Confirmed disruption · FBI, DOJ and seven-nation advisory AA26-281A · Oct 8
THE SCANNER WAS FOR HIRE.
On October 8 the FBI seized seven domains behind MicroScan and FishHub, two tools that U.S. officials say Integrity Technology Group ran for Chinese government-linked hackers tracked as Flax Typhoon. Court documents allege MicroScan probed a South Carolina power company, airports in Japan and Poland, and Taiwanese gas and power firms in 2022. The FBI has not said whether those named targets were breached. Agencies from seven countries published joint advisory AA26-281A the same day, and CISA added five exploited flaws, the oldest from 2015, to its KEV catalog.
An AI pentest agent was turned on South Korean banks.
CrowdStrike says a China-based suspect used the open-source ARTEX agent and Claude Code against Korean banks from late September. At least nine banks were reported as targets. The suspect’s identity is CrowdStrike’s assessment, not confirmed.
Fresh operator tip: AA26-281A says these actors password-sprayed Microsoft Exchange servers. Spraying needs a login page anyone can reach. Knocknoc’s guide shows how to turn its orchestration agent into an inline, identity-aware reverse proxy on Debian or Ubuntu, using HAProxy. The protected web app, such as an on-premises webmail portal, stays unreachable until a user signs in through Knocknoc. It can also forward raw TCP.
Did you know… full-text search reads inside each record, not just its title. When a decade-old flaw like Shellshock or CVE-2016-3081 turns up in a new advisory, searching the CVE number finds every report and guidance document that mentions it.
AA26-281A says the actors pair a Mirai-variant IoT botnet and MicroScan, which has more than 1,300 test scripts, with cross-site scripting and Exchange password spraying. They then install SoftEther VPN clients that reconnect at startup and pull out email and credentials. The advisory names activity consistent with Flax Typhoon, Ethereal Panda and Red Juliett.
CrowdStrike found Claude Code session histories and ARTEX configuration files in the attacker’s open directories, with DeepSeek as ARTEX’s main model. Shinhan, KB Kookmin and Hana were among the targets. The developer has made ARTEX closed-source, but copies of the code remain available.
Black Lotus Labs reports a cryptomining botnet, active since at least April, that targets exposed LiteLLM, Ollama, Gotenberg and Gitea servers. Infected hosts derive the control server’s IP address from four words in a poem on GitHub, and the operator has changed the poem 11 times.
Edition 015’s lead remains a live campaign; no update this window changed the FBI and Secret Service figures. Treat edge devices with internet-reachable admin logins as the common thread between FortiBleed and the Exchange spraying in AA26-281A.
Phasor data, plant switches and a scanned power company
Confirmed · Synchrophasor software · Oct 8
openPDC: deserialization, open data publisher, hard-coded credentials.
ICSA-26-281-02 lists six CVEs. CVE-2026-100730 allows deserialization that could lead to remote code execution, and the internal data publisher accepts unauthenticated connections by default. Upgrade to openPDC 2.9.482 or openHistorian 2.8.585, and turn on Windows Authentication. CISA reports no known public exploitation.
N-Tron 700 switches ship admin credentials that never go away.
ICSA-26-281-01 covers seven CVEs in Red Lion N-Tron 700 firmware 3.11.0 and earlier. Factory admin credentials persist even after new admins are created, passwords sit in plaintext, and a single URL can force repeated reboots. Fix: firmware 3.11.1, and restrict SNMP and the web GUI.
A South Carolina power company was on the MicroScan target list.
Court documents allege scans on or about April 26 and December 29, 2022, of a South Carolina power company and Taiwanese natural-gas and power companies. The FBI has not said whether those utilities were breached. Scans are not intrusions, but they show where the actors looked.
NERC, the E-ISAC and SERC co-host the 2026 conference October 20–23. The E-ISAC is also running awareness content all of October. No new NERC weekly update had been posted when this edition went to press.
Guidance, approvals and rules under review are different things
Confirmed · NSA guidance · Oct 8
Zero trust for OT: 26 high-impact activities.
NSA’s information sheet, “Hardening Department of War Critical OT Environments with Zero Trust Principles,” calls for continuously verifying users, devices, workflows and communications. A summary of the sheet lists 26 activities, including inventories of local, privileged, shared and service OT accounts.
First two EN 40000 standards pass CEN-CENELEC approval.
EN 40000-1-1 (Vocabulary) and EN 40000-1-2 (Principles for cyber resilience), the horizontal standards behind the EU Cyber Resilience Act, completed formal approval. Ratification is scheduled for November 2; they are not yet published.
The incident-reporting rule is at the White House.
CISA sent the final CIRCIA rule to OIRA on October 1. It would require covered entities to report cyber incidents within 72 hours and ransom payments within 24 hours. Review can take 90 days, so publication may slip to early 2027.
Confirmed facts remain separate from Claims to Watch
Confirmed · Verified incident ledger
Karaoke contractor malware puts 8.7 million records at risk
Daiichi Kosho says malware on a Nippon Columbia employee’s computer exposed records on 8,631,000 customers and 93,000 employees, covering names, birth dates, email addresses and phone numbers. Passwords were not included. Theft has not been confirmed, and Daiichi Kosho says its own systems were not breached.
Luminis Health restores systems five weeks after its attack
The Maryland health system says its systems are restored and its hospitals are caring for patients. Staff are still entering records from the downtime period, and the investigation continues. Luminis has not said who was responsible or confirmed that personal data was affected.
Japan’s National Cybersecurity Office told ministries on October 9 to push stronger defenses to companies and local governments. A Yomiuri and Trend Micro count found more than 500 cases so far in 2026, already past 2025’s 473.
The flaws in AA26-281A date from 2014 to 2023. MicroScan has been in use since 2017 and draws on a Mirai botnet of hijacked consumer devices, so its scans come from ordinary-looking home IP addresses. That is why a forgotten FTP server, an old BIND resolver or a Struts app on a utility’s business network is worth an attacker’s time.
For every address you own, record: is ProFTPD, BIND, Struts, ONLYOFFICE, Strapi, Bash CGI, Pulse Secure or GitLab exposed? Is Exchange webmail reachable without MFA? Is there an unexplained SoftEther client or service? Has anything run DCSync-style Active Directory replication it should not? Any unknown answer is a finding.
TXONE NETWORKS: PROTECTING THE ASSETS YOU CANNOT PATCH
TXOne’s latest news is two channel deals, announced September 29 and October 6, just before this window. Nothing new was announced October 8–11. Capability statements below are TXOne’s or its partners’ own claims, not independent test results.
Current update
Marlink and TXOne announced a global strategic partnership on September 29 for vessels, offshore assets and industrial sites, citing IACS UR E26 and IEC 62443. On October 6, Itochu Techno-Solutions (CTC) began reselling TXOne in Japan to manufacturers and electricity and gas companies, targeting ¥1 billion in sales over three years.
TXOne, founded by Trend Micro and Moxa, sells endpoint protection (Stellar), network defense (Edge) and portable inspection. Its September Edge release added AI asset fingerprinting, policy automation, attack-chain alert grouping and an MCP service for authorized AI agents. It also added vEdgeIPS Pro, its first virtual appliance.
TXOne’s core pitch is protecting what you cannot patch. CTC says the network products drop malicious commands in industrial protocols without cutting the whole connection, so production keeps running. This week, that means putting N-Tron 700 switches and openPDC hosts behind protocol trust lists until they are upgraded.
TXOne says Stellar Discover runs in user space with no kernel driver or reboot, takes about a minute per endpoint, and covers Windows 2000 SP4 through Windows 11. Linux is not yet supported; TXOne lists it for 2027. Siemens has again listed Stellar as a supported antivirus for WinCC OA.
Most OT security tools only watch the network. TXOne puts protection on the endpoints and inline in the network, aimed at legacy Windows HMIs and engineering workstations. It claims policy automation cuts deployment effort by more than 90%. Partners like Marlink and CTC show it reaches operators mainly through managed-service and integrator channels.
Stellar Discover only logs malware; blocking needs the paid Stellar Protect upgrade. The 90% effort-reduction figure is TXOne’s own. Buyers should ask how the AI policy features handle change control, and what an MCP connection lets an AI agent change. This edition found no independent outcome study.
They affect Nexus 3000 and 9000 switches in standalone mode, but only when NX-API, NGOAM or MPLS OAM is enabled. Cisco found them internally and knows of no exploitation. Temporary Live Protect shields are available.
CVE-2026-76482, rated CVSS 10.0, and three other flaws affect the former Smart Software Manager in any configuration. Cisco says to move to version 10-202609; older releases will not be patched.
Palo Alto survey: 68% lack full OT asset visibility
The vendor’s survey of more than 1,600 critical-infrastructure leaders says 74% have not fully merged IT and OT security operations. These are survey answers, not incident data.
Ikotas Labs won with $361,000 after hacking the Pixel 10, Galaxy S26, OpenAI Codex and Oracle’s AI database. Vendors have 90 days to patch before details are published.
Agencies from Australia, Canada, Japan, New Zealand, Spain, the U.K. and the U.S. say Integrity Tech enables Chinese government-linked hacking. The DOJ calls this the second public disruption of the firm’s infrastructure, after the 2024 botnet takedown. The U.S. sanctioned the firm in January 2025, the U.K. in 2025, and the EU in 2026.
Open-source AI attack agents now pose a policy question.
After ARTEX was linked to the Korean bank attacks, its developer closed the project and said the developer was not responsible for illegal use. President Lee Jae Myung called for strong countermeasures; China’s foreign ministry said it opposes hacking.
Tokyo asks companies to treat cyber as a core management issue.
The National Cybersecurity Office asked companies to update protections, use strong passwords and secure their supply chains. It cited recent leaks at Lawson, Daiwa Securities, BookOff and Times Car, where about 6.6 million member accounts were affected.
Severity, configuration and exploitation remain separate
Confirmed · KEV · 2026.10.08
Five Flax Typhoon flaws, due October 11
KEV version 2026.10.08 added ProFTPD, BIND, Struts, ONLYOFFICE and Strapi entries on October 8. Ransomware use is listed as unknown. The federal deadline has passed; remove any internet-facing instance that cannot be patched.
CVSS v3 8.8. The flaws are stored cross-site scripting, a regular-expression slowdown and path traversal in data import. All require a logged-in user, in Satel’s communications-sector design tool. No public exploitation is reported.
N-Tron 700 switches (CVSS v3 8.3) need firmware 3.11.1. openPDC and openHistorian (CVSS v3 9.8) need 2.9.482 and 2.8.585. CISA posted no new ICS advisories October 9–12 at press time.
Exchange 2016/2019 extended support ends this week
The forecast expects Microsoft’s last updates for Windows 11 24H2 Home and Pro, and the end of extended-update support for Exchange Server 2016 and 2019. AA26-281A shows Exchange is already being password-sprayed. Atlassian CVE-2026-21589 was still not in KEV at press time.
Each scenario has three items. Pick the one that is the real risk, based on this edition’s advisories.
Four scenarios await a call.
Open solution desk
Item B: the 3.11.0 switch with a reachable web GUI. Item C: the unpatched openPDC Docker image. Item A: password-only webmail open to the internet. Item A: the unexplained SoftEther service.
Page 11 · Sources
References & Attribution
Complete selected-source appendix
Promotions, corrections, rejections and retrieval limits
Promoted
Integrity Tech moves from 2024 botnet background to a Confirmed disruption through the October 8 seizures, AA26-281A and five KEV additions. The named 2022 scan targets are court allegations; the FBI has not said they were breached. The ARTEX campaign is Developing: CrowdStrike’s suspect profile is an assessment.
Corrected
KEV now reads version 2026.10.08; Edition 015 reported 2026.10.04. Atlassian CVE-2026-21589 is still not in KEV. The Register, The Hacker News and iTnews all list the same seven co-signing countries.
Rejected
A “Foxconn confirms cyberattack” story re-dated October 11 described a May 2026 incident and was rejected. Colorado water-utility intrusions resurfaced in aggregators but date from August, disclosed September 18. An open letter on AI cyber defense that appeared in October feeds dates from August.
Retrieval limits
CISA advisory and KEV pages were read directly. The NSA information sheet PDF was not retrieved; its 26-activity detail comes from a practitioner digest. No NERC weekly update for October 12 was posted at production, and no ICS advisories were found for October 9–12.
Sources selected, re-fetched or explicitly retained for Edition 016.
