock Cyber collection).

3. Transportation and shipping organizations sharing infrastructure with listed victims must prepare for the public release of stolen files on 2026-10-19. (Source: Monadnock Cyber collection)

2. Monitor ConnectWise Cloud Backup status and review Microsoft 365 tenant access logs for unauthorized activity (Source: BleepingComputer — https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/).
THE EVIDENCE
  • N0n posted 38 victims in one batch on 2026-10-12, all with the same publication deadline of 2026-10-19; 35 of them are transportation organizations, in 18 countries. The stolen data is the same kind across the batch: electronic shipping messages (EDI archives). (Source: Monadnock Cyber collection)
  • CISA added 9 actively exploited flaws to its KEV catalog in the last 7 days, by type: edge devices (firewalls, VPNs, gateways): 4; backup and recovery software: 2; operating systems: 1; other software: 2. (Source: CISA KEV — https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
  • Attacks on backup software are a common precursor to ransomware, because they remove the victim's ability to recover. (Source: Monadnock Cyber collection)
  • Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack — ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants. (Source: BleepingComputer — https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/)
  • Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants. (Source: The Hacker News — https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html)
  • N0n, a NEW ransomware/extortion gang first seen in our collection on 2026-09-18 (108 listings so far; no state attribution in our files). (Source: Monadnock Cyber collection)
  • Edge devices (firewalls, VPNs, gateways): Fortinet Multiple Products (CVE-2025-61624), Cisco Secure Email Gateway (CVE-2026-76519), Palo Alto Networks PAN-OS (CVE-2026-0322), Ivanti Connect Secure (CVE-2026-104935). (Source: CISA KEV — https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
  • Backup and recovery software: Ahsay AhsayCBS (CVE-2026-105134), Ahsay AhsayCBS (CVE-2026-105133). (Source: CISA KEV — https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
  • Operating systems: Microsoft Windows (CVE-2026-96951). (Source: CISA KEV — https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
  • COLLECTION GAP: how N0n got into these 38 victims. Nothing in our collections names the flaw, product, or supplier used, and the gang does not say. Until that is known, organizations in the same sector cannot check whether they share the exposure. (Source: Monadnock Cyber collection)
✓ Prepared on Monadnock infrastructure. Authored by the local engine qwen3.6:latest and cross-checked by local engines (gemma3:27b, gemma4:31b); ICD-203 lexicon enforced by a deterministic gate (CLEAN). No third-party cloud. Statistics carry their sources inline.
Monadnock Cyber LLC · At the intersection of AI and Security
Sources & references
Labels:

Comments

Post a Comment

Popular posts from this blog

Cyber Intelligence (Risk) Brief — a sample for your review

What if one of these arrived on a regular schedule? This is a sample Intelligence Brief from Monadnock Cyber. Corvane Precision,  its people, domains and vendors  are all fictitious. The threats are real as of October 19, 2026: the exploited flaws, the advisories, the regulatory picture. The brief answers four questions: What is coming for this organization? Why? What to watch for. What to do about it.  Every finding names its source and says how reliable that source is. Every judgment says how confident we are and why. Now picture one written about your own company, your organization, or you, delivered every quarter or whenever something changes. Monadnock Cyber offers it for: Companies: your exposure, the attackers interested in your sector, and the regulations that apply when something goes wrong. Organizations: nonprofits, schools, municipalities and associations, which often hold sensitive data with thin security staff. Individuals: executives, board members and p...
Post a Comment
Read more

French Supermarket Fridge Attack: What Our Data Shows and What It Means for You

Monadnock Cyber Intelligence and Analysis · 13 October 2026 On the night of Oct. 11–12, attackers hijacked refrigeration controls in hundreds of French supermarkets, heated display cases to 50°C (122°F) and destroyed the stock. The warning was public 52 days earlier. The threat extends beyond one manufacturer. For U.S. organizations, the greater risk is not exposed equipment but the contractors who service it: the same door attackers used against Target in 2013. This time they came to break things, not to steal. An Intermarché supermarket in Remollon, France, in 2014. Intermarché reported about 300 stores hit in the attack; this photo predates it and does not show an affected store. Editorial credit: Alastair Wallace / Shutterstock.com What happened About 300 Intermarché and Netto stores were hit, along with 80 Coopérative U, 80 Carrefour, about 30 Monoprix and "several" E.Leclerc stores (The Hacker News, BleepingComputer). The attackers turned the equipment against it...
Post a Comment
Read more