Skip to content

📚 Archive

  • 7 min read

🛡️ Daily Cybersecurity Briefing — 2026-10-04 (Sunday)

Confidential · 04 Oct 2026

🛡️ Daily Cybersecurity Briefing — 2026-10-04 (Sunday)

Window: last 24–48h (extended look-back to Oct 2 for the M&A/case sweeps). Severity: 🔴 CRITICAL · 🟡 HIGH · 🟢 MEDIUM.

Threat level GUARDEDVictims L30D 144Top actor QilinM&A L30D $24.8M

Number of the day$1B+North Korea's cumulative 2026 crypto-theft haul, after Chainalysis attributed the Sep 24 $387M Bitget hack to DPRK-linked actors in an Oct 1 report; lifetime theft since 2017 now exceeds $6B. Chainalysis via CryptoRank
  • 7 min read

🛡️ Daily Cybersecurity Briefing — 2026-10-03 (Saturday)

Confidential · 03 Oct 2026

🛡️ Daily Cybersecurity Briefing — 2026-10-03 (Saturday)

Window: last 24–48h. Severity: 🔴 CRITICAL · 🟡 HIGH · 🟢 MEDIUM.

Threat level GUARDEDVictims L30D 149Top actor QilinM&A L30D $24.8M

Number of the day$3.4 billion — the damage US prosecutors attribute to the decade-old, IRGC-directed Mabna Institute campaign (300+ universities, 22 countries, 31TB stolen) whose alleged operator Montenegro extradited to the US on Oct 1, a rare case of a NATO-adjacent state handing a suspected state-linked hacker to US custody. SecurityWeek
  • 6 min read

🛡️ Daily Cybersecurity Briefing — 2026-10-02 (Friday)

Confidential · 02 Oct 2026

🛡️ Daily Cybersecurity Briefing — 2026-10-02 (Friday)

Window: last 24–48h. Severity: 🔴 CRITICAL · 🟡 HIGH · 🟢 MEDIUM.

Threat level GUARDEDVictims L30D 142Top actor QilinM&A L30D $24.8M

Number of the day$91.5 billion — the trading volume Treasury says moved through Russia's A7 shadow-banking network before OFAC sanctioned it Oct 1 as a "significant transnational criminal organization," a network Treasury says Iran's IRGC and central bank also used to evade their own sanctions. One payment rail, two sanctions regimes now explicitly fused. Treasury
  • 6 min read

🛡️ Daily Cybersecurity Briefing — 2026-10-01 (Thursday)

Confidential · 01 Oct 2026

🛡️ Daily Cybersecurity Briefing — 2026-10-01 (Thursday)

Window: last 24–48h. Severity: 🔴 CRITICAL · 🟡 HIGH · 🟢 MEDIUM.

Threat level GUARDEDVictims L30D 137Top actor QilinM&A L30D $24.8M

Number of the day7the number of distinct Cisco Catalyst SD-WAN Manager vulnerabilities CISA has added to its KEV catalog in 2026 alone (latest: CVE-2026-76504, CVSS 9.8, added Sep 30). One product line, seven actively-exploited flaws in a single year — a repeat-exposure pattern any portfolio company running Cisco SD-WAN should treat as structural, not a one-off patch cycle. CISA · Tech Insider
  • 7 min read

🛡️ Daily Cybersecurity Briefing — 2026-09-30 (Wednesday)

Confidential · 30 Sep 2026

🛡️ Daily Cybersecurity Briefing — 2026-09-30 (Wednesday)

Window: last 24–48h. Severity: 🔴 CRITICAL · 🟡 HIGH · 🟢 MEDIUM.

Threat level GUARDEDVictims L30D 125Top actor QilinM&A L30D $24.8M

Number of the day50,000+the number of internet-facing Citrix NetScaler ADC/Gateway instances Unit 42 counted as still exposed to two actively-exploited zero-days (CVE-2026-88771/88772, both CVSS 9.5); CISA gave federal agencies just three days to patch, a deadline that lands today. Unit 42 · BleepingComputer
  • 7 min read

🛡️ Daily Cybersecurity Briefing — 2026-09-29 (Tuesday)

Confidential · 29 Sep 2026

🛡️ Daily Cybersecurity Briefing — 2026-09-29 (Tuesday)

Window: last 24–48h. Severity: 🔴 CRITICAL · 🟡 HIGH · 🟢 MEDIUM.

Threat level GUARDEDVictims L30D 117Top actor QilinM&A L30D $24.8M

Number of the day2–3TBthe volume of employee and applicant data ShinyHunters claims to have exfiltrated from the FBI's own PeopleSoft HR system, including Social Security numbers; the Bureau confirmed Sep 28 it has an internal "cyber security incident," corroborating the substance of a claim it had spent a week calling only "a matter under investigation." TechCrunch
  • 7 min read

🛡️ Daily Cybersecurity Briefing — 2026-09-28 (Monday)

Confidential · 28 Sep 2026

🛡️ Daily Cybersecurity Briefing — 2026-09-28 (Monday)

Window: last 24–48h. Severity: 🔴 CRITICAL · 🟡 HIGH · 🟢 MEDIUM.

Threat level GUARDEDVictims L30D 118Top actor QilinM&A L30D $24.8M

Number of the day9.5the CVSS v4 score of two Citrix NetScaler zero-days CISA added to its KEV catalog Sep 27; one of them affects every NetScaler ADC and Gateway deployment in its default configuration, no optional feature required. CISA
  • 5 min read

🛡️ Daily Cybersecurity Briefing — 2026-09-27 (Sunday)

Confidential · 27 Sep 2026

🛡️ Daily Cybersecurity Briefing — 2026-09-27 (Sunday)

Window: last 24–48h. Severity: 🔴 CRITICAL · 🟡 HIGH · 🟢 MEDIUM.

Threat level GUARDEDVictims L30D 106Top actor QilinM&A L30D $500M

Number of the day16,326publicly exposed Supabase-hosted databases found readable in UpGuard's study of AI-generated ("vibe-coded") apps that never enabled Row Level Security; more than half showed indicators of exposed PII. TechCrunch
  • 5 min read

🛡️ Daily Cybersecurity Briefing — 2026-09-26 (Saturday)

Confidential · 26 Sep 2026

🛡️ Daily Cybersecurity Briefing — 2026-09-26 (Saturday)

Window: last 24–48h. Severity: 🔴 CRITICAL · 🟡 HIGH · 🟢 MEDIUM.

Threat level GUARDEDVictims L30D 105Top actor QilinM&A L30D $500M

Number of the day4 million — current and former US military personnel whose unencrypted Social Security numbers sat exposed in a Pentagon personnel-records breach that ran undetected for roughly nine months, October 2025 to July 2026. Military Times
  • 6 min read

🛡️ Daily Cybersecurity Briefing — 2026-09-25 (Friday)

Confidential · 25 Sep 2026

🛡️ Daily Cybersecurity Briefing — 2026-09-25 (Friday)

Window: last 24–48h. Severity: 🔴 CRITICAL · 🟡 HIGH · 🟢 MEDIUM.

Threat level GUARDEDVictims L30D 106Top actor QilinM&A L30D $500M

Number of the day5,714Microsoft 365 accounts across 28 Chilean-organization tenants compromised in Proofpoint's newly attributed UNK_CondorFiltration password-spray campaign, entirely through dormant service accounts with never-rotated default passwords and no MFA. Proofpoint