A U.S. court on Monday granted the government's request to detain Abdulrahman Alfozan, a 35-year-old Saudi national and former OpenAI engineer, accused of planting a concealed audio recorder in an executive conference room at the company's San Francisco office. A prosecution filing says he was in frequent WhatsApp contact in 2025-2026 wit…
The NSA, CISA and FBI issued joint advisory AA26-251A warning that China-based AI companies are running industrial-scale knowledge distillation campaigns against U.S. frontier AI models. The named companies are DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI. According to the agencies, they have extracted billions of tokens acro…
Bullhorn, a US-based recruitment software provider serving more than 10,000 customers, disabled access to its platform after detecting a cyber incident on October 16-17, 2026. The company engaged CrowdStrike to investigate and restore services. Systems are back online in the UK, US and Australia, but as of October 20 some users still had …
Acronis Threat Research Unit found that the Gentlemen ransomware operation is using the BYOVD (bring your own vulnerable driver) technique with legitimate Lenovo and Safetica kernel drivers to terminate endpoint security software before encrypting files. Two custom dropper samples were recovered from a recent incident. They install the dr…
A Chinese-speaking threat actor used AI agents coordinated through the open-source Cairn platform to attempt intrusions against more than 1,200 websites, reportedly compromising sites of over 100 companies, including Deere, SharkNinja and Cummins. Researcher Snorre Fagerland of NorForge found the activity while monitoring internet-exposed…
This SentinelOne weekly roundup covers law enforcement wins and two major breaches. A federal court sentenced former U.S. Army soldier Cameron John Wagenius to 70 months for attacks on technology and telecom firms, and former U.S. Air Force members Chijioke Timothy Odimegwu and Harafat Mogaji received a combined 189 months for business em…
CrowdStrike researchers analyzed AI infrastructure left openly exposed on web servers by four previously unreported criminal groups (Chinese-, Spanish/English-, Indonesian- and Russian-speaking). The groups ran attacks between May and August 2026 using mostly older versions of Anthropic's Claude and open-weight Deepseek models. All four b…
This SentinelOne weekly roundup (Week 39, 2026) covers one law enforcement success and two active threat campaigns. A US court sentenced Armenian national Karen Serobovich Vardanyan ("Maneeken"/"Karl Lagerfeld"), an initial access specialist for Ryuk ransomware, to two years in prison and over $1.2 million in restitution. SentinelLABS ide…
The FBI has publicly called on remaining ShinyHunters members to surrender. Cyber division assistant director Brett Leatherman released a video thanking Dutch police for arresting a 24-year-old in Amsterdam. The FBI calls him "one of the alleged leaders" of the group, while Dutch police say only that he played a role. He is also suspected…