28th September – Threat Intelligence Report
Reported exploitedCheck Point Security GatewayShinyHuntersCheck Point Security ManagementOur summary
Check Point's latest Threat Intelligence Report covers a week dominated by breaches and active exploitation of critical flaws. The ShinyHunters group defaced FBIjobs.gov and claims to have exfiltrated FBI personnel and applicant data, while the Storm-2570 affiliate was found running consistent post-compromise tooling across Qilin, DragonForce, Anubis, and BERT ransomware operations. On the vulnerability side, Check Point confirmed in-the-wild attacks against two pre-authentication, 9.8-CVSS flaws in Security Gateway and Security Management (CVE-2026-85102 and CVE-2026-93616) that allow remote code execution, and F5 patched an actively exploited heap overflow in BIG-IP Access Policy Manager (CVE-2026-94127) that permits unauthenticated RCE under OAuth-configured access policies. Separately, WordPress addressed CVE-2026-87902, a local file-inclusion bug in versions before 7.1.2 already being abused to plant malicious PHP files, and Bitget disclosed a $351.6 million crypto theft suspected to involve North Korean actors. Fixes exist for all the named flaws, making prompt patching the key defensive step this week.
Below is the opening; the full story is at Check Point Research.
From Check Point Research
For the latest discoveries in cyber research for the week of 28th September, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
- The FBI has confirmed unauthorized activity affecting FBIjobs.gov after the ShinyHunters group defaced the website. The group claimed to have stolen employee and applicant information and shared samples of purported FBI personnel records with several media organizations.
- Astrana Health, a major US healthcare technology provider, has confirmed a cyberattack that exposed confidential information. Attackers spoofed the company’s telephone number to impersonate personnel and gained access to its servers. Astrana restored systems from backups and disclosed the incident in an SEC filing but has not publicly revealed what data was exposed.
- Cryptocurrency exchange Bitget has disclosed the theft of $351.6 million from several hot and warm wallets. The company detected unauthorized transfers on September 24 and temporarily suspended withdrawals. Bitget said cold wallets and most platform assets were unaffected, while suspected North Korean involvement remains under examination.
- Ludwig Maximilian University of Munich, one of Germany’s largest universities, has suffered a data breach after an attacker accessed an enrollment system. The university said information was likely retrieved, potentially including names, bank details, health insurance information, and financial aid identifiers belonging to students.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.