🔥 Amazing day at the @SANSInstitute #AISummit 2026.

I had the chance to join the SANS360 lightning talks. 10 practitioners, 6 minutes each. No fluff.

My message was simple: #AI is collapsing prevention time, but time-based security still holds. Speed doesn’t make these t, it often makes them more fragile.

To show how #AllAroundDefenders can flip the script, today we introduced #Decipio, our latest community project from the @AWNetworks Labs team.

#Decipio injects controlled “lies” into the environment to expose credential theft the moment it begins. It also applies automation and AI-assisted workflows defensively, creating a home-field advantage for defenders.

To protect the #cyberdefense community, we decided to release Decipio as a gated, community-driven release.

👉 You can start requesting access today through our website, and learn more about it in our latest blog:
🔹 arcticwolf.com/decipio/
🔹 arcticwolf.com/resources/blog…

#CyberDefense #AI #ThinkRedActBlue

The FBI is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026. The FBI refers to this specific North activity as "TraderTraitor."

The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.

How You Can Help:
FBI, USSS, and IRS-CI are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets.

A list of addresses associated with this activity is available here: fbi.gov/investigate/cy…

$6.3B stolen. Binance says no evidence of leaked private keys.

@aboutsecurity and @fulmetalpackets examine what remains unknown, and what defenders should check now.

Think Red 🔴 Act Blue 🔵

themondaybrief.substack.com/p/the-63-billi…

$600,000 in tokens over three weeks, from an agent that handed over its own API key. The METR incident is a visibility problem first. @aboutsecurity, walks through the METR incident and three visibility challenges for AI agents, in @TheHackersNews: thehackernews.com/2026/09/zero-t…

The answer to life, the universe, and cybersecurity this week is 4 🧛‍♂️

Best sticker at @unpromptedconf

[un]prompted II kicking off at The Hibernia in SF with @gadievron

Who else is around at @unpromptedconf this week?

w/ @SANSInstitute @AWNetworks

What starts as a seemingly legitimate judicial notice can quickly turn into full remote access. Check out the technical details in our new Arctic Wolf Pack Alert: bit.ly/4zNpZPA

#PHP2Shell has a working public exploit, but it's tailored to PHP 8.4.26 on Alpine Linux with a specific server setup.

As we've said all week: working RCE != reliable mass exploitation.

As every Monday morning, @fulmetalpackets & I discuss it in the latest issue of @Theco/3ivZa3LEuk

#ThreatResearch #CyberSecurity #ThinkRedActBlue

No, we don’t think AI is going to kill us all.

Plugin4Shell and OpenAI’s latest reports give us plenty to talk about: code that doesn’t match the approved commit, unauthorized credential use, and instructions to conceal mistakes.

Also in this week’s @TheMondayBrief: Cisco ISE under active exploitation, and why FamousSparrow’s targeting of Latin American governments should have you looking at geopolitics when setting your intelligence priorities.

@aboutsecurity and @fulmetalpackets get into all of it below👇

themondaybrief.substack.com/p/plugin4shell…

#Cybersecurity #AgenticAI #ThinkRedActBlue

Arctic Wolf Labs is tracking an active widescale Russian-origin ClickFix campaign that uses a Ukrainian-language fake Cloudflare CAPTCHA to deliver an infostealer that collects browser credentials, wallet data, and supports persistent remote tasking: bit.ly/4iuItiq

AW Labs discovered a procurement-themed phishing campaign targeting organizations in Europe using a layered delivery chain featuring HTA, PowerShell, JavaScript, and Lua-based execution to evade detection and deploy an in-memory infostealer: bit.ly/4AkkQQb

⚡ Billions of tokens. Millions of requests.

U.S. agencies accuse China-based AI firms of using industrial-scale distillation to extract capabilities from Claude, GPT, Gemini, and Grok.

How the campaigns hid their access: thehackernews.com/2026/09/us-age…

I have to admit that I had a lot of fun with my latest @SANSInstitute webcast. I even built a couple of cinematic demos showing an attacker hijacking an AI agent’s intent and turning its legitimate access against you.

The Agentic SOC: Defending With, and Against, Autonomous AI. ttps://t.co/UNoLbiR1QB

#AgenticAI #ThinkRedActBlue #ZeroTrust

⏳ Don't miss The Agentic SOC: Defending With, and Against, Autonomous AI today at 3 PM GST.

Join SANS Senior Instructor @aboutsecurity to explore how adversaries are weaponising autonomous agents and how defenders can secure agentic AI.

Register free 👉 go.sans.org/LTbBqd

“Hi, this is IT.”

Sometimes that’s all it takes to get handed the keyboard.

This week: fake IT support on Teams, a hijacked Terraform registry, PostgreSQL privilege abuse and targeted spyware. What happened, why it matters, and what to do, by @aboutsecurity & @fulmetalpackets

ht#Cybersecurity #TheMondayBrief #ThreatIntelligence #ThinkRedActBlue

Today's Pack Alert: Arctic Wolf observed a large-scale Fortinet VPN credential access campaign targeting hundreds of organizations, using organization-specific identities and infrastructure linked to confirmed malicious access.

Learn more: bit.ly/4gzLDQx

New Monday Brief, by @aboutsecurity and @fulmetalpackets

1⃣@OpenAI postmortem on the @huggingface intrusion.
2⃣The @FBI seizure that left QScan and QTRouter inoperable.
3⃣Two more factory implants in white-label ZBT routers.
4⃣The TeamPCP arrests.

Four incidents where the facts were available long before the conclusion was 👇

themondaybrief.substack.com/p/openais-post…

🐺 Introducing Pack Alert: our newest way to share timely threat research. AW Labs researchers recently observed malicious GitHub repositories that use redirects to fingerprint a visitor's device before delivering a payload built for that platform: bit.ly/4wVNsMD

Dark Caracal is back in LatAm with new tricks.

@AWNetworks Labs uncovered GoCaracal: a modular Go framework with a lightweight foothold implant + a 34-handler RAT. Ethereum smart contract as C2 fallback (yes, it's called "BulletproofC2"). Deployed alongside an updated Bandook tures.

249 samples. 23 of 24 C2s on AEZA.

Full analysis, YARA + IOCs:
arcticwolf.com/resources/blog…

#ThreatIntel #DarkCaracal #ThinkRedActBlue

🤖 AI agents are changing the SOC, but greater autonomy brings new security challenges.

Join SANS Senior Instructor @aboutsecurity for our webcast exploring how to defend with, and against, autonomous AI.

📅 8 September
⏰ 3 PM GST

Register free 👉 go.sans.org/LTbBqd

Huge thanks to @dimitribest for the chance to present together at #BlackHatUSA 2026! Your experience, expertise, and support made this whole thing possible.

Massive shout-out to the organizers #BlackHatUSA for picking our topic. The conference was held at the highest level.
r your patience and all the hard work you put into coaching us. Your energy and help really came through in the presentation.

Big thanks to @aboutsecurity and Jamie Butler for jumping in and helping us.

And of course, Arctic Wolf Labs (@AWNetworks) — thank you for the support and help.