2026-W41 · 05 Oct – 11 Oct 2026 Makani Lab · Cyber Watch Operations · Force Protection · Professionals
BLUF — Rule-based issue (the AI curation stage has not run for this week). Items below are the highest-scoring open-source reports from the last seven days, one section per lane.
Threat actor spotlight — ShinyHunters · Criminal extortion group · UNC6040
Why now
Data theft and extortion via cloud/SaaS and enterprise app exploitation (Salesforce, Oracle); leak threats against government and corporate victims
Mentions, 30d
11 this week
Notable TTPs
—
Countermeasures
—
OperationsThreats to networks, missions, and infrastructure the command depends on: exploited vulns, intrusions, APT campaigns, ICS/OT, SATCOM/PNT, telecom.
In other news: Ransomware attack could have crippled South Africa's air traffic operations; US sanctions Venezuelan ATM hackers; Chinese APT targets AI experts.
Unauthorized users accessed sensitive records for roughly nine months before discovery, exposing another government personnel data fiasco as the FBI confronts its own breach incident.
Cisco Talos uncovered a cluster of activity we track as UAT-11587 targeting government and policy organizations across Asia, including in Taiwan, India, the Philippines, and Cambodia, to deliver a…
UNCLASSIFIED · open-source reporting only · 8 sources · built 2026-10-06 06:49 HSTCyber Watch · 2026-W41 · page 1 of 2
UNCLASSIFIED
Force ProtectionWhat Guardians, Airmen, civilians, and families need to know personally: scams, social engineering, apps and devices, OPSEC, breaches of consumer services, official guidance.
Cybersecurity firm Proofpoint said TA419 impersonated officials and AI industry figures in an effort to gain access to cloud accounts held by U.S. think tank, university and legal-sector experts.
According to Proofpoint, China-aligned TA419 posed as a former OSTP official, a former State economist and an Anthropic employee, inviting AI policy experts to a fake advisory committee and then phishing their Microsoft logins.
So what: Staff who work with think tanks get the same invitations.
Consider: Be aware that known names can be spoofed; verify out of band.
A new China-nexus cyber espionage group known as TA419 has been attributed to multiple credential phishing campaigns targeting artificial intelligence (AI) experts working for U.S. think tanks,…
Space & Cyber ProfessionalsContext for the cyber and space workforce: strategy, doctrine, policy, organization, workforce, standards, exercises, industry and technology trends.
Cyber Mastery Incentive Pay, part of CYBERCOM 2.0, launched 1 Oct. Documents reviewed by DefenseScoop show cuts of $100 to $1,000 a month in at least one branch.
So what: Pay changes bear on retaining cyber operators.
Consider: Recommend reviewing how C-MIP applies to USSF cyber billets.
The nomination comes about two weeks after Secretary of the Air Force Troy Meink announced that the U.S. military now has “on-orbit space control weapons."
SPACECOMNORTHCOMSpace & SATCOM
UNCLASSIFIED · open-source reporting only · 8 sources · built 2026-10-06 06:49 HSTCyber Watch · 2026-W41 · page 2 of 2