Russia's federal education supervisor Rosobrnadzor said on 19 October 2026 that it had restored its online systems after a cyberattack on its resources and those of the Federal Institute for Education Quality Assessment (FIOKO), its subordinate body that runs national education-quality testing. During the attack on Friday 16 October, students answering questionnaires on the Edutest assessment platform were shown messages urging them to join an underground movement against President Vladimir Putin instead of the next question, and assessments at schools and vocational colleges across the country were suspended. The disruption hit a major stage of the programme, which runs from 12 to 29 October, when 9th-grade students in 29 regions were due to sit questionnaires; the results rate institutions, not individual students. A pro-Ukrainian group calling itself Black Spark claimed responsibility on Telegram and denied trying to recruit minors. Rosobrnadzor has not said how the attackers got in or whether any data was taken. (sources: Rosobrnadzor statement; The Record)
Rosobrnadzor — statement on restoration of online resources after the attack (MAX channel, 19 Oct 2026; Russian)
breaches
Incidents
Fri 16 Oct
Updated Tue 27 Oct
Nikkei Inc. said on 16 October 2026 that a cloud service it uses for system development was accessed without authorisation and that, as of 16 October, about 1.83 million items of personal information had leaked. About 150,000 items contained at least one of name, email address, postal address, phone number or date of birth, and about 120,000 of those included an email address. The other roughly 1.68 million items held only identifiers that cannot identify a person on their own. No credit card information was involved. Nikkei says the credentials used were stolen by unknown means, the access took place from the early hours to the morning of 7 October, and personal information stored in the cloud was taken. It has disabled the credentials, reported the incident to Japan's Personal Information Protection Commission on 11 October, and will contact each person whose information is confirmed to have leaked. As of 16 October it had found no misuse of the data, no system outages and no data tampering. Nikkei has not named the cloud service or an attacker. This is a separate incident from the hijacked Microsoft 365 account that sent about 9,000 phishing emails on 30 September and the earlier Google Workspace account compromise, both covered on Cyberstack (/n/nikkei-m365-email-phish-breach-20261004); Nikkei has not said whether they are connected. (sources: Nikkei Inc. notice; BleepingComputer) Updated 19 Oct 2026 (BleepingComputer): BleepingComputer's report is dated 19 October 2026; details credited to BleepingComputer on this card come from that report.
Nikkei Inc. — Personal Information Leak Due to Unauthorized Access (16 Oct 2026)
breaches cloud identity
Incidents
Fri 16 Oct
Updated Tue 3 Nov
ConnectWise says it found unauthorised access to application identities in its Cloud Backup environment (the Microsoft 365 and Google Workspace backup service for MSPs, formerly SkyKick). Its Trust Center advisory, first posted 16 October 2026 and updated 17 October 05:01 UTC, says it has shut off Cloud Backup application access as a protective step, which interrupts backups until further notice; it has no indication so far that partner backup data was compromised and the existing backup archive is not affected. Huntress, which found the activity, says the app's Microsoft 365 credential (API secret) is in an attacker's hands: on 15 October between 06:13 and 08:34 UTC it was used from 144.172.64[.]128, a hosting-provider address, to obtain Microsoft Graph tokens in customer tenants, moving through tenants in sorted order a few seconds apart, which points to a script. As of 19:00 UTC on 16 October Huntress had confirmed unauthorised sign-ins in 162 tenants, and says the credential works in every tenant where the app is consented, so any organisation with it installed is exposed. The app's consent covers mail and attachments, OneDrive and SharePoint files, Teams chats and directory data, and some directory reads leave no audit trail. Huntress also saw the same IP password-spraying four law-firm tenants on 13 and 14 October, and in one tenant a ConnectWise Cloud Management app for Teams added itself to Global Administrator and added new secrets to an MSP management app and Huntress's own app; it has not tied that earlier activity to the same operator. Todyl separately reported the same Graph sign-ins and notes that revoking user sessions does not end app access. No country breakdown has been published. (sources: ConnectWise Trust Center advisory; Huntress) UPDATE 17 October (ConnectWise, 17:00 UTC): ConnectWise says it suspended the Cloud Backup service by revoking the certificates used for the affected application connections for all users, so the shared credentials previously used for Cloud Backup are no longer valid. It has brought in an outside incident response firm, has not seen successful threat activity in the environments it monitors since the mitigations, and has no evidence that the encrypted backup archives were accessed; archives are preserved but backup and restore remain unavailable until service is restored. ConnectWise says Cloud Backup gives it no visibility into partner and customer tenants, so it cannot tell whether a given Microsoft 365 tenant saw unauthorised activity; partners must check their own. UPDATE 17 October (Huntress, 21:15 UTC): Huntress now counts almost 1,000 Entra tenants with sign-in activity from 144.172.64[.]128, more than 300 of them successful, although tenants without the app's service principal could not be accessed. It also found a second, targeted wave on 15 October against 16 tenants in the policy, national security, trade and critical-minerals sectors, most of which do not use ConnectWise products; an automated sweep for Graph tokens (09:25 to 12:35 UTC) was followed by what looked like a manual sweep (13:54 to 14:20 UTC) aimed at Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Entra and the Office 365 Management APIs, and failed where the app was not present. The credential added to a Huntress application in one tenant came from private Azure IPv6 space rather than the earlier IP. Huntress has received unverified outside reports of similar, apparently hands-on activity in other tenants. UPDATE 18 October (ConnectWise, 01:00 UTC): ConnectWise says it first identified the issue on 14 October and at 07:00 UTC on 17 October disabled seven of its application identities: ConnectWise Cloud Backup (506e08f9-6e9a-4da4-942b-a099a03644ae) and six ConnectWise Cloud Management apps, the base app (2399d300-6fca-4e6a-a686-399fefe75b83) plus MS Teams (24205314-2b89-4e07-a2a4-579e898a5640), Exchange Online (b78f6a77-d4e5-46fb-87e5-d1648bd02519), MS Graph (0de14c77-b9b0-4137-9360-34878a929827), Partner Center (412dcf96-176d-4b3a-a1b0-4981ad66971e) and SharePoint Online (b2b55f5b-7758-4719-8d8f-88ae172e6bdb). It stresses that disabling them stops new sign-ins through those connections but does not undo changes already made inside a tenant, that previously issued access tokens may stay usable until they expire, and that any credentials, roles or consents an attacker added through other identities need separate clean-up. As a further precaution it has taken SaaS Security (monitoring and alerting) and Cloud Management (user and licence management) offline; Cloud Backup stays suspended with no restoration time, scheduled backups are not running and archives cannot be restored, though ConnectWise says they remain encrypted and it has no evidence they were accessed. It has engaged an outside forensics firm and says it has not yet established whether a product vulnerability was involved; how the credential was exposed is still under investigation. UPDATE 18 October (ConnectWise, 18:45 UTC; 19 Oct 02:45 Perth): ConnectWise lists two further attacker IP addresses, 144.172.64[.]99 and 144.172.64[.]60, shared through downstream monitoring of partner and customer environments, alongside the original 144.172.64[.]128, and asks partners to include all three when reviewing Microsoft 365 sign-in and audit logs. Its 16:00 UTC update reported no new confirmed findings; Cloud Backup, SaaS Security and Cloud Management stay suspended, archives remain encrypted and isolated with no sign of compromise, and ConnectWise says that finding does not establish whether individual live tenants were affected. iTnews (19 Oct) reports that the rogue secrets added to the MSP management app and Huntress's app in the one tenant were both set to remain valid until 2028, which would have allowed a return after ConnectWise's own credential was cancelled; Huntress says it found and removed the credential on its app on 16 October. UPDATE 19 October (ConnectWise, 13:45 UTC; 21:45 Perth): ConnectWise says it has not seen successful threat activity in the environments it monitors since 17 October 05:00 UTC (1:00 pm Perth), with containment measures still in place. Cloud Backup, SaaS Security and Cloud Management remain suspended, scheduled backups, archive access and restores are still unavailable, and there is no confirmed restoration time; it will publish a timeline and any reconnection instructions once confirmed. It asks partners who serve customers through a reseller, distributor or marketplace to make sure the administrator of each customer tenant receives and acts on its remediation guidance. UPDATE 19 October (Huntress, 1:30 pm ET / 17:30 UTC; 1:30 am Perth 20 Oct): reviewing application sign-ins across more than 10,000 tenants with ConnectWise apps where it can see logs, Huntress says only 144.172.64[.]128 and Microsoft-internal ranges produced application sign-ins. The other circulating addresses in the same provider range (AS14956, RouterHosting) showed only failed user logins or password spraying, which Huntress does not currently link to the app sign-ins: 144.172.64[.]99 (concentrated spray, 10–14 Oct), 144.172.64[.]60 (a few failed logins, 18 Oct) and 144.172.94[.]243 (broad, ongoing spray against many organisations). Huntress has found a second tenant with post-compromise activity. In both tenants the actions ran within two minutes of each other at about 03:45 UTC on 15 October (11:45 am Perth): the ConnectWise application granted itself Global Administrator, then planted new secrets on a few other applications registered in the tenant, apparently chosen at random and often low-privilege ones, to keep a foothold. Huntress found no mailbox or file tampering or user or policy changes in those two tenants, but notes Microsoft Graph directory reads leave no audit record. The last confirmed successful sign-in with the stolen credential was at 08:44 UTC on 15 October (4:44 pm Perth); since then it has seen only failed attempts. UPDATE 19 October (ConnectWise, 18:50 UTC; 2:50 am Perth 20 Oct): containment remains in place with no successful threat activity seen since 17 October 05:00 UTC; ConnectWise says it is monitoring its entire environment and sees no indication of impact beyond Cloud Backup and the precautionary suspensions of SaaS Security and Cloud Management, all three of which remain suspended with no restoration time yet. It has published a video walkthrough of its Cloud Backup technical investigation and remediation guide, and repeats that affected applications must stay disabled until it issues formal restoration instructions. UPDATE 20 October (ConnectWise, 00:45 UTC; 8:45 am Perth): ConnectWise says it has strengthened administrative-access protections and is resetting accounts and replacing application credentials in the affected environment, with third-party forensics still validating remediation; existing Cloud Backup archives remain encrypted, isolated and preserved with no indication they were compromised, though it stresses this does not show whether live Microsoft 365 tenants were affected, so each tenant still needs review. Services will come back in controlled phases, with partner instructions issued before anything is re-enabled; no restoration time yet, and the next update is due by 13:00 UTC on 20 October (9:00 pm Perth). UPDATE 20 October (ConnectWise, 13:01 UTC and 19:05 UTC; 9:01 pm 20 Oct and 3:05 am 21 Oct Perth): ConnectWise says it completed a full reset of all accounts and credentials in the affected Cloud Backup environment on 19 October and is finishing security validation before restoring services in controlled phases, core infrastructure first, with extra review of the most sensitive connections. Once restoration starts it expects it to take several days; it will give a firmer timeline after the first full day of restoration work and will issue instructions before partners need to re-enable connections. Cloud Backup, SaaS Security and Cloud Management stay suspended, so scheduled backups, archive access, restores, SaaS Security alerting and Cloud Management user and licence management are still unavailable. It is still working with outside specialists to find how the access first happened and its full scope, sees no impact on other ConnectWise products, and has started partner technical webinars every two hours from 18:00 UTC on 20 October (2:00 am Perth 21 Oct) walking through Entra ID sign-in and audit logs, app registrations, credentials and permissions, including legacy backup integrations. UPDATE 21 October (ConnectWise status page, 14:35 UTC; 10:35 pm Perth): ConnectWise says it has begun restoring services in controlled phases after remediation and security validation, with each restoration step subject to security review, and expects restoration to take several days; it says service will return in stages and the start of restoration does not mean all capabilities are available. It will publish step-by-step instructions on when and how partners should reconnect affected services, including any reauthorisation and verification steps, and says partners should keep affected application connections disabled until then. Its investigation continues alongside restoration; existing backup archives remain encrypted, isolated and preserved with no indication of compromise, which it says does not establish whether individual partner or customer Microsoft 365 environments were affected, and it sees no indication that other ConnectWise products are impacted. Next update due by 19:00 UTC on 21 October (3:00 am Perth 22 Oct). UPDATE 22 October (ConnectWise status page, 00:52 UTC; 8:52 am Perth): ConnectWise says phased restoration is underway, with each step subject to security validation, and still expects restoration to take several days; partners should keep affected connections disabled until formal instructions apply to their service. It says existing backup archives remain encrypted, isolated and preserved with no indication of compromise, that it has no indication other ConnectWise products, services or offerings are impacted by this incident, and that individual Microsoft 365 tenants still require review for unauthorised changes or persistent access. ConnectWise says that beginning 22 October it will publish updates twice daily. UPDATE 22 October (attribution): In a Trust Center update at 22:00 UTC on 21 October (6:00 am Perth 22 Oct), ConnectWise says that, based on the evidence available to it, including threat intelligence shared by Microsoft, it appears that a China state-aligned group was responsible for the attack on Cloud Backup, and that the group used an openly available agentic AI framework to automate and speed up its operation; ConnectWise says its containment and phased restoration do not remove unauthorised access that may already have been established within individual customer tenants, which require separate review. In a Microsoft Security Blog post (21 Oct, 18:23 UTC; 2:23 am Perth 22 Oct), Microsoft assesses that Storm-0940, a China-state aligned actor active since 2021, was responsible for the ConnectWise supply chain compromise, and says the actor used ARTEX, an agentic AI penetration testing framework, to accelerate scanning and reconnaissance, password spraying and OAuth application abuse at downstream victims. Microsoft says that following the unauthorised access Storm-0940 used ARTEX to attempt to sign in to more than 2,250 tenants at 2,900 sign-in attempts per minute, and that in some environments the agents progressed to Microsoft Graph and directory operations, including reconnaissance, application credential modifications to establish persistence, and changes involving identities, groups and privileged roles, which Microsoft warns can remain active as a backdoor. Microsoft also says Storm-0940 infrastructure at 144.172.64.99 ran a cross-tenant password-spray campaign against 327 accounts across eight organisations between 10 and 14 October in which no successful authentication was observed, that the presence of an affected application or a successful sign-in does not necessarily mean customer data was accessed or exfiltrated, and that the activity did not result from a compromise of or vulnerability in Microsoft corporate systems, products or services. UPDATE 23 October (ConnectWise status page, 01:11 UTC; 9:11 am Perth): ConnectWise says service restoration work is progressing and it anticipates completing testing and security validation of the restored environment by the end of this weekend, which, subject to successful completion, will let it begin returning capabilities to partners in phases: first a process for partners who need to restore data from existing backups, which it currently anticipates enabling early next week, then phased full-service re-enrolment with step-by-step instructions. Partners should keep affected application connections disabled until ConnectWise provides instructions that apply to their service. ConnectWise says that starting 23 October it will move to once-daily updates. Updated 23 Oct 2026 (ConnectWise Trust Center, 14:00 UTC; 10:00 pm Perth): ConnectWise says its teams and independent specialists are continuing restoration testing and security validation, which it expects to complete by the end of the weekend; it then anticipates enabling a process for partners to restore data from existing backups early next week, followed by phased re-enrolment supported by step-by-step instructions, video tutorials and webinars. Partners should keep affected application connections disabled until ConnectWise gives instructions for their service; existing backup archives remain encrypted, isolated and preserved with no indication of compromise; and ConnectWise will publish updates once daily at 14:00 UTC. (source: ConnectWise) Updated 24 Oct 2026 (ConnectWise Trust Center, 14:00 UTC; 10:00 pm Perth): ConnectWise says services are being brought back online in a controlled sequence, including rotating certificates across its infrastructure, with restoration, testing and security validation continuing through the weekend and a target of beginning phased partner onboarding on Monday 26 October, subject to the required checks. It anticipates enabling backup restoration for partners on Monday, followed by phased re-enrolment, and says bringing infrastructure online does not mean all partner capabilities are available. Existing backup archives "remain encrypted, isolated and preserved, with no indication of compromise", and it has no indication that other ConnectWise products, services or offerings are impacted. (source: ConnectWise) Correction (24 Oct 2026): an earlier version gave a figure of 173 affected tenants on 17 October; no source on this card gives that figure, so it has been removed. Updated 28 Oct 2026 (ConnectWise status page, 17:09 UTC; 1:09 am 29 Oct Perth): ConnectWise says it is beginning phased restoration, starting with Microsoft 365 backups and restores through a new, security-hardened application, with other features returning in phases over the coming days. Partners must re-authorize each Microsoft 365 tenant using the new application, 'ConnectWise Cloud Backup for M365', to resume backup and restore operations, following the instructions on the ConnectWise Trust Center. (source: ConnectWise) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: ConnectWise; Huntress)
ConnectWise Trust Center — Cloud Backup (formerly SkyKick) service interruption advisory (16–18 Oct 2026)
breaches cloud identity ai
iTnews reported on 16 October 2026 that WAGD, an Australian dog-harness retailer on Shopify, remains closed on Shopify's advice after malicious JavaScript delivered through third-party theme extensions redirected at least one shopper to a fake checkout on 13 October. Logbase, maker of the Selleasy upsell app (claimed 49,000+ active stores), said an unauthorised party accessed an internal Selleasy tool and added a malicious script to store settings; the attack window was 07:47–15:00 UTC on 13 October (evening into early morning AEST). Logbase said Shopify confirmed at 15:40 UTC that malicious code delivered through Selleasy had been removed, then locked the abused setting, tightened authentication and hired a third-party firm. Selleasy is currently listed as unavailable on the Shopify App Store. HulkApps separately disclosed that unauthorised configurations altered its Hulk Product Options theme extension in a global attack; developer Roman Zipp documented a function named hijack that cancelled the real checkout click and sent shoppers to lookalike payment domains including biliing[.]top and checkout-confirm[.]top, firing only once per browser session. Shopify temporarily disabled the HulkApps extension while the code was removed. Logbase said it has no evidence of a breach of its own systems but cannot rule out customers entering details on the fake pages. Shopify did not reply to iTnews before publication. (source: iTnews)
iTnews — Shopify tells Australian store to stay shut after hijacked extensions divert shoppers (16 Oct 2026)
australia cloud
Incidents
Fri 16 Oct
Updated Sat 31 Oct
BleepingComputer reported on 16 October 2026 that a cyberattack on government contractor BAE Systems has taken down the notice system used by US federal bankruptcy courts. According to BleepingComputer, the Administrative Office of the US Courts (AOUSC) said in a Thursday press release that the attack halted the production and distribution of bankruptcy notices, and that "all access to the BNC systems and websites that BAE operates on behalf of the Judiciary and the related bankruptcy noticing process are unavailable at this time, including bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov, and the National Creditor Registration Service." The AOUSC said it has been in communication with the impacted courts and is coordinating with BAE Systems, which is "actively investigating this incident and working to restore operations". A BAE Systems spokesperson told BleepingComputer: "We are aware of a security incident that is isolated to the BNC system and have taken immediate steps to address it." BleepingComputer notes the federal judiciary said last year that it was strengthening cybersecurity defences after a cyberattack on its electronic case management systems. (source: BleepingComputer) Correction (29 Oct 2026): the card date has moved from 15 to 16 October 2026, the date of BleepingComputer's report, and the card is now sourced to BleepingComputer because the US Courts release returns a server error to Cyberstack. Removed: a sentence on the Bankruptcy Noticing Center's role that BleepingComputer does not state, a statement that neither party had described the attack, and internal source labels. (source: BleepingComputer) UPDATE (30 Oct 2026, Perth; The Record): According to The Record, the Administrative Office of the U.S. Courts and BAE Systems said the Bankruptcy Noticing Center (BNC) systems are back online after the cyberattack caused outages. A BAE Systems spokesperson told The Record: "No other systems were affected. No data was extracted. There was no breach of any PII." According to The Record, federal court officials declared a "Bankruptcy Rules emergency" that allowed bankruptcy judges to extend deadlines and issue related orders to operate around the BNC outage; the emergency declaration lasts 90 days, through January 2027, unless court officials end it, and all paper notices created between October 13 and Monday will carry a warning that they were sent later than intended because of the cyberattack. (source: The Record) Correction (30 Oct 2026): the US Courts release can now be read, so it is the card's primary source with BleepingComputer secondary, and the card date moves back to 15 October 2026, the release's published date. Correction (31 Oct 2026): the US Courts release no longer reads in full for this desk (on 31 October it redirects to another page), so the card date moves from 15 to 16 October 2026, the date BleepingComputer's report shows, the earliest linked source we can read. The US Courts release has also been removed as a source, with the details only it gave; the card now rests on BleepingComputer and The Record. (source: BleepingComputer)
BleepingComputer — BAE Systems cyberattack disrupts US federal court operations (16 Oct 2026)
breaches
ABC News reported on 16 October 2026 that newly surfaced emails show sensitive Australian federal court transcription data was sent to India more than a decade ago under Auscript, and that court leadership treated the 2014 disclosure as a minor issue despite contract language forbidding transfer of information outside Australia. Former Auscript national manager Paul Cutbush raised Public Interest Disclosures with the family court, Federal Court and AFP in December 2014; a 2016 family court reply said there was 'no express provision' preventing offshore work, while Cutbush says the contract did forbid it. ABC links that history to VIQ Solutions (Auscript's successor), which earlier in 2026 breached its Commonwealth contract by allowing highly sensitive court files to be accessed in India; shortly after ABC coverage of that breach, VIQ was put into liquidation amid calls for a forensic audit and national-security concerns. A Federal Circuit and Family Court spokesperson said current leadership was unaware of the earlier Auscript offshoring. Shadow Attorney-General Michaela Cash and Greens leader David Shoebridge called for investigation. (source: ABC News)
ABC News — Federal courts knew Australian data was sent to India more than a decade ago but took no action (16 Oct 2026)
australia identity
Incidents
Fri 16 Oct
Updated Fri 30 Oct
Banking Daily reported on 16 October that a Poole Group spokesperson told it and its sister brand Cyber Daily that the firm is responding to a cyber incident that affected part of its IT environment in recent days: it implemented containment measures, engaged external cyber security specialists, and notified the Office of the Australian Information Commissioner, the Australian Cyber Security Centre and the Australian Taxation Office. LockBit claimed the attack, according to Banking Daily. Poole Group is a Sunshine Coast accounting and business advisory firm founded in 1980. The investigation into nature and scope is ongoing; the firm says it will contact individuals directly if it determines any were affected. Accounting firms hold tax file numbers, identity documents and financial records, so clients should watch for targeted phishing or invoice-redirection attempts. (source: Banking Daily company statement) Correction (30 Oct 2026): removed a detail about the group's leak-site listing and rewrote the lead to start with the company's statement; card date moved to 16 Oct 2026, the date of Banking Daily's report. (source: Banking Daily)
Banking Daily — Poole Group investigating LockBit ransomware attack; OAIC, ACSC, ATO notified (16 Oct 2026)
australia
An ABC investigation published on 15 October 2026 found that the same LinkedIn accounts used to groom businessman Alexander Csergo, the first person convicted of reckless foreign interference in Australia, also reached out to many other Australians. LinkedIn records the Australian Federal Police obtained during the Csergo case show two accounts posing as think-tank and consultancy representatives (including 'Vera Su' of 'Nesa Consulting') built thousands of connections worldwide; between 2016 and 2025 they targeted more than 100 people linked to Australia and messaged 58 of them, offering paid consulting work for 'valuable advice' and, in one message, asking for information 'from important people in the government'. Those approached included people listing jobs at Austrade, the Department of Foreign Affairs and Trade, Investment NSW, Invest Victoria and Tourism Australia, an AFP commander and senior federal officials; Steven Miles, now Queensland Opposition Leader, was connected to the Vera Su account in April 2021 while deputy premier, though the ABC saw no messages and understands he did not reply. Some recipients shared personal contact details or moved conversations to WeChat, phone calls or meetings. A fictitious security firm, 'Data 31', also sought retired Australian police officers as part-time 'security expert' consultants, contacting at least seven Australians, according to Information Age's summary of the ABC reporting. The AFP alleges the operation was run by China's Ministry of State Security (MSS); the Chinese embassy called the claims 'entirely groundless', and ASIO would not comment. Csergo was approached through LinkedIn in Shanghai in November 2021, convicted in March and sentenced in September to three years and six months' jail; the court heard his reports used publicly available material. The accounts have since been deregistered following the AFP investigation; LinkedIn told Information Age that fake accounts breach its terms and it is focused on state-sponsored abuse. The Five Eyes partners warned in June about Chinese intelligence recruiting through online job platforms.
ABC News — Alleged Chinese spies targeted former premier and AFP commander via LinkedIn (15 Oct 2026)
australia identity
Incidents
Thu 15 Oct
Updated Wed 21 Oct
Google Threat Intelligence Group (GTIG) and Mandiant, working with ManageEngine's Threat Analysis Lab, disclosed on 15 October 2026 that AOMEI Technology's origin update servers for AOMEI Backupper were repeatedly tampered with between April and July 2026. In confirmed windows on 28 May (10 minutes), 16 July (6 minutes) and 20 July (5 minutes) UTC, attackers briefly changed the unsigned down_html.ini and Notifycfg.ini files that Backupper polls over HTTPS so any client that checked for an update during those minutes downloaded and ran a trojanised package. There was no software vulnerability: the client trusted the MD5 checksum inside the same unsigned configuration file that named the download. GTIG tracks the cluster as UNC7017. On hit machines a CROSSROAD downloader staged a signed Radmin binary beside an attacker DLL that loaded the SHINYROAD implant (later Adaptix C2 on some hosts), set a scheduled task, and restored the local update file so the machine looked clean while the vendor's download page also looked clean again within minutes. GTIG telemetry spans IT services, telecommunications and higher education in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the United States; victimology is opportunistic. AOMEI told Mandiant on 29 July that it had secured the servers; ManageEngine said it had not independently confirmed containment as of publication. Backupper's changelog through 8.5.0 (9 Oct) lists no change to update verification. (source: Google Cloud) UPDATE (19 Oct, BleepingComputer): ManageEngine says it first told AOMEI about the suspicious activity on 7 June, when AOMEI suggested the files may have been altered in transit (the researchers disagreed). After capturing the 16 July tampering, ManageEngine sent AOMEI the original and modified files, hashes and differences, advised it to preserve evidence before moving the configuration files to new infrastructure, and put it in touch with Mandiant. AOMEI told BleepingComputer it is treating the matter as a high priority, that its chief technology officer is leading an internal investigation, and that a more detailed response will follow. It has not said how the attackers got into its update infrastructure or confirmed that the compromise is fully resolved. UPDATE (19–20 Oct): AOMEI released Backupper 8.5.1 on 19 October as a security update for the tampering incident. Its changelog says it turns off the in-app entry points for promotional pop-up content and automatic software updates, adds asymmetric encryption to remote configuration files including the .ini files, stops using the old update domain www2.aomeisoftware.com, separates software updates from marketing configuration and download resources, and only accepts update files from official AOMEI websites. In an email to The Record on 20 October, AOMEI confirmed that attackers repeatedly altered configuration files on its update servers between April and July. It said its own investigation after ManageEngine's first warning 'rectified some potential vulnerabilities' but could not find the root cause, and that it only found traces of the intrusion in server logs after ManageEngine supplied the exact tampering times in July. AOMEI said it has not yet identified or notified infected customers, will assess and contact potentially affected users, has released a free detection tool, and saw anomalies only in Backupper, not AnyViewer. Google said it has notified the victims it identified, and that in the 20 July window the attackers also used an invisible pop-up to make machines send Windows password hashes to an attacker-controlled server, which could work even where the malware itself was blocked. Vendor: AOMEI changelog; report: The Record (20 Oct).
Google Threat Intelligence / Mandiant — Investigating ephemeral supply-chain tampering (AOMEI / UNC7017, 15 Oct 2026)
breaches australia cloud
Incidents
Thu 15 Oct
Updated Wed 28 Oct
Kyodo News reported on 15 October 2026 that BK Japan, the operator of the Burger King hamburger chain in Japan, said 11.18 million customer records were exposed through unauthorised access to a server managing data from its official smartphone app. According to Kyodo, the leaked data includes users' names, dates of birth, email addresses, phone numbers and gender, and BK Japan said it has not confirmed any fraudulent use of the information and is investigating the breach. BK Japan's own notice (a PDF on burgerking.co.jp) returns HTTP 403 to Cyberstack, so details from it are not shown. Correction (28 Oct 2026): removed the access window (2 to 7 October), the 13 October detection date, the statement that no card numbers were stored and the other details taken from BK Japan's notice, because that notice could not be read; the card now gives only what Kyodo states. (source: Kyodo News)
Kyodo News — Burger King's Japan operator says 11.18 mil. customer records exposed (15 Oct 2026)
breaches
GreyNoise published research, reported by BleepingComputer on 15 October 2026, on a proxyjacking campaign by an actor it tracks as skynox7. The actor breaks into internet-facing edge devices and installs Pawns.app, a legitimate bandwidth-sharing app (a rebrand of IPRoyal Pawns that feeds IPRoyal's residential proxy pool), without the owners' consent, so the attacker is paid for the victims' internet connections. GreyNoise counted at least 143 compromised devices in 34 countries. The exploits used were CVE-2024-3272 and CVE-2024-3273 in end-of-life D-Link NAS devices, CVE-2021-44228 (Log4Shell) in Ubiquiti UniFi Video NVR, and CVE-2025-31324 in SAP NetWeaver Visual Composer; Hikvision and Dahua DVR/NVR devices were also targeted, but GreyNoise did not say which flaws. In some cases the actor added SSH key authentication as a backup way back in. GreyNoise found the activity while helping an organisation that had spotted GreyNoise-flagged residential IPs in its Entra ID sign-in logs, which turned out to be a real intrusion. Its point is that residential proxies defeat 'impossible location' and VPS-reputation checks, and that an IP can carry both legitimate logins and an attacker's traffic. GreyNoise has not published a per-country list. (sources: GreyNoise; BleepingComputer)
GreyNoise — skynox7: Proxyjacking edge devices into residential proxies
vulnerabilities network
Incidents
Thu 15 Oct
Updated Mon 2 Nov
Infoblox Threat Intelligence published research on 15 October 2026 linking the long-running Help Traffic Distribution System (Help TDS), active since at least April 2017, to the Russian-language affiliate program Hotejka, which Infoblox assesses is a rebrand of the older ROI777 traffic operation. Help TDS sells PHP templates that affiliates plant on compromised websites to steer visitors into tech-support scams: full-screen fake Microsoft/Windows security alerts and exit-prevention tricks urge the victim to phone a 'support' number; operators then push free remote-desktop tools such as UltraViewer so they can take over the machine. Since April 2026 the scam landers have been hosted on free Cloudflare Pages (*.pages.dev). Infoblox says Hotejka's Telegram channel announces nearly 300 new Pages destinations a day and that researchers detected more than 20,000 such domains in six months, plus about 10,000 more pages that look like phishing or decoys. Each destination typically resolves for about a week. Infoblox also ties Help TDS traffic to prolific website malware actors including Detour Dog, Balada Injector and DollyWay. (source: Infoblox) Correction (02 Nov 2026): removed The Hacker News as a source. (source: Infoblox)
Infoblox — Inside Help TDS: Hotejka and Cloudflare Pages abuse (15 Oct 2026)
breaches cloud
