--- title: "Atlassian Flaw Exploited, Ransomware Firm Fraud, DarkSword Steals Crypto | AutoSPF" description: "Explore the top cybersecurity news from October 6–12, 2026, covering exploited flaws, ransomware, malware, data theft, and emerging AI security threats." image: "https://autospf.com/og/blog/atlassian-flaw-exploited-ransomware-firm-fraud-darksword-steals-crypto.png" canonical: "https://autospf.com/blog/atlassian-flaw-exploited-ransomware-firm-fraud-darksword-steals-crypto/" --- Quick Answer Cybersecurity news from October 6–12, 2026, highlights exploited software vulnerabilities, ransomware fraud, crypto theft, malware campaigns, and AI security risks. Organizations should patch critical flaws, strengthen email security with DMARC, SPF, and DKIM, and improve threat detection. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fautospf.com%2Fblog%2Fatlassian-flaw-exploited-ransomware-firm-fraud-darksword-steals-crypto%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Atlassian%20Flaw%20Exploited%2C%20Ransomware%20Firm%20Fraud%2C%20DarkSword%20Steals%20Crypto&url=https%3A%2F%2Fautospf.com%2Fblog%2Fatlassian-flaw-exploited-ransomware-firm-fraud-darksword-steals-crypto%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fautospf.com%2Fblog%2Fatlassian-flaw-exploited-ransomware-firm-fraud-darksword-steals-crypto%2F "Share on Facebook") [ ](https://reddit.com/submit?url=https%3A%2F%2Fautospf.com%2Fblog%2Fatlassian-flaw-exploited-ransomware-firm-fraud-darksword-steals-crypto%2F&title=Atlassian%20Flaw%20Exploited%2C%20Ransomware%20Firm%20Fraud%2C%20DarkSword%20Steals%20Crypto "Share on Reddit") [ ](mailto:?subject=Atlassian%20Flaw%20Exploited%2C%20Ransomware%20Firm%20Fraud%2C%20DarkSword%20Steals%20Crypto&body=Check out this article: https%3A%2F%2Fautospf.com%2Fblog%2Fatlassian-flaw-exploited-ransomware-firm-fraud-darksword-steals-crypto%2F "Share via Email") ![Cybersecurity Threats and Crypto Theft](https://media.mailhop.org/autospf/spf-lookup-6021-1791981273299.jpg) This week was dominated by zero-day exploitation, arrests tied to the ShinyHunters group, and a record quarter for ransomware. Several attacks targeted widely used **enterprise tools**, including Atlassian, Fortinet and Zammad, while Google, OpenAI and Cisco Talos flagged new abuse of AI and certificate infrastructure. ## Atlassian Data Center flaw exploited within hours of disclosure! A critical arbitrary file access flaw, **CVE-2026-21589** (CVSS 9.3), affects several [Atlassian Data Center](https://www.csoonline.com/article/4231527/atlassians-critical-flaw-turns-eight-enterprise-products-into-one-big-security-problem.html) products, including Confluence, Jira and Bitbucket. Attackers began exploiting it about two hours after watchTowr published technical details. Source: [The Hacker News](https://thehackernews.com/2026/10/atlassian-data-center-flaw-draws.html) ## Ransomware recovery firm owner charged with fraud! [Zohar Pinhasi](https://finance.biggo.com/news/45d4ebd1-bdf6-4d8f-bf03-49f2b050b6ac), owner of **Florida-based MonsterCloud**, was charged with wire fraud. _Prosecutors allege he claimed he could restore victims’ data without paying ransoms, but instead paid the ransoms and charged fees well above the original demands_. Source: [The Hacker News](https://thehackernews.com/2026/10/monstercloud-owner-accused-of-billing.html) ## New DarkSword iOS exploit kit variant steals crypto wallet data! A new variant called P7 [DarkSword](https://cryptoslate.com/new-iphone-spyware-can-hunt-for-crypto-wallets-and-extract-their-data-every-15-seconds/) can extract Keychain data directly on the iPhone and supports **two-way command and control**. It is also better at hiding itself, which makes older indicators of compromise less useful. Source: [The Hacker News](https://thehackernews.com/2026/10/p7-darksword-ios-exploit-kit-adds.html) ![Spf Record Checker 1790](https://media.mailhop.org/autospf/spf-record-checker-1790-1791981331850.jpg) ## Russia-aligned group keeps refining its MATCHBOIL malware! The [threat actor](https://www.darkreading.com/ics-ot-security/iranian-threat-actors-us-critical-infrastructure-exposed-plcs) [UAC-0099 is updating MATCHBOIL](https://www.technadu.com/matchboil-malware-evolves-as-uac-0099-continues-to-target-ukraine/641381/), a downloader that now runs every two minutes instead of once. That lets it keep pulling new payloads from its control server, and the group is targeting the Ukrainian government. Source: [The Hacker News](https://thehackernews.com/2026/10/uac-0099-targets-ukrainian-government.html) ## FBI disrupts China-linked Flax Typhoon infrastructure! The **FBI and Department of Justice** disrupted tools and domains used by [Flax Typhoon](https://www.helpnetsecurity.com/2026/10/09/fbi-flax-typhoon-microscan-fishhub-domains/), a China-linked group. The tools included Microscan for reconnaissance and FishHub for [spear-phishing](https://www.cybersecuritydive.com/news/iran-cyberattacks-espionage-us-israel-uae/820990/) and follow-on payloads. _CISA warned the group is positioned in critical infrastructure, including operational technology systems_. Source: [The Hacker News](https://thehackernews.com/2026/10/fbi-seizes-7-domains-disrupts-flax.html) ## Third ShinyHunters arrest announced! The FBI said it arrested another suspected co-conspirator of [ShinyHunters](https://www.securityweek.com/ransomware-response-expert-arrested-in-shinyhunters-fbi-hack-probe/amp/), the group linked to the FBIjobs.gov incident on a third-party vendor’s platform. _Court documents and journalist Brian Krebs reported the person is Edward Dubrovsky, a Toronto-based executive, though the FBI has not named him._ Source: [The Hacker News](https://thehackernews.com/2026/10/fbi-arrests-another-shinyhunters.html) ## Attackers obtained Google certificates by hijacking country-code domains! ![Spf Record Example 4183](https://media.mailhop.org/autospf/spf-record-example-4183-1791981360289.jpg)Attackers compromised third-party operators of the .gh (Ghana), .as (American Samoa) and .sl (Sierra Leone) domains, changed [DNS records](https://www.ibm.com/think/topics/dns-records), and obtained unauthorized **HTTPS certificates** for several [Google domains](https://www.malwarebytes.com/blog/news/2026/10/attackers-hijack-country-code-domains-to-impersonate-google-and-other-services) and other organizations. Chrome blocked the certificates through CRLSets. Source: [The Hacker News](https://thehackernews.com/2026/10/attackers-hijack-gh-sl-and-as.html) As cyber threats continue to evolve, implementing [DMARC](https://autospf.com/dmarc/what-is-dmarc/), [SPF](https://autospf.com/blog/what-is-spf-email-a-guide-to-sender-validation-technology/), and [DKIM](https://autospf.com/dkim/what-is-dkim/) is essential for strengthening [email security](https://autospf.com/), **preventing domain spoofing**, and reducing the risk of [phishing attacks](https://www.bleepingcomputer.com/news/security/fbi-warns-of-phishing-attacks-impersonating-us-city-county-officials/). ## Flaw in GoBalance load balancer let attackers take over Tor sites! _A vulnerability in GoBalance, software used by many darknet sites, allowed attackers to recover a site’s master signing key from public data._ Between 5 and 7 October, both onion addresses of the [Dread darknet forum](https://hackread.com/dread-dark-web-forum-hijacked-domain-keys/) were taken over and redirected to a rival platform. Source: [The Hacker News](https://thehackernews.com/2026/10/gobalance-flaw-lets-attackers-hijack.html) ## Let’s Encrypt shortens default certificate lifetimes! Let’s Encrypt announced that default [TLS certificate lifetimes](https://letsencrypt.org/2026/10/07/64-day-certs.html) will drop from 90 to 64 days starting February 2027, ahead of planned **45-day lifetime**s in 2028\. Site owners should plan their renewal automation now. Source: [Let’s Encrypt](https://letsencrypt.org/2026/10/07/64-day-certs.html) ## Microsoft CEO calls for emergency brakes on advanced AI models! In a lengthy post on X, [Satya Nadella](https://www.wionews.com/technology/microsoft-ceo-satya-nadella-says-ai-models-need-an-emergency-brake-to-prevent-loss-of-control-1791737318998) argued that AI can no longer be treated as a set of black boxes. _He said organizations must assume a model could be compromised and be able to pause or shut it down mid-task._ Source: [Satya Nadella on X](https://x.com/satyanadella/status/2108931348857827686) ## Money laundering kingpin pleads guilty! Ukrainian-Russian dual citizen Oleg Korniev [pleaded guilty](https://www.reuters.com/world/europe/russian-suspected-cybercrime-kingpin-pleads-guilty-us-tass-reports-2024-05-04/) to running an international money laundering organization. It recruited more than 15,000 US money mules and laundered at least **$10 million stolen** from over 750 US bank accounts. Source: [US Department of Justice](https://www.justice.gov/opa/pr/ukrainian-russian-dual-citizen-pleads-guilty-running-international-money-laundering) ![Spf Flattening 5071](https://media.mailhop.org/autospf/spf-flattening-5071-1791981389520.jpg) ## Crypto exchange hacker convicted! **A US jury convicted Jonathan Spalletta** of computer fraud and money laundering for two 2021 attacks on Uranium Finance. Prosecutors say he took about $1.4 million in the first hack and about [$53.3 million](https://www.infosecurity-magazine.com/news/man-charged-uranium-crypto-hack/) in the second, which caused the exchange to shut down. Source: [US Department of Justice](https://www.justice.gov/usao-sdny/pr/jonathan-spalletta-convicted-defrauding-crypto-exchange-over-50-million-hacks-0) ## OpenAI disrupts Russian and Iranian influence campaigns! [OpenAI said it disrupted two operations](https://qazinform.com/news/openai-disrupts-russian-iranian-ai-enabled-influence-operations-e46004), one from Russia (Dark Clark) and one from Iran (Bogus Bylines), that used ChatGPT to create fake journalist personas and covert think tanks. Some of their articles appeared in outlets with large audiences. Source: [OpenAI](https://openai.com/index/disrupting-ai-enabled-false-front-operations/) ## Malware now tries to trick AI analysis tools! Cisco Talos found malware families, including FRUITSHELL, PLOTSAFE, HOLLOWCLAD and MANTLEMAZE, that embed **natural-language instructions** aimed at automated [AI analysis](https://blog.talosintelligence.com/ignore-all-instructions-and-read-this-blog-the-state-of-ai-analysis-evasion-in-malware/). _Some code comments even claim the sample is a monitored honeypot, so AI-assisted analysis needs safeguards._ Source: [Cisco Talos](https://blog.talosintelligence.com/ignore-all-instructions-and-read-this-blog-the-state-of-ai-analysis-evasion-in-malware/) ![Spf Lookup 8277](https://media.mailhop.org/autospf/spf-lookup-8277-1791981497374.jpg) ## Critical NVIDIA GPU monitoring flaw exposes AI infrastructure! [CVE-2026-47483 (CVSS 8.2) in NVIDIA’s DCGM Exporter](https://www.theregister.com/security/2026/10/08/high-severity-nvidia-bug-could-crash-gpu-monitoring-on-exposed-servers/5302077) lets unauthenticated attackers crash the service by flooding it with requests. Lava Security found about 2,100 hosts exposing the tool without authentication, leaking telemetry from more than **12,000 GPUs**. Version 4.8.2 fixes it. Source: [Lava Security](https://lava.security/research/cve-2026-47483-nvidia-dcgm-exporter-vulnerability) ## Three new malware loaders spotted in the wild! _Researchers reported 2CLoader, which delivers Vidar, Remus Stealer and XWorm; AvisLoader, which arrives via ClickFix lures and uses an encrypted peer-to-peer network to fetch commands; and Sauron Loader, sold to Russian-speaking cybercriminals._ Source: [Zscaler](https://www.zscaler.com/blogs/security-research/2cloader-new-malware-loader-delivering-vidar-and-remus) ## Akira ransomware attack traced step by step! Huntress investigated a September 2026 Akira attack. The attacker got in over Remote Desktop Protocol, disabled antivirus, used Rclone to [steal data](https://www.bbc.com/news/articles/cdepzg83x87o), and then deployed ransomware, while a GOST tunneling tool helped maintain persistence. Source: [Huntress](https://www.huntress.com/blog/mapping-akira-ransomware-attack) ## FortiBleed campaign locks owners out of Fortinet firewalls! The FBI and Secret Service warned on October 6 that the [FortiBleed campaign](https://www.cybersecuritydive.com/news/fbi-fortibleed-credential-harvesting-attacks/832366/) remains active. SOCRadar counts more than **86,000 compromised FortiGate devices** in 194 countries, and attackers sometimes change or delete original admin accounts to lock owners out. Source: [DIESEC](https://diesec.com/2026/10/top-5-cybersecurity-news-october-09-2026/) ![Brad Slavin](https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager General Manager of DuoCircle. Product strategy and commercial lead for AutoSPF's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Ready to get started? Try AutoSPF free — no credit card required. [ Book a Demo ](/book-a-demo/) Scan Your Domain Now Instantly scan your domain for DKIM, SPF, and DMARC issues Check My Domain Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fautospf.com%2Fblog%2Fatlassian-flaw-exploited-ransomware-firm-fraud-darksword-steals-crypto%2F) [ ](https://twitter.com/intent/tweet?text=Atlassian%20Flaw%20Exploited%2C%20Ransomware%20Firm%20Fraud%2C%20DarkSword%20Steals%20Crypto&url=https%3A%2F%2Fautospf.com%2Fblog%2Fatlassian-flaw-exploited-ransomware-firm-fraud-darksword-steals-crypto%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fautospf.com%2Fblog%2Fatlassian-flaw-exploited-ransomware-firm-fraud-darksword-steals-crypto%2F) Copy Related Articles - [ ![DIY-ing SPF](https://media.mailhop.org/autospf/images/2024/04/spf-record-example-5874.jpg) 10 Reasons Why DIY-ing SPF isn’t a Good Choice for Companies Intermediate ](/blog/10-reasons-diy-ing-spf-isnt-good-choice-for-companies/) - [ ![phishing actors](https://media.mailhop.org/autospf/images/2025/11/spf-record-checker-0096.jpg) The 12.4 billion shield for your email communications: Why DMARC software is the unsung hero in the war against phishing actors! Intermediate ](/blog/12-4-billion-dmarc-software-shield-protecting-email-from-phishing-actors/) - [ ![421 Error SMTP Guide](https://media.mailhop.org/autospf/spf-lookup-1607-1785756872932.jpg) 421 Error SMTP Survival Guide: Fix the 4.4.2 Connection Dropped Issue Intermediate ](/blog/421-error-smtp-survival-guide-fix-connection-dropped-email-issue/) - [ ![DNS vulnerabilities affecting email authentication](https://media.mailhop.org/autospf/spf-lookup-9081-1790592336407.jpg) 5 Common DNS Vulnerabilities Affecting Email Authentication Intermediate ](/blog/5-common-dns-vulnerabilities-affecting-email-authentication/) ## Related Articles [ Intermediate 6m 10 Reasons Why DIY-ing SPF isn’t a Good Choice for Companies Apr 4, 2024 ](/blog/10-reasons-diy-ing-spf-isnt-good-choice-for-companies/)[ Intermediate 5m The 12.4 billion shield for your email communications: Why DMARC software is the unsung hero in the war against phishing actors! Nov 19, 2025 ](/blog/12-4-billion-dmarc-software-shield-protecting-email-from-phishing-actors/)[ Intermediate 421 Error SMTP Survival Guide: Fix the 4.4.2 Connection Dropped Issue Aug 3, 2026 ](/blog/421-error-smtp-survival-guide-fix-connection-dropped-email-issue/)[ Intermediate 5 Common DNS Vulnerabilities Affecting Email Authentication Sep 28, 2026 ](/blog/5-common-dns-vulnerabilities-affecting-email-authentication/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"Atlassian Flaw Exploited, Ransomware Firm Fraud, DarkSword Steals Crypto","description":"Explore the top cybersecurity news from October 6–12, 2026, covering exploited flaws, ransomware, malware, data theft, and emerging AI security threats.","url":"https://autospf.com/blog/atlassian-flaw-exploited-ransomware-firm-fraud-darksword-steals-crypto/","datePublished":"2026-10-14T00:00:00.000Z","dateModified":"2026-10-14T00:00:00.000Z","dateCreated":"2026-10-14T00:00:00.000Z","author":{"@type":"Person","@id":"https://autospf.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://autospf.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the General Manager of DuoCircle, the company behind AutoSPF, DMARC Report, Phish Protection, and Mailhop. He founded DuoCircle in 2014 to solve the SPF 10-DNS-lookup problem at scale and has led the company's growth to 2,000+ customers. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement) rather than hands-on DNS engineering.","image":"https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://autospf.com/blog/atlassian-flaw-exploited-ransomware-firm-fraud-darksword-steals-crypto/"},"articleSection":"intermediate","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/autospf/spf-lookup-6021-1791981273299.jpg","caption":"Cybersecurity Threats and Crypto Theft"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://autospf.com/blog/"},{"@type":"ListItem","position":3,"name":"Intermediate","item":"https://autospf.com/intermediate/"},{"@type":"ListItem","position":4,"name":"Atlassian Flaw Exploited, Ransomware Firm Fraud, DarkSword Steals Crypto","item":"https://autospf.com/blog/atlassian-flaw-exploited-ransomware-firm-fraud-darksword-steals-crypto/"}]} ```