Anthropic disrupts Russian APT GTG-20006 that weaponized Claude for malware evasion
TanStack breach expanded to CrowdSec; ALTERED SPIDER hit 300+ dependencies; Sandworm chains Cisco flaws for Cyclops Blink botnet revival.
CISA KEV additions span Linux kernel TLS, GitLab Perfect-10, Artifactory, ScreenConnect, RouterOS, Cisco FMC, and Fortinet with confirmed exploitation.
Iranian Chosen Brick targets dissidents and journalists; Russian GTG-20006 weaponized Claude; Gulf tanker intrusion attributed to foreign actors.
MUIS payroll system (Avelogic) held for ransom in Singapore; Cedar County Memorial Hospital (MO) suffered full IT outage diverting trauma care.
CrowdSec confirmed its source code was stolen and assessed the breach as the result of the May 2026 TanStack supply-chain attack, naming CrowdSec as a further confirmed victim and extending the campaign's documented impact into a security-tooling codebase.
CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog Friday, citing evidence of active in-the-wild exploitation. CVE-2025-39682 (CVSS 9.8) is an improper check in the TLS receive path. The confirmed exploitation of these kernel-level flaws represents a mass-exploitation risk to Linux-based infrastructure globally.
ALTERED SPIDER conducted a supply-chain compromise campaign affecting over 300 software dependencies within a single day, establishing adversary access through trusted dependency channels to reach downstream organizations at scale. Threat hunters have documented the operation; the campaign represents active, mass-reach supply-chain exploitation rather than a single-victim incident.
Software supply chain attacks turn trusted dependencies into adversary access. 📦 ALTERED SPIDER compromised more than 300 software dependencies in a single day, creating a path to reach organizations at scale. See what threat hunters uncovered:— CrowdStrike · @CrowdStrike 于 X · Sep 19, 2026, 3:30 AM
U.S. Coast Guard and FBI physically boarded two oil tankers in the Gulf of Mexico to ensure the integrity of the vessels' operational and information technology systems following a cyberattack by 'foreign cyber actors' (The Record, Sep 16). The Coast Guard confirmed evidence of malicious cyber activity specifically on the VL Prosperity and reported that two oil tankers were targeted in the incident; the agency explicitly stated it has not attributed the attack to Iran, narrowing the state-actor picture beyond the initial 'foreign cyber actors' characterization (SecurityWeek, Sep 17). The joint multi-agency physical response confirms an active, state-linked cyber operation against U.S. maritime infrastructure, with affected vessels taken offline for inspection. Newly confirmed: the network compromise interfered with at least one tanker's navigation and propulsion systems, demonstrating direct functional impact on vessel operability beyond IT-system intrusion, and the affected tankers were en route to the U.S. coast at the time of the incident.
MUIS confirmed its SmartHRMS payroll system (supplied by Singapore vendor Avelogic) was breached and held for ransom, with staff personal and financial details of mosques and madrasahs potentially compromised. Avelogic published a cybersecurity incident notice on its website.
The UK NCSC, US FBI, and Dutch AIVD jointly published an advisory documenting an active Iranian state-sponsored APT espionage campaign. The campaign targets dissidents, activists, and journalists using spyware now specifically identified as 'Chosen Brick,' a platform designed for covert surveillance of targeted individuals. The tri-agency coordination confirms ongoing operational activity and elevates the threat picture from a single-vendor report to a multi-nation validated assessment with named tooling.
Today, the NCSC alongside the @FBI and the Dutch AIVD, has published an advisory exposing spyware used by Iranian state actors to target dissidents, activists, and journalists. 1/2— NCSC UK · @NCSC 于 X · Sep 15, 2026, 10:11 PM
Cedar County Memorial Hospital (El Dorado Springs, MO) confirmed an IT network shutdown on Aug 14 that took offline its EHR, patient portal, and diagnostic imaging, forcing the ED to partially divert trauma and critical cases. A ransomware group has publicly claimed responsibility for the disruption. The incident is documented via DysruptionHub reporting; hospital-side confirmation of the ransomware vector and whether a demand or extortion has been issued remains unconfirmed.
Russian GRU-linked APT Sandworm is actively chaining multiple Cisco vulnerabilities to deploy an upgraded variant of the Cyclops Blink botnet (originally disrupted by the FBI in 2022), indicating an ongoing supply-chain compromise campaign against network infrastructure.
CISA confirmed active exploitation of the GitLab 'Perfect-10' vulnerability. watchTowr observed miscreants probing internet-facing servers in the days following the patch release, indicating an active exploitation window for unpatched deployments.
CISA has added five vulnerabilities affecting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. No specific victims, attacking groups, or operational-impact details are provided in this advisory; it serves as a patch-now directive for the three product families.
Anthropic confirmed and disrupted a Russia state-sponsored cyber espionage operation (GTG-20006) that abused Claude to build AI-assisted workflows, using generative models to rapidly reconstruct malware payloads to evade detection after initial detection. The activity has been attributed to a spy group associated with the 'Midnight' threat cluster, representing a significant APT operational incident.
CISA added three actively exploited vulnerabilities affecting Cisco (CVE-2026-20079, CVSS 10.0, authentication bypass), Citrix, and Fortinet to its Known Exploited Vulnerabilities catalog, mandating FCEB agencies to patch by September 12, 2026. Cisco Talos has confirmed it is actively tracking exploitation of two separate vulnerabilities in Cisco Secure Firewall Management Center (FMC) software—CVE-2026-20079 and CVE-2026-20316—by both state-sponsored and financially-motivated (ransomware) actors. Because FMC is used for centrally managing multiple Cisco Secure Firewall devices across a network, successful exploitation extends control beyond a single appliance. The dual-CVE, dual-actor-type vendor confirmation escalates the incident from a single-patch KEV entry to a coordinated multi-vector threat against enterprise firewall-management infrastructure.