Attackers in Japan have abused mobile app APIs and hit known flaws in tools like Metabase, leading to a sharp rise in web data leaks reported to JPCERT/CC. This is a reminder to treat mobile backends and third party web apps as exposed services that need the same patching and access control as anything public facing.
The FBI and US DoJ have seized seven domains tied to the China linked group Flax Typhoon that were used to scan and in some cases infiltrate critical infrastructure. Even if you are not in the US, it is a nudge to keep an eye on outbound traffic to odd domains and to review how you segment anything that looks like operational tech or critical services.
In a separate case, the FBI says a China linked crew tied to Integrity Technology Group ran a portal that let others access stolen email from governments, law enforcement, healthcare, and religious bodies in Southeast Asia. If your users handle sensitive email, this backs the case for strict patching on mail servers, phishing training, and watching for unusual sign ins or forwarding rules.
CrowdStrike has detailed a campaign against South Korean financial firms where attackers used an AI pen testing tool called ARTEX for data theft between late September and early October 2026. The same AI tools defenders like can now show up in live attacks, so it is worth checking that your own pen test tools are locked down and that data exfiltration alerts are tuned.
The latest ThreatsDay round up highlights a ransomware affiliate who kept all the profits, an exposed attacker server full of tools, and malicious code in developer packages and extensions. Supply chain and insider style risks are not just a big vendor problem, so small teams should tighten access for contractors, review third party code sources, and log admin actions in case trust breaks.
Need IT support that just works? Email hello@icthero.co.uk or talk to us.