Cyber Security News

Hacking Editorial Brief — October 20, 2026

AI-Driven Attack Campaign Expands from South Korea to Japan and Global Targets

The ARTEX-based campaign previously reported against South Korean financial institutions has expanded significantly, with Bloomberg confirming the same Chinese-developed AI tool was used to breach major Japanese companies including GMO Internet Group. Separately, Reuters documented a Chinese-speaking threat actor who used autonomous AI agents—specifically DeepSeek and Claude Code—to compromise over 100 companies globally, including John Deere and SharkNinja, at an average cost of $50 per breach. The actor conducted more than 1,200 automated break-in attempts with minimal human involvement, assigning reconnaissance and exploitation tasks directly to AI models. This represents confirmation of operational AI agent deployment across multiple concurrent campaigns, with the low cost-per-breach and minimal operator involvement demonstrating a fundamental shift in attack economics. Ransomware operators are now using generative AI to accelerate reconnaissance phases and prioritize high-value data for theft and disclosure, according to separate reporting on ransomware tactical evolution.

Palo Alto Networks Firewall Vulnerability Under Active Ransomware Exploitation

Unit 42 confirmed active exploitation of PAN-OS authentication bypass vulnerability CVE-2026-0257 by ransomware groups Spikey Scorpius (Qilin) and Tarnished Scorpius. The vulnerability allows unauthenticated attackers to bypass authentication on affected firewall management interfaces. Unit 42's October 19 update to its threat brief indicates ongoing exploitation targeting enterprise perimeter defenses, though specific victim counts and attack timelines were not disclosed. The exploitation follows established ransomware operational patterns of weaponizing firewall and VPN vulnerabilities for initial access to corporate networks.

Critical Infrastructure and Application Security Incidents

Check Point Research disclosed two critical vulnerabilities in the LiteLLM AI gateway—CVE-2026-35029 and CVE-2026-59823—that enable administrative takeover or remote code execution. An anonymous hacker group claims access to 375,000 State Bank of India customer records in an unconfirmed data breach. Recruitment platform Bullhorn is responding to a cyber incident affecting operations in Australia, the UK, and the US, warning customers of targeted social engineering attacks during the breach response. NSO Group avoided contempt proceedings despite WhatsApp allegations of continued exploitation activity, according to October 19 court filings.

Sources: Bloomberg · Chosun · GBHackers · GBHackers · Unit42 · Check Point Research · Cybersecurity Connect · Law360