Confidential · 29 Sep 2026
🛡️ Daily Cybersecurity Briefing — 2026-09-29 (Tuesday)¶
Window: last 24–48h. Severity: 🔴 CRITICAL · 🟡 HIGH · 🟢 MEDIUM.
Threat level GUARDEDVictims L30D 117Top actor QilinM&A L30D $24.8M
Number of the day2–3TBthe volume of employee and applicant data ShinyHunters claims to have exfiltrated from the FBI's own PeopleSoft HR system, including Social Security numbers; the Bureau confirmed Sep 28 it has an internal "cyber security incident," corroborating the substance of a claim it had spent a week calling only "a matter under investigation." TechCrunch
💼 M&A ACTIVITY¶
No new deals strictly inside this run's Sep 26–29 window.MediumAll six mandatory query families ran (~65 searches incl. the full PE-newsroom roster, buy- and sell-side wording); nothing new cleared the bar for the window itself. Three catch-up deals surfaced instead — filed with their true announcement dates because they were missing from the tracker entirely: Bridgepoint → Lansweeper ($920M majority stake, 8.0x revenue, Jul 27 — a PE buyout building "the global leader in Technology Asset Intelligence powering enterprise cybersecurity," the single biggest gap found in the tracker to date); SecureSky → Soveren (Sep 9, undisclosed — adds real-time DSPM to SecureSky's exposure-management platform); Nomios → Orbcom (Sep 23, undisclosed — Keensight-backed Nomios enters the Portuguese market). Rejected: CY4GATE/DIATEAM (minority stake mop-up, not a fresh deal), Amplix/24By7Security (2025 deal, resurfaced by a year-end roundup), Cloud5/interTouch and Elmo/Solu Digital (not cybersecurity).
L30D summary (Aug 30 – Sep 29): 20 deals tracked, total disclosed value still concentrated in one figure — Palo Alto Networks → Console (Sep 1, ~$500M reported by TechCrunch, unconfirmed by the company). Biggest by strategic weight: Palo Alto/Console, the Quorum Cyber → Ontinue and CyberMaxx → Avertium pair (both Sep 16, Microsoft-MDR consolidation), and S&P Global → OpenZeppelin (Sep 17, onchain security). Consolidation theme unchanged: services and MDR/MSSP roll-ups dominate by count — 11 of the 20 tracked deals this month. SecurityWeek M&A Tracker
⚠️ CRITICAL BREACHES & INCIDENTS¶
The FBI confirmed an internal incident affecting its own hiring-system HR data, corroborating a week-old extortion demand it had declined to acknowledge.CriticalGovernment & Public SectorThe Bureau declared an internal "cyber security incident" Sep 28: staff were told their names, addresses, job titles and Social Security numbers were exposed via the FBIJobs.gov PeopleSoft HR system, with some reporting adding medical/psychiatric evaluation notes; ShinyHunters says it holds "data on mostly all of FBI" (~2-3TB), taken via a purported Oracle PeopleSoft zero-day. The actor's stated motive was retaliation (retract a May 2026 FBI bulletin about the group) rather than ransom, and on Sep 29 it told Cybernews it has decided not to publish the data, calling the episode a "marketing campaign" — that walk-back does not change that the FBI itself has now confirmed the incident's substance. TechCrunch · CNN · Cybernews
Japanese car-sharing service Times Car confirmed a breach of roughly 6.6 million current and former member accounts.HighTransportation & LogisticsPark24 disclosed Sep 25 that unauthorized access, underway since early September, was blocked Sep 26; exposed data includes names, addresses, dates of birth, phone numbers, emails, driver's license numbers and images, account passwords and linked service IDs. Credit card data was not affected and there's no evidence yet of a leak or sale — company-confirmed. BleepingComputer
🔓 CRITICAL VULNERABILITIES¶
No new CISA KEV additions this window beyond yesterday's Citrix NetScaler pair.MediumCVE-2026-65660 (Microsoft SharePoint on-prem, CVSS 8.8, code-injection-to-RCE via ToolPane/XamlServices, KEV-added Sep 25) hit its federal remediation deadline Sep 28 under BOD 26-04, which also required forensic triage for lateral movement and exfiltration. Separately, CISA retired its Weekly Vulnerability Bulletin effective Sep 28, moving fully to the KEV/BOD risk-based posture rather than severity-only lists — a process change, not an incident. eSecurityPlanet · Cybersecurity Dive
🚨 INTELLIGENCE AGENCY ALERTS & POLICY¶
No new CISA/FBI/NSA/NCSC or Five Eyes joint advisory, sanctions notice, or law-enforcement takedown this windowMediumbeyond the routine KEV items covered above.
🌐 THREAT ACTOR & CAMPAIGN ACTIVITY¶
Four new DLS listings this window, all unverified claims with no company confirmation:MediumKellys Home Center (USA, home-appliances/furniture retailer) claimed by data-theft-only group Pear — Ransomware.live (Consumer & Retail); Nissho Electric Manufacturing (Japan, ~300GB claimed) claimed by Qilin — Ransomware.live (Industrials & Manufacturing); the official website of the Swiss municipality of Manno (Ticino) — an unusual target class, a municipal site rather than a company — claimed by Safepay — Ransomware.live (Government & Public Sector); and a listing naming "ATCO Ltd" (Canada, ~80 emails claimed) by Medusalocker, where entity identity is unresolved — aggregator coverage separately references a distinct, smaller "ATCO Products Inc" in connection with the same actor around the same date, and the claimed volume is far too small to be the large Calgary-based energy utility this name usually denotes — Ransomware.live (Energy & Utilities).
Microsoft attributed a destructive, AI-agent-driven campaign against Azure tenants to a new actor it names Storm-3168 ("JadePuffer").HighThe group compromised two Azure service-principal identities — one for reconnaissance, one for destructive action plus credential theft — then deleted 100+ storage accounts, Key Vaults, Function Apps, VMs and App Services in a 7-minute burst, removed Azure Site Recovery backup locks to hinder restoration, and expanded targeting to AI training datasets and vector databases via a tool the group calls "EncForge." No ransom demand or confirmed data theft reported; the motive so far looks disruptive rather than extortion-driven. Authoritatively attributed by Microsoft Security Research/MSTIC. BleepingComputer · The Register
This run's mandatory case follow-up sweep checked 6 open cases: the FBI case advanced twice (see above — confirmed Sep 28, then ShinyHunters' Sep 29 "won't publish" walk-back); Revolut's "iamnotavillain" published preview files (~85,000, branded "Italy Files") claiming a broader Italian-government dataset distinct from the original 680-account claim, but Italy's Interior Ministry and Postal Police dispute the scope and say their own investigation found no evidence of an Interior Ministry systems breach — the original 680-account sale threat remains unconfirmed either way; AEMET/Panzer, Prefix Corp/Securotrop and Fanatics/N0n are unchanged, no publication, statement or deadline move observed; Kimberly-Clark/ShinyHunters is one day short of its 14-day close-as-outcome-unknown eligibility window.
🌍 GEOPOLITICS¶
Analyst lens: how this week's cyber activity maps to state strategy. Defense · cyber · economics.
The Pentagon reversed a year of restraint, ordering Cyber Command back into active midterm-election defense five weeks before the vote.HighDefense Secretary Hegseth's memo (signed Sep 22, reported Sep 28) directs Cyber Command, NSA, DIA and NGA to "identify, disrupt, and neutralize foreign interference" ahead of November, working with DHS on election-infrastructure threats — reporting frames this as restoring activity curtailed since Trump's 2025 return. A visible, top-down remilitarization of election defense signals Washington now treats foreign interference as an active near-term threat rather than background risk; portfolio holdings touching election infrastructure, voter data or political-ad platforms should treat election week as a discrete operational-risk window. CNN · Axios
A suspected Russian-ordered arson at a Polish Starlink ground station shows hybrid sabotage now targets the physical layer of Ukraine's civilian internet lifeline, not just its networks.CriticalPolish prosecutors are treating the Sep 23 fire at a Starlink ground station (Wola Krobowska) as sabotage/terrorism likely acting "on the orders of Russian secret services" to disrupt connectivity Ukraine depends on; Denmark's intelligence service separately warned Moscow is likely to intensify hybrid activity in the coming months. It sits inside a broader Aug–Sep pattern of attacks on NATO logistics and comms nodes (the Leipzig/Halle drone incident, German and Dutch rail sabotage), assessed as designed to raise the cost of Ukraine support while keeping attribution ambiguous enough to avoid a collective NATO response. Portfolio exposure to European logistics, telecom, rail or satellite-comms infrastructure sits inside a live target set, and analysts flag the next escalation cluster around the EU's October sanctions cycle. ABC News (AU) · Notes from Poland
A $6.9B Kremlin-linked payment network shows Russian sanctions evasion has industrialized past crypto into mainstream correspondent banking.HighInvestigative reporting details how the "A7 Swift" scheme — 49%-owned by Russian state bank Promsvyazbank — moved $6.9B through major international banks; separately, blockchain analytics firm Elliptic has identified five Russia-linked crypto exchanges (one, ABCeX, processing ~$11B from Moscow) filling the role Garantex left after its takedown, now formalized under Russia's own crypto-licensing law (effective Sep 1). For financial-services and payments holdings, correspondent banks and crypto rails are the evasion surface regulators will target next, with the EU's next sanctions round expected in October. Cryptonomist · The Block / Elliptic
The US and China agreed a first-of-its-kind bilateral AI-incident notification channel days ahead of the Trump-Xi summit — a new diplomatic-hotline template for state-directed AI/cyber risk.HighAnnounced Sep 26 during Xi's state visit, the mechanism and a recurring "SI Dialogue" (next meeting by November) are meant to let each side alert the other to national-security-level AI incidents, including unauthorized or AI-directed cyberattacks; no defined incident scope or response-time commitment has been published yet. This closely tracks policy templates CSIS and the Atlantic Council had independently proposed, and is worth watching for whether a second state pair (EU-China, US-Russia) adopts a comparable channel. Washington Post · Axios
Travel advisories: checked against US State Dept, UK FCDO, Australia Smartraveller, Government of Canada and New Zealand SafeTravel — no level change to any of the 9 tracked countries this window. Mexico's tracker record was corrected from a stale "Reconsider Travel" snapshot to the accurate national "Exercise Increased Caution" level (State Dept's May 29 reissue), unrelated to this window.
M&A activity
Alchemy Technology Group → Freeit Data Solutions—
Intelligent Protection Management Corp. → Advanced Technology Distributors (IT/telecom/connectivity/managed-services business)—
Forte Technologies → Business Cyber Security Solutions (BCSS)—
EC-Council → Cyber Insurance Academy—