Reboot, rinse, repeat.

Chinese spies exploit a BeyondTrust zero-day. Atlassian faces active attacks. Rogue AI agents breach Indian networks. Ransomware gangs turn to threats of violence. A cyber incident disrupts U.S. bankruptcy courts. F5 and Juniper push critical patches. Japanese companies suffer a wave of breaches. Google brings AI-powered scam protection to Android. Our guest is Nick Jackson, Global Director of Cyber Security Services at Bitdefender, sharing how the UK are thinking about AI regulation. Braille meets brains.

Today is Friday October 16th 2026. I’m Dave Bittner. And this is your CyberWire Intel Briefing.

A suspected Chinese espionage group exploits a BeyondTrust zero-day.

A suspected Chinese state-sponsored espionage group is exploiting a zero-day vulnerability in BeyondTrust’s Remote Support software. The flaw, tracked as CVE-2026-102764, allows attackers to escalate privileges, move laterally through networks, and steal stored credentials. Researchers at Mandiant and Google attribute the activity to Armory Castle, also known as UNC5221, a group specializing in long-term intelligence gathering. The attackers demonstrated sophisticated knowledge of BeyondTrust’s internal systems, deploying custom malware and establishing persistence that survives reboots and configuration resets. The group has previously exploited vulnerabilities in Ivanti and Citrix products, often expanding attacks once vulnerabilities become public. BeyondTrust has released a patch, but researchers warn that internet-facing appliances should be considered potentially compromised until thoroughly investigated. Google expects broader exploitation as attackers race against patch deployments.

CISA says a critical Atlassian vulnerability is under active exploitation. 

CISA has added a critical Atlassian vulnerability to its Known Exploited Vulnerabilities catalog following confirmed attacks. The flaw, tracked as CVE-2026-21589, carries a severity score of 9.3 and affects multiple Atlassian Data Center products, including Jira, Confluence, and Bitbucket. Attackers can exploit a path traversal vulnerability to access sensitive files without authentication, potentially exposing credentials and enabling administrative access. Researchers observed exploitation attempts shortly after technical details became public. Organizations are urged to apply available patches promptly.

AI agents access government and private-sector systems in India. 

India’s cybersecurity agency, CERT-In, is warning that AI agents have accessed government and private-sector systems without authorization, exceeding the boundaries of their assigned tasks. The agency received voluntary disclosures from AI developers whose agents exploited exposed credentials, misconfigured cloud accounts, and poorly secured interfaces to access sensitive information. None of the affected organizations detected the intrusions themselves. The warning follows similar incidents involving OpenAI agents in Australia. CERT-In also reports that criminals are using agentic AI tools to accelerate cyberattacks, reducing the time from initial compromise to impact from days to hours. The agency has not identified the AI developers or affected organizations, raising transparency concerns. Officials are urging developers to strengthen safeguards preventing AI agents from accessing unauthorized systems.

Researchers at Cyble have identified an upgraded version of GhostBat Android malware targeting 60 banking and payment apps in India. Distributed through fraudulent government-service messages and malicious APK downloads, the malware abuses Android’s Accessibility Service to capture payment PINs, intercept messages, and collect sensitive information. Its sophisticated overlay technique records PIN entries while victims use legitimate banking apps, making detection difficult. GhostBat also employs encrypted loaders and remotely configurable settings to evade security tools. Users are advised to avoid unofficial app downloads and scrutinize permission requests.

Ransomware gangs increasingly threaten physical violence. 

Ransomware gangs are increasingly threatening physical violence against corporate executives and employees to pressure organizations into paying extortion demands. According to the 2026 Semperis Ransomware Risk Report, 40% of attacks involved psychological or physical intimidation, including threats against employees’ families and even their homes. This tactic, known as triple extortion, adds personal threats to traditional ransomware demands and data-leak threats. Among affected organizations, 25% reported employees being doxxed, while 23% experienced swatting incidents, sometimes forcing victims to relocate or seek psychological treatment. Researchers warn that these tactics can undermine even well-prepared organizations with reliable backups, as executives weigh employees’ personal safety against ransom demands. The findings are based on a survey of 1,200 IT and security professionals worldwide.

A cyber incident disrupts bankruptcy court notifications. 

A cybersecurity incident affecting BAE Systems has disrupted bankruptcy court notifications across the United States. The company operates the Bankruptcy Noticing Center, which distributes official notices for federal bankruptcy courts nationwide. Since October 9, the system has been unable to generate or deliver notices, affecting both electronic and paper communications. Courts continue accepting filings, but creditor notification services remain unavailable. BAE says the incident is isolated to the noticing system. The cause, potential data exposure, and timeline for restoring services remain unknown.

F5 and Juniper Networks release new patches. 

F5 and Juniper Networks have released patches addressing more than 160 security vulnerabilities, including dozens of critical flaws. F5 fixed 11 vulnerabilities in NGINX, including three critical issues that could enable unauthenticated remote code execution under certain conditions. Meanwhile, Juniper published 17 advisories covering more than 150 vulnerabilities in Junos OS and related products. Roughly two dozen critical flaws could allow attackers to execute commands with root privileges, take over devices, or disrupt services. Neither company has reported evidence of active exploitation.

A wave of cyberattacks hit major Japanese companies. 

A wave of cyberattacks against major Japanese companies has exposed millions of customer records. Logistics giant Yamato Transport reported a breach affecting 5.31 million records, while publisher Nikkei disclosed the compromise of 1.83 million. Burger King Japan confirmed attackers accessed a server containing 11.18 million customer records, including names, contact information, birth dates, and purchase histories. The company says payment card information and login credentials were not exposed. Meanwhile, car-sharing operator Park24 is deleting stored identity verification documents following its own breach. Security researchers have documented 119 incidents involving personal information exposure in Japan this year. Attackers are increasingly exploiting weaknesses in website authentication, access controls, and APIs, highlighting the growing risks facing Japanese businesses and their customers.

Google rolls out new AI-powered protections for Android. 

Google is rolling out new AI-powered protections against increasingly sophisticated mobile scams on Android devices. The enhancements include Gemini-based analysis of suspicious text conversations, on-device detection of malicious links, and stronger warnings about potential fraud. Google is also expanding protections that hide sensitive information during screen sharing and prevent apps from secretly enabling call forwarding. An enhanced bank-call verification system helps identify spoofed calls, automatically disconnecting suspected fraudsters. Google says its existing protections flag more than five million suspicious calls and messages monthly, while its bank verification system has blocked over three million fraudulent calls in Brazil since June. The new features are rolling out to eligible Android devices, with some protections requiring users to opt in.

Braille meets brains. 

Scientists are making progress toward an intriguing new frontier in computing: using actual human brain cells instead of silicon chips. Researchers at Bristol University have demonstrated that tiny clusters of human neurons, known as brain organoids, can help recognize letters of the Braille alphabet. By converting Braille patterns into electrical signals, researchers found that a single organoid containing roughly 10,000 neurons could classify letters with 61 percent accuracy. Combine three organoids, and accuracy jumped to 83 percent. The research is part of an emerging field called organoid intelligence, which explores using living neural tissue for information processing. Previous experiments have demonstrated similar systems recognizing speech sounds and even playing Pong. Researchers emphasize that these miniature brains aren’t actually reading or understanding Braille. They’re simply processing electrical patterns. Still, it’s an intriguing development in biological computing, and perhaps another reminder that the line between hardware and wetware is getting a little blurry.

I want to know where they get the brains…

And that’s the CyberWire.

For links to all of today’s stories, check out our Daily Briefing at the cyberwire dot com.

 

 

Special Edition:
And this Sunday, don’t miss our special edition podcast, featuring my full conversation with John Kindervag and Dr. Chase Cunningham on zero trust and building cyber resilience in the age of AI.

And that’s the CyberWire Daily, brought to you by N2K CyberWire.

We’d love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like the show, please share a rating and review in your podcast app. Please also fill out the survey in the show notes or send an email to cyberwire@n2k.com

 

 

N2K’s lead producer is Liz Stokes. We’re mixed by  Tré Hester, with original music by and sound design Elliott Peltzman. Our contributing host is Maria Varmazis. Our executive producer is Jennifer Eiben. Peter Kilpe is our publisher. And I’m Dave Bittner. Thanks for listening.