Bare Metal Cyber

Bare Metal Cyber Magazine Weekly Roll-Up — Week ending 2026-10-09

This week’s roll-up opens with a cloud ransomware outage that disrupted hundreds of companies and local governments in Japan, showing how one provider incident can spread across many operations. A sweeping FortiGate campaign also shows the danger of stolen privileged credentials, persistent administrator accounts, and ransomware access at the network edge. In Denmark, misuse of a trusted company’s registry access exposed identity data tied to millions of people. The issue also tracks active NetScaler compromises that can outlive patching and attacks against self-hosted Atlassian systems within hours of disclosure. Together, these stories make one theme clear: resilience depends on third-party access, edge identities, rapid patching, and recovery plans being tested before a crisis. Direct story links are collected at the bottom of the article. Read the issue and turn the week’s signals into action.

Japan cloud ransomware outage disrupts 495 organizations
A ransomware attack disrupted cloud services used by 495 companies and local governments in Japan. The operator isolated and shut down systems in an eastern Japan data center cluster after the attack began. Management consoles across all regions were also disabled while security checks continued. The intrusion route and full operational impact remain under investigation.
What this means: The outage can prevent customers from managing virtual servers, storage, networks, websites, applications, and business systems. For leaders: shared cloud infrastructure can concentrate operational risk across hundreds of organizations at once. For defenders: validate independent backups, recovery access, and continuity procedures that do not depend on the affected management console. Watch for failed console access in administrative logs and backup-job failures in recovery systems. Claims that databases, virtual machine disks, and snapshots were damaged remain unverified. The larger lesson is that cloud resilience must account for provider-wide control restrictions, not only individual workload failure.
Recommendation: Inventory affected dependencies, activate continuity plans, and verify recoverable backups outside the impacted environment.

Stolen FortiGate access locks out admins and fuels ransomware
Organizations are losing administrative control of exposed FortiGate firewalls and VPN gateways. Attackers are using stolen or leaked credentials, cracking harvested password hashes, and creating new administrator accounts. Some attackers delete existing accounts or change their passwords to lock out legitimate teams. More than 86,000 devices across 194 countries were estimated to be compromised. The access has also been linked to ransomware affiliates.
What this means: Valid credentials let attackers bypass defenses that focus only on software weaknesses. For leaders: an overlooked identity failure at the network edge can become operational disruption and a ransomware incident. For defenders: recover control of affected appliances, terminate active sessions, reset credentials, and check connected networks for lateral movement. Watch for new administrator accounts and password changes in appliance audit logs, plus unfamiliar sessions in authentication records. Patching alone is insufficient when persistent accounts and stolen credentials remain usable. The larger lesson is that edge-device identities require the same protection and monitoring as other privileged enterprise accounts.
Recommendation: Restrict external access, reset privileged credentials, enforce phishing-resistant authentication, and investigate every unauthorized administrative change.

Denmark registry breach exposes data tied to 8.8 million people
Personal data tied to approximately 8.8 million people was accessed through Denmark’s national population registry. Attackers misused a private company’s legitimate authority to look up registry information. Exposed records included names, addresses, personal identification numbers, and other details. The affected population included current residents, people who moved abroad, and deceased people. The company’s access was blocked while police investigated.
What this means: Authoritative registry data can make fraud, impersonation, and social engineering unusually convincing. For leaders: third-party access to sensitive national data needs the same scrutiny as direct internal access. For defenders: monitor partner queries for enumeration, unusual lookup patterns, and sudden increases in volume. Watch for abnormal searches in registry audit logs and related impersonation reports in fraud or helpdesk systems. Accurate personal details may let malicious messages establish trust before requesting money or more information. The larger lesson is that legitimate access can become a population-scale breach path without exploiting the registry itself.
Recommendation: Audit third-party registry access, investigate unusual query volumes, and warn affected people to verify unsolicited communications independently.

NetScaler attacks disrupt remote access and leave hidden control
Remote access services can be repeatedly knocked offline, while compromised NetScaler appliances may retain hidden attacker control. Reports during the week described crashes on exposed SAML configurations and command execution against vulnerable appliances. Attackers were observed deploying web shells, creating privileged accounts, and collecting configuration data. The crash-causing issue was added to the exploited-vulnerability catalog, although code execution through that specific issue remained unconfirmed. Supported fixes are available, but patching alone may not remove persistence.
What this means: NetScaler gateways often stand between external users and important internal applications. For leaders: repeated outages or hidden control of a gateway can interrupt work and expose trusted routes into the organization. For defenders: install supported fixes, preserve evidence, and examine appliances for persistence, account changes, and configuration theft. Watch for unexplained crashes in system logs and unexpected files or privileged accounts in appliance records. Failed authentication entries do not prove that malicious commands failed, and missing payloads do not rule out earlier access. The larger lesson is that actively exploited edge devices require incident response as well as maintenance.
Recommendation: Apply supported fixes immediately and investigate affected appliances for persistence, stolen configurations, and unauthorized accounts.

Sensitive Atlassian files face attacks within hours of disclosure
Sensitive files on self-hosted Atlassian systems faced active access attempts within roughly two hours of technical details becoming public. The weakness affects eight Data Center products, including Confluence, Jira, Bitbucket, Bamboo, and Crowd. An unauthenticated attacker who knows a file’s exact name and path can read it from the application’s web root. Exposed configuration files may contain credentials, tokens, or keys. Atlassian patched its cloud services, while affected self-hosted systems require customer action.
What this means: One exposed configuration file can turn limited file access into administrative control or a wider breach. For leaders: internet-facing collaboration and development platforms now have a sharply compressed response window. For defenders: patch every affected node, restrict external access if delayed, and review requests matching published traversal patterns. Watch for unusual file paths in web logs and unexpected use of exposed credentials in identity or application records. Cloud customers do not need to act on this self-hosted product issue. The larger lesson is that public technical details can shrink practical patch windows from days to hours.
Recommendation: Patch every affected Data Center node now or remove it from external access until documented controls are active.

FBI disrupts China-linked attacks on critical infrastructure
Seven domains supporting China-linked hacking platforms were seized during a law-enforcement disruption. One platform supported vulnerability scanning, while another enabled phishing, malware delivery, remote access, and data theft. The activity targeted government, healthcare, technology, education, manufacturing, law enforcement, and critical infrastructure. Investigators found files belonging to more than 20 organizations on a linked server.
What this means: Removing known infrastructure can disrupt operations without proving that every associated intrusion has been contained. For leaders: organizations in targeted sectors should treat broad scanning as a possible precursor to compromise. For defenders: review the published indicators, patch exposed systems, disable unnecessary services, and strengthen multifactor authentication. Watch for the identified infrastructure in network logs and unusual scanning or login activity on internet-facing systems. Successful breaches were confirmed at two Taiwanese universities, but not at every named infrastructure target. The larger lesson is that contractor-supported attack ecosystems can combine automation, botnets, phishing, and hands-on exploitation.
Recommendation: Review the available indicators and prioritize exposed systems that match the attackers’ known techniques.

Pentagon breach creates long-term identity risk for millions
Millions of people face continuing identity and impersonation risk after unauthorized users accessed a Defense Manpower Data Center system. The incident affected 2.76 million living people and approximately 294,000 deceased individuals. Access reportedly continued from October 2025 until July 2026 through a file-sharing weakness. Exposed unencrypted records may include Social Security numbers, birth dates, contact details, demographic data, and military occupational information.
What this means: The exposed identity fields can retain value for fraud, phishing, impersonation, and counterintelligence for years. For leaders: short-term support does not remove the long-term consequences of losing durable personnel data. For defenders: strengthen file-sharing access controls, encryption, logging, and exposure reviews around bulk workforce records. Watch for unusual bulk downloads in file-sharing logs and identity abuse in fraud-monitoring or account-recovery systems. Affected people are being offered one year of monitoring and identity-restoration services. The larger lesson is that the risk window for permanent identity data lasts far longer than the original intrusion.
Recommendation: Treat the exposed personnel records as a long-term identity risk and maintain monitoring beyond the offered support period.

Old SharePoint gaps drive ransomware into critical services
Water, telecom, government, and university organizations remain exposed to ransomware through SharePoint weaknesses disclosed more than a year ago. Warlock operators recently hit at least four organizations across Europe, Africa, and Latin America. Attackers used unpatched on-premises SharePoint servers for entry and then expanded through Windows domains. In one critical-infrastructure intrusion, security tools were disabled across at least 40 hosts. Ransomware was deployed to at least 33 systems.
What this means: An old internet-facing application gap can become a route to widespread disruption when joined to trusted administrative systems. For leaders: delayed remediation can turn technical debt into interruption across essential operations. For defenders: inspect SharePoint exposure, domain administration, security-tool failures, tunneling services, and replicated files as one attack path. Watch for webshell activity in SharePoint or web-server logs and unexplained security-tool failures across endpoint consoles. Stolen machine keys and trusted administration mechanisms can help attackers continue after initial access. The larger lesson is that known weaknesses remain valuable when attackers can connect them to privileged enterprise systems.
Recommendation: Patch or mitigate on-premises SharePoint and hunt for post-compromise activity before declaring the exposure closed.

Country-code registry breaches enable trusted website impersonation
Attackers gained the ability to impersonate legitimate websites after compromising operators for three country-code domain registries. They changed authoritative domain records under .gh, .sl, and .as. The attackers also obtained valid HTTPS certificates, including certificates for several Google domains. Google said its own systems were not breached and encryption was not broken. Other brands and online services were also believed to be affected.
What this means: A browser padlock does not prove that a destination is legitimate when attackers control domain records and valid certificates. For leaders: trust in online services depends on registry and certificate infrastructure outside the organization’s direct control. For defenders: monitor authoritative domain records, certificate issuance, and unexpected changes affecting important brands and services. Watch for unauthorized certificates in transparency monitoring and unexplained record changes in DNS administration logs. Identified certificates were blocked and revoked, but not every affected domain may have been found. The larger lesson is that web identity can fail below the application layer even when encryption works as designed.
Recommendation: Enable certificate and domain monitoring for important services and investigate unauthorized issuance or record changes immediately.

South Korean bank breaches expose customer and worker data
Customer and worker information was exposed across several South Korean financial institutions. Incidents affected banks, savings banks, a capital company, and connected lending or support services. Reported data included contact details, income, loan limits, addresses, employer information, and national identification numbers. Some affected systems were separate from core internet and mobile banking platforms. Authorities launched investigations and directed financial companies to strengthen monitoring and reporting.
What this means: Peripheral financial systems can support fraud and targeted phishing even when core banking services remain intact. For leaders: customer protection, compensation, and trust may become significant operational issues across multiple institutions. For defenders: map sensitive data in partner, employee, broker, and support tools, then review abnormal access across shared infrastructure. Watch for unusual portal activity in support-system logs and tailored scam reports through customer-service channels. References to an AI testing tool appeared during the investigation, but its role and any common attacker remained unconfirmed. The larger lesson is that secondary systems can hold primary business risk.
Recommendation: Review connected financial support systems, contain abnormal access, and verify which sensitive records each service stores.

Developer secrets exposed by a compromised Tensorlake package
A malicious Tensorlake package release could steal developer secrets and spread risk through connected software supply chains. Version 0.5.144 ran an obscured installation script that searched for cloud, GitHub, deployment, SSH, container, browser, wallet, and secret-management data. The package had more than 100,000 lifetime installs, although that does not show how many systems received the compromised version. Other analyzed distribution channels showed no compromise. Any workstation, build runner, or server that installed the malicious release should be treated as compromised.
What this means: One poisoned dependency can expose development, cloud, publishing, infrastructure, and financial assets at the same time. For leaders: a package compromise can turn trusted developer access into a route toward customers and downstream projects. For defenders: isolate affected systems before rotating credentials, then rebuild from known-good files and review publishing activity. Watch for version 0.5.144 in package or build logs and unexpected credential use in cloud or repository audit records. The malware reportedly includes a destructive trigger connected to token revocation, making response sequencing important. The larger lesson is that stolen developer access can become the starting point for another supply-chain infection.
Recommendation: Isolate systems with version 0.5.144, preserve evidence, and rotate exposed credentials from a clean device.

Developer access turns into cloud exposure through GitHub workflows
Stolen developer access is being used to place credential-stealing automation inside public repositories. The latest GhostAction wave compromised 772 repositories across 373 GitHub users and organizations. Malicious workflows targeted 2,577 cloud keys, SSH credentials, registry logins, database passwords, and platform tokens. Some files survived from earlier activity and were later updated with new collection infrastructure.
What this means: One compromised developer identity can expose build systems, cloud accounts, package registries, and downstream environments. For leaders: removing a malicious file does not eliminate the business risk created by stolen access and secrets. For defenders: revoke compromised GitHub access, review workflow changes and runs, and rotate every reachable credential. Watch for unexpected workflow commits in repository audit logs and unusual secret use in cloud or platform records. Only 124 of the 772 affected repositories had been effectively cleaned in public commit history as of October 5. The larger lesson is that software delivery security depends on identity control, workflow review, and rapid secret rotation.
Recommendation: Revoke compromised access, remove malicious workflows, audit their runs, and rotate every secret they could reach.

GitHub users face malware across 17,610 FakeGit repositories
The FakeGit campaign returned with 17,610 GitHub repositories distributing SmartLoader and the StealC information stealer. More than 13,000 repositories were redirected in 34 hours. Convincing download buttons in repository documentation steered visitors toward malicious archives. At least 700 accounts appeared to belong to legitimate developers. Malicious files also remained available through forks, releases, older content, and issue attachments.
What this means: Developers searching for tools, AI skills, or server components may encounter malicious repositories that appear established and credible. For leaders: trusted development platforms can become large-scale malware delivery channels without the platform itself being breached. For defenders: restrict installations to verified sources and investigate unexpected downloads initiated from repository pages. Watch for repository-driven archive downloads in browser records and SmartLoader activity in endpoint telemetry. Deleting one visible link does not remove copies held in forks, releases, or attachments. The larger lesson is that platform reputation cannot replace verification of repository ownership and software origin.
Recommendation: Restrict installations to verified sources and investigate unexpected downloads initiated from repository documentation.

Helpdesk breach reaches full server control in seconds with AI
A helpdesk breach gave an intruder full server control within seconds after an AI agent chained two previously unknown Zammad weaknesses. The attack hijacked a session, executed code as the service account, and escalated to root. The intrusion was detected the next day, and data-center access was blocked. Volunteer email addresses were confirmed stolen, while possible exposure of support correspondence and research remained under investigation. A later public demonstration showed how active sessions could be stolen and used for server access.
What this means: Helpdesk systems can contain customer details, operational discussions, credentials, and sensitive security reports. For leaders: automated attacks can move from initial access to full control faster than manual escalation procedures. For defenders: preserve logs, update affected systems, rotate accessible credentials, and treat compromised hosts as fully controlled. Watch for service accounts launching command shells in endpoint records and unusual session or WebSocket activity in application logs. A stolen session can bypass passwords and multifactor authentication by reusing an existing login. The larger lesson is that automation compresses response time while session theft weakens otherwise strong identity controls.
Recommendation: Update affected Zammad systems, preserve evidence, and rotate every credential accessible from compromised hosts.

Exposed AI servers become cryptomining and attack launchpads
More than 3,400 exposed servers were compromised by malware that mines cryptocurrency and searches for additional victims. The campaign targets AI services including LiteLLM and Ollama, along with Gotenberg and Gitea systems. Infected machines derive changing command-server addresses from selected words in a poem hosted on GitHub. They also scan and attempt to exploit other internet-facing systems.
What this means: Poorly protected AI infrastructure can consume resources, provide remote access, and help a botnet expand. For leaders: rapid AI deployment can add powerful but weakly governed servers to the organization’s attack surface. For defenders: remove unnecessary public exposure, apply available fixes, restrict trusted sources, and investigate compromised hosts. Watch for unexplained processor spikes or mining processes in server telemetry and outbound scanning in network logs. Most reported victims were in the United States and Western Europe. The larger lesson is that AI services need the same segmentation, monitoring, exposure management, and patch discipline as other production systems.
Recommendation: Remove unnecessary public exposure and investigate affected AI servers for cryptomining, remote access, and outbound scanning.

That’s this week’s Bare Metal Cyber Magazine Weekly Roll-Up. If this helped you decide faster, pass it along to a teammate. For more newsletters, audio courses, videos, and merch, visit BareMetalCyber.com. See you next week.