> InfoSec News Nuggets – 10/12/2026

Ransomware attack disrupts Japan’s IDCF Cloud used by govt clients IDC Frontier, the SoftBank-owned Japanese cloud and infrastructure provider, has confirmed that a ransomware attack beginning on October 7 knocked out its IDCF Cloud East Japan Region 1, disrupting service for 495 companies and local governments. The firm isolated the affected systems and disabled management console access across all regions while it investigates, and screenshots shared by customers show a message in which the attackers claim they breached the environment in seven minutes, encrypted 225 databases totaling 3.6 PB, reached 239 hypervisors and wiped more than 554,000 snapshots. Seafood giant Nissui separately reported a logistics outage tied to a third-party data center, though a link to the IDCF incident has not been confirmed.   FBI touts another ShinyHunters arrest in response to data breach FBI Director Kash Patel announced that agents arrested another suspected co-conspirator of the ShinyHunters extortion group this week, as the bureau pursues those behind the defacement of FBIjobs.gov and the theft of sensitive data on nearly every FBI employee. The FBI has not named the suspect or disclosed charges, though reports indicate the arrest took place in Pennsylvania and involved a Canadian national. It follows the detention of an alleged key member in Jordan on September 28 and an earlier arrest in the Netherlands, while the breach itself has reportedly been traced to an unpatched system managed by a contractor who has since been removed.   CyberXero Used 51 AI Agents to Steal 628,000 Ukrainian Records Researchers have exposed CyberXero, a Russian-speaking initial access broker that ran up to 51 AI coding agents alongside commodity hacking tools, after the actor left an open directory exposing more than 90,000 files including AI session logs, scripts with plaintext tokens and stolen victim data. The operation paired a mass campaign against WordPress and e-commerce sites, at one point scanning 4,708 targets and planting 32 webshells in 61 seconds, with a hand-picked campaign against Ukrainian energy and critical infrastructure that yielded records on more than 628,000 people, including over 564,000 customers of a district heating provider in Kharkiv. The logs also show the model refusing several requests and the actor simply opening new sessions and reframing tasks as authorized penetration tests to get around those refusals.   Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries Bitdefender has uncovered Midnight Mimosa, a malware campaign baked into the firmware of low-cost Android phones built on MediaTek platforms, giving operators a persistent system-level app that cannot be removed through normal uninstall procedures. The malware can silently install and remove apps, grant permissions and load remotely supplied code, and is being used for ad and click fraud and to enlist devices in a larger botnet, with thousands of affected devices observed in more than 150 countries. Researchers also found 13 Google Play apps carrying the same ad-fraud code and saw the malware temporarily disabling Play Protect while installing additional payloads.   Multiple major US law firms hit by data breaches, Social Security numbers exposed Holland & Knight and Squire Patton Boggs have each disclosed data breaches involving Social Security numbers, adding to a growing list of major US law firms hit by cyber incidents. Holland & Knight said an attacker used social engineering to gain unauthorized remote access to a firm computer, exposing a small number of files and affecting 14 clients, while Squire Patton Boggs reported that an unauthorized third party obtained a limited set of information. The disclosures follow September breaches at Quinn Emanuel, McDermott and Greenberg Traurig, several of which also involved social engineering. The post InfoSec News Nuggets – 10/12/2026 appeared first on AboutDFIR - The Definitive Compendium Project.