Confidential · 25 Sep 2026
🛡️ Daily Cybersecurity Briefing — 2026-09-25 (Friday)¶
Window: last 24–48h. Severity: 🔴 CRITICAL · 🟡 HIGH · 🟢 MEDIUM.
Threat level GUARDEDVictims L30D 106Top actor QilinM&A L30D $500M
Number of the day5,714Microsoft 365 accounts across 28 Chilean-organization tenants compromised in Proofpoint's newly attributed UNK_CondorFiltration password-spray campaign, entirely through dormant service accounts with never-rotated default passwords and no MFA. Proofpoint
💼 M&A ACTIVITY¶
Two new deals this window.MediumA-LIGN → AssurePoint (Sep 22, undisclosed) — A-LIGN's formal entry into the Australian market, adding IRAP (Infosec Registered Assessors Program) certification capability for cloud security assessments needed by companies pursuing Australian government contracts. PR Newswire · MSSP Alert. Shield Technology Partners → Nerds Support (Sep 24, undisclosed) — the 20th MSP acquisition for Shield's consolidation roll-up platform, adding a Miami-based managed IT/cybersecurity provider. Channel Dive
L30D summary (Aug 26 – Sep 25): 16 deals tracked, still only one company-adjacent priced figure — Palo Alto Networks → Console (Sep 1, ~$500M reported by TechCrunch, unconfirmed by the company). Biggest by strategic weight: Quorum Cyber → Ontinue and CyberMaxx → Avertium (both Sep 16, Microsoft-MDR consolidation), S&P Global → OpenZeppelin (Sep 17, onchain security) and NetSPI → Synack (Sep 2, offensive-security platform merger). Consolidation theme unchanged: services and MDR roll-ups dominate by count — Fortress SRM, Amivero, INE, RedTrace, Ontinue, Avertium, MSP Corp, STACK Cybersecurity and now Nerds Support span MSSP, training and Microsoft-MDR consolidation, most not disclosing a price. SecurityWeek M&A Tracker
⚠️ CRITICAL BREACHES & INCIDENTS¶
Revolut discloses a second, unrelated breach this month — a third-party vendor (DriveWealth) exposed EU customer PII via a Sep 4–5 social-engineering intrusion, disclosed to affected customers Sep 24.HighFinancial ServicesDriveWealth, the US broker that powers Revolut's US-stock-trading feature, had its network accessed via social engineering; exposed data is limited to name, email, phone and postal address, plus employment info, and for EU customers only pre-December-2023 records. Revolut says its own systems were not touched and funds/investments are unaffected. Distinct from the ongoing iamnotavillain extortion case covered below — no attacker deadline, no named threat actor, vendor-side only. Irish Times · RTE
🔓 CRITICAL VULNERABILITIES¶
CVE-2026-87902 — WordPress Core, CVSS 9.2, unauthenticated RCE, exploited within hours of disclosure.HighA path-traversal flaw in `get_page_template()` lets an unauthenticated attacker chain into local file inclusion (observed via `/usr/local/lib/php/pearcmd.php`) and drop a PHP webshell; WordPress shipped an emergency patch (7.1.2) Sep 22, and exploitation was recorded within hours the same day. Not yet a CISA KEV entry. Any site with a theme exposing a `page-*` top-level directory and a readable local PHP target is in scope — patch now rather than wait for a KEV add. The Hacker News · BleepingComputer
No new CISA KEV catalog additions since the Sep 22 four-CVE batchMedium(F5 BIG-IP APM, Check Point Quantum VPN, Check Point Security Management, Arista VeloCloud) — federal remediation for that batch was due today, Sep 25. CISA KEV
🚨 INTELLIGENCE AGENCY ALERTS & POLICY¶
No new CISA/FBI/NSA/NCSC or Five Eyes advisory, KEV/BOD action, sanctions notice, or law-enforcement takedown this window.MediumThe FBI's only public posture remains investigating the ShinyHunters extortion claim covered under Threat Actor Activity below.
🌐 THREAT ACTOR & CAMPAIGN ACTIVITY¶
Proofpoint attributes UNK_CondorFiltration, a TeamFiltration-tool password-spray campaign compromising 5,714 Microsoft 365 accounts across 28 tenants — almost entirely Chilean organizations, including a major retailer and multiple financial institutions.HighFinancial ServicesSeven dormant, unmanaged service accounts with never-rotated default passwords and no MFA were the entry point; post-compromise activity pivoted through a German VPN node within 90 seconds to probe Azure Portal, SharePoint and the Microsoft Graph API from 1,487 unique AWS EC2 source IPs. Vendor-attributed, not nation-state. Proofpoint · Dark Reading
The ShinyHunters/FBI extortion claim covered Sep 23 now carries a formal clock: retract the May 2026 tactics bulletin by Sep 30 or the group leaks the claimed 2–3TB of employee/applicant data.HighGovernment & Public SectorCase opened today for tracking (attacker claim only; FBI has not confirmed a breach, says it is investigating).
The Revolut/"iamnotavillain" extortion case has shifted tactics after its corporate deadline lapsed unpaid: the actor opened a Tor site to extort roughly 680 affected accountholders individually rather than selling the dataset in bulk.MediumFinancial ServicesA separate Telegram channel claims the same breach with a partial sample, disputed by the original actor as a reseller. No publication or payment confirmed; sourcing here leans on extortion-adjacent trackers rather than tier-1 press, treat as low-confidence.
Nine further DLS listings Sep 24, all unverified, no company confirmation:MediumProfessional & Business ServicesHealthcare & Life SciencesIndustrials & ManufacturingEnergy & UtilitiesKrybit claimed efada.sa (Saudi Arabia, professional services) and Rhysida claimed NEAD Pro (Italy, professional services); Incransom claimed a Macau law/IP practice (bnlawmacau.com/bn-ip.com) and Welgen One, an Atlanta healthcare/wellness provider; Akira claimed Wallatec GmbH (Austrian beverage-carbonation equipment manufacturer) and Strack Companies (Minnesota construction firm); Qilin claimed Agora cooperative agricole (France) and GDM Pipelines (UK).
This run's mandatory case follow-up sweep checked 6 open cases: AstraZeneca Türkiye/N0n, Fanatics/N0n, LA Metro/The Gentlemen, Kimberly-Clark/ShinyHunters and Revolut/Unknown showed no leak, sale or payment; Veradigm/The Gentlemen closed as outcome-unknown after 4 quiet checks spanning the 14 days since its Sep 11 deadline (the company's Sep 20 patient-notification consequence stays on record).
🌍 GEOPOLITICS¶
Analyst lens: how this week's cyber activity maps to state strategy. Defense · cyber · economics.
The Trump-Xi summit ended Sep 24 without a joint statement, and the trade truce extension is two months, not the multi-month reprieve markets priced in.HighBeijing and Washington issued separate, domestically-framed readouts rather than a unified communique; the truce now runs only to Jan 10, stacking directly against the pre-existing Nov 10 rare-earth export-control suspension deadline and creating a live, back-to-back crisis window rather than a resolved one. For portfolios exposed to critical-mineral, EV, defense-electronics or semiconductor-equipment supply chains, treat Nov 10–Jan 10 as the actual risk window to plan around, not a closed chapter. CNBC · Nikkei Asia
Xi's summit language on AI was rhetorical, not a signed mechanism.MediumXi told Trump both countries should "jointly guard against" AI misuse, but Washington's proposed US-China AI-incident notification channel remains an unadopted proposal, and US negotiators have confirmed chip and semiconductor-equipment export controls sit outside it entirely regardless of the dialogue's fate. Don't underwrite cross-border AI-incident coordination as a planning assumption. NPR · CNBC
Taiwan's $14B arms package is still Trump's bargaining chip, not Taipei's banked deal.HighTrump said post-summit he remains "unsure" whether to approve the package after discussing arms sales "in great detail" with Xi, while Taiwan's Defense Ministry insists the procurement will "proceed as planned" regardless of Beijing's pressure to shelve it. Defense-adjacent names with Taiwan procurement exposure face continued approval uncertainty into Q4 — treat any near-term award as a summit-linked political signal, not a routine sale. The Hill · PBS
A China-linked crew kept running network-intrusion tradecraft the same week Xi dined at the White House.HighA suspected Chinese-speaking actor exploited a Zyxel GS1900 switch flaw (CVE-2026-7273, CVSS 8.8) against 996 devices across 48 countries, pulling more than 18,000 records from a Western government network; CISA's compressed three-day KEV remediation window for federal agencies closed Sep 24, the same day the summit concluded. Diplomatic thaw and PRC-linked state espionage are running on uncoupled tracks — trade détente is not a signal to ease infrastructure-hardening priorities against Chinese state-linked actors. SecurityWeek · BleepingComputer
Travel advisories: checked against US State Dept, UK FCDO and Australia Smartraveller during Trump-Xi summit-outcome research — no level change to any of the 9 tracked countries this window. Iran remains Do Not Travel/Level 4 across all checked sources.
M&A activity
Alchemy Technology Group → Freeit Data Solutions—
Intelligent Protection Management Corp. → Advanced Technology Distributors (IT/telecom/connectivity/managed-services business)—
Forte Technologies → Business Cyber Security Solutions (BCSS)—
EC-Council → Cyber Insurance Academy—