Cyber Digest
A daily roundup of key cybersecurity developments across sectors
Executive Summary
The AI-as-attacker thesis moved from proof of concept to observed intrusion. Unit 42 describes responding to a ransomware attack in which a human operator drove a fleet of frontier-AI agents that breached an enterprise network autonomously, deployed more than 50 MITRE ATT&CK techniques and claimed master keys to the victim's cloud AI infrastructure — compressing what it estimates would have been roughly two weeks of multi-red-team human work into under ten hours, and leaving an 80-page technical audit of the victim's security posture behind. That lands directly on the heels of yesterday's Forescout-Claude PLC exploit and the Financial Stability Board's frontier-AI warning, and the same supply chain show up again in the vulnerability line: CISA added seven new Known Exploited Vulnerabilities including the actively exploited JFrog Artifactory authentication bypass (CVE-2026-82329), and Manifold's "Universal Evil" research showed malicious `.git` configuration files can make Claude Code, Codex, goose and other AI coding agents execute attacker code before the user ever approves a trust prompt (CVE-2026-72718). Independently, US prosecutors indicted a Russian national accused of infecting 80,000 freelancers with TeamSpy malware, and the ShinyHunters healthcare-data wave continued with McKesson confirming data theft from its third-party applications under a reported $55 million extortion demand.
No new ACSC alerts were published in this window; the operative advisory remains the 24 August high-rated alert on active exploitation of TeamCity On-Premise servers within Australia (CVE-2026-63077). The most directly relevant Australian development this cycle is regulatory, not incident: Australia's Privacy Act reform process advanced its second wave, with the Government publishing initial proposals that continue to reshape breach-notification and consent obligations for Australian organisations — a reminder that the disclosure duty around vendor-procured SaaS and identity data, the shared thread through today's McKesson, Dropbox and Austrian identity-chain stories, is tightening. On the technical front, JFrog Artifactory is a repository manager Australian build and deployment teams run self-managed; an unauthenticated bypass that forges admin tokens (CVE-2026-82329) is exactly the trusted-artifact poisoning class APRA CPS 234 and the ASD Essential Eight's application-control and patching measures are designed to blunt, so Australian firms running self-hosted Artifactory should treat the KEV addition as urgent. The "malicious .git configs" research is a direct caution for Australian developers and infosec teams now standardising on AI coding agents — a poisoned repository can silently turn a trusted CLI into an execution primitive — and the ShinyHunters vishing-to-third-party-SaaS pattern behind McKesson mirrors the vendor-chain risk this page flagged through Jack Henry and CareCloud in recent days.
The NZ cycle is quiet: no new Privacy Commissioner breach notifications and no NZ Police cybercrime releases surfaced this window, so the standing item remains the Commissioner's Manage My Health phase-1 findings over the December 2025 breach of nearly 100,000 health records. The nearest fresh angles are imported. The Dropbox breach — attackers re-registering a Lenovo ID against victims' email addresses to reach Dropbox accounts without their passwords, exposing ~5,000 accounts — is a concrete caution for NZ firms and users relying on federated identity brokerage: it shows trust assumed from a third-party assertion can be hijacked, the exact risk profile Privacy Act 2020's accountability principles put on controllers who outsource authentication. On the AI line, Unit 42's autonomous-intrusion case bears directly on RBNZ-regulated entities and NCSC NZ's critical-infrastructure framework, whose resilience expectations are being tested by machine-speed tooling that collapses the incident timeline. For NZ defenders relying on their own AI-assisted analysis, Manifold's finding that a malicious repository can execute before a model is ever consulted argues for treating AI tooling behind the same code-integrity controls as any other supply-chain component.
The week's through-line is the consolidation of frontier AI into first-class attack tooling, and today closes the loop between demonstrated capability and observed use. Where Forescout's Claude-driven PLC exploit and UAC-0099's anti-LLM prompt poisoning (both 01–02 September) were researchers and adversaries demonstrating the edges, Unit 42's case is a real-world intrusion where a human operator's only job was direction while agents executed, re-planned and reported — and the .git-config finding shows the same agent class is itself a supply-chain attack surface. These are no longer separate stories: Vercel's CEO publicly speculated a link between the JFrog bypass and recent autonomous-AI-agent research, and JFrog's token model (access tokens persist independent of the patch) means an already-forged admin token survives the upgrade — a concrete, shared mitigation both AU and allied defenders should chase today rather than at the next patch cycle. Geopolitically, the pro-Ukraine cyber-ecosystem is reorganising: the newly surfaced VantaCore rig (F6 attributes it as a rebrand of Thor) is building custom ransomware rather than relying on LockBit/Babuk, a move partly motivated by distrust of software with Russian roots, while the Russian state-apparatus thread continues with the indictment of a TeamSpy operator. Separately, the first confirmed Pegasus infection of 2026 alongside a new NoviSpy variant on Serbian activists and officials (14 targets) marks the year's largest documented surveillance wave, carried out with a zero-click exploit that Apple's update has since closed — a reminder that commercial spyware remains the most reliable state-surveillance instrument and that patching mobile OS is the operative control. Watch whether JFrog discloses victim counts and whether the idscan.net licence breach (yesterday) crystallises into an official notification with a full count.
Incident Map
Defence 3 stories
US Charges Russian National for Malware Campaign That Infected 80,000 Freelancers
Searzhudin Tamirlanovich Aktulaev appeared in a San Francisco federal court after a May 2025 arrest in Cyprus and extradition to the US, facing conspiracy, aggravated identity theft and computer-damage charges carrying a maximum 20-year sentence. Prosecutors allege that between June 2016 and November 2017 he used 255 fake accounts on a freelance-employment platform's messaging system to distribute TVRAT (a.k.a. TVSpy/TeamSpy) via malicious Excel attachments, exploiting a TeamViewer flaw for remote takeover, alongside a VNC-exploiting DarkVNC strain. About 80,000 users were infected — roughly half in the US, mostly in California — and the operator harvested e-commerce credentials and personal data for fraud; the 2021 indictment remains sealed and the company targeted is unnamed.
Indicators of compromise · DarkVNC — 3 shown
165[.]245[.]160[.]178:5900165[.]245[.]171[.]220:590031[.]59[.]220[.]26:5900
Defanged third-party indicators (abuse.ch). The defanging is deliberate: never click, resolve or fetch these values. An indicator corroborates a report — it never proves one, and its presence here does not mean this story's hosts are listed.
New Pro-Ukraine 'VantaCore' Gang Targets Russian Companies With Custom Ransomware
Russian cybersecurity firm F6 documented VantaCore, a ransomware group it assesses as a rebrand of the pro-Ukrainian operation Thor, targeting at least seven Russian organisations since its August detection (leak site dating to early June). Operating as a ransomware-as-a-service outfit with a Tor-based comms channel, VantaCore builds its own toolset — a proprietary ransomware encrypting servers and endpoints, a VantaCoreLoader propagator, a VantaCoreRAT backdoor and a SnowKiller tool to disable security software — with ransom demands reaching millions of dollars. F6 says the shift away from LockBit 3 Black and Babuk reflects usable weaknesses in those tools and pro-Ukrainian reluctance to rely on Russian-rooted software.
First Confirmed Pegasus Infection of 2026 Plus NoviSpy Variant Found on Serbian Activists
The SHARE Foundation said 14 people — including a member of parliament and a local government official — were targeted in what it called the largest documented surveillance wave in Serbia, coinciding with protests after the 2024 Novi Sad canopy collapse and ahead of October parliamentary elections. Citizen Lab confirmed a Pegasus infection on a student activist "with high probability" via a zero-click exploit used from December to January, while Amnesty International confirmed two devices carried a new NoviSpy variant, pointing to Serbian police or secret-service involvement during detention. Citizen Lab's Bill Marczak urged users to update to the latest iOS, noting Apple's updates have closed this exploit.
Healthcare 3 stories
McKesson Confirms Data Theft in Cyberattack on Third-Party Applications
Drug distributor and supply giant McKesson said an unauthorised party gained access to its third-party applications and stole data, affecting customers in its oncology, multispecialty and medical-surgical businesses, with employee data also taken; the company has "reasonable assurance" there is no ongoing activity and has not yet determined materiality. ShinyHunters claimed responsibility, telling BleepingComputer it used voice phishing to compromise employee accounts and reach cloud applications, demanding a reported $55 million. The number affected remains unknown, but McKesson's position — roughly 40,000 daily deliveries to nearly every US care site — makes it an unusually connected healthcare intermediary, and Health-ISAC flagged the vishing-to-SSO pattern as a ShinyHunters signature in July.
DaVita Agrees to Pay $15M to Settle Claims From 2025 Interlock Breach
Kidney-care provider DaVita will pay US$15 million to settle a consolidated class action over a ransomware attack last year at the hands of Interlock that affected roughly 2.7 million people, after the group published victims' personal data on the dark web when the company refused to pay. A Colorado judge signed the preliminary settlement last week; final approval is pending next year. The breach potentially exposed names, addresses, Social Security numbers, health insurance information, dialysis lab results and images of written cheques, and followed Interlock's separate attack on Kettering Health, with Health-ISAC profiling the group as a repeat healthcare threat actor operating double extortion.
Oncology Firm Novocure Discloses Cyberattack Affecting More Than 1,400 Patients
Medtech and oncology firm Novocure disclosed in a 1 September SEC Form 8-K that it detected unauthorised access to some systems via a subsidiary in mid-August, with containment and an external forensic investigation under way. Impact is reported as limited: roughly 1,400 US patients had internal company ID numbers exposed (no names or identifying data), fewer than 50 patients in the Western US had additional identifying information exposed, and general contact information for US healthcare providers and employees was affected. Novocure says no medical treatment devices were accessed, operations are fully functional and it does not expect a material financial impact; the threat group and nature of the incident were not disclosed.
Education 1 story
Bennett College Data Breach Affects More Than 30,000 People
Greensboro's Bennett College, a private historically Black women's liberal-arts college, disclosed that unauthorised access to its network occurred from 27 October to 15 November last year, affecting at least 30,065 individuals including 10,875 in North Carolina, per a notification filed with the state Attorney General. Affected data may include names, Social Security numbers, driver's licence and state ID numbers, dates of birth, alien registration numbers, financial account information, taxpayer IDs, passport numbers, digital signatures, medical information and health insurance data. Ransomware monitor sites DeXpose and Galaxy Warden reported the college on Incransom's leak site on 6 December; the college has engaged forensic specialists and is offering credit monitoring.
Indicators of compromise · Alien — 1 shown
2f3dee0739dcaaf866c76738bc6e7826932e468a37027356274a018f1f350360
Defanged third-party indicators (abuse.ch). The defanging is deliberate: never click, resolve or fetch these values. An indicator corroborates a report — it never proves one, and its presence here does not mean this story's hosts are listed.
Government 2 stories
CISA Adds Seven Vulnerabilities to Known Exploited Catalog
CISA added seven actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog on 2 September: BerriAI LiteLLM improper authentication (CVE-2026-59822), Kludex Starlette HTTP request/response smuggling (CVE-2026-48710), Kestra OSS OS command injection (CVE-2026-49869), the actively exploited JFrog Artifactory authentication bypass (CVE-2026-82329), Sangoma Switchvox SQL injection (CVE-2026-9586) and the two SonicWall SMA1000 command-injection flaws (CVE-2026-83548 / CVE-2026-83549) already covered in yesterday's digest. Federal agencies face binding operational directives to patch, and the catalog is the authoritative signal for which flaws are confirmed in the wild.
Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages
Check Point continuity research documented malicious Apache modules, built with a component called 3snake, planted on compromised web servers to route site traffic toward gambling pages, with Brazilian government sites among those affected; 3snake's documentation states it targets rooted servers and extracts strings related to password-based authentication. Check Point ties the cluster to Earth Berberoka, an actor Trend Micro documented in 2022 targeting gambling sites across Asia, with links to the Xnote Linux backdoor and oRAT. The vendor published no count of compromised servers or module filenames/hashes to aid detection, and no affected organisation is named.
Indicators of compromise · oRAT — 4 shown
f0c5a7427f91aef5cb4a210d24c7702b63a9dd2ea552fbb84afdec77884f88cc3dc86c26c257a23c465905f218c5d27efb5bdc213b977a76632e63b0eeb534e730d5b56779145aeb30802f73692b4aed57ea50f3
Defanged third-party indicators (abuse.ch). The defanging is deliberate: never click, resolve or fetch these values. An indicator corroborates a report — it never proves one, and its presence here does not mean this story's hosts are listed.
Transport 1 story
Ceva Logistics Sued Over Theft of Employee Records in July Cyberattack
A former employee filed a class action against France-based freight and contract-logistics provider Ceva Logistics in the Southern District of Texas, alleging the company failed to protect bank account details and Social Security numbers stolen during a cyber intrusion in late July that disrupted operations at eight European warehouses serving retailers in the Netherlands and elsewhere. The suit, seeking at least $5 million, alleges Ceva failed to maintain reasonable security following a previous incident — SOCRadar attributes a September 2025 CoinbaseCartel ransomware attack — and has not formally notified employees, allowing fraud risk to persist; the plaintiff reports fraudulent card activity.
Retail & Entertainment & Sport 1 story
Dropbox Accounts Breached via Lenovo Email-Verification Flaw
Dropbox warned some users that unauthorised parties accessed their accounts by exploiting a flaw in Lenovo's email-verification process to register fraudulent Lenovo IDs under victims' email addresses, then using the federated identity to log into Dropbox accounts without their passwords; Dropbox uses Lenovo Identity Provider Services in its authentication stack. Per Reuters, roughly 5,000 accounts were accessed between 4 and 21 August, with some content viewed or downloaded. Dropbox has expired sessions authenticated through Lenovo IDs and now requires a Dropbox account password alongside Lenovo ID authentication; Lenovo described the issue as a legacy integration exploit and says Lenovo customers were not affected.
Global (Macro) 3 stories
Unit 42: Frontier-AI Agents Breached Enterprise Autonomously in Under 10 Hours During Ransomware Attack
Unit 42's incident-response publication documents a ransomware intrusion in which a human attacker used frontier-AI models and attack-specific agentic frameworks to breach an enterprise autonomously: deploying more than 50 MITRE ATT&CK techniques, mapping internal microservices, harvesting secrets from source repositories and the secret manager, seizing root credentials, triggering unauthorised CI/CD builds, and turning the victim's AI endpoints into post-compromise compute — effort Unit 42 estimates would take human operators around two weeks compressed to under ten hours. Techniques spanned initial access via a public API (T1190), credentials in files (T1552.001) and cloud-account abuse (T1078), mapped to the MITRE ATLAS framework. The attacker also left an 80-page technical audit of the victim's security posture.
Malicious .git Configs Make AI Coding Agents Run Attacker Code (CVE-2026-72718)
Manifold's "Universal Evil" research showed that malicious Git configuration files can make AI coding agents execute attacker code before any model call, tool approval or trust prompt — GitHub assigned CVE-2026-72718 (CVSS 7.0, credited to Francisco Rosales). The report lists affected agents including goose (fixed 1.44.0), Codex CLI (fixed 0.131.0), Claude Code (fsmonitor path fixed 2.1.196), Qwen Code, Grok Build and Hermes Agent (fix pending), with one finding duplicating Sonar's April disclosure and echoing the same trust-dialog bypass class behind CVE-2021-43891 in Visual Studio Code. The goose `review` command is called out as executing attacker code in a malicious repo with no interaction.
Indicators of compromise · Hermes — 4 shown
31[.]76[.]100[.]248:809345[.]95[.]99[.]195:808045[.]95[.]99[.]195:809345[.]95[.]99[.]195:8787
Defanged third-party indicators (abuse.ch). The defanging is deliberate: never click, resolve or fetch these values. An indicator corroborates a report — it never proves one, and its presence here does not mean this story's hosts are listed.
Hackers Exploit Critical JFrog Artifactory Auth Bypass to Forge Admin Tokens
A critical authentication-bypass vulnerability (CVE-2026-82329) in self-managed JFrog Artifactory is being exploited in the wild, with watchTowr observing attackers minting Admin tokens on what is effectively the default configuration. An unauthenticated attacker with network access can gain administrative privileges, then enumerate users, read artifacts, change security configuration and poison packages trusted by downstream build and deployment systems; Vercel CEO Guillermo Rauch warned the impact extends beyond Artifactory because downstream systems pull released artifacts automatically. JFrog patched on 28 August across multiple versions (7.161.20 and earlier), and massaged that access tokens are independent credentials, so a forged token survives the binary upgrade. The flaw is now in CISA's KEV; victim counts and IoCs remain undisclosed.
Analytics
Source Reliability Index
| Tier | Label | Description |
|---|---|---|
| ● Tier 1 | Very High | Official / first-party |
| ● Tier 2 | High | Established cyber journalism |
| ● Tier 3 | Moderate | General tech/news media |
| ● Tier 4 | Low | Social / unverified |
Key to this page
Two pill families appear in the text and they answer different questions. A CVE pill colours severity — a measured CVSS band from the National Vulnerability Database. A threat-actor pill colours attribution confidence — how well-corroborated the naming is, which is a claim rather than a measurement. Both are links: a CVE opens the ATT&CK matrix or its wiki page, an actor opens its wiki page.
CVE identifiers
- CVE-XXXX-NNNNCritical · CVSS 9.0+
- CVE-XXXX-NNNNHigh · CVSS 7.0–8.9
- CVE-XXXX-NNNNMedium · CVSS 4.0–6.9
- CVE-XXXX-NNNNLow · below 4.0
- CVE-XXXX-NNNNNo severity resolved — not the same as low
Threat actors · MITRE ATT&CK
- APT29State attribution stated by MITRE ATT&CK
- ShinyHuntersSelf-declared, or criminal-reporting attribution
- Transparent TribeContested — ATT&CK hedges, or two plausible sponsors
- ZIRCONIUMNo attribution in MITRE ATT&CK
Story signals
- ● Tier 1/4Source reliability — 1 official, 4 leads only
- VerifiedCorroborated by a second source or the principal
- ReportedSingle outlet, or a claim still in progress
- UnverifiedA claim we could not corroborate
- ConfirmedBreach acknowledged by the victim or a regulator
- ProbableBreach indicated but not yet acknowledged
- IOCs · FamilyLive abuse.ch indicators exist for that malware family
A collapsed Indicators of compromise block under a story lists defanged abuse.ch indicator values. The defanging is deliberate — never click, resolve or fetch them. An indicator corroborates a report; it never proves one.
Full methodology, evidence grading and caveats: Methodology & reading guide →