ZeroFox Daily Intelligence Brief - October 9, 2026
|by Alpha Team
ZeroFox Daily Intelligence Brief - October 9, 2026
ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Here is today’s daily roundup to give you and your clients an advantage over the adversary.
Brief Highlights
- U.S Seizes Chinese Hacking Tools Targeting Critical Infrastructure
- Ransomware Attack Disrupts Major Japanese Cloud Infrastructure Provider
- Ukraine Drone Hits Russian Data Center; Yandex Affected
U.S Seizes Chinese Hacking Tools Targeting Critical Infrastructure
What we know: The U.S. Department of Justice and FBI have seized two hacking tools—Microscan and FishHub—operated by a China-based company with government contracts. The tools were used by actors linked to advanced persistent threat (APT) group Flax Typhoon to conduct vulnerability scanning and spear phishing campaigns against critical infrastructure in the United States and abroad.
Context: Microscan was used to conduct reconnaissance of victim networks for exploitable vulnerabilities, facilitated through a botnet of IoT devices infected with a Mirai malware variant. FishHub facilitated network exploitation through spear phishing, downloading additional malware after initial compromise to establish remote access. Confirmed targets include a U.S. power company, Japanese and Polish airports, Taiwanese natural gas and power sector companies, and multiple universities across Taiwan.
Analyst note: The use of commercial contractors to conduct state-directed intrusions very likely provides China with plausible deniability while expanding the scale of its offensive cyber operations. While the seizures will likely cause temporary operational disruptions, associated actors are very likely to adapt their infrastructure and resume targeting.
Ransomware Attack Disrupts Major Japanese Cloud Infrastructure Provider
What we know: Japanese cloud infrastructure provider IDC Frontier (IDCF), a subsidiary of SoftBank Group, has disclosed a ransomware attack disrupting its East Japan Region 1 data center cluster. The attack affects 495 companies and local governments using IDCF cloud services.
Context: An unidentified threat actor has reportedly claimed to have encrypted 225 databases containing 3.6 petabyte (PB) of data, accessed 239 hypervisors, and wiped more than 554,000 snapshots.
Analyst note: Local government services and business systems hosted in the affected region are likely to remain unavailable in the immediate aftermath. The threat actor is very likely to demand ransom from IDCF. Additionally, downstream entities are also likely to face separate extortion attempts if data was taken from their environments.
Ukraine Drone Hits Russian Data Center; Yandex Affected
What we know: A Ukrainian drone attack has reportedly hit a data center in Russia’s Sasovo belonging toYandex, a major Russian search and cloud service provider. Yandex’s status page states that its cloud availability zone ru-central1-b is currently down.
Context: The drone attack caused a fire impacting one of Yandex’s five data centres. The company recommended the use of alternative service recovery options. Previously, Russian strikes reportedly hit Ukrainian data centers, affecting nearly 100,000 households in the Kyiv region.
Analyst note: Entities relying on the affected Yandex data center are likely to face long disruptions if migration of resources to another data center is not possible. However, it is unlikely to disrupt government and military use of the data centers in the immediate aftermath. Other Yandex data centers are likely to be targeted in similar drone attacks. Kinetic targeting of data centers is likely emerging as an escalation in attacks beyond traditional communication infrastructure. Interestingly, data centers have become a target in the Ukraine-Russia conflict rather recently in 2026 following Iran’s attacks against data centers in the Middle East conflict.
DEEP AND DARK WEB INTELLIGENCE
Organizational Disclosure website user mrhex: An untested threat actor “mrhex” has developed a website on the dark web called, Organizational Disclosure, which is claiming to host records associated with U.S. and Israeli governments The website offers search option for data allegedly including 147,629 records of armed forces and security agencies, 38,765 Israeli police records alongside drivers’ licenses, letters, images, and other correspondence of personnel as well as individuals on the wanted list. The data hosted on the site is unlikely to have been obtained through direct breaches and is likely to have been scraped from previously disclosed leaks or breaches. The actor is very likely ideologically or politically motivated.
VULNERABILITY AND EXPLOIT INTELLIGENCE
Cisco vulnerabilities: Cisco has disclosed three critical NGOAM vulnerabilities, CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501, that could enable unauthenticated remote attackers to execute code with root privileges or trigger denial-of-service by sending crafted IP packets. In addition to the three, Cisco also patched two other vulnerabilities, CVE-2026-76471 and CVE-2026-76465, that could enable threat actors to carry out remote code execution or denial-of-service through crafted requests.
Affected products: The affected products are listed in this advisory.
Tags: DIB, tlp:green