ZeroFox Daily Intelligence Brief - October 7, 2026

ZeroFox Daily Intelligence Brief - October 7, 2026

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Here is today’s daily roundup to give you and your clients an advantage over the adversary.

Brief Highlights

• British Fashion Retailer ASOS Confirms Unauthorized Access
• SafePay Ransomware Claims Breach of German IT Service Provider T-Systems
• FBI Warns FortiBleed Campaign Remains an Active Threat

British Fashion Retailer ASOS Confirms Unauthorized Access

Source: https://www.londonstockexchange.com/news-article/ASC/update-regarding-cyber-incident/17822931

What we know: British fashion retailer ASOS has confirmed that unauthorized users sent push notifications to customers on October 6, 2026. The unauthorized notifications had reportedly claimed compromise of the organization’s Snowflake instance and threatened to leak data associated with it.

Context: A threat group called "Xuanye group" claimed responsibility for the incident on their Telegram channel. ASOS said that basic personal information including contact details may have been accessed, but payment-card information or account passwords do not appear to be compromised. Snowflake has reportedly launched an investigation, but has not found a compromise of its platform so far. Additionally, the UK's cybersecurity agency has warned ASOS customers to remain alert for follow-on phishing attempts.

Analyst note: Threat actors likely compromised downstream third-party platforms used for customer communications as Snowflake does not provide end-user push notifications. Further unauthorized notifications are unlikely in the near term after ASOS restricted access to the affected platforms. Beyond the immediate impact on ASOS's share price, the incident is likely to result in additional financial losses through remediation, regulatory and legal costs, customer notification, and reputational damage.

SafePay Ransomware Claims Breach of German IT Service Provider T-Systems

Source: https://cloud.zerofox.com/intelligence_new/advanced_dark_web/112292

What we know: ZeroFox has observed the SafePay ransomware group listing T-Systems, a major German IT services provider, on its dark web leak site. T-Systems is a subsidiary of the partially state-owned telecom company Deutsche Telekom.

Context: T-Systems has not confirmed the incident. SafePay has issued a 48-hour deadline to negotiate before threatening to publish allegedly stolen data. ZeroFox observed SafePay as the most active threat group in the past 24 hours, with nine attacks recorded across multiple sectors. The ransomware group is known for double extortion tactics by exfiltrating data and encrypting the data. Previously, it has been reportedly linked to operational disruption at Microlise.

Analyst note: If SafePay’s claims are legitimate, the incident is likely to result in operational disruptions. Telecom sectors serve as high-value central hubs; compromising them very likely provides threat actors with access to critical infrastructure, valuable data that can be leveraged for state-sponsored espionage or high-leverage extortion. ZeroFox also observed that Deutsche Telekom has been repeatedly targeted by threat actors. SafePay's spike in victim postings in the past 24 hours likely indicates an aggressive operational burst aimed at forcing rapid ransom payments within narrow deadline windows.

FBI Warns FortiBleed Campaign Remains an Active Threat

Source: https://www.ic3.gov/CSA/2026/261006.pdf

What we know: FBI and partners have released an alert warning that the FortiBleed campaign remains active, targeting internet-facing Fortinet FortiGate firewalls and secure socket layer (SSL) virtual private network (VPN) gateways. The campaign has compromised over 86,644 devices across 194 countries.

Context: Attackers reuse leaked passwords and use GPU-powered systems to crack stored password hashes at scale. The operators act as access brokers, selling network access to other criminals, with reporting indicating that access has been passed to INC/Lynx and Payload ransomware affiliates. Some victims have been locked out of their Fortinet devices.

Analyst note: Compromised credentials are very likely to provide direct administrative access to Fortinet infrastructure of organizations without requiring exploitation of a new vulnerability. Operational disruptions are likely if users are locked out of their devices and threat actors modify configurations. Successful initial access is also likely to enable later movement within the affected network.

DEEP AND DARK WEB INTELLIGENCE

PwnForums user DaOnlySpark: Well-reputed threat actor "DaOnlySpark" has advertised data allegedly associated with Lopay, a UK-based fintech company, on dark web forum PwnForums. The actor claims to have exported approximately 38 GB of data across four databases, including personally identifiable information (PII) of merchants and customers and Know Your Customer (KYC) verification records that include passport and driving licence scans and selfies. The actor has also listed alleged password hashes, session tokens, and banking data. If legitimate, threat actors are likely to carry out credential stuffing attacks using password hashes and PII. Furthermore, the data is likely to be leveraged in phishing, social engineering, identity fraud, account takeover attempts, and/or fraudulent loan applications.

VULNERABILITY AND EXPLOIT INTELLIGENCE

CVE-2026-21589: This is an arbitrary file access vulnerability in eight Atlassian Data Center products, which enables an attacker with no login access to read specific files in the web application root directory. Exploitation requires prior knowledge of the exact file name and path and does not allow directory enumeration; however, some configurations may contain sensitive files, increasing the severity of the flaw.

Affected products: The affected products are listed in the advisory.