Confidential · 16 Sep 2026
🛡️ Daily Cybersecurity Briefing — 2026-09-16 (Wednesday)¶
Window: last 24–48h (Sep 15–16). Severity: 🔴 CRITICAL · 🟡 HIGH · 🟢 MEDIUM.
Threat level GUARDEDVictims L30D 78Top actor QilinM&A L30D $500M
Number of the day7.49 million — the customer-record count a threat actor claims to have stolen from Texas utility CenterPoint Energy via an exposed API; the company confirms unauthorized access but disputes the figure. SecurityWeek
💼 M&A ACTIVITY¶
No new cybersecurity M&A deals announced in the Sep 15–16 window.MediumThoma Bravo-backed Proofpoint remains only in reported talks to acquire Varonis Systems (Bloomberg, Sep 2) — not yet an announced transaction, so it stays off the tracker until confirmed.
L30D summary (Aug 17 – Sep 16): Unchanged from yesterday — 4 deals tracked, $575M+ in disclosed value. Biggest: Munich Re (via HSB) → At-Bay $575M (cyber insurtech/MDR), the only deal in the window with disclosed value; the other three — Fortinet → Virtue AI (AI runtime security), Socure → Fravity (agentic AI fraud investigation), Brinqa → PlexTrac (CTEM/offensive-security validation) — remain undisclosed-value bolt-ons. Consolidation theme unchanged: insurers buying prevention capability, platforms folding in AI-native tooling at undisclosed prices. SecurityWeek M&A Tracker
⚠️ CRITICAL BREACHES & INCIDENTS¶
CenterPoint Energy, the Houston utility serving roughly 7 million electric and gas customers across Texas, Indiana, Minnesota and Ohio, confirms unauthorized access to customer data after a hacker's dark-web post alleged 7.49 million records were taken.HighEnergy & UtilitiesA Sep 14 SEC 8-K confirms an unauthorized third party obtained personal information through a company-managed API; CenterPoint has not confirmed the attacker's 7.49M-record figure or the authenticity of the leaked dataset. Exposed fields allegedly include names, contact and billing details, account/premise identifiers, autopay status, and last-four SSN digits. No grid or operational impact reported. SecurityWeek
Baseline DLS volume Sep 14–15: newcomer group iah6477 claims 1.9 TiB from US packaging distributor Veritiv, and Genesis claims a CPA firm, Bernath & Rosenberg.MediumIndustrials & ManufacturingProfessional & Business ServicesNeither is company-confirmed; iah6477 is a newly emerged, US-only operation whose prior listings have included unverified or disputed claims — treat with extra caution pending corroboration. DeXpose (Veritiv) · DeXpose (Bernath & Rosenberg)
Two extortion deadlines expire today with no update:MediumShinyHunters' Kimberly-Clark ultimatum (set Sep 13) and The Gentlemen's Los Angeles Metro ultimatum (set Sep 7, first covered on this desk today on discovery — missed at initial posting). Neither group has published data samples; LA Metro has confirmed only that it restricted employee network access following "unauthorized activity." See the site's Dates to Watch panel for both countdowns. Ransomware.live · Cybernews
🔓 CRITICAL VULNERABILITIES¶
Adobe's emergency Sep 7 fix for a maximum-severity Magento/Adobe Commerce zero-day, dubbed StyleSmuggler, had not previously run on this desk — flagged here on discovery.CriticalTechnology & SoftwareCVE-2026-75650 (CVSS 10.0) lets an unauthenticated attacker inject PHP into Magento's template engine via a failed-payment email, achieving arbitrary code execution; exploitation began Sep 4 and deployed a Rust-based Linux backdoor disguised as a kernel worker process (later variants disguised as `fc-cache`). All versions 2.4.4 through 2.4.9 were affected before the out-of-band patch (APSB26-146). Sansec and Adobe have not published an affected-store count, though the flaw's unauthenticated, mass-exploitable nature put every unpatched storefront at risk. eSecurity Planet
No new CISA KEV additions identified in the Sep 15–16 window itselfMedium, though today is the FCEB remediation deadline for two AI-infrastructure flaws added Sep 2 (LiteLLM auth bypass CVE-2026-59822, Starlette request-smuggling CVE-2026-48710) — see Geopolitics below.
🚨 INTELLIGENCE AGENCY ALERTS & POLICY¶
The FBI, UK NCSC, and Dutch AIVD jointly exposed Iranian-intelligence spyware Sep 15 that has been used since at least 2023 to surveil dissidents, journalists, and activists worldwide.HighThe FBI calls it HEAVYGRAM; NCSC calls it CHOSEN BRICK. Telegram-controlled, it copies emails and chat messages, takes screenshots, and activates microphones; the FBI attributes it to Iran's Ministry of Intelligence and Security, which has impersonated contacts on WhatsApp/Telegram to build rapport before deploying it. Some victims' details later appeared on pro-Iranian leak sites, and the advisory notes Iranian intelligence has separately plotted kidnap or lethal operations against perceived regime enemies abroad — raising the stakes of this malware beyond conventional data theft. NCSC-UK
🌐 THREAT ACTOR & CAMPAIGN ACTIVITY¶
Rapid7 documents a new DPRK-aligned Linux toolkit — a "Ted" backdoor hidden inside victims' own HAProxy builds, paired with CurlRAT and an SSH keylogger — running long-term espionage against South Korean automotive and media organizations since roughly early 2025.HighIndustrials & ManufacturingMedia & TelecomBoth observed victims exposed edge webservers (Groupware login on 443, mail on 25) as the likely initial-access vector; tradecraft overlaps with Kimsuky/APT37. The toolkit intercepts web traffic and steals credentials for sustained, stealthy access rather than smash-and-grab theft — consistent with long-horizon industrial espionage rather than crypto theft. Rapid7
Ransomware DLS activity at baselineMediumsee Veritiv, Bernath & Rosenberg, and the Kimberly-Clark/LA Metro deadlines above; no leaderboard-moving volume shift.
🌍 GEOPOLITICS¶
Analyst lens: how this week's cyber activity maps to state strategy. Defense · cyber · economics.
A joint FBI–NCSC–AIVD advisory naming Iran's intelligence service as the operator of transnational spyware targeting dissidents is also a diplomatic signal: three governments, not just the "Five Eyes," are now willing to publicly attribute and name Iranian state malware.HighWidening the coalition beyond the standard Five Eyes grouping to include a non-Five-Eyes ally (the Netherlands) raises the reputational and diplomatic cost to Tehran of continuing transnational repression campaigns, at a moment when Iran is separately navigating post-conflict reconstruction and sanctions relief negotiations. Portfolio companies with executives, dissidents, or advocacy-linked clients from the Iranian diaspora should treat this as a concrete personal-security threat model, not an abstract one. NCSC-UK
North Korea's shift toward sustained, low-noise industrial espionage against South Korean automotive and media firms — rather than its more typical smash-and-grab crypto theft — signals a widening of Pyongyang's economic-collection priorities toward manufacturing IP and information control.HighIndustrials & ManufacturingMedia & TelecomA toolkit built for long-term persistence (credential theft, traffic interception) inside two critical private-sector verticals suggests targeting decisions made well above the operator level, consistent with a regime under sanctions pressure diversifying its hard-currency and technology-transfer channels beyond direct financial theft. Rapid7
Today's federal remediation deadline for two AI-infrastructure vulnerabilities (LiteLLM, Starlette) is a small but concrete marker of how fast AI orchestration software has been absorbed into the same compliance regime as traditional critical infrastructure.MediumCybersecurityTechnology & SoftwareThese flaws sit in the control-plane layer connecting enterprises to frontier models — exactly the "AI infrastructure concentration" this desk has flagged as a signal to watch — and their presence in a routine CISA KEV batch, with an ordinary federal patch clock, shows regulators already treat AI-stack software as infrastructure rather than as a novel category needing separate rules. CISA KEV
CenterPoint Energy's breach adds a Texas utility to a lengthening 2026 list of US critical-infrastructure operators confirming customer-data exposure without operational disruption — a distinction regulators and insurers are increasingly treating as the meaningful line, not whether an intrusion occurred at all.MediumEnergy & UtilitiesThe company's own SEC 8-K frames the incident narrowly around a single exposed API rather than broader OT/grid systems, the same containment pattern seen across most confirmed 2026 utility-sector incidents; it keeps this class of breach a data-privacy and disclosure story rather than an energy-security one, for now. SecurityWeek
M&A activity
Alchemy Technology Group → Freeit Data Solutions—
Intelligent Protection Management Corp. → Advanced Technology Distributors (IT/telecom/connectivity/managed-services business)—
Forte Technologies → Business Cyber Security Solutions (BCSS)—
EC-Council → Cyber Insurance Academy—