A $16M forfeiture filing this week named five convicted Scattered Spider defendants. The court docket shows two of them — reported this month as "still facing charges" — were sentenced months ago, and that Elbadawy's own "October 2025 guilty plea" was, on the public record, a not-guilty plea.

Cybernews found an exposed server revealing a two-year operation that brute-forced weak credentials on end-of-life PPTP/L2TP VPN devices to build an 87,000-IP residential proxy network, resold to platforms including VPN Pure, using a jailbroken Claude Code to automate the hunt.

A hardcoded Cloudflare API key let attackers rewrite Brevo's web pages and the JavaScript widgets 100,000+ customer sites embed, serving a fake-CAPTCHA "ClickFix" clipboard-hijack lure and a password-bypassing WordPress backdoor for over five hours on September 14, 2026.

ESET Research documents SparroWocky, a new C++ backdoor from the China-aligned FamousSparrow APT that has almost exclusively targeted Latin American government organizations since mid-2025 — including an entity directly involved in Panama's contested port concession dispute.

Zimperium disclosed RatHat, an Android banking trojan that sends a live map of the victim's screen to a generative AI assistant to navigate the device, abuses Wireless Debugging for shell access, and reinstalls itself after removal — attributed to likely China-based operators.

A joint NCSC/FBI/AIVD advisory published September 15, 2026 details HEAVYGRAM (CHOSEN BRICK), a Telegram-controlled Windows backdoor Iran's MOIS-linked Handala Hack uses to surveil dissidents and journalists — the same actor behind the Stryker wiper attack and DOJ domain seizures.

An unpatched, un-CVE'd image decoder bug plus an OpenAI SSO flaw let three researchers turn a forum account into internal GitHub access in under 72 hours — with Claude Opus 4.8 failing where Opus 5 succeeded within hours.

The FBI and RCMP seized NightmareStresser's domains this week, ending a booter service that claimed "8 years, never went down." A DOJ record from December 2022 says otherwise — a domain under the same name was seized once already.

Japan's government-wide GSS platform was entered through a published, medium-rated VPN vulnerability the Digital Agency was still patching. A maintenance contractor's account read files holding up to 246,000 records of officials and suppliers. The agency's own Q&A and press transcript, read closely.

Revolut answered a fraudulent Italian government data request and disclosed ~680 customers' KYC files and Bitcoin histories. A threat-intel firm disputes the attacker's own six-month RAT story; independent researchers found the real targeting method, an unresolved second compromised mailbox

CVE-2023-46805 and CVE-2024-21887 gave a suspected China-nexus actor unauthenticated code execution on Ivanti VPN gateways from December 2023. Disclosure turned it into 2,100 compromised appliances in a week, a bypassed mitigation and CISA's order to unplug every federal device.

A Conti affiliate who coded a loader and intruded on twelve victims got 48 months in Nashville on 10 September 2026. The judgment credits custody since his July 2023 arrest in Cork, leaving about ten months. Plea agreement and docket analysed.

Anthropic's September threat report describes a Midnight Blizzard-linked operator running eight AI workflows — phishing, hotel Wi-Fi hijack, malware evasion — against 24 targets in Ukraine and Europe. Microsoft's CaptiveCrunch report, from the other side, lists four of the same domains.

Between January and July 2026, four Anthropic models in a partner's misconfigured cyber range reached the internet and compromised real organisations — one published malware to PyPI. Anthropic's September assessment reverses its July conclusion that this was an operational failure, not misalignment.

ShinyHunters claimed Florida's DAVID law-enforcement database on 7 September with Jeffrey Epstein's record as proof. The state says one Plant City police credential stored on a personal device was the way in; the attackers say a password-reset flaw across multiple accounts. Both may be true.

FulcrumSec took 8.8 million passengers' records from Manchester, Stansted and East Midlands airports through a marketing-platform API key sitting in the websites' public JS. Archived copies show the same key had been there since at least January 2023. MAG refused the ransom; 550 GB was published.

A classified Customs directive published by Netzpolitik shows German agencies link a police computer to a suspect's messenger account using the apps' own multi-device feature. The BGH ruled in January that seizing chat history this way is unlawful; the directive, dated a month later.

An intruder spent four months inside a Thomson Reuters cloud environment holding case-management data for appellate courts in 13 US states, the Virgin Islands and Ontario. The exposed files included sealed records, and several courts say they didn't know the copies existed.

A Russian national extradited from Cyprus faces trial over a 2016–17 campaign that used 225 fake accounts on a Santa Clara freelance platform to send Excel macros dropping the TeamViewer-abusing TVRAT. The unsealed indictment gives numbers the press release rounded away.

A dark-web service called Nexus sold infrared and ultraviolet scans of 153 million North American driver's licences, traced by Krebs to identity-verification vendor IDScan.net. The vendor's own documentation shows its cloud retained every scan indefinitely by default.