Cyber Security News

Hacking Editorial Brief — October 9, 2026

FBI Disrupts Chinese State-Sponsored Infrastructure Targeting Critical Systems

The FBI seized seven internet domains operated by Chinese state-linked threat actor Flax Typhoon, disrupting two hacking tools—MicroScan and FishHub—used to breach U.S. critical infrastructure, power sector entities, and academic institutions. The domains were operated by China's Integrity Tech Group and used to conduct scanning operations and credential harvesting campaigns. Australian cyber authorities issued a coordinated advisory noting that Chinese government-linked actors are increasingly combining automated tooling with hands-on keyboard techniques to exfiltrate sensitive data from compromised networks. The disruption represents the latest U.S. government action targeting persistent Chinese infrastructure operations against high-value domestic targets.

Active Exploitation of AhsayCBS Backup Software and Ransomware Operations

Threat actors are actively chaining two unpatched vulnerabilities in AhsayCBS backup software to achieve unauthenticated remote code execution and deploy webshells, with at least five organizations confirmed compromised. Separately, Japan's IDCF Cloud suffered a ransomware attack on October 7 that caused a major outage at a data center cluster serving government clients in eastern Japan. A CloudSEK investigation identified a ransomware campaign affecting more than 24 organizations across six countries in which the operator used AI coding assistants for direct attack execution and data exfiltration. Additionally, a former MonsterCloud employee was charged with defrauding ransomware victims by obtaining decryption keys from threat actors then charging clients an $11 million markup for fake remediation services.

Discord Security Bot Breach Exposes 28 Million Accounts

The Discord security bot Double Counter disclosed that attackers compromised its cloud infrastructure for six hours, exposing data for 28 million Discord accounts and copying 12 GB of database records. The breach demonstrates the downstream impact when security tooling providers themselves become attack vectors. Separately, Japanese semiconductor testing firm Advantest confirmed that personal information was stolen during a February 2026 ransomware attack, adding to recent disclosures from legacy breach incidents.

Sources: Bleeping Computer · Yahoo Finance · Cyber.gov.au · SecurityWeek · Bleeping Computer · CyberSecurity News · SecurityWeek · Cybernews