Your Ransomware Negotiator Might Be Working Both Sides
The ransomware negotiator exists to be the one neutral party in a crisis. Now the FBI has charged one, a second has pleaded guilty to feeding attackers his clients’ secrets, and a third is accused of quietly paying ransoms he billed as recovery. The industry sells trust it was never built to prove.
Silent Lynx Reads Russia’s Mail From Inside the Alliance
Recorded Future and Cisco tie the espionage actor Silent Lynx, at moderate confidence, to Kazakhstan, a member of Russia’s own security and economic blocs. Its targets read like a Kazakh intelligence requirements list, Russia, Belarus, and Central Asian neighbors timed to Kazakhstan’s own diplomacy.
Japan Is Being Breached Faster Than it Can Count
On October 15 Burger King Japan confirmed 11.18 million app records exposed, the latest in a Japanese disclosure wave that has not let up for weeks. A cloud provider, a university, a brewer, a software company, and now a fast-food chain. One country learning of its breaches late.
Fear of a Breach Is How The Gentlemen Get Paid
The Gentlemen added ten names to its dedicated leak site this month, including Deloitte, KFC, and MoneyGram. None has confirmed a breach and no files have appeared. The ransomware-as-a-service operation does not need the claims proven. It only needs the accusation to travel faster than the evidence.
Threat Actor Asked AI Where to Sell Stolen Data Then to Write His Résumé
A lone operator pointed an open-source Chinese AI agent at South Korean banks and let cheap language models do the scaling. Then he asked one of those models to write his résumé. CrowdStrike recovered all of it, and the same memory that powered the attack documented the operator behind it.
Japan Cyber Threat Landscape Report, October 2026
In seven minutes an attacker took down the cloud 495 Japanese companies and governments shared, then told them to restore from their own backups. That is the whole landscape in one week. Japan now holds more power to strike attackers than ever, and less ability than ever to see them.
Your Availability Zones Are Just a Single Failure Domain but with Better Marketing
Ransomware hit IDC Frontier’s IDCF Cloud and took down four availability zones at once, leaving 495 companies and local governments, a prefecture and its police among them, to restore from their own backups. Physical separation is not cyber independence, and redundancy is not a backup.
Seize a National Registry and the Web Will Certify You as Google
Attackers did not break HTTPS or trick a certificate authority. They seized three small country-code registries, passed the automated checks, and walked away with valid, publicly trusted certificates for google.com and youtube.com. The certificate authorities were not fooled. They were obeyed.
Osaka's Backups Died in the Same Blast Radius as Its Servers
Ransomware did not just lock 500 servers at Osaka Metropolitan University. It encrypted most of the backups too, turning recovery into a rebuild and exposing data on 130,000 people. The real failure was never the break-in. It was backups that shared the blast radius.
Denmark Was Not Hacked, It Was Logged Into
Attackers never breached Denmark's national population register. They abused one trusted company's legitimate access to enumerate and pull 8.8 million identities, then got caught by the bill, not by security. Permission, not malware, emptied the CPR.
China Paid UK Academics to Build Its Spy Tradecraft
MI5 named a Chinese front that funded more than 100 UK academics to build AI and espionage tradecraft for the Ministry of State Security. No breach, no malware, just a grant. China did not hack the research. It bought it, and many academics never knew who was behind it.
Google Closed Its Bug Bounty Because AI Drowned It
On October 1, Google paused its open-source bug bounty, drowned in AI-generated reports that were not real vulnerabilities. The attack is not on the code. It is a denial-of-service on the human attention that secures it. AI does not need to find the zero-day, only bury it.
China Phished the People Who Write America's AI Rules
To learn where US AI policy is heading, you do not breach a frontier lab. You phish the analysts who shape it. China-aligned TA419 did that, impersonating a former White House official and an Anthropic employee. The model tells you what America can build. The inbox tells you what it plans to do.
ShinyHunters Survived Every Arrest but Now Someone Is Talking
Jordanian authorities detained Rey, an admin who seized the ShinyHunters brand, and he is reportedly helping the FBI. Jailing a member never killed the brand. The leak sites are already back. But a cooperating insider attacks the one thing the collective cannot do without. Trust between its members.
Microsoft's 2026 Threat Report Is Really About 2020
Microsoft's 2026 Digital Defense Report leads with autonomous AI ransomware. Read it in full and it argues the opposite. The most detected bug in the data is Zerologon, patched in 2020. Attackers log in with stolen credentials. AI did not change how you get breached, only how fast.
Eleven Years After the OPM Breach the Pentagon Lost Three Million More Records
OPM was supposed to be the breach that changed everything. Eleven years later, a Pentagon data hub exposed 3 million defense personnel through a file-sharing flaw nobody watched for nine months. DoD wrote the fix into its own 2022 strategy, then skipped it. The warehouses are still open.
