Threat Intelligence RoundUp: October
November 03, 2026
Our analyst team shares a few articles each week in our email newsletter which goes every Thursday. Make sure to register! This blog highlights those articles in order of what was the most popular in our newsletter – what our readers found the most intriguing. Stay tuned for a recap every month. We hope sharing these resources and news articles emphasizes the importance of cybersecurity and sheds light on the latest in threat intelligence.
1. Treasury Dismantles Major Hamas Financing Network – U.S. Department of the Treasury
On October 2, 2026, the U.S. Department of the Treasury announced sanctions against individuals and organizations involved in a Hamas financing network that allegedly moved more than $2 million to the group between 2020 and 2026. According to Treasury, the network operated through France-based organizations that presented themselves as charities raising humanitarian aid for civilians in Gaza, while actually directing donations to a Hamas financial facilitator in Gaza. The network also used cryptocurrency to transfer hundreds of thousands of dollars and promoted fundraising accounts through social media. Treasury stated that $1.5 million of the funds was raised after the October 7, 2023, Hamas attack on Israel. Read full article.
2. Hackers stole Pentagon personnel records of over 3 million people – Bleeping Computer
The Pentagon recently reported a major data breach that exposed personal information belonging to nearly 3 million people in October 2025. Hackers accessed a Defense Manpower Data Center (DMDC) system containing sensitive information, including names, Social Security numbers, dates of birth, and other personal and employment details. The affected individuals include military personnel, civilian employees, contractors, veterans, and others connected to the Department of Defense. Officials say the vulnerability has been fixed and an investigation is ongoing. Read More.
3. U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud – The Hacker News
The U.S. Federal Bureau of Investigation (FBI), in coordination with the Department of Justice (DOJ) and cybersecurity firm CrowdStrike, disrupted more than 40 suspected “laptopfarms” across Texas as part of an operation targeting North Korean remote IT worker fraud schemes. These laptop farms were residences used by U.S.-based facilitators to host and operate laptops supplied by American companies, allowing North Korean IT workers to appear as legitimate U.S.-based remote employees while concealing their actual identities and locations. According to U.S. authorities, the workers allegedly used stolen or falsified identities to secure employment with more than 70 U.S. companies across industries including healthcare, communications, retail, manufacturing, and cybersecurity support. The FBI seized approximately 187 laptops and keyboard, video, and mouse (KVM) devices used to facilitate the scheme, which reportedly generated around $3 million in revenue believed to have been transferred to entities controlled by North Korea. Read more here.
4. FBI Seizes 7 Domains, Disrupts Flax Typhoon Tools Used in Critical Infrastructure Intrusions – The Hacker News
The Federal Bureau of Investigation (FBI) and the U.S. Department of Justice (DOJ) seized seven internet domains to disrupt cyber operations associated with Flax Typhoon, a China-linked advanced persistent threat (APT) group connected to Beijing-based Integrity Technology Group. According to U.S. authorities, the group used two primary tools, MicroScan and FishHub, to target critical infrastructure and organizations in the United States and internationally. MicroScan is a Python-based vulnerability scanning tool containing more than 1,300 scripts designed to identify security weaknesses in websites, applications, and network systems. FishHub was used to conduct spear-phishing attacks, gain unauthorized access to victim networks, and potentially steal sensitive information. Investigators also connected the group to a large Internet of Things (IoT) botnet called Raptor Train, which infected hundreds of thousands of devices before a previous FBI disruption operation in September 2024. Read here.
5. Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites – The Hacker News
A researcher at the cybersecurity company NorForge observed a Chinese-speaking hacker breach more than 100 company websites using autonomous AI agents. According to the report, the AI agents attempted to compromise more than 1,200 sites; among the 100 compromised ones were Deere, SharkNinja, and Cummins. Snorre Fagerland, the researcher who observed the incident, discovered it by scanning the web for “inadvertently exposed instances of Cairn,” an AI-powered system often used by hackers. Fagerland observed approximately two dozen instances of Cairn being used in malicious ways—one of which was by the Chinese-speaking hacker. Learn more.
6. Police Arrest 16-Year-Old Suspected of Running KillSec, Seize Ransomware Leak Site and Servers – The Hacker News
On 30 September 2026, an international law-enforcement operation led by German authorities resulted in three arrests linked to the KillSec ransomware group. The suspected 16-year-old main operator was arrested in Alicante, Spain, where Spanish police also searched a home and a hotel office. A 24-year-old suspect was arrested in Romania, with searches carried out in Bucharest and Vaslui County. The third suspect was arrested in the United Kingdom and is reportedly linked to an extradition request from U.S. authorities. In addition to the arrests, police carried out eight searches across Spain, Greece, Romania and the UK, while seizing five servers and securing at least 110 terabytes of data. Read full article.
7. US soldier gets 70 months in prison for extorting 10 tech, telecom firms – Bleeping Computer
Cameron John Wagenius (known online as ‘kiberphant0m’ and ‘cyb3rph4nt0m’) has been sentenced to 70 months in prison for hacking and extorting 10 technology and telecommunications companies. According to records, the attacks occurred from April 2023 to December 2024 while Wagenius was on active duty with the U.S. Army. Wagenius and his accomplices used stolen credentials to access victim networks, coordinated their activities through Telegram, and later attempted to extort organizations by threatening to publish or sell stolen data on cybercrime forums. The conspirators also sold some of the stolen information and used it to conduct additional fraud, including SIM-swapping, while attempting to extort at least $1 million from data owners. Wagenius was sentenced to 70 months in prison and ordered to pay $294,978 in restitution for his role in the scheme. Read full article.
8. Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks – The Hacker News
Cybersecurity researchers at Dutch mobile security firm ThreatFabric uncovered a new Android banking trojan called Hirudo, which uses modified versions of legitimate banking applications to bypass built-in security protections and facilitate financial fraud. The malware targets users across several countries including Indonesia, China, India, Mexico, Morocco, and Thailand, with eight Indonesian banking apps identified as targets for replacement with malicious versions. Hirudo is distributed through seemingly legitimate shopping, entertainment, and video-streaming applications that prompt users to install the malware through fake in-app updates. Once installed and granted the necessary permissions, it can steal banking credentials, payment PINs, SMS messages, and device information, capture screens and camera activity, and give attackers remote control of infected devices. What makes Hirudo particularly concerning is its ability to replace genuine banking apps with modified copies containing tools designed to deceive security mechanisms, including application-signature verification, accessibility-service checks, screen-capture protections, and Google Play Integrity checks. Learn more.
