Confidential · 13 Sep 2026
🛡️ Daily Cybersecurity Briefing — 2026-09-13 (Sunday)¶
Window: last 24–48h (Sep 12–13). Severity: 🔴 CRITICAL · 🟡 HIGH · 🟢 MEDIUM.
Threat level GUARDEDVictims L30D 71Top actor QilinM&A L30D $500M
Number of the day4the number of separate state-aligned espionage clusters, three of them China-linked, that independently adopted the same never-before-seen Chrome-plus-Windows exploit chain within roughly a week of each other, per Proofpoint's Sep 9 disclosure. Proofpoint
💼 M&A ACTIVITY¶
No new cybersecurity M&A deals announced in the Sep 12–13 window.MediumWeekend quiet, consistent with the prior weekend.
L30D summary (Aug 14 – Sep 13): 5 deals tracked, $669.5M+ in disclosed value — unchanged from yesterday's window (no deal fell out or in as the trailing window rolled forward one day). Biggest: Munich Re (via HSB) → At-Bay $575M (cyber insurtech/MDR); Datavault AI → CyberCatch Holdings $94.5M all-cash (AI-enabled compliance). Consolidation theme unchanged: insurers buying prevention capability rather than just underwriting risk, and platforms bolting on AI-security or agentic-AI tooling at undisclosed values (Fortinet/Virtue AI, Socure/Fravity). SecurityWeek M&A Tracker
⚠️ CRITICAL BREACHES & INCIDENTS¶
Revolut confirms it handed customer identity documents and financial histories to a scammer who impersonated a government agency's own email domain.HighFinancial ServicesThe fintech says an "external impersonation scam" used a legitimate government-agency domain to submit fraudulent information requests, netting identity/contact details (birth dates, addresses, phone numbers), copies of passports and driver's licenses, verification selfies, and account statements including full transaction and Bitcoin histories. Revolut calls the number of affected customers "limited" but has not disclosed a count; it blocked the sender and notified the impersonated agency, law enforcement, and regulators. On-chain investigators speculate the targeting favored high-net-worth accounts. TechCrunch · The Block
Imperial Healthcare Solutions, a US healthcare organization, listed on Qilin's leak site Sep 11.MediumHealthcare & Life Sciences🟥 Unverified DLS claim — the listing carries no stated data volume, ransom figure, or publication deadline and no description of the intrusion; no organizational confirmation yet, verify before treating as a breach. Ransomware.live · RedPacketSecurity
Baseline DLS volume Sep 12–13: a handful of new named victimsMedium, most from Krybit (Tiflis Palace hotel, Georgia; Tender butcher chain, Mexico; Capricorn Logistics; Ibn Sina Trust) plus one from newcomer group Unsafe (watchops.com) — none individually clears the bar for a new tracker entry beyond Revolut and Imperial Healthcare Solutions above. RansomLook
🔓 CRITICAL VULNERABILITIES¶
No new KEV additions or CVSS ≥9 disclosures in the Sep 12–13 window.MediumThe three zero-days behind today's BlueMoon exploit-kit story (two Chrome V8 flaws, one Windows ALPC flaw) were already patched and KEV'd Sep 4, 8, and 9 and covered in prior briefings — see Threat Actor & Campaign Activity below for what's new today: four separate espionage clusters caught sharing the same chain.
🚨 INTELLIGENCE AGENCY ALERTS & POLICY¶
DOJ sentences a Ukrainian Conti operator to four years in federal prison.MediumOleksii Lytvynenko, who worked as both a hacker and malware developer for the Conti ransomware operation (active 2020–2022 against victims in 47 US states and 31 countries, with the FBI estimating $150M+ in ransom payments by January 2022), pleaded guilty in June to wire fraud conspiracy; investigators found stolen data from a dozen victims, eight of them US-based, in his online accounts. DOJ · The Record
🌐 THREAT ACTOR & CAMPAIGN ACTIVITY¶
Proofpoint documents four state-aligned espionage clusters independently converging on the same new exploit chain, "BlueMoon," within about a week — a pattern not previously flagged in this briefing.HighTechnology & SoftwareChina-linked TA412 (APT31) first used the chain Aug 28; UNK_LateNight (targeting US aerospace companies) and UNK_DoubleCheck (a Vietnamese manufacturer) followed Sep 2; China-linked UNK_QuietRacket hit government, consulting, and financial targets in Indonesia and Singapore Sep 3. The chain links two Chrome V8 zero-days (CVE-2026-85046, CVE-2026-87491) for remote code execution and sandbox escape with a Windows ALPC zero-day (CVE-2026-85880, CVSS 7.8) for local privilege escalation — all three now patched and KEV'd. Phishing delivers a link that triggers the browser exploit, then drops shellcode via the Windows flaw. Disclosed by Proofpoint Sep 9; this desk is surfacing it today as the operator-level attribution wasn't previously covered. Added to the signals watchlist as a shared-tooling pattern distinct from single-CVE convergence. Proofpoint · SecurityWeek
Ransomware DLS activity stayed at baseline over the weekendMediumsee Krybit/Unsafe listings above; no named-actor leaderboard movement worth flagging beyond the routine volume.
🌍 GEOPOLITICS¶
Analyst lens: how this week's cyber activity maps to state strategy. Defense · cyber · economics.
Four state-aligned clusters sharing one exploit chain lands eleven days before Xi Jinping's Sep 24 White House visit, where Washington plans to raise AI-directed cyberattacks and model-IP protection directly with Beijing.HighTechnology & SoftwareCybersecurityThree of the four BlueMoon-adopting clusters are China-linked, but the pattern itself — top-tier zero-day tooling circulating as shared infrastructure across ostensibly independent state operators rather than staying siloed per-group — is a capability story bigger than any one country's attribution, and undercuts the assumption that patching against one named actor's TTPs buys isolation from the others using the same chain. Watch whether US officials cite BlueMoon specifically (distinct from the AI-model-distillation attribution already on the table via AA26-251A) when framing the cyber component of the summit agenda. Proofpoint
Revolut being fooled by a spoofed government email domain is a second instance this month of law-enforcement/government-channel impersonation reaching sensitive identity data, after Florida's DMV breach traced to a personal device holding law-enforcement database credentials.HighFinancial ServicesTechnology & SoftwareDifferent mechanisms — Florida was a device/credential-hygiene failure, Revolut a social-engineering exploit of institutional trust in official government correspondence — but both defeat controls built around "the request came from a legitimate government address/device" rather than verifying the request itself. For portfolio companies handling KYC or regulated-identity data, the audit question is whether inbound "official" data requests get verified out-of-band, not just whether the sender's domain looks right. TechCrunch
A four-year sentence for a working Conti hacker and developer is a real enforcement outcome, but it lands against a ransomware-as-a-service model built to survive exactly this kind of individual accountability.MediumCybersecurityConti itself shut down in 2022; its personnel, tooling, and playbooks dispersed into successor brands (several tracked on this desk's leaderboard today) rather than disappearing. Individual prosecutions remain worth doing — they raise the personal cost of affiliate work — but they are a lagging, personnel-level response to a threat that has already moved on to a brand-and-infrastructure level. DOJ
Krybit's pace this weekend (four-plus new listings in roughly 24 hours, spanning a Georgian hotel, a Mexican butcher chain, a logistics firm, and a hospital trust) is unremarkable in isolation but consistent with the broader RaaS-proliferation pattern this desk flagged to the watchlist Sep 12.MediumCybersecurityMid-tier brands sustaining high listing cadence across unrelated sectors and countries, rather than one or two dominant groups doing the same, is the market-structure signal to watch, not any single victim above. RansomLook
M&A activity
Alchemy Technology Group → Freeit Data Solutions—
Intelligent Protection Management Corp. → Advanced Technology Distributors (IT/telecom/connectivity/managed-services business)—
Forte Technologies → Business Cyber Security Solutions (BCSS)—
EC-Council → Cyber Insurance Academy—