CYFIRMA Says Black October Was a Disclosure Wave, Warns of Faster Supply-Chain Risk
Summary
CYFIRMA analyzed 42 incidents from Nov. 2025–Oct. 2026; 34 involved supplier pathways. It assesses October’s cluster as an uncoordinated disclosure wave and says AI speeds flaw discovery and puts AI tooling at risk, recommending stronger supplier controls and resilience
Key points
- Of 42 incidents analyzed from November 2025 to October 2026, 34 reached victims through supplier pathways; the sample is weighted toward October, and 13 supplier-path incidents had no disclosed root cause.
- The October disclosures involved at least six unrelated actor sets and a certificate authority failure with no attacker; 9 of 26 cases with known start dates began before October. CYFIRMA assesses a coordinated campaign as very unlikely.
- Of 21 supplier-path incidents with known causes, 14 involved basic control gaps. The failure sat with the supplier in 28 of 34 cases.
- AI tools or AI-provider keys were targeted in 8 of 34 supplier-path incidents. Gateways and developer platforms can concentrate credentials for multiple model providers.
- Microsoft’s monthly security-fix count rose from about 590 in July to about 1,410 in October; Microsoft credits LLM-assisted discovery. The report cautions that fix volume is not evidence of exploitation.
- The report says AI agents have accelerated some intrusions, but the techniques described remain established ones. It cites ARTEX use in reported South Korean and MSP-connected incidents.
- Recommendations include inventorying third-party applications and credentials, rotating and revoking supplier-held secrets, removing exposed management interfaces, and preparing tested recovery plans.
Article Details
- Publisher
- CYFIRMA Research
- Report Period
- Incident analysis: November 2025 to October 2026; information cut-off: 2026-11-02
- Scope
- Cross-sector analysis of supplier incidents, AI-enabled attacks, ransomware activity, and underground listings. Coverage is strongest in English-language and vendor sources; the Middle East and Africa are underrepresented.
- Sample Size
- 42 publicly reported incidents; 34 reached victims through a supplier.
- Key Statistics
- Of 42 incidents analysed from November 2025 to October 2026, 34 reached victims through a supplier.
- Of 21 supplier-path incidents with a known root cause, 14 (67%) involved basic control gaps; the failure sat with the supplier in 28 of 34 cases.
- Verizon's 2026 DBIR reported third-party involvement in 48% of breaches, compared with 30% in 2025; the report notes that the definition widened.
- CYFIRMA recorded 8,452 ransomware leak-site victims from 1 January to 28 October 2026, up 45% from the same period in 2025 and 110% from 2024.
- Of 32,368 underground forum listings captured from 1 January to 29 October 2026, 45% offered stolen data.
- Recommendations
- Inventory consented third-party applications, OAuth grants, API keys, and service accounts; alert on new credentials added to existing apps.
- Rotate secrets after supplier incidents, set token expirations, and revoke credentials and certificates held by former suppliers.
- Remove firewall, appliance, and OT-controller management interfaces from the internet; map shared components so they can be patched or shut down quickly.
- Pin dependencies, container images, and CI actions by hash; scan packages and delay adoption of new versions by a few days.
- Store AI-provider keys in a secrets manager, scope and cap them, monitor usage, and keep them out of AI coding agents' reach.
MITRE ATT&CK
T1110.003 · Password SprayingThe report says Storm-0940 used password spraying against MSP-connected cloud tenants, with attempts peaking at 2,900 per minute.T1190 · Exploit Public-Facing ApplicationThe report describes exploitation of known flaws in internet-facing applications and exposed management interfaces, including PHP runtime flaws and security appliances.
Threat Actors
Cl0pCYFIRMA's ransomware monitoring associates 89 victims in August 2026 with a mass-exploitation campaign identified as Cl0p.Storm-0940Microsoft reported that this China-aligned actor abused identities belonging to an MSP backup application to access customer cloud tenants, using ARTEX and reaching privileged access in under three hours in some tenants.TAG-217CrowdStrike and Zscaler reported that this actor used ARTEX against at least seven South Korean financial institutions. The article notes that the reporting was not confirmed by authorities.
Vendors
AmazonThe fix took more than two months, the embargo broke hours early, and Amazon’s honeypots recorded an exploitation attempt on 17 October, four days before disclosure.MicrosoftMicrosoft’s monthly security fixes rose from about 590 in July to about 1,410 in October, a rise Microsoft credits to LLM-assisted discovery.
Products
Tools
Countries
BrazilIn Brazil, a bank had left its payment technology provider months earlier, but its old client certificates were still valid and were used in an attack.ChinaA China-aligned actor, Storm-0940, abused the identities of an MSP backup application that customers had already consented to, reaching privileged access in under three hours in some tenants.IndiaIn India, a certificate authority failure reached global trust stores.JapanA leaked embargo forced early disclosure of PHP2Shell; Japan’s mandatory incident reporting for critical infrastructure operators took effect on 1 October, and once the label spread, analysts and journalists wentSouth KoreaPolice-investigated intrusions in South Korea and Microsoft’s reporting on a campaign against MSP-connected cloud tenants show AI agents compressing intrusions to hours, using old techniques.United Statesreported by a security vendor, was a China-linked actor rooting firewall management interfaces in the US and East Asia using PHP2Shell together with a second flaw.
Industries
Critical infrastructureA leaked embargo forced early disclosure of PHP2Shell; Japan’s mandatory incident reporting for critical infrastructure operators took effect on 1 October, and once the label spread, analysts and journalists wentlogisticsBackups were deleted in an attack on a logistics supplier (2025)