Confidential · 18 Sep 2026
🛡️ Daily Cybersecurity Briefing — 2026-09-18 (Friday)¶
Window: last 24–48h (Sep 16–18). Severity: 🔴 CRITICAL · 🟡 HIGH · 🟢 MEDIUM.
Threat level GUARDEDVictims L30D 84Top actor QilinM&A L30D $500M
Number of the day200,000+driver records, including Social Security numbers, that ShinyHunters published after Florida's DMV refused to pay an extortion demand; the group got in through a password-reset flaw that compromised DMV employee and FBI-agent accounts. BleepingComputer
💼 M&A ACTIVITY¶
S&P Global → OpenZeppelin (undisclosed): a ratings agency buys into onchain security.HighS&P Global signed an agreement (Sep 17) to acquire OpenZeppelin, the smart-contract security firm behind the industry-standard OpenZeppelin Contracts library (cited as securing $37T in value transferred, 900+ security engagements). OpenZeppelin keeps its name and CEO Demian Brener, operating as a separate unit that feeds S&P Global's push into onchain risk assessment as capital markets move on-chain. S&P Global PR · PR Newswire
Niobrara Capital → MSP Corp (undisclosed): PE buys one of Canada's largest managed IT/cybersecurity platforms.HighNew York-based Niobrara bought MSP Corp (2,300+ recurring clients, ~500 staff, 12 offices across 6 provinces) from Alfar Capital, Walter Capital Partners and BDC Capital, capping a four-year roll-up from a single Quebec provider. Niobrara plans to deepen the Canadian footprint and extend into the US. PR Newswire · PE Hub
eSentire acquires an unnamed stealth-mode AI-security startup (undisclosed), folded into a new Atlas AIDR module.MediumThe module gives Atlas Platform customers a real-time record of AI-agent activity — full conversation timelines, tool calls with inputs/outputs, token/cost accounting and security events. AiThority
Worldwide NFT signs an LOI for RedTrace Technologies (undisclosed): a micro-cap OTC shell moves into government cyber services.MediumRedTrace is a Maryland firm serving Federal Civilian, DoD and Intelligence Community clients, several million dollars in revenue and positive run-rate EBITDA, led by a former Army Signal Corps/US Cyber Command/NSA/FBI veteran. LOI stage only — a definitive purchase agreement and due diligence are still ahead, expected to close Q4 2026. GlobeNewswire
Catch-up: NetSPI → Synack (undisclosed), announced Sep 2 and missed by this desk's prior sweeps.MediumThe two offensive-security firms signed a definitive merger agreement forming an 800-person, $200M+-revenue combined platform spanning penetration testing and continuous/crowdsourced security validation; close expected October 2026. NetSPI PR · GlobeNewswire
L30D summary (Aug 19 – Sep 18): 11 deals tracked, $575M+ in disclosed value — still only Munich Re (via HSB) → At-Bay's $575M carries a public number. The two biggest by strategic weight: Quorum Cyber → Ontinue and CyberMaxx → Avertium (both Sep 16, both undisclosed, both Microsoft-MDR consolidation plays), followed by NetSPI → Synack's $200M+-revenue offensive-security combination. Consolidation theme: services/MDR roll-ups now dominate by count — 5 of the 11 tracked deals (At-Bay, Ontinue, Avertium, MSP Corp, RedTrace) are services plays, spanning an insurer, a PE-to-PE Canadian platform sale and a micro-cap shell's LOI, with AI-native SOC tooling (Cribl/Radiant, eSentire's stealth buy) and offensive-security scale (NetSPI/Synack) filling the rest. SecurityWeek M&A Tracker
⚠️ CRITICAL BREACHES & INCIDENTS¶
ShinyHunters leaked 200,000+ Florida DMV driver records, including Social Security numbers, after the state refused to pay — and published a screenshot of Jeffrey Epstein's DMV record as proof of access.CriticalGovernment & Public SectorThe group got into the "DAVID" database through a password-reset flaw that compromised multiple accounts, including ones reportedly belonging to DMV employees and an FBI agent; it had listed FLHSMV on its leak site Sep 7 before publishing files Sep 16 when the ransom went unpaid. FLHSMV has confirmed it is investigating a breach; the full scope of the leaked-data claims is not yet independently verified. BleepingComputer · TechCrunch
Metaencryptor listed AECOM, the Texas-based global infrastructure engineering and consulting firm, on its leak site Sep 17, claiming 1.22TB of data.HighIndustrials & ManufacturingNo samples published, no company confirmation of scope or whether systems were encrypted — verify before treating as a confirmed breach. RedPacket Security · Ransomware.live
Revolut's Sep 12-disclosed breach is escalating: the actor "iamnotavillain" cut its ransom demand to $3M in Monero with a 24-hour deadline (reported Sep 17) to avoid selling the 680 high-net-worth crypto-account files it obtained by impersonating a government agency.MediumNo new victim count — this is a development on the record already in the tracker, not a new incident. CryptoTimes
🔓 CRITICAL VULNERABILITIES¶
CVE-2026-76460 — Cisco Identity Services Engine/ISE-PIC, CVSS 10.0, actively exploited.CriticalAn unauthenticated attacker can send a crafted request to bypass the web management interface's API authentication entirely and reach root-level command execution; Cisco has no workaround, only a patch. CISA added it to KEV Sep 16 with a Sep 19 federal remediation deadline (BOD 26-04). BleepingComputer · CISA KEV
CVE-2026-87886 — Acronis Backup plugin for cPanel/WHM and Plesk, CVSS 7.8, exploited in the wild.HighInsecure default file permissions let an already-authenticated, low-privileged local user escalate to elevated access on hosting servers running the plugin; added to KEV alongside the Cisco flaw Sep 16, same Sep 19 federal deadline. TheHackerNews · CISA KEV
🚨 INTELLIGENCE AGENCY ALERTS & POLICY¶
DOJ and Canadian authorities seized NightmareStresser, one of the longest-running DDoS-for-hire ("booter") platforms, used in hundreds of attacks against schools, government agencies and gaming platforms since 2022.MediumThe takedown is part of Operation PowerOFF, the ongoing international law-enforcement effort against DDoS-for-hire infrastructure; no arrests were disclosed alongside the domain seizure. Help Net Security · SecurityAffairs
No new joint Five Eyes intelligence-agency advisory identified in the Sep 16–18 windowMediumbeyond the standing HEAVYGRAM/CHOSEN BRICK disclosure already covered.
🌐 THREAT ACTOR & CAMPAIGN ACTIVITY¶
Ransomware DLS activity at baseline — see the Florida DMV and AECOM items above.MediumNo leaderboard-moving volume shift and no new APT/nation-state campaign with authoritative attribution surfaced in-window.
NightmareStresser's seizure (above) removes one of the oldest DDoS-for-hire brands from circulation, but booter services are structurally easy to replaceMediumdomains and infrastructure change hands faster than any single takedown can suppress demand.
🌍 GEOPOLITICS¶
Analyst lens: how this week's cyber activity maps to state strategy. Defense · cyber · economics.
Russia and China vetoed a US-backed UN Security Council resolution to extend the 1737 Committee's Iran sanctions-monitoring panel — the fourth straight quarter they have blocked it — leaving the underlying "snapback" dispute over Iran's nuclear-related sanctions legally unresolved at the UN level.HighThe 11-2 vote (Somalia and Pakistan abstaining) is a structural read, not a one-off: as long as Moscow and Beijing keep the monitoring mechanism itself contested, any future cyber, financial or sanctions-enforcement action tied to Iran inherits that same legal ambiguity, complicating compliance calls for portfolio companies with Iran-adjacent exposure. The National
The Trump-Xi summit in Washington (Sep 23-25, meeting Sep 24) arrives with a bilateral AI safety and cyber-risk dialogue reportedly in preparation, six days after this desk's coverage of NSA/CISA/FBI's formal attribution of industrial-scale AI-model distillation to six named Chinese firms.HighExpect the summit to prioritize stabilizing the relationship (a likely one-year extension of the Busan tariff truce, eased rare-earth export-control friction) over resolving that dispute — for portfolio companies with China-exposed AI supply chains, the near-term signal is continuity of the current uneasy status quo, not escalation or resolution. CSIS
Analysis published Sep 17 on the Aug 12 presidential memorandum authorizing vetted US companies to run offensive "hack-back" cyber operations against foreign criminal groups is surfacing the liability and oversight questions that will determine whether the program is usable.MediumCompanies conducting government-directed Cyber Effects Operations take on a novel category of legal and diplomatic exposure — a foreign government's retaliation calculus does not necessarily distinguish a state actor from a licensed private one — that portfolio companies vetted into the program should weigh against the offensive capability it grants them. Foreign Policy
DOJ's NightmareStresser seizure (see Policy above) was conducted jointly with Canadian authorities under Operation PowerOFF, the kind of low-profile, allied law-enforcement cooperation that does more to raise the operating cost of commodity DDoS-for-hire crime than any single sanctions packageMediumit targets the infrastructure and economics of the criminal service model directly, rather than a state sponsor that can simply deny involvement. Help Net Security
M&A activity
Alchemy Technology Group → Freeit Data Solutions—
Intelligent Protection Management Corp. → Advanced Technology Distributors (IT/telecom/connectivity/managed-services business)—
Forte Technologies → Business Cyber Security Solutions (BCSS)—
EC-Council → Cyber Insurance Academy—