Ransomware: lamashtu named Becker Logistik (DE)
1. Executive summary A ransomware group tracked as "lamashtu" listed Becker Logistik, a German road-freight and bulk-goods haulier, on its public leak
30 Sep 2026 · 5 min read
read →
// author
Jeff Davies
Malicious Custom GPTs Turn ChatGPT Into RAT Delivery Lure
1. Executive summary Threat actors created a malicious ChatGPT Custom GPT named "Plus 5.6" and promoted it through sponsored Google search results, using
30 Sep 2026 · 9 min read
read →
CVE-2026-76504 Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
1. Executive summary CVE-2026-76504 is a CVSS 9.8 critical authentication bypass in Cisco Catalyst SD-WAN Manager, caused by improper handling of URI
30 Sep 2026 · 7 min read
read →
Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager
1. Executive summary Cisco published an advisory on 30 September 2026 for CVE-2026-76504, an authentication bypass in Cisco Catalyst SD-WAN Manager that lets
30 Sep 2026 · 9 min read
read →
Ransomware: rhysida named clicks digital GmbH Information (DE)
1. Executive summary The rhysida ransomware group listed clicks digital GmbH Information, a Berlin-headquartered online marketing agency with offices in Dresden, Munich and Cologne, on
30 Sep 2026 · 7 min read
read →
Ransomware: safepay named econ-tec.com (DE)
1. Executive summary The ransomware leak site aggregator ransomware.live listed econ-tec.com, a German industrial engineering firm, as a victim of a group calling
30 Sep 2026 · 4 min read
read →
Mobile malware warning from Ukrainian researchers includes iPhone exploit kit
1. Executive summary Ukraine's SSSCIP published a report this week describing sustained Russian targeting of Android and iOS smartphones used by military personnel, government
30 Sep 2026 · 7 min read
read →
Ransomware: lamashtu named GERLON (DE)
1. Executive summary A ransomware group tracked as "lamashtu" listed GERLON, a French steel wool, brush, abrasive and tooling manufacturer based in Abbeville (Somme)
30 Sep 2026 · 5 min read
read →
Ransomware: thegentlemen named Williamson Dacar Associates (GB)
1. Executive summary On 2026-09-30 the ransomware leak site "thegentlemen" listed Williamson Dacar Associates, a GB-registered entity, as a victim. The
30 Sep 2026 · 5 min read
read →
Ransomware: thegentlemen named Agospap (GR)
1. Executive summary The ransomware and extortion group calling itself "thegentlemen" listed Agospap, a French non-profit benefits administrator for roughly 150,000 AP-
30 Sep 2026 · 5 min read
read →
Ransomware: thegentlemen named Defencebit (GB)
1. Executive summary The ransomware and extortion group tracked as "thegentlemen" listed Defencebit, a UK-registered boutique cybersecurity consultancy, on its leak site on
30 Sep 2026 · 7 min read
read →
Hackers exploit SQL injection flaw to steal patient data from Polish medical software provider
1. Executive summary Attackers exploited an SQL injection vulnerability in the application interface of Medyc, a patient management platform sold by Polish vendor Qbusoft to medical
29 Sep 2026 · 8 min read
read →