ZeroFox Daily Intelligence Brief - October 12, 2026

ZeroFox Daily Intelligence Brief - October 12, 2026

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Here is today’s daily roundup to give you and your clients an advantage over the adversary.

Brief Highlights

• FBI Arrests Suspected ShinyHunters Co-Conspirator
• New DarkSword iOS Exploit Variant Targets iPhone Credentials
• Geopolitical Focus: Missile Hits Saudi Airport, Flash Floods in Nepal, and More

FBI Arrests Suspected ShinyHunters Co-Conspirator

Source: https://www.bleepingcomputer.com/news/security/cyber-exec-arrested-in-case-allegedly-tied-to-shinyhunters-hackers/

What we know: The FBI has arrested a suspected co-conspirator of the ShinyHunters extortion group. The individual, an alleged cybersecurity executive, was detained in Pennsylvania while attending a conference.

Context: The arrest follows the September 15 detention of an Amsterdam-based suspected ShinyHunters leader by Dutch police, and the September 29 detention of a Jordan-based member. Separately, Germany has reportedly arrested a Russian national suspected of being a leading Qilin ransomware member following extradition from Japan.

Analyst note: The arrest of an individual operating within the ransomware negotiation space is very likely to expose the network of victims, payments, and communications handled through that channel. Threat actors linked to Russian-speaking cybercrime ecosystems have historically operated with relative impunity within Commonwealth of Independent States (CIS) countries. However, the arrest of a suspected member of Qilin ransomware in Japan and the subsequent extradition to Germany very likely confirms that travel to cooperating jurisdictions, even briefly, exposes these actors to significant risk of arrest and prosecution.

New DarkSword iOS Exploit Variant Targets iPhone Credentials

Source: https://thehackernews.com/2026/10/p7-darksword-ios-exploit-kit-adds.html

What we know: The P7 DarkSword iOS exploit kit, a new variant of the DarkSword iPhone hacking tool, reportedly enables attackers to steal iCloud Keychain credentials, photos, data from notes, app data, and cryptocurrency-wallet information from compromised iOS devices.

Context: The variant was reportedly developed after DarkSword’s code was leaked earlier this year. Researchers also observed attempts to modify the tool for iOS 26 and combine it with another iOS hacking tool called “Coruna.” Additionally, researchers reportedly found a Chinese-speaking exploitation-as-a-service operation offering Darksword, 11 victim recovery phrases, 179 device-loot directories, and a control panel listing 75 accounts from related infrastructure.

Analyst note: Given that DarkSword’s source code is now available, continued development is likely to enhance its data-theft capabilities and also increase its utility for state-backed espionage over time.

Geopolitical Focus: Missile Hits Saudi Airport, Flash Floods in Nepal, and More

• A missile attack reportedly hit the passenger terminal of Saudi Arabia’s King Khalid International Airport in Riyadh, resulting in the closure of the airport. Iran-backed Houthis claimed responsibility for the attack. Meanwhile, the U.S. Federal ​Aviation Administration (FAA) has issued a NOTAM to U.S. airlines to maintain caution while flying to or over Saudi Arabia.
• Fresh flash floods along Nepal’s Budhi Gandaki River has reportedly swept away bridges, nearly two dozen houses, and a camp at a hydropower project. Nepalese Army personnel rescued 49 people. A landslide upstream is believed to have triggered the flooding.
• Hurricane Isaias has hit the southern U.S. coast reportedly killing four people across Alabama and Florida and leaving approximately 500,000 people without power. Separately, Hurricane Simon has strengthened to Category 4 and is expected to make landfall on Mexico’s Pacific coast.
• Pakistan government has declared a state of emergency in its northwestern province of Khyber Pakhtunkhwa citing a deterioration in the law and order situation.

DEEP AND DARK WEB INTELLIGENCE

Exploit user DDEEAALLEERR: Moderately reputed threat actor "DDEEAALLEERR" has advertised access to a property management panel and booking data allegedly associated with 14 luxury hotels in the United States on dark web forum Exploit. The dataset allegedly includes personally identifiable information (PII) of guests, reservation details, and property door access codes.

• ZeroFox has observed the actor consistently targeting the hospitality sector across Saudi Arabia, India, Japan, South Korea, and the United States in the past five months. The activity very likely suggests a sustained, sector-specific campaign enabled by a shared point of compromise, possibly a popular property management system or third-party booking integration common across all targeted regions. Additional properties are very likely exposed or at risk of being targeted.

VULNERABILITY AND EXPLOIT INTELLIGENCE

CVE-2026-102255: SonicWall has released patches for a pre-authentication server-side request forgery (SSRF) vulnerability in SonicWall SMA1000 appliances. The flaw enables unauthenticated remote attackers to direct the appliance to access internal functionality and perform unauthorized operations. Exploitation attempts have been detected.

Affected products: SonicWall SMA1000 appliances, models 6210, 7210, and 8200v