Confidential · 30 Sep 2026
🛡️ Daily Cybersecurity Briefing — 2026-09-30 (Wednesday)¶
Window: last 24–48h. Severity: 🔴 CRITICAL · 🟡 HIGH · 🟢 MEDIUM.
Threat level GUARDEDVictims L30D 125Top actor QilinM&A L30D $24.8M
Number of the day50,000+the number of internet-facing Citrix NetScaler ADC/Gateway instances Unit 42 counted as still exposed to two actively-exploited zero-days (CVE-2026-88771/88772, both CVSS 9.5); CISA gave federal agencies just three days to patch, a deadline that lands today. Unit 42 · BleepingComputer
💼 M&A ACTIVITY¶
Three deals recorded this run, none inside the strict 72h window — all catch-ups, one recent.MediumAll six mandatory query families ran (~37 searches incl. the full 46-firm PE-newsroom roster, buy- and sell-side wording). Quantum eMotion → Plurilock Security (Sep 28, ~US$24.8M all-share-and-cash, ~100% premium to 20-day VWAP): the Montreal quantum-secure crypto vendor buys Plurilock's AI-driven identity/authentication platform and commercial government/enterprise customer base, converting from a technology-validation company into a revenue-generating one. Two older gaps surfaced by the PE-newsroom sweep: Bridgepoint → iC Consult Group (Apr 27, undisclosed, media estimate €400-450M) — Carlyle fully exits the world's largest independent IAM consulting/managed-services firm; and Eurazeo → Nextron Systems (May 19, undisclosed majority stake) — a German APT-detection/forensics vendor (550+ clients, 25+ countries). Rejected: several deals already tracked (IT Solutions/STACK, CyberMaxx/Avertium, Quorum Cyber/Ontinue, Niobrara/MSP Corp among others), a RedLattice SPAC listing (not an acquisition), Bregal Sagemount/Critical Start (a minority funding round, not M&A), and two non-cyber deals (Hg/ENTERSOFTONE, Abry/Confirma Software). Quantum eMotion · Bridgepoint · Eurazeo
L30D summary (Aug 31 – Sep 30): 23 deals tracked in the trailing 30 days, total disclosed value still anchored by Palo Alto Networks → Console (Sep 1, ~$500M reported, unconfirmed) and Bridgepoint's two identity-security buyouts this year (Lansweeper $920M Jul 27; iC Consult, undisclosed but est. €400-450M). Consolidation theme unchanged: services/MDR/MSSP roll-ups and identity/IAM both keep pace — this run's catch-ups (iC Consult, Quantum eMotion/Plurilock) add two more identity-adjacent deals to a month already anchored by Epiq/Canopy (data-privacy) and SecureSky/Soveren (data-privacy). SecurityWeek M&A Tracker
⚠️ CRITICAL BREACHES & INCIDENTS¶
Two more Japanese transport operators disclosed incidents over the weekend, widening a sector-wide pattern alongside Monday's Times Car breach.HighTransportation & LogisticsKeio Corporation (railway + hospitality operator) confirmed a ransomware attack detected Sep 26 that disrupted payment/reservation systems at retail and hospitality units including Keio Plaza Hotel — train operations were not affected, and no group has claimed responsibility. Separately, Tokyo Metro disclosed roughly 59,000 email addresses from its "Metpo" loyalty program were accessed via a compromised vendor/affected server. Neither incident has a confirmed scope of customer-data theft yet. BleepingComputer · SecurityAffairs · MLex
A South African Telkom subsidiary's DLS claim, if verified, would be one of the larger source-code exposures this quarter.MediumTechnology & SoftwareBCX (Business Connexion) is listed on Incransom's leak site with a claim of ~500GB (4.2M files/596K folders) including source code and technical documentation; no company confirmation yet. Ransomware.live
🔓 CRITICAL VULNERABILITIES¶
Apple's newest KEV entry is a spyware-grade zero-day used against named individuals, not a mass-exploitation flaw.CriticalCVE-2026-86950 (CVSS 8.8, CoreGraphics out-of-bounds write) was added to the KEV catalog Sep 29 after Apple confirmed exploitation "in an extremely sophisticated attack against specific targeted individuals" — discovered by Meta's own Product Security team. Patched in iOS/iPadOS 26.7.1 and macOS Sequoia 15.8.1/Tahoe 26.7.1 (Sep 28); no federal remediation deadline has been published for this entry yet. CISA KEV · BleepingComputer
The federal patch deadline for both actively-exploited Citrix NetScaler zero-days lands todayCritical, three days after their Sep 27 KEV addition — an unusually short window reflecting active in-the-wild exploitation GreyNoise traced back to Sep 24, three days before public disclosure. See Number of the Day for the exposure scale; Mandiant and GreyNoise have both observed post-exploitation webshells and lateral movement. CISA KEV · Cybersecurity Dive
🚨 INTELLIGENCE AGENCY ALERTS & POLICY¶
No new CISA/FBI/NSA/NCSC or Five Eyes joint advisory this windowMediumbeyond the routine KEV actions covered above. Note for the record: the OFAC Treasury action against Iranian military-procurement networks (with Iranian state cyber actors named in the same designations) is covered in Geopolitics below, and Congress's extension of the Cybersecurity Information Sharing Act liability protections (avoiding a Sep 30 sunset) is a domestic-policy item worth flagging for any portfolio company that relies on it: the stopgap funding bill pushes the cliff to Dec 11 rather than resolving it. Federal News Network
🌐 THREAT ACTOR & CAMPAIGN ACTIVITY¶
Dutch police confirmed the arrest of a named ShinyHunters suspect — the first person in custody tied to the group's FBI breach, though it doesn't resolve the case.HighPepijn van der Stap ("Umbreon"), 24, of Amsterdam — a previously-convicted hacker now working as an offensive-security lead at a Dutch firm, also separately accused of soliciting two murders — appeared before Rotterdam District Court Sep 29. FBI Cyber Division Assistant Director Brett Leatherman posted a video statement to remaining group members: "You know how to find us, and we know how to find you." ShinyHunters denies the suspect is a member and separately gave NBC News a sample document a former agent confirmed as authentic, further corroborating the underlying breach without publishing the full 2-3TB trove it says it holds. NBC News · TechCrunch
Six fresh DLS listings this window, all unverified claims with no company confirmation:MediumGroupe Proxitel (France, B2B telecom/IT services), claimed by emerging group Vexy with a ~31-day publication clock — Ransomware.live (Technology & Software); Carolina Asthma & Allergy Center (USA), ~290GB of patient records claimed by Chaos with a reported 24-hour ultimatum — Ransomware.live (Healthcare & Life Sciences); MinMor Industries (USA), claimed by Cry0 — Ransomware.live (Industrials & Manufacturing); Arnold Center (USA, Michigan community-rehabilitation nonprofit — disability employment, ABA/autism, residential/vocational services), claimed by Qilin — an unusual target class for this group — Ransomware.live (Government & Public Sector); Precision Facades Ltd (UK, facade-engineering firm, full file server incl. bank mandates and board papers claimed), claimed by N0n with an Oct 2 deadline, now an open case — Ransomware.live (Industrials & Manufacturing); and Camorim Serviços Marítimos (Brazil, maritime services, 30+ years), claimed by LockBit 5.0 — Ransomware.live (Transportation & Logistics).
Bitget's $351.6M hack (Sep 24, withdrawals resumed in phases from Sep 28) is now attributed to suspected North Korean actors by both the exchange and blockchain-forensics firm TRM LabsHighwallet-clustering overlap ties the laundering infrastructure to the Bybit and AFX Bridge/UNC4899 cases. The exchange's own User Protection Fund (>$464M) covers customer losses; cold wallets were unaffected. This pushes DPRK's disclosed 2026 crypto-theft total above $1B. The Hacker News
Gang-on-gang infrastructure warfare continues:MediumShinyHunters is using Clop's hijacked leak site to publish data from its own, separate Salesforce-extortion campaign against roughly 39 companies (Oct 10 deadline) — not Clop's own alleged 2025 victim-payment data, which remains unpublished; Clop has reportedly reached out to negotiate directly with ShinyHunters.
🌍 GEOPOLITICS¶
Analyst lens: how this week's cyber activity maps to state strategy. Defense · cyber · economics.
Russia's FSB is running a two-track campaign against Ukraine's Western support network — arson at the physical layer, credential theft at the policy layer — in the same week.HighMicrosoft (MSTIC) detailed Sep 29 a refined Star Blizzard delivery chain, "RedFlick," active since March: fake conference invitations impersonating Chatham House and the Atlantic Council drop a new backdoor ("CosmicPulse") via scheduled tasks, hitting 100+ organizations since January — mostly US/UK governments, NGOs, think tanks, financial firms, academics and diplomats working Ukraine policy. Paired with the Sep 23 Starlink ground-station arson in Poland (already briefed), this is genuine two-domain pressure from the same state actor, not a repeat of that story. Any portfolio company, think tank or financial firm with Ukraine-policy exposure sits inside a live, named FSB target set. Microsoft Security Blog · The Hacker News
Washington's "Economic D-Day" sanctions campaign against Iran has moved from oil and banking into the missile/drone supply chain — with Iranian state cyber actors named in the same target set.HighOFAC announced 10 new designations Sep 29 under "Operation Economic Outcast" against networks procuring weapons and components for Iran's Ministry of Defense and Armed Forces Logistics (which also oversees ballistic-missile and UAV development); Treasury's description of the covered networks explicitly includes cyber actors directed by Iran's Ministry of Intelligence and Security. For portfolio holdings adjacent to Gulf logistics, correspondent banking or dual-use tech exports, OFAC is actively widening this net, not just threatening to. Treasury · MLex
The South China Sea's cyber gray zone edged toward a kinetic incident, though the core event sits just outside this window.MediumChinese Coast Guard/PLA Navy vessels blocked a Philippine resupply mission to a disputed Second Thomas Shoal outpost Sep 25 — the first such hostile incident in two years — and Beijing's Ministry of National Defense kept escalating rhetorically through Sep 28, demanding Manila "curb" its "egregious conduct." This sits on top of an already-documented China-nexus cyber-espionage campaign (Mustang Panda) against Philippine government entities during the same military buildup. Alliance-dynamics angle: any US-Philippines mutual-defense-treaty exposure now carries a live-incident backdrop. Bloomberg
Congress just bought three more months of legal cover for companies sharing breach data with Washington — the liability-protection cliff didn't disappear, it moved to December.MediumThe stopgap funding bill extends the Cybersecurity Information Sharing Act of 2015 (which shields companies from legal exposure when voluntarily sharing threat intel with NSA/CISA) from its Sep 30 sunset to Dec 11, along with the Federal Cybersecurity Enhancement Act and the Technology Modernization Fund. Any cyber vendor or MSSP portfolio company that relies on CISA 2015 protections for threat-sharing programs should treat December as the real deadline, not today. Federal News Network · Defense One
Travel advisories: checked against US State Dept, UK FCDO, Government of Canada, Australia Smartraveller and New Zealand SafeTravel — no level change to any of the 9 tracked countries this window.
M&A activity
Alchemy Technology Group → Freeit Data Solutions—
Intelligent Protection Management Corp. → Advanced Technology Distributors (IT/telecom/connectivity/managed-services business)—
Forte Technologies → Business Cyber Security Solutions (BCSS)—
EC-Council → Cyber Insurance Academy—