The Flax Typhoon gets a cold front.

Dave Bittner reports that an international coalition disrupted infrastructure used by Integrity Technology Group, a Chinese cybersecurity company that U.S. officials say supports state-backed hacking. The U.S. Justice Department seized websites supporting two Integrity Tech tools: Microscan, which automated reconnaissance and vulnerability scanning, and Phishub, which supported phishing and malware deployment after attackers entered victim networks. The tools were used in the long-running Flax Typhoon campaign. Microscan was used against targets including power companies, airports, and other critical-infrastructure organizations. Officials also say Chinese operators targeted poorly monitored edge devices to maintain persistent access, potentially positioning themselves to disrupt critical infrastructure later. Agencies from the United States, Australia, Japan, the United Kingdom, Spain, New Zealand, and Canada contributed to an advisory describing the tools and the group's operations. The episode's title, "The Flax Typhoon gets a cold front," refers to this coordinated disruption of the campaign's infrastructure.

Authorities in Ghana say they dismantled suspected cybercrime centers in the Great Accra region, arrested eight suspects, and rescued 120 people believed to have been trafficked and forced to conduct online fraud, including romance scams. Investigators seized 136 phones, 130 laptops, networking equipment, vehicles, and other evidence. Most of those rescued were Nigerians, and Ghanaian authorities are working on their repatriation. The operation generated a dispute over credit and authority. FBI Director Kash Patel described the raid as part of the Bureau's global Operation Blackout, while Ghana's Cybersecurity Authority said the operation was planned, coordinated, and executed by Ghanaian authorities. Ghana acknowledged intelligence support from the FBI and Britain's National Crime Agency but emphasized that foreign agencies cannot independently exercise police powers in Ghana. The briefing also covers Anthropic's effort to shorten the time between discovering an AI-assisted vulnerability and fixing it. Its free OSS scanner will periodically scan participating open-source projects with Anthropic's most capable models and send maintainers vulnerability details, proof-of-concept exploits, and possible fixes. Reports are sent without human review, so errors are possible, although Anthropic expects a true-positive rate above 90%. Its separate critical-infrastructure defense program provides models, engineers, and threat research to organizations securing operational technology, where patching is difficult because industrial systems often cannot be taken offline.

Attackers appear to be exploiting a maximum-severity vulnerability in SonicWall SMA-1000 remote-access appliances only days after a patch became available. The flaw affects the workplace interface on several SMA-1000 models and could let an unauthenticated attacker force the appliance to access internal functionality and perform unauthorized operations. Security firm Previdian saw honeypot activity consistent with exploitation, although researchers have not confirmed that the attempts successfully compromised systems. Shadowserver is tracking more than 400 internet-exposed SMA-1000 appliances, but the number that remain unpatched is unknown. The product line has already had a difficult year: attackers exploited several zero-days, including flaws used to install custom malware and vulnerabilities later linked by CISA to ransomware operations. The Cybersecurity Information Sharing Act of 2015 is also stuck in Congress more than a year after its permanent authorization expired. The law gives companies certain liability protections when sharing cyber-threat indicators with the government or with one another. Short-term extensions have preserved the protections but tied them to repeated government-funding disputes. Senate Homeland Security Chairman Rand Paul is blocking a long-term extension while seeking an amendment limiting government efforts to influence social-media content moderation. Bipartisan proposals would extend the law through 2035, but none has advanced. Cyber Threat Alliance president Michael Daniel supports a medium-term extension that would give Congress time to modernize the law for AI-era threats, including information about model-distillation attacks.

Comparitech counted more than 2,600 claimed ransomware attacks during the third quarter of 2026, a record high and a 27% increase over the second quarter and 61% increase year over year. Only 247 attacks have been confirmed by the targeted organizations. Finance and technology experienced the sharpest quarterly increases, while education, healthcare, government, and utilities also saw substantial growth. Researchers suggested that advances in AI may be helping attackers scale and accelerate campaigns. They also pointed to the growing use of triple extortion: attackers encrypt systems, steal data, and then pressure the victim's customers or other connected individuals. The average ransom demand was slightly above $600,000. Keelan and The Gentlemen were identified as the most prolific groups, while the United States accounted for more than 1,000 claimed attacks, or 41% of the global total. Huntress says attackers are exploiting two unpatched vulnerabilities in AhsayCBS backup software to obtain unauthenticated remote code execution. The flaws affect even the latest version and have been used against at least five organizations. Attackers chained them to deploy web shells, conduct reconnaissance, install XMRig cryptocurrency miners, and establish persistence. Because no patch was available, Huntress recommended restricting the AhsayCBS management interface to trusted IP addresses or requiring VPN access, followed by checks for compromise.

Bitdefender uncovered a supply-chain campaign called Midnight Mimosa affecting inexpensive Android devices built on MediaTek platforms. The malware is embedded in device firmware before sale, giving it system-level privileges and persistence that survives ordinary attempts to uninstall it. Operators can remotely install or remove applications, grant permissions, and load additional code. Those capabilities support ad fraud, click fraud, and botnet activity. Bitdefender observed thousands of affected devices in more than 150 countries over a two-year period, with particularly strong representation in Western Europe and the Americas. Researchers also found 13 Google Play applications containing related ad-fraud code, although those applications did not have the privileged access provided by the firmware implant. Midnight Mimosa can temporarily disable Google Play and Play Protect while installing additional payloads. That means operators can control compromised devices from the moment they are activated, rather than needing to persuade a user to install a malicious application later. The briefing presents the campaign as a warning about the security of low-cost devices and the supply chain that produces their firmware.

Oleg Korniev, a 42-year-old Ukrainian-Russian dual citizen, pleaded guilty to helping run Your Mule Cash Out, a money-laundering operation that prosecutors say processed millions of dollars for cybercriminals worldwide. The organization had operated since 2007 and recruited more than 15,000 U.S. money mules through fake job offers. The recruited mules received stolen funds in their bank accounts and wired the money to cash-out contractors in Eastern Europe. Prosecutors allege that the network processed more than $10 million stolen from more than 750 U.S. bank accounts. Korniev admitted that the operation caused more than $14.7 million in actual and intended losses and that he personally laundered at least $7 million. He pleaded guilty to charges including money laundering, identity theft, and computer-fraud conspiracy. He faces a possible prison sentence ranging from two to 50 years. The case illustrates how cybercrime proceeds can be moved through apparently ordinary job seekers and bank accounts before being transferred to overseas cash-out networks.

Maria Varmazis interviews Dave Bittner as part of the CyberWire Daily's 10th-anniversary series, focusing on public-private partnerships and law-enforcement operations. Dave defines the partnership as the interaction between substantial cybersecurity capabilities in the private sector and government authorities, intelligence, and resources. He describes the two sides as historically separate silos that must support one another because neither can make the country, or the wider world, safer alone. Looking back to roughly 2016, Dave says cooperation existed but was more episodic and relationship-driven. After something bad happened, people who already knew one another would get on the phone. Private companies were uncertain what they gained by bringing government into an incident and worried about regulatory scrutiny, litigation, reputational damage, or losing control. Maria jokes that bringing in former colleagues from a three-letter agency could sometimes be a matter of hiring the right person; Dave calls that pathway real but says it has both advantages and disadvantages. Dave says partnerships are now more institutionalized, with standing relationships and established channels. Government brings authorities, intelligence, and foreign-partner relationships, while industry owns much of the infrastructure and sees activity that government cannot. He credits the cumulative effect of incidents such as SolarWinds, Colonial Pipeline, ransomware, and attacks on healthcare and critical infrastructure rather than one single "cyber Pearl Harbor" moment. Colonial Pipeline showed that a private ransomware incident could become a national issue involving fuel, transportation, and public safety. Standing groups such as ISACs and the Joint Cyber Defense Collaborative help build trust and work through bureaucracy before a crisis, but Dave warns that an organizational partnership must still be maintained as people, priorities, and administrations change. He and Maria agree that when an incident reaches a large enough scale, government involvement may be inevitable, so organizations should establish and practice those relationships in advance.

The final news item reports that OpenAI released more than 350 AI-generated mathematical findings in a single day. The results span algebra, number theory, topology, and other fields, including a proof of the quasi-Riemann hypothesis. Rutgers mathematician Alex Kontorovich said that if a human had produced that proof, it would merit a medal. The release did not mean the work was settled. Researchers still need to verify the results, and OpenAI had withdrawn three papers and corrected others by Thursday. The episode says mathematicians are also considering the broader implications for peer review, graduate education, and the enjoyment of doing mathematics itself. The concluding characterization is that AI systems have climbed formidable mathematical mountains, but mathematicians now have to verify the routes and consider what it means if the machines begin choosing which peaks to climb. The program ends with a reminder that there will be no CyberWire Daily episode on Monday, October 12, for Indigenous Peoples Day in the United States. Research Saturday will feature Adam Myers of CrowdStrike discussing Phantom Raven, an LLM-generated information stealer developed for bug-bounty hunting, and Sunday's T-Minus Space Cyber Briefing will begin Maria Varmazis and producer Ethan Cook's discussion of executive orders shaping U.S. space policy.