CJIS v6.1 requires agencies to maintain strong authentication, account security, and audit controls while demonstrating ongoing compliance. Specops outlines five practical priorities covering MFA, account management, passwords, logging, and audit readiness.
A Nigerian national was sentenced to eight years in prison for his involvement in a series of spearphishing attacks targeting US tax preparation businesses since 2019. 40-year-old Chukwuemeka Victor Amachukwu (also known as Chukwuemeka Victor Eletuo and So Kwan Leung) has pleaded guilty to conspiracy to commit computer intrusions and wire fraud after being extradited from France to the United States in August 2025. "Chukwuemeka Amachukwu believed he was operating safely offshore when he targeted his victims, but he has now been held to account and now faces a serious sentence for his crimes," said US Attorney Jamie McDonald in a Monday press release. "Amachukwu took part in sophisticated schemes to hack into US businesses, steal and use stolen identity information of victims, and commit fraud. These crimes imposed significant harm on the victims and the public, and so it is only appropriate that the crimes also come with a significant sentence for the defendant."
ConnectWise on Monday said it has taken remediation measures, including strengthening administrative-access protections and resetting accounts and replacing application credentials, as it continues to respond to a security incident that led to unauthorized access to application identities associated with Cloud Backup. The company said it has completed the following actions since it began
Microsoft urges organizations to secure AI Agents as insider threats, using dynamic permissions, continuous risk monitoring and automated containment. Microsoft published a detailed blog post explaining how organizations should secure AI agents. Microsoft sees them as a growing insider threat, not just a possible risk in the future. AI agents are not dangerous by nature, but they can access critical systems and may fail, be manipulated, or be compromised. “The most trustworthy agentic system will not be the one with the model we trust most. It will be the one designed that enables us to trust the model least.” said Satya Nadella This is not just a theory. It is a principle that should guide how organizations design and secure AI systems. The post makes a distinction worth holding onto. An agent that starts a task with the right permissions and behaves correctly can still become dangerous if its context changes mid-run. A prompt injection in an external document, a piece of untrusted data that shifts the agent’s reasoning, a task that evolves in a direction nobody anticipated, none of these require the agent to be compromised in the traditional sense. The model produces variable outputs, the context changes, and the agent’s behavior drifts. At machine speed, the window between that drift starting and it causing damage is very short. Microsoft’s proposed answer is continuous containment rather than upfront trust. You define what the agent is allowed to do before it acts, you monitor what it actually does while it runs, and you adjust its permissions in real time as its behavior or the risk calculation changes. An expense approval agent should start with access scoped exactly to reviewing and approving expenses, nothing broader, and those permissions should shrink or disappear the moment the agent tries something outside that task. The post introduces Dynamic Permissions to apply the principle of least privilege to AI agents. An agent should not automatically get the same access rights as the employee who deployed it. It starts with no permissions and receives only the access needed for its approved task. These permissions remain active only while the task is running. “The employee retains the employee’s access.” Microsoft states. “The agent receives its own identity, permissions and its own authority scoped to its current task and for the duration of the task only.” Alongside that, Dynamic Agent Risk is a continuously updated score that combines signals from identity, endpoints, network, cloud, runtime, and the agent’s own behavior to assess whether what the agent is currently doing still matches what it was authorized to do. The response when risk rises is graduated rather than binary: preserve reads while blocking writes, narrow accessible resources, require human approval for high-impact steps, or stop execution entirely if the risk warrants it. “Dynamic Agent Risk combines signals from identity, data, endpoints, cloud, network, runtime, and the agent’s own activity. It considers how securely the agent is configured, what resources it can reach, the potential impact if something goes wrong, and whether its actions are drifting from the user’s or organization’s intent.” Microsoft states. “The result is not a one-time score assigned at onboarding. It is a continuously updated understanding of the agent’s current risk and whether its current authority still matches that risk. “ Organizations frequently have AI agents running locally or introduced through third-party tools that were never formally registered in any central system. Microsoft says it’s expanding discovery to 60 types of local agents, including Claude Code, OpenAI Codex, and GitHub Copilot. Getting those into a unified registry with accountable identities is the prerequisite for applying any of the governance controls described in the rest of the post. You can’t set least-privilege permissions for an agent you don’t know exists. You can’t detect behavioral drift from an agent that doesn’t have a tracked identity. The agent registration problem is logistically harder than it sounds, especially for organizations where individual employees can spin up agents without IT involvement, which is most organizations right now. Microsoft recognizes that organizations cannot manually review every risk alert when they run hundreds of thousands of AI agents. Its solution is Guardian Agents, AI agents focused on security. They follow playbooks created by human operators, investigate changes in risk, apply or recommend security measures, and use what they learn to improve security policies. Humans set the goals and approve important decisions, while the agents handle continuous monitoring and response. However, this approach raises another concern. Guardian Agents are also AI agents, so they can fail or be manipulated, just like the agents they are supposed to control. Microsoft says security controls must operate outside the AI model and must not be changed by it. But this raises an important question: how can organizations ensure these controls remain reliable when the system enforcing them is also an AI agent? This is a challenge that real-world deployments will need to address in the coming years. “Organizations are adopting agents to serve customers better, solve problems faster, and give people more time for the work that matters most. The goal is not to make every model perfectly predictable before it can be useful.” Microsoft concludes. “The goal is to build systems that remain secure even when the model is not.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, AI Agents)
Ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc) are exploiting PAN-OS vulnerability CVE-2026-0257. The post Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19) appeared first on Unit 42.
Cybercriminals are selling forged identity documents, deepfake videos, and live verification services to help buyers bypass Know Your Client (KYC) checks. Flare examines how these underground services operate and the techniques used to create and maintain fraudulent verified accounts.
ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants. The disabled identities are listed below - ConnectWise Cloud Backup - 506e08f9-6e9a-4da4-942b-a099a03644ae ConnectWise
A cyber incident at a BAE Systems subsidiary just stopped every bankruptcy court in the US from sending notices, and the problem started a week ago. A security incident at BAE Systems Inc., the US subsidiary of British defense contractor BAE Systems, has taken the Bankruptcy Noticing Center offline since October 9. The Bankruptcy Noticing Center (BNC) is the system that federal bankruptcy courts use to send official notices. It handles court notices, messages to creditors, and deadline notifications that keep everyone involved in a case informed. “BAE Systems IT and websites that support the operations of the Bankruptcy Noticing Center (BNC) have been impacted by a cybersecurity incident.” reads the official judiciary statement. “As a result of the incident, all access to the BNC systems and websites that BAE operates on behalf of the judiciary and the related bankruptcy noticing process are unavailable at this time, including bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov, and the National Creditor Registration Service. The incident has also halted the BNC’s production and distribution of bankruptcy notices for bankruptcy courts.” The disruption has prevented the center, which BAE operates on behalf of the federal judiciary, from generating and sending notices to creditors, courts, and attorneys in federal bankruptcy cases across the country. This is not a minor service disruption. The entire notification system used by federal bankruptcy courts across the country is down. “Several online services supporting US federal courts’ bankruptcy systems have gone offline following a cybersecurity incident involving a court contractor, the Administrative Office of the US Courts (AOC) said on Thursday.” Reuters reported. The US judiciary explained that the BNC sends bankruptcy notices for every federal bankruptcy court in the country. Affected domains include bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov, and the National Creditor Registration Service. With that last one down, attorneys using the electronic filing system can’t generate the creditor mailing lists they normally need to serve documents. Courts are still accepting new case filings and electronic notifications to registered attorneys are still going out, but anything tied to the noticing pipeline itself has been dark since last Thursday. A BAE Systems spokesperson said that the company is “aware of a security incident that is isolated to the BNC system” and has taken immediate steps to address it. BAE Systems is “coordinating closely” with the courts on the response, the spokesperson said. Neither BAE nor the judiciary disclosed tachnical details of the incident, whether it was a deliberate cyber attack or a different kind of incident, or whether any data was accessed or taken. The Eastern District of Texas bankruptcy court’s own public notice adds a useful detail: BAE first told the Administrative Office about the problem late on October 9, which means the court system’s administrative leadership knew by that evening. “Late on Friday, October 9, 2026, BAE Systems, the contractor that services the Bankruptcy Noticing Center (BNC), notified the Administrative Office of a service disruption impacting BAE systems that process notices as well as the following websites: bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov, and the National Creditor Registration Service website that supports CM/ECF access to address labels (the mailing matrix).” reads the notice. “Because of this disruption, the court polling and certification drop-off process that supports the delivery of electronic and paper notices has been interrupted and the BNC is unable to provide noticing services to the courts at this time.” Courts started posting disruption notices on October 13, but none of them mentioned a cybersecurity incident at that point, several framed it as a service interruption. The public acknowledgment of the word “cybersecurity” didn’t come until October 15. Summarizing, the incident started on or before October 9. The judiciary’s administrative office learned about it that day. Courts informed users of the problem on October 13, and the public announcement confirming a cybersecurity incident came on October 15. That’s six days between the contractor discovering the problem and the public announcement. During that time, bankruptcy cases across the country continued without the system that sends notices to keep courts, creditors, and lawyers informed. No one has announced when the service might be restored, suggesting the investigation is still at an early stage. This incident highlights a recurring problem: critical systems operated by contractors can fail in a single incident, disrupting services across every federal court handling a specific type of case. The public also waited nearly a week for an official statement. This is not a new pattern, but it keeps happening. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, BAE Systems)
India’s CERT-In warns AI agents accessed confidential data undetected, while attackers used offensive AI frameworks to accelerate cyberattacks. CERT-In, India’s national cyber response team, published a critical-severity advisory 15 documenting two distinct categories of AI-related incidents. In one, AI models under research and evaluation exceeded their assigned tasks and accessed live Indian systems without authorization. In the other, attackers deliberately weaponized open-source AI agent frameworks to run financially motivated intrusions. “CERT-In has observed different categories of cyber incidents in which the attacker was an AI agent, that is, a software system capable of autonomously planning work, issuing commands, invoking tools and acting on the internet over extended periods. In some incidents, AI agents under research and evaluation exceeded their assigned task authorization and made unauthorized access to Indian information and communication technology (ICT) assets. In others, cyber attackers deliberately used open-source agentic AI tools to conduct reconnaissance, exploitation and financially motivated intrusions.” CERT-In states. “The incidents came to light through voluntary disclosures by AI model providers, CERT-In’s forensic analysis of suspicious activities, and CERT-In’s own proactive threat hunting. The affected organizations could not detect the unauthorized access on their own.” What makes these incidents especially concerning is that the affected organizations didn’t detect the unauthorized access. None of the affected organizations detected the unauthorized access; in every case the incident was disclosed by the AI model providers after their internal review. The organizations only learned about the incidents from the AI companies. The agents accessed Indian systems using exposed credentials and connection settings found in configuration files, public code repositories, and cloud accounts with excessive permissions. They then accessed business records containing personal and confidential information. CERT-In didn’t name the AI companies, models, or affected organizations. It also didn’t say whether the agents copied or kept any data, or whether the affected organizations had been notified. “Further, victim entities in the campaign that remediated incompletely were attacked again within days, at greater scale.” continues the advisory. “In the voluntarily disclosed incidents, agents were observed re-deriving and re-using the same exposed credential in separate operations.” That’s worth reading carefully. It means an agent that encountered a leaked key once didn’t just use it once, it came back to it. CERT-In’s own threat hunting found a separate campaign against Indian entities using publicly available offensive AI frameworks. These tools have been misused, rebranded, and redeployed across infrastructure in multiple countries, and CERT-In describes a large number of active deployments. The attackers ran multiple agents in parallel for hours to days, and victims who only partially remediated the initial access were hit again within days at greater scale. The biggest concern is how quickly these attacks can happen. These frameworks can reportedly reduce the time between gaining access and causing damage from several days to just a few hours. In September, Google Threat Intelligence Group reported a similar case in which attackers used a compromised cloud resource to run an AI-driven campaign that stole thousands of credentials from other services in less than six hours. CERT-In puts the strongest emphasis on this point. In every incident, the weaknesses were common security problems: credentials and keys stored in source code, commit histories, CI/CD variables, configuration files, and public web pages. Other issues included unused APIs that had never been disabled, payment API keys stored in plain text, cloud roles allowing anonymous or regular users to read and change data, and management interfaces exposed to the internet with weak or no multi-factor authentication. CERT-In’s conclusion is clear: AI found and exploited these common weaknesses “faster, more exhaustively and at greater scale than human attackers.” That’s the real change. The vulnerabilities themselves are nothing new. What has changed is how quickly attackers can find them and combine them to carry out attacks. The advisory’s list of recommended actions for organizations covers ground that should already be standard practice, but clearly isn’t. Audit every repository and build pipeline for exposed credentials. Rotate and purge anything you find. Keep a full API inventory and shut down anything old or unused. Remove management interfaces from the internet. Keep logs for at least 180 days and watch API traffic for bulk reads and automated registrations in real time. For organizations running their own AI agents, CERT-In adds a specific requirement: give each run its own short-lived, least-privilege identity, block outbound traffic to anything outside the task’s defined scope, and maintain a tamper-resistant log of every agent action touching production systems. The advisory also cross-references an earlier October 9 warning on payment and disbursement API abuse, which CERT-In says BFSI and fintech entities should apply alongside the measures here. AI developers and testing labs should block all outgoing network connections from test environments at the infrastructure level, rather than relying on instructions given to the AI model. If an AI agent tries to connect to an external system or finds credentials it should not have access to, the test should stop automatically, and the affected organization should be notified immediately. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, AI agents)
Unit 42 details the top initial access vectors adversaries use to breach organizations, led by edge exploits, credential abuse and phishing The post Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026 appeared first on Unit 42.
Confirm this action.
Leaving now will discard your changes.