AI Fuels Ransomware, Zero-Days Exploited, and Supply Chain Attacks

Further investigation into the ETS data breach reveals that the compromised login credential was specifically used to access an SFTP (Secure File Transfer Protocol) site. This update clarifies the technical vector of the attack. Additionally, the scope of exposed data has been expanded to include student dates of birth and Unique Statewide Student Identifiers (SSID). While the original report indicated data dating back to 2023, new information confirms that data for some former students dating back as far as 2006 was also compromised, significantly increasing the number of potentially affected individuals and the long-term risk of identity theft.

A new report from Semperis elaborates on the escalating 'triple extortion' tactics used by ransomware gangs. Beyond data encryption and leaks, 40% of attacks now involve direct psychological or physical threats against employees and their families. This includes sending threatening messages or packages (57%), threats against family members (37%), and physical intrusion threats (19%). This shift aims to pressure organizations into paying ransoms even with robust technical defenses, creating significant human safety and legal challenges. The report also reaffirms that 84% of ransomware attacks leverage AI.

New information reveals that CISA has added CVE-2026-102764, the BeyondTrust Remote Support zero-day exploited by Armory Castle, to its Known Exploited Vulnerabilities (KEV) catalog. This mandates immediate action for federal agencies and underscores the critical nature of the flaw. The CVSS score has also been updated from 9.3 to 9.8. Additionally, the threat actors are noted to be modifying system files for persistence and using stolen credentials for lateral movement into broader networks, highlighting the severe post-compromise impact.

Days after the cyber-physical attack on French supermarkets, security researchers have discovered that hundreds of the affected Danfoss and Copeland refrigeration controllers remain directly exposed to the public internet. This continued exposure, discoverable via tools like Shodan, indicates that the root cause of the initial attack—internet-accessible industrial control systems—has not been remediated. This leaves the door open for potential further attacks and underscores a systemic failure in securing critical operational technology within the retail sector. Specific Shodan queries have been identified to locate these vulnerable systems, including `title:"XWEB EVO"` for Copeland/Dixell and `http.component:"Danfoss"` for Danfoss products.

ConnectWise has responded to the supply chain attack by suspending its Cloud Backup service and disabling seven application identities, including `506e08f9-6e9a-4da4-942b-a099a03644ae`, to prevent further unauthorized authentication. The attack, which began on October 13, 2026, leveraged a compromised service account credential with Delegated Admin Privileges (DAP) to access 173 Microsoft 365 tenants. This clarifies the attack mechanism and highlights the critical need to transition from DAP to Granular Delegated Admin Privileges (GDAP) for enhanced security. Additional disabled application identities include `2399d300-6fca-4e6a-a686-399fefe75b83`, `24205314-2b89-4e07-a2a4-579e898a5640`, `b78f6a77-d4e5-46fb-87e5-d1648bd02519`, `0de14c77-b9b0-4137-9360-34878a929827`, `412dcf96-176d-4b3a-a1b0-4981ad66971e`, and `b2b55f5b-7758-4719-8d8f-88ae172e6bdb`.