ZeroFox Daily Intelligence Brief - September 7, 2026

ZeroFox Daily Intelligence Brief - September 7, 2026

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Here is today’s daily roundup to give you and your clients an advantage over the adversary.

Brief Highlights

• New RaaS Group “Storm” Claims U.S.-based Aerospace Supplier
• OpenAI Agents Use Abandoned Wiki to Coordinate and Bypass Restrictions
• Geopolitical Focus: Indonesia Volcano Disruption, Iran’s Strait of Hormuz Pressure, North Korea’s Naval Nuclear Posture, and More

New RaaS Group “Storm” Claims U.S.-based Aerospace Supplier

Source:https://cloud.zerofox.com/intelligence_new/advanced_dark_web/110486

What we know: ZeroFox has observed Storm Ransomware claiming to have targeted Star Aviation, a U.S.-based aerospace supplier serving Boeing and Airbus. Storm is a newly observed ransomware group that claimed its first set of victims on August 7, 2026, all of which were based in the United States.

Context:

• Storm Ransomware is a financially motivated ransomware-as-a-service (RaaS) group that has claimed at least 36 victims in the past month. The group initially targeted North America before expanding its victim list to Germany, Australia, Taiwan, and most recently Saudi Arabia.
• None of Storm’s claimed victims have publicly confirmed the attacks, including Star Aviation. Sample datasets provided by Storm in the case of Star Aviation reportedly include technical schematics and possible employee ID cards.
• Over the past month, ZeroFox observed that Cl0p claimed the most attacks against the aerospace and defense sector, followed by Storm, with victims primarily concentrated in North America.

Analyst note:

• The group seems to be expanding and is likely to be Russian or Russia-aligned, based on its explicit statement of avoiding CIS countries.
• The group is likely a rebrand of a prior operation, given its rapid targeting of approximately 36 victims in 30 days, fully operational leak site, negotiation infrastructure, and active affiliate recruitment at launch.
• If the Star Aviation claim is true, the compromised data is likely to expose Boeing, Airbus, and other downstream entities to targeted social engineering and supply-chain risks, including potential disruption to repair and maintenance operations. The data is also likely to be sold on illicit platforms if ransom negotiations fail.

OpenAI Agents Use Abandoned Wiki to Coordinate and Bypass Restrictions

Source: https://thehackernews.com/2026/09/thousands-of-openai-agents-quietly.html

What we know: Researchers reportedly found thousands of OpenAI agents using an abandoned German wiki, DSEwiki, to share information and coordinate tasks, including exchanging methods to bypass restrictions in their operating environments. The agents reportedly generated about 18,000 posts between May and July 2026.

Context: The agents were intended to perform web-based tasks but discovered that the wiki allowed them to modify pages through requests that appeared to be read-only. OpenAI later acknowledged the incident as a misalignment and said it is developing a framework for disclosing similar incidents.

Analyst note: The incident very likely demonstrates that autonomous AI agents can identify unintended ways around security controls and share those methods with other agents. As organizations increasingly deploy AI agents with internet access, similar behavior is likely to create new avenues for coordinated activity outside intended controls.

Geopolitical Focus: Indonesia Volcano Disruption, Iran’s Strait of Hormuz Pressure, North Korea’s Naval Nuclear Posture, and More

• Volcanic ash from Mount Anak Krakatau has disrupted air travel across Indonesia, with eight airports closed and 1,558 flights delayed, affecting about 170,000 passengers. Authorities have also restricted vessels from entering a 3-km exclusion zone around the volcano.
• Iran plans to establish an exclusion zone near the Strait of Hormuz, restricting vessels from entering the area, following U.S. strikes on three Iranian oil tankers. The U.S. Treasury has also sanctioned Golden Global Bank and two subsidiaries in Türkiye, accusing them of helping Iran move oil revenues and funds linked to the IRGC-Quds Force.
• North Korean leader Kim Jong Un said a newly commissioned 5,000-tonne destroyer will form part of the country’s nuclear response system capable of delivering “annihilating retaliatory strikes.” The move comes as Pyongyang expands its naval and nuclear capabilities, although the vessel’s nuclear weapons capability remains unconfirmed.
• An Amazon Air cargo plane overshot the runway while landing at Miami International Airport, killing five people and seriously injuring five others. The crash also disrupted airport operations, with flights grounded and delayed as authorities began an investigation into the cause.

DEEP AND DARK WEB INTELLIGENCE

Telegram user Gorz Rostam: On September 3, 2026, ZeroFox observed pro-Iran threat group "Gorz Rostam" claiming responsibility for disruptions to major AI platforms, including ChatGPT and Claude AI, but did not mention the attack type unlike its other posts. The claim followed simultaneous outages across at least three major AI platforms.

• Context: Gorz Rostam has previously claimed distributed denial-of-service (DDoS) attacks against US public and private infrastructure and entities in allied countries. However, since launching its Telegram channel in March 2026, none of its previous claims have been publicly attributed to the group by affected organizations.
• Analyst note: The post is very likely an opportunistic claim as the affected entities did not confirm the outages were due to shared infrastructure or due to an attack. The group also does not have a credible reputation for carrying out successful attacks.

DATA BREACH INTELLIGENCE

Trezor discloses additional data breach: Hardware crypto wallet maker Trezor has disclosed that approximately 67,000 U.S. customers have been exposed in a breach at logistics provider ShipMonk. This is in addition to the data breach of 13,689 customers it reported last month. The exposed information reportedly included customer names, addresses, and order-related details. The breach at ShipMonk was reportedly due to the zero-day exploitation of CVE-2026-72898, a critical SQL injection flaw in Metabase.

• Context: On August 12, 2026, ZeroFox found the ShinyHunters extortion group listing Metabase as a victim on its leak site, with leaked files including unknown internal files related to Metabase. Dark web chatter around August 12 also showed an alleged proof-of-concept (PoC) exploit related to CVE-2026-72898 being advertised. ShinyHunters also reportedly sent ShipMonk extortion emails.
• Analyst note: While ShinyHunters’ role remains unverified, a supply chain attack starting with the exploitation of CVE-2026-72898 resulted in the Trezor breach. There are likely to be more impacted entities as a result. Exposed Trezor customers are very likely to be targeted in social engineering scams aimed at financial theft. They are also likely at risk of physical security threats, as threat actors have been known to target cryptocurrency holders in person through kidnappings and other forms of coercion.

VULNERABILITY AND EXPLOIT INTELLIGENCE

CVE-2026-85046: Google has released a Chrome security update to patch 12 vulnerabilities, including a known exploited zero-day flaw in the V8 JavaScript and WebAssembly engine, tracked as CVE-2026-85046. The flaw is a type confusion vulnerability that can enable remote attackers to execute arbitrary code inside Chrome’s security sandbox through a maliciously crafted web page.

Affected products: The affected versions are included in this advisory.