Bitdefender Labs (8 October 2026) describes Midnight Mimosa, malware preinstalled in the firmware of low-cost multi-brand Android phones built on MediaTek platforms so it is present before first boot and cannot be removed through normal uninstall. Platform-signed system packages (including com.android.system.lite, com.android.sys.prot, com.android.sys.gmsprot and related names) run as system, silently install and remove apps, grant permissions and load remote code. Cover apps (weather, app-lock, notes, OCR) drive ad and click fraud; the same framework can enrol devices as residential-proxy botnet nodes. Bitdefender observed thousands of devices across more than 150 countries over about two years, with the largest shares in Mexico, France and Italy, then the United States, Germany, Brazil and Spain. Model names associated with Doogee S200 X and Cubot KINGKONG X appear, as do phones impersonating major brands. Some affected firmware was signed with certificates bearing the name Shenzhen Zediel; Bitdefender does not claim that company knowingly planted the malware. Thirteen Google Play apps talking to the same C2 infrastructure were also found. Cleaning typically needs firmware replacement or ADB disable — unrealistic for most owners. (sources: Bitdefender Labs; BleepingComputer)
Bitdefender Labs — The phone was compromised before the user turned it on: Midnight Mimosa (8 Oct 2026)
On 8 October 2026, CISA, FBI, NSA and international partners including Australia's ACSC published joint Cybersecurity Advisory AA26-281A on China-linked threat actors enabled by Integrity Technology Group (Integrity Tech), a China-based company with government links that builds or acquires cyber tools, hosts infrastructure and compromises networks. Observed TTPs are consistent with activity tracked as Flax Typhoon, Ethereal Panda and Red Juliett (vendor names may not map 1:1). Actors combine automated scanning (including MicroScan with 1,300+ scripts), large IoT botnets, password spraying against Microsoft 365/Exchange, VPN persistence and hands-on exploitation to steal email and credentials, and have run a portal giving third parties access to stolen mail. Same day, the US Justice Department and FBI announced court-authorised seizures of seven domains used for MicroScan and FishHub spear-phishing/malware delivery; scanning targets cited in court papers include a South Carolina power company, airports in Japan and Poland, Taiwanese energy firms and universities. Integrity Tech was previously sanctioned by the US (Jan 2025) and UK (Dec 2025); a 2024 FBI action disrupted its Raptor Train botnet. Mitigations in the advisory include disabling unused services/ports, sanitising web inputs, MFA everywhere, and timely patching of listed n-day flaws. (sources: CISA AA26-281A; US Department of Justice) The advisory's victim list covers US government services, critical manufacturing, healthcare and IT organisations, US law enforcement, education and religious organisations, and organisations across Southeast Asia, Africa and North America; it does not name Australia. Besides ASD's ACSC, its co-authors include agencies from the UK, Canada, Japan, New Zealand and Spain. It says the FBI recovered an archived email database the actors used, with victims of email theft among government, law enforcement, healthcare and religious organisations in Southeast Asia, and access to the stolen data in some cases restricted to IP addresses in Xiamen, China; the actors also used a tool called DC.exe to run DCSync. It advises watching for unexpected Active Directory replication and replacing end-of-life products. (source: CISA AA26-281A) Correction (29 Oct 2026): removed an 11 October update that rested on an iTnews report, including an ASD spokesperson's comment to iTnews and a count of about 20 Taiwanese university FishHub victims, which no other linked source states; the iTnews link was removed and the advisory details that update repeated are now credited to CISA's advisory directly. (source: CISA AA26-281A)
CISA — AA26-281A: Chinese government-linked cyber threat actors combine automated and hands-on hacking tools (8 Oct 2026; ACSC co-author)
IDC Frontier (IDCF), a SoftBank Group subsidiary that runs the IDCF Cloud IaaS platform, said a third-party ransomware attack caused a disruption in East Japan Region 1 from about 3:40am JST on 7 October 2026. Its third notice (8 Oct) says 495 corporate and municipal customers were affected. Impacted zones named: tesla, henry, pascal and joule. Effects included virtual servers stopping and not restarting. IDCF isolated East Japan Region 1, stopped the management console across regions while it checked safety, and is working with an external security firm to find and block the intrusion path. For the four named zones it says customer data is difficult to retrieve or restore and that recovery currently depends on customers' own backups; it is guiding those customers to rebuild in a separate environment. Other East Japan 1 zones and other regions had no confirmed unauthorised access at the time of the notice, but customers were told to take their own backups. IDCF has reported to regulators and the Tokyo Metropolitan Police. Press coverage (BleepingComputer, NHK, Mainichi) notes knock-on outages including Nissui logistics shipping and Ibaraki prefectural and police websites; IDCF has not itself confirmed every downstream victim in the notice. Threat-actor social posts claiming encrypted databases and hypervisors are unverified by IDCF. (sources: IDC Frontier notice 20261008001; BleepingComputer)
IDC Frontier — Notice 3: unauthorised access / disruption on part of IDCF Cloud (8 Oct 2026, Japanese)
Citrix Security Bulletin CTX697191 (published 8 October 2026) assigns CVE-2026-107406 to a memory-overflow flaw (CWE-119) in NetScaler ADC and NetScaler Gateway when the appliance is configured as a SAML service provider or identity provider. CVSS v4.0 base 9.5 (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L). Successful abuse can lead to remote code execution or denial of service. Exposure is version-specific: builds 14.1-73.37 through 14.1-73.41 and 13.1-64.23 through 13.1-64.28 (and matching FIPS/NDcPP ranges) are affected only as SAML IdP; older supported builds before those floors are affected as either SAML SP or IdP. Citrix urges upgrades to 14.1-73.46 or later, 13.1-64.29 or later, 14.1-73.46 FIPS or later, and 13.1-37.283 or later for 13.1-FIPS/NDcPP. Secure Private Access Hybrid deployments that use affected NetScaler instances also need the upgrade. Customer-managed appliances only; Citrix-managed cloud and Adaptive Authentication are updated by Citrix. Check config for add authentication samlAction (SP) or add authentication samlIdPProfile (IdP). Citrix said it was not aware of unmitigated exploits at publication. (sources: Citrix CTX697191; Cyber Security News)
BleepingComputer reported on 8 October 2026 that Jonathan Spalletta, 36, of Maryland (online 'Jspalletta' and 'Cthulhon'), has been found guilty of computer fraud and money laundering over the April 2021 hacks of Uranium Finance, an automated market maker on BNB Chain. In the first attack on 8 April 2021 he drained about US$1.4 million by abusing a smart-contract flaw with zero-token withdrawals, then pressured Uranium into a sham 'bug bounty' of nearly US$386,000. About three weeks later he exploited a second coding error, where transaction checks used 1,000 instead of 10,000, to withdraw nearly 90% of the liquidity pools, about US$53.3 million in total, and Uranium closed. Prosecutors say he laundered the funds through Tornado Cash and decentralised exchanges and bought rare collectibles, including Magic: The Gathering packs and a Black Lotus card, a first-edition Pokémon base set and a Roman coin. Agents seized the collectibles in February 2025 and recovered about US$31 million in crypto. He surrendered on 30 March and faces up to 10 years for computer fraud and 20 years for money laundering. Source: BleepingComputer, quoting the US Attorney's office.
BleepingComputer — Uranium crypto exchange hacker convicted for stealing $53 million (8 Oct 2026)
A territory-wide technical network outage knocked out telecommunications and digital systems across key Northern Territory government departments and agencies on 8 October 2026, including Police, Health and Education. It began at about 3am NT time (4.30am Sydney) and was resolved about 12 hours later through what the government called undisclosed workarounds by the Department of Corporate and Digital Development (DCDD). NT Police, Fire and Emergency Services issued a public advisory that non-emergency communications, including police assistance lines and phone lines to local police stations, were affected, while triple zero (000) stayed up and all Territory hospitals kept providing patient care. Other agencies reported problems with phone lines, email and network-connected servers. DCDD says it is still investigating the root cause and how to prevent a repeat; the government has not said what caused the outage, and nothing published so far points to a cyber attack. (sources: NT Police, Fire and Emergency Services; iTnews) UPDATE (23 Oct 2026): iTnews (8 Oct), citing ABC News (8 Oct), reported that the problem was linked to a gateway in the core network, and that three calls were missed during the outage, although checks found they were routine police follow-ups rather than emergencies, which qualifies the government's line that triple zero kept working throughout. DCDD's root-cause review is still open.
NT Police, Fire and Emergency Services — Public advisory: technical network outage affecting non-emergency communications (8 Oct 2026)
Microsoft has added two Teams meeting features to the Microsoft 365 Roadmap, BleepingComputer reported on 8 October 2026. The first lets organisations plug in certified third-party tools that analyse meeting audio and video for signs of synthetic or manipulated media and send detection signals into Teams, which will surface them in the meeting with related controls. The second, impersonation protection, warns users and shows risk indicators when Teams detects that a meeting organiser or participant may be pretending to be someone else. Both are in development, with a worldwide rollout and general availability planned for November. They follow other Teams anti-abuse changes: admins locking out external users through the Defender portal, blurring of QR codes from external senders, a meeting policy that blocks identified external bots, and reporting of suspicious guest invitations from November. The deepfake feature depends on buying a supported third-party provider; Microsoft has not named providers or prices. Source: BleepingComputer, citing Microsoft 365 Roadmap entries.
BleepingComputer — Microsoft Teams to get support for third-party deepfake detection tools (8 Oct 2026)
JPCERT/CC issued alert JPCERT-AT-2026-0030 on 8 October 2026 (updated 23 October) about a run of unauthorised-access incidents that have leaked personal data from Japanese organisations around September 2026. It names no attacker or victim and says the information it holds is limited and fragmentary. Besides consumer apps, victims include business intelligence (BI) tools and staff-facing management systems that were never meant to take access from the general public. The alert describes five cases, based on reports to JPCERT/CC, and says not every incident used the same method. Case A: attackers scan each target for a range of known flaws and try to exploit them, or abuse poor device management, for example by stealing configuration and backup files. Case B: unauthorised requests to apps' admin APIs, including analysing public smartphone apps to find API endpoints and keys; attacking internal APIs that the app's screens cannot reach (changing user privileges, creating rogue accounts, probing how responses change with missing headers or malformed tokens, and blind NoSQL injection to find account details); and using API keys stolen from other compromised systems, with access also routed through Tor exit nodes and residential proxies. Case C: exploitation, through API requests, of the Metabase SQL injection flaw CVE-2026-72898, covered in JPCERT/CC's 14 August alert. Case D: WAR files planted on application servers reachable from public web servers, whose JSP files act as simple web shells that were accessed repeatedly around September. Case E, added on 23 October: attack attempts using AI-driven penetration-testing platforms such as Cairn, CyberStrikeAI and ARTEX, mainly against internet-facing web applications. The alert lists suspicious source IP addresses and User-Agent strings for checking logs, and recommends rate limits on APIs, access control on every API endpoint including non-public ones, least-privilege, short-lived API tokens that can be revoked quickly, limiting access by region where a service is local, and patching known flaws (source: JPCERT/CC). Macnica's Security Research Center, which the alert lists as a reference, counted 119 publicly reported personal data leaks through web systems run by Japanese companies this year as of 6 October 2026 (84 in 2025 and 62 in 2024), 81 of them made public since July (source: Macnica). UPDATE (13 Oct): the Cabinet Secretariat's National Cybersecurity Office (NCO) issued an advisory dated 9 October 2026 saying it had confirmed multiple cases in which systems of companies handling large volumes of personal data were breached through web-system vulnerabilities, supply-chain compromise and weak data management. It asks those companies to patch promptly (including internal servers), stop using unsupported products, use MFA, keep admin accounts to a minimum, keep and watch logs, and check contractors and sub-contractors, and asks breached organisations to share technical details quickly with the NCO, their ministry or specialist bodies (source: National Cybersecurity Office). UPDATE 23 Oct 2026: JPCERT/CC added Case E and further suspicious source IP addresses to Case B (source: JPCERT/CC). Correction (29 Oct 2026): the card now follows the current JPCERT/CC alert, which describes five cases rather than three, and links Macnica's report directly. Removed details that the linked sources do not state: Jiji Press reporting on a cross-ministry meeting chaired by the cybersecurity minister and NCO comments on August and AI, a Financial Services Agency notice that is not linked, counts of IP addresses and User-Agent strings, Metabase CVSS and cloud zero-day details, a line saying the advisories are requests rather than legal duties, and internal source labels. (sources: JPCERT/CC; Macnica; National Cybersecurity Office)
JPCERT/CC — JPCERT-AT-2026-0030: alert on recent successive unauthorised access at domestic organisations (8 Oct 2026, updated 23 Oct, Japanese)
GreyNoise reported on 8 October 2026 a rise in scanning and exploitation attempts against digital video recorders and cameras in Ukraine between 21 September and 1 October 2026. Almost all of it targeted CVE-2021-36260, the 2021 unauthenticated command injection in the web server of many Hikvision products (CVSS 9.8, NVD). Reconnaissance started on 21 September from a Ukrainian IP address; exploitation attempts jumped from near zero on 23 September and ran to 1 October. Four IP addresses sent nearly all of them: three PureVPN exit nodes (195.238.124.178, .181 and .188, AS56630) and one Ukrainian domestic address, which GreyNoise links to the VPN activity only with low confidence. Every request used the same command test from the public Nuclei template for this bug, with no payload, and the four addresses did not try it against GreyNoise sensors outside Ukraine; nothing more came from them through 7 October. GreyNoise records attempts, not confirmed takeovers, and does not link the activity to the missile and drone strikes it coincided with. Context: Ukraine said in January 2024 that Russian intelligence had used two hijacked cameras to watch Kyiv air defences. (sources: GreyNoise; Cyber Security News)
GreyNoise — Spike in attacks targeting digital video recorders in Ukraine (8 Oct 2026)
Software supply-chain security firm Apiiro reported, and BleepingComputer covered on 8 October 2026, that the FakeGit campaign resumed on 4 October and now uses 17,610 GitHub repositories to spread SmartLoader, a loader that pulls in further malware such as the StealC infostealer. In 34 hours the operator pushed changes to more than 13,000 repositories, peaking at 2,999 an hour; in sampled commits 97% touched only the README and 88% pointed its Download button at a ZIP that installs SmartLoader. Most accounts are disposable, but at least 700 appear to belong to real developers. Island named the operation in July after finding 7,600 such repositories, 800 of them posing as AI skills or MCP servers listed in public AI registries. Apiiro says takedowns fail because they work from lists that cover a fraction of the repositories, and copies sit in forks, older files, release assets, issue attachments and separate download repositories, so the operator just changes the link. 71% of the fleet was missing from URLhaus before the report, and DNS blocking cannot single out one file on GitHub. (sources: Apiiro research; BleepingComputer)
Apiiro — FakeGit research: never deleted, only re-pointed (Oct 2026)
Strapi Cleartext Storage of Sensitive Information Vulnerability. Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
ONLYOFFICE Docs Server Path Traversal Vulnerability. ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
