The latest from Italy, ITW exploits and new 0-days, Oxygen Forensics, breaches and arrests
Italy: phishing, hacktivism and new ransomware claims
A “documents”-themed phishing campaign has been identified in Italy, exploiting the name and logo of the National Research Council (CNR) to exfiltrate employees’ email credentials. The operation involves the use of a phishing site that replicates a fake CNR webmail interface containing references to Microsoft Outlook, through which victims are prompted to enter the credentials associated with their institutional email accounts. The pro-Russian hacktivist collective NoName057(16) has once again targeted Italian portals. Specifically, DDoS attacks were claimed against the Municipality of Bari, Port Informer Augusta S.r.l.s., the Municipality of Arzignano, the Municipality of Cavallino-Treporti and SuiteCom S.n.c. The Dark Storm Team group also targeted Italy with DDoS attacks, hitting the Port of Civitavecchia, Port Informer Augusta S.r.l.s. and the Municipality of Bari. In addition, BD Anonymous carried out a DDoS attack against P.S.T. Consulting S.a.s., an Italian company operating under the POSTAexpress brand that provides shipping and express courier services. As with the previous DDoS attacks, the action was allegedly carried out in retaliation against the position attributed to the Italian Government, which was accused of being unwilling to recognize Palestine as a State. Finally, turning to the ransomware landscape, The Gentlemen claimed on its leak site the compromise of Top Sport S.r.l.; while Lamashtu claimed the compromise of Astidental di Sabbione S.p.A.
Vulnerabilities: active campaigns targeting Citrix and PeopleSoft and patched Apple and Cisco 0-
days
During September 2026, security researchers documented a campaign, active since at least the beginning of the month and targeting exposed Citrix NetScaler ADC and NetScaler Gateway appliances in North America and Europe, exploiting the 0-day CVE-2026-88772 to deploy the previously undocumented WHIPSHOT and SLAPSHOT malware. The attack occurs pre-authentication during the DTLS handshake over UDP/443: malformed records corrupt the heap of the NetScaler Packet Processing Engine, causing it to terminate and enabling execution with root privileges on FreeBSD. After obtaining an initial foothold, the adversaries modify httpd.conf to execute files with non-standard extensions as PHP or map seemingly legitimate requests to web shells, set the SUID bit on /bin/sh and restart services. Web shells and configuration changes may survive patching and HA synchronization. During the same period, a new campaign involving the mass exploitation of CVE-2026-35273 (CVSS 9.8) against Internet-exposed Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 was observed and attributed to ShinyHunters (UNC6240), which had already exploited the flaw as a 0-day between 27 May and 9 June 2026. Compared with the previous wave, which focused on higher education, the activity also affected the technology, IT services, healthcare, agriculture, transportation and government sectors. The attackers bypassed WAF mitigations on the /PSEMHUB/ path by using the encoded variant /%50SEMHUB/; following access, JSP web shells, the Ple64.exe loader with the SIDEEYE backdoor, Neo-reGeorg and, on Linux, MeshAgent/MeshCentral were observed. Oracle released the patch on 10 June 2026, and CISA added the CVE to its KEV catalog on 12 June. In addition, Apple patched CVE-2026-86950, an Out-of-bounds Write 0-day in CoreGraphics, with iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. Processing a malicious file can lead to arbitrary code execution; the issue, reported by Meta Product Security and addressed through stricter memory bounds checks, was reportedly exploited in an extremely sophisticated attack against specific individuals running versions of iOS prior to iOS 27. Finally, Cisco patched CVE-2026-76504 (CVSS 9.8), an Improper Handling of URL Encoding vulnerability in the session-based authentication mechanism of the Catalyst SD-WAN Manager APIs, exploited ITW and identified in September 2026 during a Technical Assistance Center support case. An unauthenticated remote adversary can bypass controls on a specific endpoint and gain access to the APIs with administrative privileges. Updates are available for all supported branches, with mandatory migration for versions earlier than 20.9; the fix has already been applied to Cisco SD-WAN Cloud environments. No effective workarounds are available.
International context: supply chain, data breaches and automated probing
On 23 September 2026, the US Department of Justice announced the arrest of Lee Reiber, CEO of Oxygen Forensics, and Russian citizen Oleg Sergeyevich Davydov, alleging the concealment of Russian control over the company and the development in Russia of products also used by the US Government, including Oxygen Forensic Detective. According to the charges, five Russian citizens allegedly maintained control through a Cypriot holding company and MKO Systems, which reportedly sold the same software in Russia under different names, including to the FSB, Investigative Committee and Ministry of Internal Affairs. Following the 2022 sanctions, the individuals’ names were allegedly removed from public documents, while the company reportedly declared that it was not under foreign control and, in 2026, that it had no Russian developers. In September 2024, the National Computer Forensics Institute reportedly awarded the company a five-year contract; users of its products allegedly include the Secret Service, Homeland Security Investigations and the DHS OIG. The DOJ does not allege the presence of malware or access to customer data, and on 20 September it reportedly seized approximately 57 domains, infrastructure assets and accounts. On 27 September, it emerged that the products were also used by police forces and investigative authorities in Germany, Spain, Italy, Poland, Hungary, Romania and Latvia, as well as by Moroccan authorities as part of an EU border program for the Maghreb. Oxygen was among the stakeholders of the EVIDENCE project, without receiving direct funding, and there is no evidence of malicious code or access to European data. On the breach front, between May and August, France’s DGFiP was breached using credentials stolen from personal devices and in the absence of strong authentication: two exfiltrations, claimed on 12 and 13 August and detected by neither the DGFiP nor ANSSI, involved impots[.]gouv[.]fr and cadastral data, with lateral movement from the ministère de l’Éducation nationale, without compromising the website or user accounts. In the United States, following a vulnerability discovered on 16 July, the DMDC determined that unencrypted personal data belonging to DoD personnel had been accessed between October 2025 and that date; the system was patched and there is no evidence of misuse. In Japan, on 27 September, Tokyo Metro reported apparently foreign access to approximately 59,000 Metro Point Club emails, with no other data involved and no impact on services. Regarding legal proceedings, on 15 September Pepijn van der Stap, alias Umbreon, was arrested in Amsterdam as part of the investigation into ShinyHunters linked to the theft of more than 6.2 million Odido records in February 2026; an Umbreon ASCII included in the alleged defacement of FBIJobs[.]gov on 22 September does not confirm affiliation, which the group has denied. On 25 September, the United States sentenced Cameron John Wagenius, a former service member known as “kiberphant0m”, to 70 months in prison and approximately $295,000 in financial penalties for intrusions carried out between April 2023 and December 2024 against at least ten telecommunications operators, also linked to the 2024 Snowflake compromises, including AT&T. Also in Japan, on 26 September Keio Electric Railway disclosed a ransomware attack affecting the group’s servers, with no disruption to rail services and no confirmed data leak. In the crypto sector, on 24 September Bitget reported unauthorized withdrawals of approximately $387 million from hot and warm wallets through a backend used to falsify transactions, while private keys were believed to remain intact and user balances unchanged. On 30 September MetaMask began exiting the affected staking validators, with the process expected to be completed by 7 October, with no indication of any impact on wallets or funds. In parallel, between 13 April and 19 June, AI agents likely associated with OpenAI carried out more than 16,500 scans of the UNCTADstat API involving already-public data. On 24 September, the Dutch DIVD isolated its systems following an attack that it attributes to agentic AI. On 29 September, similar activity affected US and Canadian government websites, including an SQL injection attempt against the Department of Education and approximately 899 requests to Library and Archives Canada, with no compromises reported. In Kyiv, on 27 September a Russian attack damaged Kyivstar’s headquarters and, according to Zelenskyy, a data center, leaving three people injured; the claim regarding Vodafone Ukraine has not been confirmed. The kinetic attacks of the preceding weeks disrupted services to approximately 100,000 households, with no evidence of a cyber intrusion.
Weekly Threats Report is Telsy’s weekly update featuring the main developments on cyber attacks and threat actors worldwide, produced by our Threat Intelligence & Response team.
The team is composed of analysts and security researchers with technical and investigative skills and internationally recognized experience.
Through continuous monitoring of cyber threats and geopolitical events, it produces and provides organizations with useful information to anticipate attacks and understand their scope, with the support of a trusted partner in the event of a cyber incident.
Learn more about our Cyber Threat Intelligence solution.