Ransomware disrupts IDC Frontier cloud, hitting 495 customers

💥 BREACHES & INCIDENTS

• Ransomware attack on SoftBank subsidiary IDC Frontier disrupts IDCF Cloud for 495 customers
  IDC Frontier's IDCF Cloud East Japan Region 1 was hit by a ransomware attack, disrupting 495 corporate and government customers.
  • Affects IDCF Cloud customers — 495 companies and local governments including Ibaraki Prefecture — using the East Japan Region 1 data center in Shirakawa City, Fukushima Prefecture.
  • The attack began around 3:40 AM on October 7, 2026, forcing IDC Frontier to shut down and isolate the network; management consoles for all regions were disabled.
  • A claimed attacker message says the breach took seven minutes, encrypted 225 databases (3.6 PB), reached 239 hypervisors, sealed 16,000 VM disks, and wiped 554,153 snapshots — unverified by the company.
  • Downstream outages hit Nissui Logistics shipments, Greenwich's Rakuraku Zaiko inventory service, and websites of Ibaraki Prefecture, its police, Kodaira City, Adachi Ward, and sports teams.
  • The intrusion route, whether data was stolen, and a restoration timeline remain unknown; Macnica logged 119 Japanese cyber incidents this year, up from 84 in 2025.
  Sources 📄 Source: idcf.jp · 📎 Coverage: bleepingcomputer.com · 👁 via BleepingComputer

🔓 CVEs & KEV

• CVE-2026-107722 — nearform fast-jwt — CVSS 9.8 — fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-en...

• CVE-2026-84249 — IBM Guardium Data Protection — CVSS 9.8 — IBM Guardium Data Protection: Unauthenticated Arbitrary Management Operations

• CVE-2026-78406 — IBM Security Verify Access — CVSS 9.8 — IBM Security Verify Access Deserialization Flaw Enables Unauthenticated RCE

• CVE-2026-78401 — IBM Security Verify Access — CVSS 9.8 — IBM Security Verify Access Deserialization Flaw Enables Unauthenticated Remote Code Execution

• CVE-2026-107726 — hazelcast — CVSS 9.3 — Hazelcast: Arbitrary member memory access by low-privileged clientHazelcast i...

• CVE-2026-89091 — Red Hat Migration Toolkit for Applications 8 — CVSS 8.8 — Ansible-core: ansible-core: ansible-galaxy collection install symlink path es...

• CVE-2026-107725 — hazelcast — CVSS 8.7 — Hazelcast: Authorization bypass in IMap Predicates APIHazelcast is a unified ...

• CVE-2026-107723 — nearform fast-jwt — CVSS 8.1 — fast-jwt : Silent claim-validator bypass when JWT payload is a JSON arrayfast...

• CVE-2026-107724 — nearform fast-jwt — CVSS 7.4 — fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token f...

🕵️ RESEARCH & DEEP DIVES

• Citrix NetScaler SAML memory overflow flaw (CVE-2026-107406) allows unauthenticated RCE CVE-2026-107406
  Citrix has patched a critical memory overflow vulnerability in NetScaler ADC and Gateway that allows unauthenticated remote code execution or denial of service on SAML-configured appliances.

  • Affects Citrix NetScaler ADC and NetScaler Gateway appliances configured as a SAML Service Provider or Identity Provider, including FIPS builds.
  • Memory overflow vulnerability (CVE-2026-107406, CVSS 9.5) can lead to unauthenticated remote code execution or denial of service.
  • Affected versions include NetScaler ADC/Gateway before 14.1-73.37 and before 13.1-64.23, plus ranges 14.1-73.37 to 14.1-73.41 and 13.1-64.23 to 13.1-64.28 when configured as SAML IdP; fixed in 14.1-73.46 and 13.1-64.29.
  • Exploitation works via specially crafted network requests to SAML endpoints, requiring no privileges or user interaction; no public PoC or confirmed exploitation yet.
  • The flaw shares the same SAML attack surface as two other NetScaler vulnerabilities exploited in the wild in the past month; Citrix also patched its hosted cloud offering before initially marking it not vulnerable.
  Sources 📄 Source: support.citrix.com · 📎 Coverage: feedly.com · 👁 via @GossiTheDog@cyberplace.social (+1)

• DOJ and FBI seize seven domains behind Flax Typhoon hacking tools MicroScan and FishHub
  The DOJ and FBI seized seven domains used by Chinese-linked Flax Typhoon hackers to operate the MicroScan vulnerability-scanning and FishHub spear-phishing tools.

  • Targets include US government agencies, critical infrastructure, healthcare, manufacturing, law enforcement, universities, and organizations in Southeast Asia, Africa, and North America
  • MicroScan is a Python-based scanner with 1,300+ penetration-testing scripts targeting Oracle WebLogic, Apache Struts, WordPress, and Jenkins, aided by a Mirai-variant IoT botnet
  • FishHub delivered malware via spear-phishing, giving remote access and exfiltrating data; stolen files from 20+ organizations were found on a FishHub server
  • Attackers used the EBurst tool for password spraying against Microsoft Exchange and stole Active Directory credentials; seized domains include c0cc.cc, outlook3650.com, linkedinns.net, and 98aiblog.com
  • The tools were operated by China-based Integrity Technology Group, which the US, UK, and EU have sanctioned
  Sources 📄 Source: justice.gov · 📎 Coverage: bleepingcomputer.com · 👁 via CyberScoop, BleepingComputer

• Zenity Labs discloses 'AgentCorruption' flaws letting one prompt hijack all AWS AgentCore agents in an account
  Zenity Labs disclosed a chain of flaws in Amazon Bedrock AgentCore that let a single prompt to one public agent take over all AgentCore agents in the same AWS account and region.

  • Applies to organizations running AI agents on Amazon Bedrock AgentCore, AWS's managed platform for deploying enterprise agents.
  • A single prompt to one public-facing agent exposed private conversations, source code, long-term memories, and credentials including API keys and OAuth tokens from AWS Secrets Manager.
  • The attack worked by tricking an agent with outbound-request tooling into fetching temporary AWS credentials from the Instance Metadata Service (IMDS), which AgentCore's Firecracker MicroVMs did not block.
  • The default AgentCore IAM role extended across all agents in the account and region, letting researchers invoke internal agents, download container images, and read user chats.
  • Researchers also planted malicious memories that made agents follow attacker-controlled instructions and forward future conversations to an external server.
  • Zenity reported the flaws in December 2025; AWS made IMDSv2 default for new agents in February and later narrowed the default role, though AWS says the behavior is documented, not a vulnerability.
  Sources 📄 Source: labs.zenity.io · 📎 Coverage: thenextweb.com · 👁 via Dark Reading

• CVE-2026-47483: Thousands of NVIDIA DCGM Exporter endpoints exposed, DoS flaw disclosed CVE-2026-47483
  Researchers found thousands of internet-exposed NVIDIA DCGM Exporter endpoints and a high-severity flaw that lets unauthenticated attackers crash GPU monitoring.

  • Affects operators of NVIDIA DCGM Exporter on AI/GPU servers; Lava researchers found ~2,100 exposed GPU servers across ~300 organizations, including neocloud providers like Nebius, Lambda, Voltage Park, Northern Data, and DigitalOcean.
  • ~12,000 GPU UUIDs worth ~$100M were exposed unauthenticated over HTTP, including Blackwell Ultra B300, H200, H100, and consumer RTX 5090/4090 GPUs; 44% were in the US.
  • CVE-2026-47483 (CVSS 8.2) lets unauthenticated attackers exhaust the exporter's memory with concurrent requests, crashing GPU monitoring and potentially disrupting AI training or inference workloads.
  • ~25% of exposed DCGM hosts also leaked Go /debug/pprof/ profiling data, and 12,096 Prometheus Node Exporter hosts exposed server models, OS, firmware, and network details useful for reconnaissance.
  • Nvidia patched the flaw in DCGM Exporter version 4.8.2, released in September.
  Sources 📄 Source: lava.security · 📎 Coverage: theregister.com · 👁 via r/netsec

• 764 leader Prasan Nepal pleads guilty to conspiracy to sexually exploit minors
  Prasan Nepal, leader of the violent extremist network 764, pleaded guilty to conspiracy to sexually exploit minors and faces 15 to 30 years in prison.

  • Prasan Nepal, 21, of High Point, North Carolina, known online as "Trippy," led the nihilistic violent extremist network 764 and its inner subgroup "764 Inferno" from 2021 through April 2025.
  • Nepal and co-defendant Leonidas Varagiannis ("War"), detained in Greece, exploited at least eight minor victims, some as young as 13, across multiple jurisdictions.
  • The network used encrypted platforms to recruit members, identify vulnerable minors, and coerce victims into producing CSAM, self-harm, animal cruelty, and acts of violence.
  • Membership required recruits to produce abusive "content"; CSAM and gore were compiled into digital "Lorebooks" traded as currency in encrypted "vaults" to gain status.
  • Nepal pleaded guilty Thursday in U.S. District Court in Washington before Judge Reggie B. Walton, with sentencing set for March 5, 2027; prosecutors listed 22 additional alleged co-conspirators.
    📄 <https://www.justice.gov/usao-dc/pr/leader-global-violent-extremist