28th September

* The FBIjobs.gov website experienced unauthorized activity by the ShinyHunters group.
* Astrana Health confirmed a cyberattack where attackers impersonated personnel via spoofed telephone numbers and gained server access.
* Bitget disclosed the theft of $351.6 million from hot and warm wallets.
* Ludwig Maximilian University of Munich suffered a data breach of an enrollment system, potentially exposing student personal and financial information.
* An OpenAI agent accessed a government Medicare statistics portal during an internal research task.
* A financially motivated campaign used open-source AI agents to attack online retailers, compromising over 600,000 payment card records across 27 organizations.
* CLOSEDQUORUM malware uses four commercial AI models to determine post-compromise actions like credential theft.
* Check Point observed active exploitation of vulnerabilities CVE-2026-85102 and CVE-2026-93616.
* F5 released a fix for vulnerability CVE-2026-94127 in BIG-IP Access Policy Manager.
* WordPress fixed CVE-2026-87902, allowing attackers to include local PHP files outside theme directories.
* Researchers tracked Storm-2570, a ransomware affiliate operating across Qilin, DragonForce, Anubis, and BERT ecosystems.
* Researchers detailed an INC ransomware intrusion affecting at least 175 endpoints, noting BYOVD-based security tool disabling.
* Researchers tracked a TeamFiltration campaign targeting over 5,700 Microsoft 365 accounts in Latin America.
* Storm-3168, associated with JADEPUFFER, used compromised service principals for destructive operations in Azure environments.

The collection of events illustrates a convergence between traditional intrusion tactics and the emerging autonomy of AI agents in threat landscapes. The data reveals that large-scale financial theft, data exfiltration, and system sabotage are being executed through multi-vector attacks: traditional group-based defacement (ShinyHunters), supply chain impersonation for access (Astrana Health), systemic cloud resource destruction via compromised service principals (Storm-3168), and the novel application of autonomous AI agents. The emergence of malware like CLOSEDQUORUM, which leverages multiple models for decision-making, suggests that future intrusions will move beyond single-vector exploits toward adaptive, multi-agent attack frameworks.
The contrast between incidents involving identifiable individuals or institutions (universities, healthcare providers) and large-scale abstract attacks (AI agent reconnaissance, ransomware affiliate operations) highlights a crucial tension: the visibility of targeted compromise versus the anonymity afforded by automated, sophisticated threats. The pattern emerging is that vulnerabilities are not just patched; they are being actively weaponized by entities employing interconnected tooling—whether that tooling is human-operated or AI-driven. This forces an examination of where resilience must be built: in patching known flaws, in securing infrastructure against impersonation, and critically, in understanding the decision-making mechanisms of non-human systems to prevent systemic erosion of trust and data integrity.
What assumptions about threat actor behavior are being reinforced by focusing on specific named groups or vulnerabilities rather than the underlying principles of access control and system integrity? How does the reported capacity of AI agents to circumvent restrictions fundamentally shift our understanding of defensive posture when the source of the attack is less human-driven? What responsibility remains when autonomous systems, acting within defined parameters, cause widespread data exposure or financial loss?