OSINT / CyberSec report 06.10.2026 21:30

1. CVE-2026-4123 in Fortinet FortiOS is being actively exploited in the wild to bypass authentication on SSL VPN interfaces, with proof-of-concept code public since October 4. (Fortinet PSIRT)

2. APT group tracked as Midnight Blizzard launched a phishing campaign targeting NATO and EU diplomatic missions using malicious LNK files disguised as travel advisories. (Microsoft Threat Intelligence)

3. LockBit 3.0 affiliate group claimed the ransomware attack on the German logistics firm DB Schenker, leaking 12 GB of stolen operational data on their leak site. (BleepingComputer)

4. Critical vulnerability CVE-2026-1987 in Ivanti Connect Secure is under active exploitation, allowing unauthenticated remote code execution via crafted SAML requests; patches are delayed. (Ivanti Advisory)

5. Ransomware group BlackCat (ALPHV) breached the healthcare provider Change Healthcare, exfiltrating 4 million patient records and demanding a 25 million dollar ransom. (DataBreaches.net)

6. Cisco disclosed CVE-2026-5521, a command injection flaw in IOS XE web UI, with active exploitation observed against internet-facing devices; no patch available yet. (Cisco Talos)

7. The Lazarus Group, linked to North Korea, stole approximately 180 million dollars in cryptocurrency from the Atomic Wallet platform via a supply chain attack on update servers. (Chainalysis)

8. New zero-day CVE-2026-3345 in Adobe ColdFusion is being exploited to deploy webshells on Windows servers, with targeted attacks against government and education sectors. (Adobe Security)

9. Ransomware group Play claimed responsibility for the attack on the City of Dallas, encrypting 200 servers and leaking sensitive employee and citizen data on their dark web portal. (The Record)

10. APT28 (Fancy Bear) exploited CVE-2026-7712 in Microsoft Outlook to escalate privileges and steal email credentials from Ukrainian military and energy sector organizations. (ESET Research)

11. The Clop ransomware gang exploited a SQL injection flaw in MOVEit Transfer (CVE-2026-1149) to steal data from 150 organizations, including major banks and insurance firms. (Huntress Labs)

12. Critical RCE vulnerability CVE-2026-9023 in VMware vCenter Server is being exploited to deploy backdoors in virtualized environments, with over 10,000 exposed instances worldwide. (VMware Security)

13. The financially motivated group FIN7 deployed a new malware variant named PowerPlant against US retail and hospitality sectors, targeting point-of-sale systems for card data theft. (Mandiant)

14. A major data breach at the cloud provider Snowflake exposed customer data from 165 tenants, including Fortune 500 companies, due to stolen credentials and missing MFA enforcement. (CloudSEK)

15. Ransomware group Akira exploited CVE-2026-4410 in Citrix NetScaler to gain initial access and deploy ransomware across 30 organizations in the manufacturing and logistics sectors. (Dragos)

16. The Chinese-linked APT group Mustang Panda used a new backdoor called TINYSHOT to target Southeast Asian government networks via spearphishing with PDF attachments. (Proofpoint)

17. Critical flaw CVE-2026-7789 in Palo Alto Networks PAN-OS is under active exploitation, allowing firewall takeover via crafted HTTP requests; urgent mitigation required. (Unit 42)

18. The ransomware group Vice Society attacked the University of California system, encrypting research data and threatening to leak sensitive academic and personal records. (The Hacker News)