ZeroFox Daily Intelligence Brief - October 14, 2026
|by Alpha Team
ZeroFox Daily Intelligence Brief - October 14, 2026
ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Here is today’s daily roundup to give you and your clients an advantage over the adversary.
Brief Highlights
- Fashion Retailer The Foschini Group London Hit by Cyberattack
- ZeroFox Intelligence Flash Report - Ransomware Recovery CEO Charged for Secret Payments
- FBI Warns of Evolving North Korean IT Worker Scheme Targeting U.S. Companies
Fashion Retailer The Foschini Group London Hit by Cyberattack
Source: https://www.bbc.com/news/articles/cwly38gjkejko
What we know: The UK arm of South Africa's The Foschini Group, TFG London has confirmed a cyberattack that has disrupted several of its IT systems. Separately, H&M is reportedly investigating hacking claims by an actor claiming to be from the ShinyHunters extortion group.
Context: TFG London confirmed physical stores remain operational, though some website capabilities are unavailable. The retailer has indicated that customer payment information was not affected. The incidents follow a recent breach at UK fashion retailer ASOS, claimed by Xuanye threat group. Additionally, in 2025, at least two threat actor groups—Scattered Spider and ShinyHunters—had targeted UK retailers in a series of cyberattacks.
Analyst note: The clustering of cyberattacks against major UK fashion retailers within a short window very likely reflects an ongoing campaign. It cannot be confirmed whether the targeting is limited to fashion or to the broader UK retail sector. Similar cyberattacks targeting UK retailers are likely in the coming days. As the holiday retail season approaches, retail organizations are very likely to face an elevated volume of extortion attempts, since disruption is most costly at peak trading. Exposed customer data is likely to be leveraged for phishing and fraud during peak sale periods.
ZeroFox Intelligence Flash Report - Ransomware Recovery CEO Charged for Secret Payments
Source: https://www.zerofox.com/advisories/42576/
What we know: The owner and Chief Executive Officer (CEO) of a ransomware recovery company has been arrested and charged with conspiracy to commit wire fraud and two counts of wire fraud. The CEO allegedly defrauded ransomware victims by claiming to use proprietary technology to recover encrypted data while reportedly paying the attackers for decryption keys.
Context: The CEO reportedly charged victims much higher rates than they were likely to pay in ransoms and significantly more than his company paid in ransoms to the cybercriminals. Over the course of the alleged scheme, the CEO reportedly charged clients more than USD 19 million, while paying roughly USD 8 million in ransoms.
Analyst note: This fraud and subterfuge incident is almost certainly an isolated example of unscrupulous actors in the cybersecurity industry. Fraud schemes from cybersecurity companies are very likely rare but represent a unique insider threat; they almost certainly present a secondary threat layer that businesses should keep in mind when developing their defensive operations and mitigation plans.
FBI Warns of Evolving North Korean IT Worker Scheme Targeting U.S. Companies
What we know: The U.S. DOJ has announced a series of enforcement measures against North Korea’s remote IT-worker scheme, charging 14 individuals, arresting two U.S. nationals, and seizing about 187 laptops and devices. The FBI also warns that North Korean IT workers use legitimate network access to steal sensitive company data and conduct extortion to generate revenue for the regime.
Context: The FBI notes that North Korean IT workers are increasingly recruiting U.S.-based facilitators and subcontracting work to third-country nationals as companies improve their ability to detect fraudulent North Korean employees. Recent cases also involve threats of physical violence against victims and targeting of positions requiring security clearances.
Analyst note: Operators are likely to refine tactics to evade law enforcement and circumvent identity and access checks. U.S. businesses and financial entities that are being used by the threat actors to launder money for the operations are also likely to face law enforcement scrutiny if counter measures are not implemented.
DEEP AND DARK WEB INTELLIGENCE
PwnForums user bytetobreach: A moderately credible threat actor "bytetobreach" has advertised data allegedly associated with Ampath Laboratories, a South Africa-based pathology service provider, on PwnForums. The dataset allegedly contains employee, financial, patient, and system configuration records from the mid-2000s to the present, including more than 80 million laboratory admission records. If the data is legitimate, exposed patients are likely to face identity fraud, medical-themed phishing, and extortion.
VULNERABILITY AND EXPLOIT INTELLIGENCE
CVE-2026-104935: This is an authentication bypass vulnerability in Ivanti Connect Secure (ICS) VPN appliances, actively exploited in the wild by a previously undocumented threat actor tracked as UTA0576. The actor reportedly chained the flaw with two additional zero-days to achieve unauthenticated root-level code execution on a fully patched appliance. Post-exploitation activity reportedly focused on credential theft, Active Directory reconnaissance, LAPS password and BitLocker key extraction, password spraying, log tampering, and network scanning for lateral movement and broader network compromise.
Affected products: Ivanti Connect Secure—fixed in versions 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1
Tags: DIB, tlp:green