Operation CloudFire: How Attackers Used Google Calendar to Hijack Sessions and Defeat MFA at Scale
Operation CloudFire: How Attackers Used Google Calendar to Hijack Sessions and Defeat MFA at Scale
Beginning mid-August 2026, a sophisticated phishing operation dubbed Operation CloudFire systematically harvested live Google Workspace sessions from corporate users by abusing Google Calendar invites as the initial lure. Attackers deployed the Nyasher reverse-proxy framework in front of genuine Google sign-in pages, relaying all MFA challenges—SMS codes, authenticator codes, and Tap-Yes prompts—in real time, effectively nullifying every second-factor control. Lure domains were registered days before use, infrastructure was disposable, and the final credential-capture page was JavaScript-constructed client-side, defeating crawlers and proxy logs. Over one month, 68,676 malicious messages were blocked, 897 domains taken down, and 8,570 unique compromised sender accounts identified across 6,354 root domains.
Operation CloudFire illustrates a maturing class of Adversary-in-the-Middle (AiTM) attacks that render traditional MFA and reputation-based email defenses insufficient. With an unactivated Microsoft 365 branch already embedded in the Nyasher codebase, threat actors are positioned to pivot campaigns rapidly, making session-hijacking infrastructure a persistent and escalating enterprise risk heading into 2027.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
SBI's 2026 PII Leak: How a Small Breach Feeds India's Multi-Million-Record Underground Data Market
In October 2026, the State Bank of India (SBI) disclosed a customer data breach after a threat actor operating under the alias 'Siriusim' published 3,897 customer records—along with a table of 375,000 rows and 2,722 PDF files—on BreachForums. The exposed PII included names, mobile numbers, email addresses, dates of birth, home addresses, KYC documentation, Central KYC numbers, video KYC verification data, loan application metadata, and employment declarations. SBI confirmed the incident via a formal notice to India's National Stock Exchange, while stressing that core banking operations remained unaffected. The breach is suspected to have originated from a peripheral data-handling or digital-services system rather than SBI's core banking platform.
This incident underscores the compounding risk that even small PII leaks create within India's mature underground data economy, where threat actors cross-reference breach dumps with real-time lookup services to build high-fidelity identity profiles for phishing, vishing, loan fraud, and impersonation attacks—amplifying the harm far beyond the raw record count.
High impact
Kill Chain
ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
SBI Dark Web Leak 2026: How 375,000 Rows of KYC Data Slipped Past India's Largest Bank
On October 21, 2026, India's largest state-owned bank, State Bank of India (SBI), disclosed via a stock-exchange filing that approximately 3,897 customer records—drawn from a set of roughly 375,000 rows allegedly posted on BreachForums by a threat actor identified as 'Siriusim'—contained personally identifiable information including names, mobile numbers, dates of birth, email and residential addresses, branch identifiers, CIF numbers, and loan-related metadata. The bank was alerted on October 16 by CERT-In and India's Defense Cyber Agency. SBI activated incident response procedures and engaged an independent forensic firm to assess the alleged compromise. The true source—whether SBI's own systems, a subsidiary, or a third-party loan-processing provider—remains unconfirmed, and customer notification status was not disclosed in the filing.
This incident reflects a broadening pattern in which financially regulated institutions in emerging markets are targeted through supply-chain and third-party data aggregators, where egress controls and data-in-transit protections are inconsistently enforced. The BreachForums listing, combining CSV records with 2,722 KYC PDF documents, signals a shift toward high-fidelity social-engineering datasets that enable impersonation fraud at scale.
High impact
Kill Chain
ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Armory Castle's BeyondTrust Zero-Day Campaign: What Security Teams Must Do Now
Beginning August 29, a prolific Chinese state-sponsored espionage group—tracked by Mandiant and Google Threat Intelligence Group (GTIG) as Armory Castle (formerly UNC5221)—exploited a critical zero-day vulnerability (CVE-2026-102764) in BeyondTrust Remote Support. The attackers escalated privileges, moved laterally across compromised networks, and maintained stealthy persistent access for nearly a month before detection on September 28. BeyondTrust patched self-hosted instances on October 8 and auto-updated cloud versions the same day. Targets span government, legal services, technology firms, and business-process outsourcers across multiple regions, with researchers warning of broader potential exposure given the zero-day's pre-disclosure exploitation window.
Armory Castle's campaign continues a well-established pattern of targeting edge and remote-access security products—Ivanti, Citrix NetScaler, and now BeyondTrust—that typically lack EDR coverage. The group's tradecraft includes per-victim infrastructure rotation and dwell times averaging hundreds of days, raising urgent concern for organizations relying on perimeter-based security without zero-trust network segmentation or east-west traffic visibility.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Armory Castle's BeyondTrust Zero-Day: How a Remote Support Appliance Became a Nation-State Espionage Gateway
In late August 2026, China-nexus threat actor Armory Castle (UNC5221/Warp Panda) exploited CVE-2026-102764, a critical zero-day in BeyondTrust Remote Support appliances, to seize full administrative control of targeted self-hosted systems. The group deployed a PHP web shell (SAWFLY) for persistent C2, used a custom SOCKS5 proxy tool (BARECLAW) for traffic tunneling, harvested stored credentials via proprietary CLI utilities, and pivoted laterally to downstream endpoints via the appliance's Jump Item list—exfiltrating sensitive documents while systematically erasing logs to hinder detection. CISA added the vulnerability to its KEV catalog on October 16, 2026, mandating federal remediation by October 19.
Armory Castle's campaign exemplifies an accelerating pattern of state-sponsored actors pre-positioning zero-days against high-value remote-access and IT management infrastructure. As enterprises increasingly rely on privileged remote-support platforms spanning hybrid and multicloud environments, attackers who compromise these chokepoints gain instant, credential-rich access to the entire downstream estate—making network segmentation, east-west visibility, and egress control more critical than ever.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Microsoft's Xandr Hit with Record $9.6M Fine for Grindr Data Privacy Breach
Norway's Data Protection Authority fined Microsoft-owned advertising company Xandr $9.6 million for unlawfully processing and sharing sensitive data from Grindr users between July 2018 and April 2020. Xandr managed real-time advertising auctions that exposed users' sexual orientation information to thousands of companies without valid consent. The company failed to verify that Grindr had obtained proper user consent for data sharing, resulting in thousands of Norwegian users having their sensitive personal information exposed to advertisers without their knowledge or explicit permission.
This incident highlights the ongoing regulatory scrutiny of data privacy violations in the adtech industry, particularly involving sensitive personal information. With GDPR enforcement intensifying and similar privacy regulations emerging globally, companies face increasing financial and reputational risks for inadequate data protection practices.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
FBI Targets Ransomware Negotiation Industry: Edward Dubrovsky Arrest Signals New Enforcement Era
In October 2026, the FBI arrested Edward Dubrovsky, a Canadian cybersecurity executive specializing in ransomware negotiations, at a cyber insurance conference in Pennsylvania. Dubrovsky, associated with firms Cypfer and CyberSteward, was charged with cyber extortion and conspiracy in connection with the ShinyHunters cybercrime group. ShinyHunters had recently breached FBI systems, stealing sensitive data on thousands of agents including medical records and operational details. The group has extorted over $70 million in 2026 through phishing attacks and data theft from SaaS platforms.
This incident highlights the growing concern over the blurred lines between legitimate ransomware negotiation services and criminal facilitation. With ransomware attacks reaching record levels and negotiations becoming increasingly sophisticated, law enforcement is scrutinizing the entire ecosystem of ransomware response services, signaling a potential shift in how cybercrime enablement is prosecuted.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Cybersecurity Executive Arrested: The Dark Side of Ransomware Negotiations
Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive and founder of CYPFER, was arrested by federal authorities in Pennsylvania on charges of conspiracy and extortion. Dubrovsky's firm specializes in helping organizations negotiate with ransomware operators, but he now faces charges of conspiring to threaten information confidentiality for extortion and Hobbs Act violations. The arrest appears connected to the ShinyHunters ransomware group's attack on FBI IT systems, which exposed personal data of thousands of bureau employees. The breach originated from an unpatched third-party contractor system managed by Accenture.
This incident highlights the growing complexity of ransomware negotiations and the blurred lines between legitimate cybersecurity consulting and criminal conspiracy. As ransomware attacks continue to surge and regulatory scrutiny intensifies, organizations must carefully vet their incident response partners and ensure compliance with evolving legal frameworks around ransom payments.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
GoBalance Flaw Exposes Critical Weakness in Dark Web Infrastructure Security
A critical vulnerability in GoBalance, a load balancer used by dark web sites, allowed attackers to hijack .onion addresses by recovering private keys from public descriptors. The flaw occurred because GoBalance only used the first 32 bytes of Tor's 64-byte private keys during signing, exposing the secret values. Between October 5-7, 2026, this vulnerability was exploited to take over major dark web forums including Dread, redirecting users to attacker-controlled sites. While server access and user data remained secure, the compromised addresses could be used indefinitely for phishing and credential harvesting attacks.
This incident highlights the growing sophistication of attacks targeting anonymity networks and the critical importance of proper cryptographic implementation. As organizations increasingly rely on privacy-preserving technologies and zero-trust architectures, vulnerabilities in foundational security tools pose significant risks to operational continuity and user trust.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
MonsterCloud Ransomware Recovery Fraud: When Incident Response Goes Wrong
In September 2024, Zohar Pinhasi, CEO of MonsterCloud, was indicted on federal wire fraud charges for operating a deceptive ransomware recovery scheme from 2018 to 2023. Pinhasi falsely claimed his company possessed proprietary decryption tools to recover ransomware-encrypted data without paying criminals. Instead, he secretly paid ransoms using client funds while charging inflated fees up to twice the actual ransom amount. The scheme affected hundreds of clients across the US and Canada, with MonsterCloud collecting over $19 million in fees while paying approximately $8 million in ransoms. This case highlights the growing sophistication of fraud within the ransomware economy, where bad actors exploit victims' desperation during crisis situations. The incident demonstrates how the lack of transparency and regulation in the ransomware recovery industry creates opportunities for exploitation, making it critical for organizations to verify the legitimacy and methods of incident response providers.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
MonsterCloud Ransomware Recovery Fraud: $19M Scam Exposes Industry Vulnerabilities
In October 2026, the U.S. Department of Justice charged Zohar Pinhasi, owner of Florida-based MonsterCloud, with wire fraud for allegedly defrauding ransomware victims by secretly paying ransom demands while claiming to use proprietary decryption tools. Between 2021 and 2023, Pinhasi charged clients over $19 million while secretly paying over $8 million in ransoms to threat actors, marking up fees by 500-1800% above actual ransom costs. In one case, he paid $8,200 to attackers but billed the client $150,000, falsely advertising advanced decryption capabilities that never existed.
This case highlights the growing threat of secondary victimization in the ransomware ecosystem, where recovery firms exploit victim desperation. As ransomware attacks surge globally and organizations increasingly turn to third-party recovery services, this incident exposes critical trust gaps in the cybersecurity vendor ecosystem and underscores the need for transparency in incident response partnerships.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
FBI-French Joint Operation Dismantles AI-Powered Deepfake Exploitation Network
In October 2024, the FBI and French authorities conducted a coordinated operation to seize two websites, NudeLeaksTeens and NLTVIDS, that were distributing child sexual exploitation material including AI-generated deepfake content. A 25-year-old French resident suspected of being the primary administrator was arrested by French cybercrime division. The sites monetized stolen and hacked content from social media platforms including Snapchat, TikTok, Instagram and Facebook, using cryptocurrency payments and proprietary currency systems. One collection containing 189GB of material on 315 victims sold for $64.90. This operation highlights the evolving threat landscape where cybercriminals are leveraging AI deepfake technology to create and distribute illegal content at scale. The case demonstrates how traditional cybercrime techniques like social media account compromise are being combined with emerging AI capabilities to exploit victims and evade detection through decentralized hosting and cryptocurrency payments.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
