Weekly recap: Atlassian flaws exploited within hours, rogue certificates, ShinyHunters arrest ...

Attackers tested a critical Atlassian vulnerability two hours after disclosure. A ransomware recovery CEO faces wire fraud charges, a third ShinyHunters suspect was arrested, and malware authors now embed instructions to fool automated analysis.

Attackers began testing a critical Atlassian Data Center flaw within two hours of technical disclosure. The same week, prosecutors charged a ransomware recovery CEO with wire fraud, the FBI arrested a third ShinyHunters suspect, and malware authors began embedding natural-language instructions to fool automated analysis.

The arbitrary file access vulnerability, tracked as CVE-2026-21589 with a CVSS score of 9.3, affects Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, and Fisheye Data Center products. WatchTowr released additional technical details, and exploitation activity targeting honeypot networks started immediately.

Prosecutors charged Zohar Pinhasi, owner of Florida-based MonsterCloud, with wire fraud. They allege he claimed he could restore data without paying ransoms, then paid ransoms and charged victims fees far above the original demand. MonsterCloud appeared in a 2019 ProPublica investigation on firms defrauding ransomware victims.

A new variant of the DarkSword iOS exploit kit, called P7 DarkSword, now supports on-device keychain and crypto-wallet theft and two-way command-and-control communication. It extracts Keychain data directly on the iPhone before sending it to attackers, rather than copying the entire database for remote processing. The kit hides itself and cleans up behavior, rendering indicators of compromise useless. Investigators say malicious ads in watering hole attacks distribute the kit.

The Russia-aligned threat actor UAC-0099 is refining MATCHBOIL, a malware downloader. Over the past year, MATCHBOIL evolved from a single-execution dropper into a tool that runs every two minutes, repeatedly contacting its control server to fetch updated payloads.

The FBI and Department of Justice disrupted malicious tools linked to Flax Typhoon, a China-linked advanced persistent threat group. Microscan conducted reconnaissance and vulnerability scanning; FishHub enabled exploitation through spear-phishing and follow-on payload deployment. Chris Butera, CISA's acting executive assistant director for cybersecurity, said Chinese government hackers continue positioning themselves within critical infrastructure networks, including operational technology systems, to disrupt functions at a future time.

The FBI arrested a third suspected co-conspirator in the ShinyHunters group, believed responsible for the FBIjobs.gov breach. Director Kash Patel said agents arrested another suspected member. Court documents, POLITICO, and independent journalist Brian Krebs identified the individual as Edward Dubrovsky, a 54-year-old cybersecurity executive and investor based in Toronto. He faces charges of conspiracy to threaten information confidentiality for extortion and interference with commerce by threats. The group told Telegram members they would not remain active because several members had been arrested.

Unknown attackers obtained unauthorized HTTPS certificates for Google domains after hijacking country-code top-level domains for Ghana (.gh), American Samoa (.as), and Sierra Leone (.sl). They compromised third-party operators and modified authoritative DNS records. Google said attackers impacted additional organizations, including leading global brands and widely used online services. Chrome blocked the unauthorized certificates through CRLSets.

A vulnerability in GoBalance, a load-balancing tool used by darknet sites, lets attackers recover a site's master signing scalar from public data, enabling site takeover. Between Oct. 5 and Oct. 7, both onion addresses of Dread, a prominent darknet forum, were taken over and redirected to Conclave. Several marketplaces using the same software were affected.

Bugs drop weekly, and the gap between a patch and an exploit shrinks fast. Critical flaws this week include CVE-2026-86360, CVE-2026-86361, and CVE-2026-86362 in Dell System Update; CVE-2026-21589 in Atlassian; CVE-2026-93355 in LiteLLM; CVE-2026-106382, CVE-2026-106197, CVE-2026-106358, and CVE-2026-106347 in Google Chrome; CVE-2026-102255 in SonicWall SMA 1000; CVE-2026-105192 in LMCache; CVE-2026-102406, CVE-2026-103008, CVE-2026-102404, and CVE-2026-102413 in Elasticsearch; CVE-2026-104711 through CVE-2026-104714 in Apache Struts; CVE-2026-91140 in Progress DataDirect; CVE-2025-64393 and CVE-2026-58069 in Veeam Backup & Replication; CVE-2026-32740 in .js; CVE-2026-18397 in Thales SConnect; CVE-2026-84388 in Fortinet FortiPAM Chrome extension; CVE-2026-76464, CVE-2026-20328, CVE-2026-76454, CVE-2026-76482, CVE-2026-76480, CVE-2026-76483, CVE-2026-76455, CVE-2026-76459, CVE-2026-76471, CVE-2026-76465, CVE-2026-76485, CVE-2026-76486, CVE-2026-76501, CVE-2026-76498, CVE-2026-76499, and CVE-2026-76500 in Cisco; CVE-2026-76281, CVE-2026-76282, CVE-2026-76284, and CVE-2026-76268 in Splunk; CVE-2026-85097 in Bricksforge WordPress plugin; CVE-2026-93836 in WPC Product Bundles; CVE-2026-94504 in Ninja Forms; CVE-2026-105133 and CVE-2026-105134 in AhsayCBS; CVE-2026-96940 in Microsoft Exchange Server; CVE-2026-63277 in LibreOffice; CVE-2026-59265 in Apache OpenOffice; and multiple vulnerabilities in WordPress.

Threat actors embed "AI-Analysis Evasion" capabilities in malware by embedding natural-language instructions to influence automated analysis. Cisco Talos detected this against FRUITSHELL, PLOTSAFE, HOLLOWCLAD, and MANTLEMAZE. Techniques include anti-analysis in source code, sometimes generated from templates with intimidation notes instructing the model that it is a monitored honeypot. Talos said direct-instruction techniques have evolved to target multiple models through template spraying.

The India-nexus adversary Dropping Elephant (Patchwork) targets government, defense, naval, aerospace, academic, and strategic sectors across Pakistan, Sri Lanka, China, and South Korea using spear-phishing with malicious LNK attachments delivering PowerShell malware and DLL sideloading payloads. Bitter, assessed to align with Indian interests, targeted a European embassy in Asia in June 2026 with a FIFA World Cup-themed lure to deliver BDarkRAT, using a compromised diplomatic mailbox from an African country.

Let's Encrypt will drop TLS certificate lifetimes from 90 to 64 days by default in February 2027, preparing for 45-day lifetimes in 2028.

Microsoft CEO Satya Nadella warned that advanced AI models can no longer be treated as nested black boxes. He urged transparent systems with containment, observation, and tamper-proof evidence, and said organizations must assume a model is compromised and contain it from the start.

Comparitech data shows Q3 2026 saw 2,627 ransomware incidents, a 29% increase from Q2 2026 and a 61% increase from Q3 2025. The median demand was $150,000; the average was $602,400. Qilin and The Gentlemen were the most prolific gangs.

Oleg Korniev, 42, a dual citizen of Ukraine and Russia, pleaded guilty to running an international money laundering organization that recruited over 15,000 U.S. money mules to launder at least $10 million stolen from more than 750 U.S. bank accounts. He led Your Mule Cashout.

Jonathan Spalletta, 36, of Maryland, was convicted of computer fraud and money laundering over two hacks of Uranium Finance in 2021. He drained nearly $1.4 million in the first hack and approximately $53.3 million in the second. He laundered funds through Tornado Cash.

OpenAI disrupted two influence operations: Dark Clark from Russia and Bogus Bylines from Iran. Both used ChatGPT to create false front entities, fake journalist personas, and covert think tanks that planted stories in mainstream outlets. Some outlets had substantial audiences, including one with 2 million followers.

A brand deal scam targets YouTube creators by impersonating Hollyland, a wireless transmission manufacturer. Phishing emails lead to a fake site that harvests Google credentials.

A high-severity flaw in NVIDIA's DCGM Exporter GPU monitoring tool, CVE-2026-47483 with a CVSS score of 8.2, allows unauthenticated attackers to flood profiling endpoints and crash the service. Lava Security found roughly 2,100 hosts exposing the exporter between March and May 2026, leaking telemetry from more than 12,000 GPUs representing $100 million in hardware. The fix is version 4.8.2 or later.

Three new malware loaders have appeared: 2CLoader delivers Vidar, Remus Stealer, and XWorm; AvisLoader uses ClickFix lures and communicates via Fox encrypted peer-to-peer messaging; and Sauron Loader serves Russian-speaking cybercriminals exclusively.

Attackers exploited two Zammad flaws as zero-days to breach the Dutch Institute for Vulnerability Disclosure. CVE-2026-102489 is a remote code execution flaw affecting versions 6.3.0 to 6.5.4; CVE-2026-102490 is a local privilege escalation flaw affecting versions 1.5.0 to 7.1.0-alpha. CISA added both to its Known Exploited Vulnerabilities catalog on Oct. 2, 2026, requiring federal fixes by Oct. 5.

An investigation into a September 2026 Akira ransomware attack found the actor accessed endpoints via Remote Desktop Protocol, disabled antivirus, deployed Rclone for data exfiltration, and used a GOST tunneling tool for persistence.

AI attacks move at machine speed. Identity security must keep pace. AI agents have too much access; shadow AI creates insider risk. Organizations need to govern AI access, reduce exposure, and enable safer adoption.

A few arrests and takedowns brought good news. The larger picture is less comforting. Attackers keep finding new ways in, old mistakes still work, and systems meant to protect people are not always what they seem. Check your setup against the stories above. Better to spot the problem in someone else's breach than become part of the one.

Source : thehackernews.com