-1323.png){kind=logo}
The September edition of the Security Drop has landed, breaking down the global cyber threats you need to know about and how to defend against them. This edition covers how suspected North Korean hackers stole $351.6 million from a crypto exchange, which is just one story in September.
It also explores how a Chinese hacking group deployed stealthy malware against Latin American governments. In Africa, a cyberattack hit South Africa's largest bulk water supplier, and Kenya experienced a surge of cyber threats. Read the full edition of the Security Drop below.
In what marks the largest cryptocurrency theft of 2026 so far, Bitget— one of the world’s largest exchanges—was hit by a massive $351.6 million heist. Targeting its internal wallet infrastructure, the company disclosed that suspected state-backed North Korean hackers compromised a critical backend system connected to the platform’s hot and warm wallets.
However, the company’s CEO, Gracy Chen, confirmed that cold wallets and most of the platform’s assets remain secure and unaffected, and that the incident affected Bitget’s User Protection Fund. The CEO further confirmed that multiple assets, including ETH, XR, BNB, AVAX, USDT, USDC and other tokens, were involved in the incident. Bitget confirmed it suspended crypto withdrawals as a precaution while working with law enforcement and security firms to track and freeze stolen assets across multi-chain addresses.
This incident calls for crypto exchanges to implement zero-trust architecture controls and multi-party computation controls for internal transaction pipelines. For crypto enthusiasts and investors, avoid storing excess capital or long-term digital assets on centralised exchanges. Store your assets in self-custodial hardware wallets, which keep your private keys separate from the risks inherent in centralised exchange infrastructure.
Extortion group ShinyHunters claims it breached internal FBI systems and exfiltrated sensitive data after exploiting a newly discovered zero-day vulnerability in Oracle PeopleSoft.
The threat actors said they used an unpatched Remote Code Execution (RCE) flaw in Oracle PeopleSoft to gain initial access to the FBI Jobs platform. Once inside, the group claims it moved laterally into FBI-managed AWS GovCloud infrastructure and exfiltrated between 2TB and 3TB of data, including personally identifiable information (PII) and health records of current and former FBI personnel. ShinyHunters have further revealed that it is now actively weaponising the same PeopleSoft zero-day against Fortune 500 corporations.
What this means for organisations outsourcing organisational processes to Oracle PeopleSoft is to immediately restrict direct public internet access to PeopleSoft web portals by placing these portals behind zero-trust network access or an IP allowlist. Incident Response Teams should also vigorously audit web server and application logs for unusual inbound requests or unauthorised file creations. Administrative accounts must use multi-factor authentication (MFA) to prevent authentication bypasses.
North Korean state-backed cyber actors have significantly expanded their covert funding operations by combining fraudulent tech job placements with automated malware targeting crypto and Web3 professionals worldwide.
A joint advisory from the U.S. Federal Bureau of Investigation (FBI), Japan’s National Police Agency (NPA) and international partners warns of escalating activity by the North Korean threat group WaterPlum (commonly tracked as part of the ‘Contagious Interview’ campaign). Investigations revealed that between December 2025 and July 2026, WaterPlum compromised over 30,000 PCs across more than 100 countries, directly targeting freelance web developers, software engineers and blockchain specialists. The group successfully drained funds and credentials from over 7,000 cryptocurrency wallets, exfiltrating an estimated $10.71 million USD to generate foreign currency for Pyongyang.
For organisations, enforce strict background checks and identity verification for remote contractors and freelancers. It is further pertinent to enforce device management policies that prevent personal devices or unmanaged endpoints from connecting to sensitive corporate repositories.
Cybercriminals and state-sponsored espionage groups are increasingly converting AI platforms into automated reconnaissance engines, using large language models (LLMs) to analyse code at an unprecedented scale.
According to a threat report published by Anthropic, multiple threat actors abused the Claude AI model to automate target selection and exploit development. In the most expansive operation, an attacker linked to Shiny Hunters built an automated pipeline that downloaded, decompiled and fed approximately 1.8 million Android application packages (APKs) into Claude. Anthropic confirmed that credentials extracted through this automated AI pipeline directly enabled real-world corporate compromises, allowing attackers to move from a single stolen key to full administrative control of victim systems in under three hours.
For security teams, implement automated secret-scanning tools in your CI/CD pipeline to catch embedded credentials before deployment to production. Also, rotate any legacy or hardcoded API keys immediately, and enforce least-privilege permissions to limit lateral movement if a credential is leaked.
A federal appeals court has upheld the U.S. Department of Defense’s decision to blacklist Anthropic as a ‘supply chain risk.’
A 2-1 decision by the U.S. Court of Appeals for the D.C. Circuit ruled that the Department of Defence acted lawfully in designating Anthropic a national security supply chain risk. This effectively bars the company from federal defence contracts and contractor integration. The dispute stems from Anthropic CEO Dario Amodei refusing to remove the company’s interval safety guardrails, which explicitly restrict Claude models from being used in domestic surveillance operations or fully autonomous lethal weapons systems.
Therefore, organisations and security teams must ensure commercial AI terms of service align with jurisdictional procurement laws before entering federal or critical infrastructure partnerships. AI integrations should be audited and evaluated to ascertain whether their use could trigger regulatory breaches.
China-linked cyber-espionage group FamousSparrow has shifted its operational focus toward Latin America, deploying a newly discovered, highly evasive C++ backdoor named SparrowWocky.
According to recently published research, the threat actor has been deploying SparrowWocky against high-profile government entities across at least eight Latin American jurisdictions, including Panama, Argentina, Ecuador, Honduras and Venezuela. Researchers noted that the timing and location of the attack coincided with intelligence-gathering efforts surrounding U.S. diplomatic pressures and Chinese economic interests in the region.
SparrowWocky serves as the successor to the group’s legacy SparroDoor implant and is delivered via a sophisticated three-part loader that abuses DLL side-loading. This includes mapping the payload directly into system memory so the core backdoor executable never touches the physical disk.
Overall, this incident is a crucial reminder for government organisations to audit application servers for unauthorised DLLs that may load alongside legitimate system executables. Organisations should strictly enforce application whitelisting, and inspect firewalls and proxy logs for unusual, long-duration TLS connections that may point to unverified external IP addresses.
Rand Water, South Africa’s largest bulk water supplier, has confirmed that it is managing a cybersecurity incident that disrupted key enterprise Information Technology (IT) systems.
The utility issued a mandatory disclosure notice to holders of its listed debt securities on the Johannesburg Stock Exchange (JSE) debt board, following reports of internal system failures. While Rand Water has not formally named a specific threat actor or ransomware strain, internal disclosures indicate that the incident heavily impacted administrative and operational support applications, including the utility’s vendor payment platform and its Geographic Information System (GIS).
This underscores the need for infrastructure operators to ensure physical and logical air-gapping between enterprise IT networks and the Operational Technology environment. It is pertinent to regularly audit firewalls and network segmentation parameters to ensure lateral movement between business networks is impossible.
Kenya’s rapidly digitising economy is facing an unprecedented level of automated cyber activity, with national threat detections hitting record-breaking levels. According to a report published by the National KE-CIRT/CC, Kenya detected 11.2 billion cyber threat events during the 2025/2026 financial year, which ended in June 2026. This represents a 29% increase over the 8.62 billion events recorded during the previous year. This has established Kenya alongside Nigeria and South Africa as one of the top three most-targeted nations on the African continent.
For organisations operating within these regions, it is important to prioritise vulnerability and patch management. Additionally, implementing Web Application Firewalls (WAF) to protect web forms and login pages from automated injection and brute-force attacks is important to ensure organisational integrity.
Cyberattacks are growing worldwide, hitting crypto exchanges, government agencies and public utilities, and attackers are now using AI to work faster. The best defence is simple. Keep systems updated, use strong logins, limit access to sensitive data, and treat unknown offers or links with caution.
