New darknet marketplace peddles millions of driver's licenses.

Summary

By the N2K CyberWire staff

New darknet marketplace peddles millions of driver's licenses.

The US Federal Bureau of Investigation (FBI) is investigating a newly launched dark web marketplace that claims to be selling more than 153 million driver's licenses belonging to people in the United States and Canada, as well as more than 10 million ID cards, more than three million travel documents and international IDs, and at least 579,000 medical cards, KrebsOnSecurity reports. The driver's licenses appear to have been taken from a Louisiana-based identity verification company called "IDScan.net," although this hasn't been definitively confirmed. Krebs says his own driver's license is being advertised in the free sample offered by the marketplace. The marketplace, called "Nexus," is also selling the driver's licenses of US Defense Secretary Pete Hegseth and the assistant director of the FBI.

Shortly after Krebs published his article about the marketplace yesterday, Nexus's website disappeared, and its login page simply states, "This service is no longer available."

OpenAI + SpecterOps on defending at machine speed

AI may be accelerating cyberattacks, but it’s also exposing security problems that were already there. At Black Hat, OpenAI’s Clint Gibler and SpecterOps’ Robbie Winchester joined Dave Bittner to discuss why prevention, faster remediation, and strong security fundamentals matter even more at machine speed. Hear their conversation on what AI changes for defenders, what it doesn’t, and where security teams should focus now.

Law enforcement and industry partners shutter the Sality botnet.

An international law enforcement operation dismantled the Sality peer-to-peer botnet, which was active for more than two decades, BleepingComputer reports. US law enforcement worked with counterparts in Bulgaria, Hungary, and Romania, supported by Europol and Eurojust, to seize and sinkhole the botnet's infrastructure, cutting off infected devices from the botnet's operator. CrowdStrike and the Shadowserver Foundation also assisted in the effort.

CrowdStrike attributes the botnet, which has been active since 2003, to a Russia-based criminal threat actor tracked as "SALTY SPIDER."

Business news: Socure raises $156 million and acquires Fravity.

Nevada-based digital identity verification company Socure has raised $156 million in a strategic growth investment led by Summit Partners, with participation from Goldman Sachs Alternatives, Wells Fargo, Docusign, and others. The funding brings the company's valuation to $5.2 billion.

Alongside its growth investment round, Socure also announced it has acquired Austin-based fraud, risk, and compliance automation company Fravity. Socure stated, "The acquisition of Fravity adds a native first-party agent development platform and agentic operations layer to RiskOS®, Socure’s orchestration and decisioning platform that serves more than 3,000 customers. The two companies already share many enterprise customers running both platforms together in production, and the founding teams across Socure, Effectiv (rebranded as RiskOS), and Fravity have worked together across multiple companies for more than a decade. Fravity’s capabilities will be delivered through the RiskOS platform as RiskOS_Agents."

Notes.

Today's issue includes events affecting , and the United States.

Attacks, Threats, and Vulnerabilities

CVE-2026-9586: Sangoma Switchvox RCE (Horizon3) Horizon3 researchers detail CVE-2026-9586, a critical Switchvox SQL injection leading to RCE, with active exploitation observed in the wild.

Inside an Indian Data Brokerage Running on Unauthorized KYC Access (Cyderes) Howler Cell investigation reveals a data brokerage selling unauthorized KYC access for as low as 6 cents, exposing millions of identities without consent.

Daisy-Chaining Trust: Investigating Faronics Deploy Abuse (Huntress) Bad actors are abusing Faronics Deploy in phishing campaigns to run PowerShell, deploy ScreenConnect, and evade detection by using trusted tools.

Trends

New Cequence & EMA Research: 94% of Enterprises Trust Their AI Agents Aren't Over-Provisioned. Only 33% Actually Enforce It. (GlobeNewswire) Survey of IT and Security Leaders Reveals Standing Permissions and Delayed Authorization Checks, Not Just Identity Gaps, Are Driving Agentic AI Risk

How fear shapes cybersecurity in the age of AI (Temple Now) As AI supercharges cyber threats, John D’Arcy, professor of management information systems at Temple University’s Fox School of Business, is examining the human behavior behind them.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Aspen Cyber Summit (Washington, DC, USA, Nov 18, 2026) The Aspen Cyber Summit is the nation’s premier annual technology and cybersecurity policy gathering, bringing together the top voices from government, industry, and civil society to create a safer world, online and off.

Events

Cybersecurity Operational Methods and Education Training (COMET) cohort (Virtual, USA, Aug 31 - Sep 28, 2026) COMET was established to provide relevant, up-to-date training to Maryland state and local government employees to elevate the ability of the workforce to identify and respond to the largest cybersecurity challenges facing the state and local government.

Books in Cyber: A conference about the books that shape cybersecurity (Virtual, Sep 8, 2026) A half-day virtual conference about the books that shape cybersecurity - the writers, the readers, and the ideas that endure.

.conf26 (Denver, Colorado, USA, Sep 14 - 17, 2026) .conf26 is a three-day conference filled with hands-on training, AI insights, new certifications, fun celebrations, and endless opportunities to see how others use Splunk. Take your skills to the next level and build your most resilient defense yet. See you in Denver!

AI Security Summit 2026: State of Trust (Virtual, Sep 16 - 17, 2026) AI can now autonomously identify and exploit software vulnerabilities at near-expert level, and that capability is already in deployment. Autonomous systems have become part of the attack surface itself. Cloud architecture is being rearchitected around AI at speed. Identity perimeters are dissolving under the pressure of non-human access at scale. Zero Trust has moved from framework to survival requirement. Across all three pillars of modern enterprise security, the question of trust has never been more consequential or more contested. Join CSA for the AI Security Summit 2026: State of Trust, a free two-day virtual flagship event taking place September 16–17, 2026. Over two days, you'll get direct access to the research, standards, and practitioner guidance shaping five of the most consequential shifts in security today: agentic and autonomous AI security, quantum readiness, non-human identity management, global governance and assurance, and the next evolution of adaptive threat defense and Zero Trust. Built on CSA's vendor-neutral research and direct work with CISOs and industry leaders worldwide, this is where the global cloud, AI, and Zero Trust community comes to see clearly where trust actually stands, and where it's headed next.

Uniting Women in Cyber 2026 (Tysons, Virginia, USA, Oct 8, 2026) At UWIC 2026, our theme Creative Cyber: Amplified Intelligence reflects the energy and evolution of cybersecurity today. Join us to explore how human ingenuity and AI come together to outpace emerging threats and build a more creative, resilient future.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry's largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust N2K CyberWire to get the message out. Learn more.

Daily Briefing for 09.02.26

Top stories.

New darknet marketplace peddles millions of driver's licenses.

Law enforcement and industry partners shutter the Sality botnet.

Business news: Socure raises $156 million and acquires Fravity.

Notes.

Attacks, Threats, and Vulnerabilities

Trends

Newly Noted Events

Events