The situation

Ransomware Disrupts IDCF Cloud East Japan Region

Ransomware outage in IDCF Cloud East Japan Region 1 prompts credential rotation and artifact validation.

Composed by SitRep’s AI editors from 3 sources — BleepingComputer, The Hacker News, SecurityWeek

Ransomware hit IDC Frontier's IDCF Cloud (East Japan Region 1) on Oct 7, causing outages for ~495 government and corporate clients and forcing isolation of affected services and the management console. The attacker claims compromise of 225 databases (~3.6 PB), 239 hypervisors, ~16,000 VM disks, and 554,153 snapshots; customers must assume exposures for those artifacts until they validate containment.

Context

This outage and simultaneous high-speed exploitation and supply‑chain compromises increase immediate risk to tenant credentials, CI/CD secrets, VM snapshots, and management-plane access. Practitioner teams running self-hosted Atlassian, Fortinet devices, Nexus switches, or consuming npm packages should prioritize patching, token rotation, and snapshot/VM integrity verification — the likely blast radius spans cloud tenants, developer pipelines, and network fabric.

“The through-line is immediate, high-impact access to tenant data and credentials unless defenders patch, contain, and rotate secrets fast.”

The move

5 things to do today

Rotate all cloud API keys, management-plane credentials, and service account tokens for tenants in IDCF East Japan Region 1; assume compromise of snapshots and exported artifacts ( ).
Patch or isolate Atlassian Data Center instances for CVE-2026-21589 immediately; if patching is delayed, block internet access to these instances and add WAF rules to detect exploit attempts ( ).
Audit CI and developer environments for installs of tensorlake@0.5.144, revoke any exposed CI/Kubernetes/Vault tokens, and remove the package from build pipelines ( ).
Review FortiGate and SSL VPN admin logs for unexpected account changes, enable MFA on administrative accounts, and rotate Fortinet admin credentials after containment ( ).
Upgrade Nexus 3000/9000 NX‑OS to fixed versions or disable NX-API, NGOAM, and MPLS OAM where unused; apply Live Protect shields pending full upgrades ( ).

On the wire

P0Ransomware

IDCF Cloud Outage Impacts ~495 Clients and Exposes Snapshots and VM Artifacts

Immediate operational impact: isolate management-plane access and assume tenant artifacts (225 DBs, ~16,000 VM disks, 554,153 snapshots) may be exfiltrated. Customers should suspend or snapshot replication, inventory exposed snapshots/disks, rotate all credentials and cloud API keys, and coordinate with the provider for forensic artifacts.

BLEEPINGCOMPUTER · Ransomware Disrupts Japan's IDCF Cloud Used by Government

P1Exploit

Threat Actors Rapidly Target CVE-2026-21589 in Atlassian Data Center Products

Exploitation began Oct 6 with 190 logged attempts from 32 IPs; affected products include Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible, and Fisheye. Apply Atlassian patches immediately or block internet access to Data Center instances, add WAF rules to detect exploit patterns, and review logs for signs of successful exploitation.

SECURITYWEEK · Attackers Target Atlassian CVE-2026-21589 After PoC Release

P0Supply Chain

Compromised tensorlake@0.5.144 Delivers credential‑stealing Shai‑Hulud Worm

The npm package tensorlake (version 0.5.144) used a preinstall hook and obfuscated loader to steal tokens and secrets across local files, CI, Kubernetes, and Vault with persistence. Audit recent builds for installs of tensorlake@0.5.144, revoke and rotate any exposed tokens/credentials, remove the package from build pipelines, and scan CI logs and container images for the loader.

THE HACKER NEWS · Tensorlake Npm Package Compromised to Deliver Shai-Hulud Worm

P1Identity

FortiBleed Campaign Is Locking Admins Out by Manipulating Fortinet Accounts

Campaign affected ~86,000 devices; attackers use compromised credentials and brute force to change/delete accounts on FortiGate and SSL VPNs. Immediately review Fortinet access logs for account changes, enable multifactor authentication, rotate administrative credentials, and follow FBI/USSS containment and remediation guidance.

SECURITYWEEK · FortiBleed Attackers Lock Fortinet Devices Out of Access

P1Patch Tuesday

Five Critical NX‑OS Cves Allow Nexus 3000/9000 Takeover When Features Are Enabled

CVE set (2026-76471, 2026-76485, 2026-76486, 2026-76501, 2026-76465) enable RCE or DoS depending on NX-API, NGOAM, or MPLS OAM usage. Upgrade to fixed NX‑OS versions where available, disable NX-API/NGOAM/MPLS OAM if unused, and apply vendor Live Protect shields while scheduling patching.

BLEEPINGCOMPUTER · Cisco Warns of Critical Flaws Allowing Nexus Switch Takeover

Indicators named in this edition

Kind	Value	Note
CVE	CVE-2026-21589	Atlassian Data Center critical vulnerability under active targeting
CVE	CVE-2026-76471	Cisco NX-OS critical flaw
CVE	CVE-2026-76485	Cisco NX-OS critical flaw
CVE	CVE-2026-76486	Cisco NX-OS critical flaw
CVE	CVE-2026-76501	Cisco NX-OS critical flaw
CVE	CVE-2026-76465	Cisco NX-OS critical flaw
PACKAGE	tensorlake@0.5.144	Compromised npm package delivering Shai‑Hulud worm

Elsewhere in the edition

ASOS Data Breach Linked to Social Engineering and Credential Theft

ASOS says a data breach was caused by social engineering and credential theft, where an unauthorized party impersonated a trusted contact to steal login credentials and access information on third-party platforms. Exposed were full names, contact details, and some non-personal account information; payment data and passwords were not accessed. Investigation ongoing; customers advised to stay cauti…

5 reports

BLEEPINGCOMPUTERASOS Data Breach Linked to Social Engineering and Credential Theft
NEWSAPI CYBER INSIGHTSAsos Confirms Data Breach via Rogue App Notification
NEWSAPI CYBER INSIGHTSAsos Data Breach: Rogue App Notification Exposes Customer Data
NEWSAPI CYBER INSIGHTSASOS Data Breach Linked to Stolen Employee Credentials
NEWSAPI CYBER INSIGHTSAsos Warns of Data Breach Extent After BBC Contact

Fake Decryption Tools Masked $11M Markup in Ransomware Recovery Scheme

Zohar Pinhasi, owner of MonsterCloud, allegedly defrauded clients by claiming to decrypt ransomware without paying attackers. He paid ransoms to obtain keys and then charged victims, totaling over $19 million billed on more than $8 million in ransoms; one case involved paying about $8,200 and charging roughly $150,000.

3 reports

SECURITYWEEKFake Decryption Tools Masked $11M Markup in Ransomware Recovery Scheme
THE HACKER NEWSMonsterCloud Owner Charged With Billing Victims While Paying Ransoms
HELP NET SECURITYMonsterCloud Boss Charged With Fraud Over Ransomware Payments

Agentic SOC Architecture Boosts Firewall Telemetry with Splunk

At Splunk.conf26, Cisco ran a live SOC for 5,145 attendees across 70 countries, using a multi-stage agentic pipeline. Firewalls on Secure Firewall 10 fed Snort 3 and Encrypted Visibility Engine (EVE) data into Splunk Enterprise Security, with Unified Events and AI-assisted Triages. AgenticOps refines rules to cut SIEM load; AI Canvas enables human‑AI collaboration within Cisco Cloud Control.

3 reports

CISCO SECURITY BLOGAgentic SOC Architecture Boosts Firewall Telemetry with Splunk
CISCO SECURITY BLOGOne Cisco Action: Agentic SOC at .conf26 Demonstrates Unified TDIR
CISCO SECURITY BLOGSplunk Conf26: Agentic SOC Triage Agent in Operation

ARTEX AI Pentesting Tool Used in Data Theft Attacks

Cybersecurity researchers describe a targeted campaign against South Korean financial firms using ARTEX, an AI pentesting tool. Active late Sept–early Oct 2026, the operation led to data exfiltration. ARTEX, developed by Autumn-27, is now closed-source after misuse. The campaign involved a two-server setup with Claude Code sessions and multiple LLM backends, and potential ties to a Chinese-speaki…

2 reports

THE HACKER NEWSARTEX AI Pentesting Tool Used in Data Theft Attacks
NEWSAPI CYBER INSIGHTSChinese Hacker Deploys AI in Campaign Against South Korean Banks

US Seeks Hafnium Hacker With $10 Million Reward

The US State Department’s Rewards for Justice offers up to $10 million for information on Zhang Yu, alleged Hafnium actor linked to the Microsoft Exchange Server campaign. Zhang and Xu Zewei were named in a 2025 indictment; Xu was extradited from Italy in April 2026. RFJ says the group accessed US university and immunology data, compromising thousands of computers worldwide and over 12,700 US org…

2 reports

SECURITYWEEKUS Seeks Hafnium Hacker With $10 Million Reward
THE HACKER NEWSUS Offers Reward for Tips on Zhang Yu Linked to HAFNIUM

PoeLLM Adversarial Poetry Campaign Targets AI Services

Malware PoeLLM uses a GitHub poem to encode a C2 IP via words like driver, diode, decryption, tick. It hunts vulnerable AI-facing services (LiteLLM, Ollama), deploys XMRig miners, and can scan for more devices. The poem can be updated to change the C2 address, expanding to over 3,000 confirmed victims by Sep 2026.

2 reports

NEWSAPI CYBER INSIGHTSPoeLLM Adversarial Poetry Campaign Targets AI Services
HELP NET SECURITYCryptomining Botnet PoeLLM Hides C2 Addresses in GitHub Poem

Also reported

BLEEPINGCOMPUTERFBI Disrupts Flax Typhoon Tools Used Against Critical Infrastructure
MICROSOFT SECUREPost-Quantum Authentication Readiness: Testing Certificate Ecosystems
BLEEPINGCOMPUTERLow-cost Android Phones Ship With Residential Proxy Malware
THE HACKER NEWSFBI Ties China-Linked Hackers to Portal Accessing Stolen Emails
THE HACKER NEWSThreatsDay: Ransomware Affiliate Betrayal and Exposed Tools
SANS INTERNET STORM CENTERTwo New Scripts for Forensic Review of AI Agents
THE HACKER NEWSJapan Sees Web Data Leaks From Mobile API Abuse and Metabase
SECURITYWEEKCisco Patches Dozen Critical Vulnerabilities Across NX-OS, Meraki
THE HACKER NEWSUAC-0099 Targets Ukrainian Government With ASHVEIN RAT
SECURITYWEEKSecurity Awareness Training Needs Rethinking, Experts Say

End of the Thursday, October 8, 2026 edition.