InfoSec News 20261008
Publicada em: 08/10/2026
TOP NEWS
ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms
Cybersecurity researchers have disclosed details of a targeted campaign aimed at South Korean financial organizations that used an artificial intelligence (AI) pen testing tool named ARTEX to carry out the attacks.
The activity, per CrowdStrike Intelligence, was active from late September to early October 2026, and resulted in data exfiltration.
Link
TLP1: Green
Wazza Phishkit Targets Banking, Government, and Manufacturing Across the US, EU, and Australia
Phishing kits are no longer limited to copying a familiar login page and waiting for a victim to enter credentials. Attackers are increasingly building filtering, session management, and traffic controls into the infrastructure that delivers the phishing page itself.
Link
TLP1: Green
U.S. Offers $10 Million Reward for Alleged HAFNIUM Hacker Zhang Yu
The U.S. offers $10M for Zhang Yu, accused of helping run HAFNIUM attacks that compromised thousands of organizations worldwide.
Zhang is a director at Shanghai Firetech Information Science and Technology, a company that U.S. authorities say also carried out hacking operations for the Chinese government. According to the indictment, Zhang supervised Firetech employees involved in cyberattacks and worked directly with another accused hacker, Xu Zewei.
Link
TLP1: Green
Cybersecurity State: Surveillance, Cyberwarfare, Cybercriminality and Hacktivism
Uranium crypto exchange hacker convicted for stealing $53 million
A Maryland man was found guilty of stealing more than $53 million after hacking the decentralized crypto exchange Uranium Finance twice in April 2021.
According to court documents, Spalletta hacked Uranium (an automated market maker on Binance's BNB Chain) and stole nearly $53.3 million in cryptocurrency, forcing the company to shut down for lack of funds.
Link
TLP1: Green
Owner of Empire cybercrime market gets 40 years in prison
The co-creator of Empire Market, one of the largest dark web marketplaces before its shutdown, has been sentenced to 40 years in prison for facilitating $430 million in illegal transactions from 2018 to 2020.
Link
TLP1: Green
Sandworm-Linked Group Sharpens Matchboil Downloader
Malware Has Hit Ukrainian Transport, Energy and Manufacturing Firms
A cyberespionage group linked to Russian military intelligence has spent the past two years steadily refining a custom downloader used against Ukrainian organizations, researchers found. The steadfast upgrade indicates the malware is core to the Russia-aligned hacking operation and is likely to appear in future attacks.
Link
TLP1: Green
Breaches: Data Breaches and Hacks
Petrosul Data Breach on October 08, 2026
Description Petrosul is a fuel logistics and distribution company based in Brazil, specializing in the transportation, storage, and distribution of fuel products.
Leak Size: 19.07GB
Link
TLP1: Green
Vulnerabilities: Vulnerability Advisories, Zero-Days, Patches and Exploits
SonicWall Fixes Max Severity Pre-Auth Flaw in SMA1000 Appliances
SonicWall patched a CVSS 10 pre-auth SSRF flaw in SMA1000 appliances that could let unauthenticated attackers reach internal functions.
SonicWall released hotfixes for four vulnerabilities in its SMA1000 remote access appliances, including a critical flaw tracked as CVE-2026-102255 (CVSS score of 10.0. The issue is a pre-authentication SSRF bug in the WorkPlace portal that could let an unauthenticated attacker reach internal functions and perform unauthorized operations.
Link
TLP1: Green
FortiBleed hit 86,000 firewalls by exploiting something nobody can patch away
FBI and Secret Service warn FortiBleed, a credential-harvesting campaign against Fortinet firewalls, has compromised 86,644 devices and is locking out admins.
The FBI and the U.S. Secret Service issued a joint advisory about FortiBleed, and the headline number alone is worth sitting with: more than 86,644 compromised Fortinet FortiGate devices across 194 countries, according to SOCRadar’s verification. This isn’t a new zero-day.
Link
TLP1: Green
Incident Response: Infrastructure, Training, SIEM and Incident Handling
Medical devices patients rely on most are least prepared for quantum attacks
Threat actors are exploiting IT, IoMT, OT and IoT devices across healthcare delivery organizations (HDOs) to deploy ransomware, demand payments and monetize stolen patient data, according to Forescout’s Post-Quantum Cryptography (PQC) in Healthcare: From Data Risk to Migration Readiness report.
Link
TLP1: Green
Technical Articles: Forensics, Reverse Engineering, Malware, Phishing, Pentesting, Software Security and Cryptography
Russia-Aligned UAC-0099 Evolves MATCHBOIL Malware
In new research published on October 8, ESET documented MATCHBOIL versions compiled or observed between April 2024 and April 2026, finding that each version was more sophisticated than the one before it.
A Russia-aligned cyber espionage group has steadily upgraded its MATCHBOIL downloader over two years, adding stronger obfuscation, sandbox checks and changes to its execution and payload persistence.
MATCHBOIL was first documented by Ukraine's Computer Emergency Response Team (CERT-UA) in August 2025, but ESET found earlier samples suggesting development may have begun as early as April 2024. It is a C# downloader used to retrieve, install and establish persistence for additional payloads.
Link
TLP1: Green
1Traffic Light Protocol (TLP) [1] for information sharing:
- Red: Not for disclosure, restricted to participants only.
- Amber: Limited disclosure, restricted to participants organizations.
- Green: Limited disclosure, restricted to the community.
[1]https://www.first.org/tlp