Cyber Threat Intel Daily Briefing — 2026-10-15

CYBER THREAT INTEL

DAILY BRIEFING · 2026-10-15 12:15 UTC · REPORT BRIEF-20261015-121518

OPEN // LE

01

EU Grocers Pay a Steep Price for Unpatched Fridge Firmware

Hundreds of stores lost millions of dollars because they hired third parties to manage the outdated OT firmware running their cooling systems.

SRC: DarkReading Thu, 15 Oct 2026 07:00:00 GMT https://www.darkreading.com/ics-ot-security/eu-grocers-unpatched-fridge-firmware

02

Police arrests 95 suspects in international CSAM crackdown action

Law enforcement authorities from 17 countries in Latin America and Europe have arrested 95 suspects in an INTERPOL-coordinated operation targeting the distribution of child sexual abuse material (CSAM) through online messaging groups. […]

SRC: BleepingComputer Thu, 15 Oct 2026 07:55:38 -0400 https://www.bleepingcomputer.com/news/security/police-arrests-95-suspects-in-child-sexual-abuse-material-crackdown/

03

AdFection: How mercenary spyware invades victims’ devices through targeted advertising

Researchers say the attacks have serious implications for the online advertising world, and regulators. The post AdFection: How mercenary spyware invades victims’ devices through targeted advertising appeared first on CyberScoop.

SRC: CyberScoop Thu, 15 Oct 2026 10:00:00 +0000 https://cyberscoop.com/adfection-zero-click-spyware-discover-tech/

04

Cisco Urges Customers to Patch Email Gateway Flaw and Check for Compromise

Attackers exploit a critical Cisco email gateway flaw to gain root access. Cisco urges customers to update scanner tools and check for compromise. Cisco confirmed this week that threat actors are exploiting a critical vulnerability in Cisco Secure Email Gateway, tracked as CVE-2026-76519 with a CVSS

SRC: Security Affairs Thu, 15 Oct 2026 09:27:34 +0000 https://securityaffairs.com/200985/security/cisco-urges-customers-to-patch-email-gateway-flaw-and-check-for-compromise.html

05

U.K. Sanctions Cryptomus for RU Money Laundering

The United Kingdom has issued economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomware, narcotics, darknet markets, fraud and cybercrime services that are helping Russia circumvent existing financial res

SRC: Krebs on Security Wed, 14 Oct 2026 14:22:49 +0000 https://krebsonsecurity.com/2026/10/u-k-sanctions-cryptomus-for-ru-money-laundering/

06

Citizen Lab says governments are abusing online ads to hack people with ‘zero-click’ spyware

The digital rights unit found evidence that dozens of devices at media organization Al Jazeera were hacked after being shown malicious online ads.

SRC: TechCrunch Security Thu, 15 Oct 2026 10:00:00 +0000 https://techcrunch.com/2026/10/15/citizen-lab-says-governments-are-abusing-online-ads-to-hack-people-with-zero-click-spyware/

07

FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested

The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group's operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean remote IT worker schemes. […]

SRC: BleepingComputer Wed, 14 Oct 2026 15:41:43 -0400 https://www.bleepingcomputer.com/news/security/fbi-raids-dprk-it-worker-laptop-farms-in-texas-us-nationals-arrested/

08

Russian Influence Operation Widely Targeting Latin America

The AI-enabled operation used spoofed emails, fake government documents, and the creation of a local organization to target schools in Peru and Ecuador, among other efforts.

SRC: DarkReading Wed, 14 Oct 2026 13:00:00 GMT https://www.darkreading.com/cyberattacks-data-breaches/russian-influence-operation-targeting-latin-america

09

U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud

The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers and KVM devices as part of its ongoing efforts to disrupt North Korea's fraudulent remote IT worker (ITW) scheme. The indictment charges a mix of U.S. citizens and Chinese nationals for their roles in a

SRC: The Hacker News Wed, 14 Oct 2026 22:04:31 +0530 https://thehackernews.com/2026/10/us-shuts-down-over-40-laptop-farms.html

10

CenterPoint Energy Data Breach Impacts 1 Million Texans

Personal information such as names, addresses, Social Security numbers, and driver’s license numbers was compromised. The post CenterPoint Energy Data Breach Impacts 1 Million Texans appeared first on SecurityWeek.

SRC: SecurityWeek Thu, 15 Oct 2026 09:55:19 +0000 https://www.securityweek.com/centerpoint-energy-data-breach-impacts-1-million-texans/

11

GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories

The credential-theft campaign known as GhostAction has ramped up, targeting more than 30,000 repositories across 3,000 users and organizations. The spike, according to GitGuardian, was observed on October 8 and 9, 2026. "This resulted from compromising the GitHub accounts of about 1,900 users. It

SRC: The Hacker News Thu, 15 Oct 2026 14:15:10 +0530 https://thehackernews.com/2026/10/ghostaction-compromises-about-1900.html

12

UK Legal Aid Agency: Hackers stole records dating back to 1978

The Legal Aid Agency (LAA), an executive agency of the UK's Ministry of Justice that manages the country's Public Defender Service, says attackers who breached its IT systems in April 2025 stole records dating back to 1978. […]

SRC: BleepingComputer Thu, 15 Oct 2026 04:06:47 -0400 https://www.bleepingcomputer.com/news/security/uk-legal-aid-agency-hackers-stole-records-dating-back-to-1978/

13

Hirudo Android Trojan Replaces Banking Apps to Steal Credentials

Android trojan Hirudo replaces genuine banking apps with modified versions to steal credentials and bypass security checks, enabling financial fraud. ThreatFabric researchers detailed a new Android banking trojan called Hirudo that takes a genuinely different approach to defeating banking security.

SRC: Security Affairs Thu, 15 Oct 2026 06:06:13 +0000 https://securityaffairs.com/200970/malware/hirudo-android-trojan-replaces-banking-apps-to-steal-credentials.html

14

CikaBika Bot RAT Uses Discord for C&C

Delivered via phishing, the malware provides reconnaissance, remote execution, and data exfiltration capabilities. The post CikaBika Bot RAT Uses Discord for C&C appeared first on SecurityWeek.

SRC: SecurityWeek Thu, 15 Oct 2026 11:25:58 +0000 https://www.securityweek.com/cikabika-bot-rat-uses-discord-for-cc/

15

India Mandates Registered Caller Name Display on 4G and Newer Networks From November 1

The Indian government has directed telecom service providers (TSPs) in the country to mandatorily display callers' registered names along with their numbers for incoming calls starting November 1, 2026, in an effort to help people identify calls from unknown numbers and tackle spam or fraudulent cal

SRC: The Hacker News Thu, 15 Oct 2026 16:12:16 +0530 https://thehackernews.com/2026/10/india-mandates-registered-caller-name.html

16

Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies

The Hirudo malware combines elements of a traditional banking trojan and a full-featured RAT. The post Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies appeared first on SecurityWeek.

SRC: SecurityWeek Thu, 15 Oct 2026 10:15:32 +0000 https://www.securityweek.com/novel-android-banking-rat-hirudo-replaces-banking-apps-with-trojanized-copies/

17

Microsoft fixes bug causing Windows black screens, Explorer crashes

Microsoft has resolved a known issue that was causing black screens, desktop loading issues, and Explorer crashes after installing Windows 11 updates released since August. […]

SRC: BleepingComputer Thu, 15 Oct 2026 05:10:20 -0400 https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-bug-causing-windows-black-screens-explorer-crashes/

[ SOURCE ] OpenPhish (18 indicator(s))