Featuring: Cybersecurity is being reshaped by the expansion of cloud infrastructure, AI, distributed systems, and increasingly complex digital environments. As organizations manage more identities, devices, data, and internet-facing infrastructure, security is shifting toward continuous visibility, control, and the ability to respond to risk at scale. This report examines how core areas of
The suspected China-linked threat actor known as Warlock is still continuing to weaponize Microsoft SharePoint vulnerabilities, likely both old and new, in attacks targeting organizations in Portuguese- and Spanish-speaking countries. The activity, observed by the Symantec and Carbon Black Threat Hunter Team, has hit critical infrastructure, government, and education organizations. "In the
The China-linked ransomware group Warlock targeted a water utility, a telecom provider, a regional government body, and a university by exploiting SharePoint vulnerabilities to gain initial access. Over the past two months, the threat actor appears to have focused on countries speaking Portuguese and Spanish across Europe, Africa, and Latin America. The gang emerged in June 2025 and gained notoriety a month later after exploiting a chain of zero-day vulnerabilities in Microsoft SharePoint known as ToolShell (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771). By August, Microsoft observed state-backed hacking groups Linen Typhoon and Violet Typhoon using ToolShell exploits in attacks, along with a ransomware threat actor the company tracks as Storm-2603. Cybersecurity company Symantec identifies the same actor as Longlegs and attributes the development of the Warlock ransomware to the group.
On Thursday, unknown attackers hijacked the official Microsoft account on X, which has over 13 million followers, in what appeared to be a pump-and-dump scheme promoting a crypto token. The attack began when the Microsoft account (@Microsoft) followed and reposted a tweet from another now-suspended X account (@clippymsftcto) impersonating Microsoft's Clippy virtual assistant, The Verge first reported. While @clippymsftcto has been suspended, another X account (@ClippyMSFT) that reposted Microsoft's tweet is still promoting a $Clippy crypto token, claiming that it has "has a liquidity pool paired directly with $MSFT." Microsoft has since removed the attackers' posts and confirmed the incident, saying it's investigating the circumstances. "We have confirmed unauthorized access to our account on X including posts that did not come from Microsoft," a Microsoft spokesperson told The Verge. "The account has been secured and the unauthorized posts have been removed, and we are continuing to investigate the circumstances."
The quarterly board meeting is two weeks out. The security team is pulling exports from the identity provider, the cloud posture tool, the vulnerability scanner, the SIEM and the EDR console. Someone is building a spreadsheet to reconcile them. Someone else is turning that spreadsheet into slides. Then a board member asks three questions: How secure is the organization, overall? What is
Operation KillSwitch: Europol says the KillSec ransomware group, allegedly led by a 16-year-old, was dismantled after attacks on about 1,000 victims. Law enforcement seized control of KillSec ‘s dark web leak site, the Tor website the group used to threaten victims with publishing stolen files unless they paid up. That single action locked down more than 110 terabytes of stolen data, cutting off further unauthorized access. Full details are in Europol’s release. The takedown was part of Operation KillSwitch, led by German authorities. Investigators are looking into around 1,000 suspected attacks worldwide and believe the group’s main operator is just 16 years old. Three suspects were arrested and police searched eight properties in Greece, Romania, Spain, and the UK. “On 30 September 2026, law enforcement took control of KillSec’s leak site, securing at least 110 terabytes of data against further unauthorised access.” reads the press release published by EUROPOL. “KillSec stole sensitive data by exploiting vulnerabilities and poorly secured access points to organisations’ systems. Around 500 of the suspected attacks have so far been identified as successful. This figure may change as investigators examine the evidence seized during the operation.” KillSec has been active since around 2024. The group broke into systems by exploiting software flaws and weak security, often targeting cloud storage. After stealing sensitive data, they posted victims on their leak site and demanded payment to keep the data private. Investigators are looking into around 1,000 suspected attacks, with about 500 already confirmed. The number could change as police examine the seized evidence. In some cases, the group received ransom payments. What stands out is the tooling: investigators found the group used AI to build and maintain its ransomware infrastructure and to help pick out potential victims. Ransomware crews adopting AI for target selection isn’t exactly a plot twist at this point, but seeing it confirmed in a law enforcement operation is still worth noting. The suspected main operator is 16 years old. Another suspect, believed to be a developer, turned 18 in August 2026 and was under 18 when some of the alleged crimes happened. Investigators also found people who may have worked as a negotiator and an affiliate. The investigation is still ongoing. The case also shows a growing trend in cybercrime: some complex ransomware operations are being run by very young people. “The coordinated action targeted both the people behind KillSec and the systems they relied on. Authorities carried out eight house searches in Spain, Greece, Romania, and the United Kingdom, made three provisional arrests, and seized evidence and assets.” continues the press release. Police brought five central servers under their control over the course of the investigation, including the systems used to manage KillSec’s operations and store stolen victim data. They also seized the group’s domains and redirected visitors to a law enforcement notice instead. Authorities are now working through seized devices, tracing cryptocurrency, and following up on evidence that could surface more victims and more people involved. Ten countries took part in the operation: Belgium, Finland, Germany, Greece, the Netherlands, Romania, Spain, Switzerland, the UK, and the US. Europol and Eurojust also supported the investigation. Europol shared intelligence and helped investigators work together, while Eurojust helped coordinate the legal side. Europol also helped organize the action across countries. In total, police made three arrests and searched eight properties in four countries at the same time. Eurojust’s role was judicial coordination, getting authorities across jurisdictions to align on identifying suspects and tracking financial trails. Europol also ran a coordination center to make sure the action happened simultaneously across every country involved. Pulling off three arrests and eight searches at the same time, across four countries, isn’t a small logistics problem. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, KillSec Ransomware)
An international law enforcement operation dubbed “Operation KillSwitch” seized the KillSec ransomware gang’s data leak site and servers, led to three arrests, and identified a 16-year-old as the group’s alleged administrator. The coordinated law enforcement action was carried out on September 30, involving authorities from Belgium, the United States, Finland, Germany, Greece, the Netherlands, Romania, Spain, Switzerland, and the United Kingdom. Europol and Eurojust also took part in the investigation, along with cybersecurity companies Bitdefender and Group-IB. "The action was part of Operation KillSwitch, an international investigation led by German authorities into around 1,000 suspected attacks worldwide," says Europol. "Investigators identified a 16-year-old as the group’s suspected main operator. Three suspects were provisionally arrested and eight properties searched in Greece, Romania, Spain, and the United Kingdom. Authorities also targeted the group’s criminal proceeds."
Zero Trust can verify users once they are established, but onboarding creates a gap where organizations must decide who to trust before strong authentication exists. Specops explains why identity verification should begin before credentials, MFA methods, and access are issued.
Google unveils Gemini 4 Argon, a frontier AI model built for coding, enterprise work, and autonomous cybersecurity defense, rolling out to trusted testers. Google announced Gemini 4 Argon, and it’s not going straight to the public. It’s rolling out first to a set of trusted cyber defenders through what Google calls the Fairwind Program, which tells you something about where the company thinks this model’s sharpest edge actually is. Argon is priced to start at $2 per million input tokens and $10 per million output tokens, with cached inputs at a 95% discount, before jumping to $4 and $20 once the introductory window closes. More interesting than the price is the output limit: 1 million tokens, up from 64,000 on the previous generation. It means the model can keep reasoning through a genuinely long, complicated problem in one continuous pass instead of getting cut off mid-thought. “To support Gemini 4 Argon’s capabilities across longer, more complex use cases, we are significantly expanding the model’s output token limit to an industry-leading 1M tokens, up from the previous 64K tokens.” reads the announcement. “When the model has the headroom to think deeply and generate hundreds of thousands of tokens in a single trajectory, it adds a new level of depth in reasoning to solve tough problems in one go.” Google engineers are already using Argon internally, with some impressive results. In one case, Argon helped quantum computing researchers optimize a resource-heavy process and improve the published baseline by 40% in just a few minutes. In another, Argon agents analyzed data from Google’s data centers and found memory optimizations that freed more than 300 TiB after deployment. Google estimates there could be another 500 TiB to 1 PiB of savings. Argon is also being used to rewrite C and C++ code in Rust. This includes Google’s Fuchsia Zircon kernel, which has more than 800,000 lines of code. For the open-source libgav1 video decoder, Argon replaced 32,000 lines of SIMD code through repeated testing and compiler analysis. The new version runs 2.7 times faster than the previous Rust version, produces the same video output, and remains memory-safe. On benchmarks, Argon tops DeepSWE v1.1 at 77.9% for long-horizon software engineering, leads the Vals Index across finance, legal, and tax work, and ranks first on Zapier’s AutomationBench at 51.3%. It also posts a state-of-the-art 91.7% on LVBench, a benchmark for understanding long video, which matters more than it sounds for any workflow that involves parsing hours of footage or a stack of visual documents instead of clean text. Cybersecurity is one of the main areas where Google is focusing Argon. For trusted security teams and Google’s own engineers, Argon runs without its usual cyber safety restrictions. This allows it to actively look for vulnerabilities that defenders can then fix. Wiz is already using Argon through its Scan for Good program, which looks for serious vulnerabilities in public systems and fixes them for free. Argon found a critical flaw in healthcare software used by hospitals worldwide that could expose personal data. Earlier AI models had examined the same issue but failed to find it. On CWE-bench v1, a test that measures how well AI models can fix vulnerabilities, Argon scored 68%, tying for first place. None of this means Google is releasing a model that can autonomously hack things and calling it a day. Before any broader rollout, the company says it’s hardening defenses on four separate fronts: blocking misuse for cyber or CBRN attacks while still allowing legitimate dual-use research, improving resistance to indirect prompt injection, where hidden instructions try to hijack the model’s behavior, and sealing off the sandboxed environments used for high-risk training and testing before anything risky happens inside them. “Argon is also our most resilient model yet against indirect prompt injections, where malicious instructions or context are used to hijack a model’s behavior.” Google states. “These are complex attacks that require constant vigilance and multiple layers of defense. Through automated red teaming and adversarial training, Gemini 4 Argon is leading in prompt injection robustness on the Gray Swan’s Indirect Prompt Injection (IPI) benchmark.” The misalignment piece is the one that actually says something about how seriously Google is taking all this. Argon’s chain-of-thought and actions get monitored in real time, with execution halted if the model starts drifting past what the user actually asked for, and Google is careful not to feed what that monitoring catches back into training, specifically so the model doesn’t learn to reason its way around its own watchers. “In order to prevent Argon from stepping out of bounds to try to accomplish a task in a way that goes beyond the user’s intentions, we are deploying misalignment mitigations that monitor Argon’s chain-of-thought and actions and stop execution when necessary.” concludes the announcement. “We strongly encourage the rest of the industry to preserve reasoning transparency in these pivotal moments of increased capabilities while navigating alignment risks, so that model thoughts remain helpful in identifying and diagnosing misalignment.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Google Gemini 4 Argon)
Google unveils Gemini 4 Argon, a frontier AI model built for coding, enterprise work, and autonomous cybersecurity defense, rolling out to trusted testers. Google announced Gemini 4 Argon, and it’s not going straight to the public. It’s rolling out first to a set of trusted cyber defenders through what Google calls the Fairwind Program, which tells you something about where the company thinks this model’s sharpest edge actually is. Argon is priced to start at $2 per million input tokens and $10 per million output tokens, with cached inputs at a 95% discount, before jumping to $4 and $20 once the introductory window closes. More interesting than the price is the output limit: 1 million tokens, up from 64,000 on the previous generation. It means the model can keep reasoning through a genuinely long, complicated problem in one continuous pass instead of getting cut off mid-thought. “To support Gemini 4 Argon’s capabilities across longer, more complex use cases, we are significantly expanding the model’s output token limit to an industry-leading 1M tokens, up from the previous 64K tokens.” reads the announcement. “When the model has the headroom to think deeply and generate hundreds of thousands of tokens in a single trajectory, it adds a new level of depth in reasoning to solve tough problems in one go.” Google engineers are already using Argon internally, with some impressive results. In one case, Argon helped quantum computing researchers optimize a resource-heavy process and improve the published baseline by 40% in just a few minutes. In another, Argon agents analyzed data from Google’s data centers and found memory optimizations that freed more than 300 TiB after deployment. Google estimates there could be another 500 TiB to 1 PiB of savings. Argon is also being used to rewrite C and C++ code in Rust. This includes Google’s Fuchsia Zircon kernel, which has more than 800,000 lines of code. For the open-source libgav1 video decoder, Argon replaced 32,000 lines of SIMD code through repeated testing and compiler analysis. The new version runs 2.7 times faster than the previous Rust version, produces the same video output, and remains memory-safe. On benchmarks, Argon tops DeepSWE v1.1 at 77.9% for long-horizon software engineering, leads the Vals Index across finance, legal, and tax work, and ranks first on Zapier’s AutomationBench at 51.3%. It also posts a state-of-the-art 91.7% on LVBench, a benchmark for understanding long video, which matters more than it sounds for any workflow that involves parsing hours of footage or a stack of visual documents instead of clean text. Cybersecurity is one of the main areas where Google is focusing Argon. For trusted security teams and Google’s own engineers, Argon runs without its usual cyber safety restrictions. This allows it to actively look for vulnerabilities that defenders can then fix. Wiz is already using Argon through its Scan for Good program, which looks for serious vulnerabilities in public systems and fixes them for free. Argon found a critical flaw in healthcare software used by hospitals worldwide that could expose personal data. Earlier AI models had examined the same issue but failed to find it. On CWE-bench v1, a test that measures how well AI models can fix vulnerabilities, Argon scored 68%, tying for first place. None of this means Google is releasing a model that can autonomously hack things and calling it a day. Before any broader rollout, the company says it’s hardening defenses on four separate fronts: blocking misuse for cyber or CBRN attacks while still allowing legitimate dual-use research, improving resistance to indirect prompt injection, where hidden instructions try to hijack the model’s behavior, and sealing off the sandboxed environments used for high-risk training and testing before anything risky happens inside them. “Argon is also our most resilient model yet against indirect prompt injections, where malicious instructions or context are used to hijack a model’s behavior.” Google states. “These are complex attacks that require constant vigilance and multiple layers of defense. Through automated red teaming and adversarial training, Gemini 4 Argon is leading in prompt injection robustness on the Gray Swan’s Indirect Prompt Injection (IPI) benchmark.” The misalignment piece is the one that actually says something about how seriously Google is taking all this. Argon’s chain-of-thought and actions get monitored in real time, with execution halted if the model starts drifting past what the user actually asked for, and Google is careful not to feed what that monitoring catches back into training, specifically so the model doesn’t learn to reason its way around its own watchers. “In order to prevent Argon from stepping out of bounds to try to accomplish a task in a way that goes beyond the user’s intentions, we are deploying misalignment mitigations that monitor Argon’s chain-of-thought and actions and stop execution when necessary.” concludes the announcement. “We strongly encourage the rest of the industry to preserve reasoning transparency in these pivotal moments of increased capabilities while navigating alignment risks, so that model thoughts remain helpful in identifying and diagnosing misalignment.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Google Gemini 4 Argon)
Confirm this action.
Leaving now will discard your changes.