Cyber Incidents - International 2026-27

[Commonground]

Nepal
Updated at : September 21, 2026 14:51

Why was Nepal’s stock market shut on Monday?

Nepal’s stock market was shut on Monday after a ransomware attack at a data centre disrupted the trading systems of 72 brokerage firms, prompting regulators to halt trading to prevent further damage.

The Nepal Stock Exchange (Nepse), suspended trading at the request of the Stock Brokers’ Association of Nepal after DataHub Pvt Ltd, which hosts the brokers’ data systems, reported a cyber attack early Sunday.

... https://kathmandupost.com/money/2026/09/21/why-was-nepal-s-stock-market-shut-on-monday

 

[Commonground]

Nepal

Ransomware attack on Data Hub forces stock market to halt trading​

Excerpt:
Data center hit by ransomware

Data Hub has confirmed that its infrastructure was affected by a ransomware attack. The company informed YCO Pvt. Ltd., which manages the trading systems of stockbrokers, about the incident.

According to Data Hub, the attack was detected at around 5:30 am on Sunday. The company said it had taken a complete backup of its systems around 4 am, before the attack was detected, and that the backup remains secure and isolated.

However, the affected systems have been taken offline as a precaution against the ransomware spreading to other interconnected networks. Data Hub said forensic analysis and other security measures are being carried out before the systems can be brought back online.

... https://farsightnepal.com/news/ransomware-attack-on-data-hub-forces-stock-market-to-halt-trading/

 

[Commonground]

Every Iranian Strike on UAE Ports and Refineries Was Paired With a Cyberattack, Expert Says

By Homeland Security Today
September 29, 2026

Earlier this month, the UAE’s head of cybersecurity, Mohamed Al Kuwaiti, disclosed to the Arab Media Summit that every missile and drone attack on the country’s ports, energy facilities and refineries since the beginning of the war in Iran had been accompanied by a cyberattack against the same target. He also revealed that the average number of digital assaults had tripled since 28 February, reaching between 600,000 and 800,000 a day.

continued: https://www.hstoday.us/subject-matt...es-was-paired-with-a-cyberattack-expert-says/

 

[Commonground]

[an ongoing theme...]

DIVD says AI agent carried out cyberattack through software flaw​

Sep 29, 2026
The Dutch Institute for Vulnerability Disclosure, a nonprofit organization of volunteer security researchers, said an autonomous AI agent was used in a cyberattack against its infrastructure.

After almost seven years without a successful intrusion, the organization disclosed last week that attackers had gained access to its systems.

The investigation remains active, and DIVD hasn’t disclosed the full scope or purpose of the attack....

continued: https://beinsure.com/news/divd-says-ai-agent-carried-out-cyberattack-through-software-flaw/

 

[Commonground]

FBI seizes domains linked to China-nexus botnet​

Fri, October 9, 2026 at 10:16 AM EDT
The Department of Justice on Thursday announced the court-ordered seizureof hacking tools used by a China-nexus actor against U.S. and other critical infrastructure providers.

The tools, dubbed FishHub and Microscan, were used by a company called Integrity Technology Group (ITG) to exploit vulnerabilities in critical infrastructure networks in North America, Southeast Asia and Africa.

Continued: https://www.yahoo.com/news/us/articles/fbi-seizes-domains-linked-china-141601268.html

 

[Commonground]

Japan declares cyber space emergency as attacks soar​

Published7 HOURS AGO
Excerpt:
The increasing frequency of the attacks has prompted alarm at the highest levels of the Japanese government. Masaaki Taira, head of the NCSH, declared that Japan was in “a state of emergency in cyber space”. Japanese cyber security minister Toshiharu Furukawa said the situation was “extremely critical”.

... https://www.ft.com/content/2d4333d1-8119-44a4-a5a5-2ee9ef2544fa?syn-25a6b1a6=1

 

[Commonground]

French supermarket chains say cyberattack forced refrigerator shutdown​

Paris (France) (AFP) – Major French supermarket chains Intermarche and Cooperative U were hit by a cyberattack that caused their refrigerators to defrost, the two retailers told AFP Monday.

Issued on: 12/10/2026

Some 150-200 Intermarche shops were targeted, along with almost 100 Cooperative U outlets, in the attack, they said.

Paris prosecutors confirmed the attack, which reportedly also hit other major chains, and also indicated it had prompted outbreaks of fire.

BFM TV said France's largest supermarket chain E. Leclerc was also affected, with hackers "managing to remotely trigger the forced defrosting of the refrigeration systems in numerous stores". Contacted by AFP, E. Leclerc did not immediately confirm the information.

... https://www.france24.com/en/live-ne...-say-cyberattack-forced-refrigerator-shutdown

 

[Commonground]

CISA, FBI and Partners Warn Organizations of SafePay Ransomware Actors Targeting Multiple Critical Infrastructure Sectors​

Provides: Technical Insights of Tactics, Detection Guidance and IOCs, Actions and Mitigations to Prevent/Reduce Impact
Released
October 21, 2026

WASHINGTON – Today, the Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), U.S. Secret Service (USSS), and international partners released a joint Cybersecurity Advisory, #StopRansomware: SafePay Ransomware, that warns organizations of one of the most active ransomware group in 2026, impacting approximately 600 victims across sectors in the Americas, Europe and Australia. To help organizations protect against this group, the advisory provides observed tactics, techniques, and procedures (TTPs), indicators of compromise (IOCs) and recommended mitigations.

SafePay actors gain access to victim networks by compromising credentials and targeting known vulnerabilities in internet-facing devices, often connecting through virtual private network (VPN) services. Once inside, they use legitimate IT tools to move through networks and undermine recovery by deleting or disabling backups. They then steal data and encrypt systems, pressuring victims to pay by threatening to publish stolen information and, in some cases, calling victims directly.

“Public-facing devices with known vulnerabilities continue to be frequently targeted by threat actors like SafePay Ransomware group,” said Acting Executive Assistant Director for Cybersecurity, Chris Butera. “With our partners, CISA encourages organizations to review and implement recommended mitigations to include urgently patching the known exploited vulnerabilities in this advisory and conducting forensic triage to determine if systems have been compromised.”

“Today, the FBI and our partners are giving network defenders clear, actionable guidance to protect their organizations from one of 2026’s most active ransomware groups,” said Assistant Director Brett Leatherman of the FBI’s Cyber Division....
Continued: https://www.cisa.gov/news-events/ne...ransomware-actors-targeting-multiple-critical