International Cyber Digest

❗️ Meta's AI agent Muse is mapping relationships, disputes and "tensions and alliances" of 4 million users and the people they mention, including people who don't use it, and it is instructed not to tell users that messages they asked it to "forget" may still be visible, a review of its internal instructions found. https://time.com/article/2026/10/06/meta-muse-ai-agent-privacy/

❗️ Mistral's new AI tried to break out of its test environment during evaluation but was contained, the company says. It calls the behaviour expected for Large 4, a 1-trillion-parameter model pitched as strong at cybersecurity. The open weights ship on Oct 27.

❗️ A 16-year-old was misled by Anthropic's Claude onto a route far beyond his abilities, North Shore Rescue says. The AI's directions put him on a climbing route known as the "Widowmaker", where he was stranded below a cliff until a helicopter hoisted him out.

‼️ BREAKING: Japan has handed Germany a 28-year-old Russian suspected of being a core member of the Qilin ransomware gang, after detaining him in late May while he was on a trip to Osaka. He was extradited on Oct. 2 with Tokyo High Court approval and is suspected of extorting $165K in bitcoin from a German logistics firm in Sept. 2024, The Asahi Shimbun reports. Qilin is the group that claimed the 2025 attack on Asahi Group.

‼️ The FBI has removed a contractor over a breach that exposed personal details of thousands of its employees. The cause, per the FBI's cyber chief: a security patch that was "explicitly issued" but never installed. Sources tell Reuters the contractor is from Accenture and the unpatched platform was Oracle PeopleSoft, which ShinyHunters says it exploited.

‼️🇩🇪 Germany’s former spy chief August Hanning has been arrested on treason and espionage charges. Prosecutors say the case began with a search of his premises during the Christina Block child-kidnapping investigation. His former chief of staff allegedly passed him nearly 2,000 internal BND documents for payment between 2010 and 2022, many classified. He allegedly used them in contacts with two unnamed foreign intelligence services.

❗️ French PC retailer LDLC is warning customers that a "malicious act" gave an intruder access to one of its systems. Names, home addresses, emails and phone numbers may have been viewed. It is LDLC's fourth disclosed security incident since 2021.

‼️ BREAKING: ASOS was hacked and customers received a ransom note meant for ASOS, pushed through the app. Titled "ASOS HACKED", it tells the company's data protection officer and IT team that attackers "fully compromised the Snowflake instance" and will leak it unless ASOS engages. ASOS has not confirmed a breach. Shares fell 11%.

‼️ We have examined the Trump Mobile leaked data and can confirm it includes people close to Trump: Larry Gatlin (singer) Jason Miller (Trump adviser) Charlie Ergen (EchoStar cofounder) Mike Kelly (GOP congressman) Bo Loudon (pro-Trump influencer) Eric Brunnett (Trump Organization VP of IT) Nicholas Hayes (Trump Hotels Assistant General Counsel)

‼️ We talked to the threat actor behind the Trump Mobile breach, who told us they infected a Liberty Mobile employee with an infostealer, got access to Trump Mobile through it and are still inside its systems. Neither company was using any MFA, allegedly. Turns out no security team or third-party support is handling the incident right now according to BYOD, "they basically told us to go fuck ourselves" with "no care for customers whatsoever".

‼️ BREAKING: Trump Mobile customers have had their personal data leaked by ransomware gang BYOD. The dump covers 3,615 people and includes names, emails, phone numbers, home addresses and order details. The gang says the company answered news of the breach with "We have no team to handle this." The leak includes the Trump Organization's own CIO, who oversees its information security. People listed in the data confirmed their details are accurate and BYOD claims it still has access to Trump Mobile's backend, Straight Arrow News reports.

‼️ BREAKING: The Pentagon told the BBC it has "ceased the use of Anthropic products" months after designating the company a supply chain risk, yet sources say Claude was still in use there last week, including in military operations against Iran. It was embedded in Maven, the Palantir-run platform that is the Pentagon's primary intelligence system, and Pete Hegseth's deadline to phase it out passed in late August.

404 Media is out with another nothing burger, since teams fix and patch vulnerabilities all the time, which they would've known if they'd ever worked in cybersecurity. The real news here is the insider threat Meta faces, as 404 Media has been able to read internal posts from Meta execs to its core infrastructure team.

❗️ Beyond Gravity, the Swiss state-owned firm that builds the payload fairings for Europe's Ariane 6 rocket, says it was hit by a targeted cyberattack and suspects a highly professional actor. First signs of malicious activity appeared on August 12. It went public 51 days later, on October 2. Mandiant and Switzerland's Federal Office for Cyber Security are investigating.

‼️ BREAKING: We have obtained a 2,473-file Iranian training archive carrying IRGC and Basij credits, and the files inside say that cutting off the internet “is effective in controlling the crowd,” frame women and girls as a human shield and tell personnel to prevent anyone filming the wounded and the dead. The collection is 11.2 GB. Here is a walk through it 🧵 https://x.com/IntCyberDigest/status/2106879459802452392

‼️ BREAKING: Denmark says unauthorised parties accessed the names, addresses and ID-numbers of about 8.8 million people in its central population register. The country has only 6 million residents; the total includes emigrants and the dead. Attackers abused a private Danish company's lawful access to the register, abused during September. Police are investigating. https://ufm.dk/aktuelt/pressemeddelelser/2026/oktober/omfattende-uautoriseret-adgang-til-borgeres-cpr-oplysninger/

‼️ Meet Chinese spy Wanying Zhang aka “Heather”, who spied on the US-based son of the Taiwanese president and was arrested. She texted her handler "Saw him. Young male. It's that young one," and "I am videorecording." We found her online profiles 🧵 https://x.com/IntCyberDigest/status/2107020891620327876?s=20

❗️ Meet Darya Shipilova, 28, who worked at Irkutsk's Anti-Plague Institute as a lab technician. She died after smashing a vial of plague bacteria had "pneumonia of unknown aetiology." Records reviewed by us indicate she was a junior, joined the institute in September 2022 at age 24, was making about $850 a month, and was still listed as a student in 2024. Around 200 of her contacts are now quarantined.

Uber's security chief Joe Sullivan told the FTC under oath in 2016 how Uber was securing customer data, and ten days later he learned hackers had stolen records on 57 million riders and drivers. Instead of telling the FTC, which was already investigating Uber over an earlier breach, Uber paid the hackers $100,000 in bitcoin through its bug bounty programme and kept the theft quiet for a year. Sullivan was convicted in 2022.

‼️ BREAKING: A security researcher says he has a full VM escape zero-day: guest-to-host root in "industry standard hypervisors." Vercel awarded him its maximum $50,000 bounty, a screenshot he posted shows. Vercel's message puts the bug in its Critical class: microVM-to-EC2 host escape and cross-tenant access.