Weekly Cyber Threat Bulletin: 9 October 2026

Welcome to my weekly Cyber Threat Bulletin, where I highlight the threats and trends that matter most in today's cybersecurity landscape. If your team needs assistance with threat intelligence, cybersecurity assessments, tabletop exercises, or security strategy, reach out via my contact form.

Breach: Threat Group Compromises Retailer ASOS Comms Platform

Online retailer ASOS disclosed a breach after threat actors associated with Xuanye Group obtained employee credentials through social engineering. The group gained access to the retailer's customer communications environment and weaponized the official ASOS mobile app by broadcasting an extortion message to millions of users in an apparent effort to increase pressure on the company leadership. According to ASOS, customer contact information, basic personal data, and interaction logs were exposed in the incident. The company stated that payment card information and account passwords were not compromised. ASOS stock dropped by 10% after news of the breach broke, though later recovered when the scope of the incident was further clarified.

Key Takeaways and Recommended Action:

• Isolate & Audit Customer Communication SaaS: Ensure third-party marketing platforms, push notification engines, and CRM tools are granted strict least-privilege access and cannot pivot laterally into broader data lakes or core infrastructure.
• Enforce Multi-Factor Authentication (MFA): Move beyond basic passwords by deploying MFA solutions to mitigate social engineering and trusted-contact credential harvesting.
• Implement Out-of-Band Broadcast Controls: Require multi-person approval and rate-limiting protocols before mass notifications or push campaigns can be dispatched to customer bases.
• Implement SaaS Identity Governance and Access Reviews: Regularly audit human and non-human SaaS access identities to detect abnormal behavior and restrict single-identity blast impact.
• Prepare for Non-Traditional Extortion Tactics: Update incident response playbooks to include scenarios where attackers leverage trusted enterprise communication pipelines (app pushes, email banners, SMS) as public leverage mechanisms.

Vulnerabilities: Cisco Catalyst SD-WAN Authentication Bypass Leveraged via API

Cisco disclosed a critical authentication bypass vulnerability (CVE-2026–76504) affecting Catalyst SD-WAN Manager being actively exploited in the wild. The flaw stems from improper URI/URL encoding validation within the platform's API authentication process, allowing unauthenticated attackers to bypass authentication and obtain full administrative access. Given SD-WAN Manager's central role in managing enterprise routing and connectivity, a successful compromise could enable threat actors to intercept network traffic, modify routing and security policies, and potentially gain access to branch locations throughout an organization's environment.

Key Takeaways and Recommended Action:

• Apply Fixed Firmware Immediately: No workarounds exist for this vulnerability so organizations should patch affected instances as soon as possible.
• Eliminate Direct Internet Exposure: Restrict management interfaces (typically ports 443, 22, and 830) to isolated management VLANs, jump boxes, or trusted VPNs, rather than leaving them exposed to the public internet.
• Threat Hunt for Possible Compromise Activity: Audit web server and API request logs for unusual URL-encoded HTTP payloads or unauthorized administrative session creation preceding patch implementation.
• Harden Management Plane Access: Enforce strict access control lists (ACLs) and continuous monitoring around core network controllers and orchestrators, which represent high-value "keys to the kingdom" for enterprise infrastructure.

Cybercrime: Domino's Customers Targeted in Credential Stuffing Attack

Domino's Pizza recently reset passwords for affected customers after identifying a credential stuffing attack against its online platform. Rather than breaching Domino's systems directly, attackers used email and password combinations stolen from previous third-party breaches to gain access to customer accounts in this bot-enabled attack. While the company reported that its internal systems and payment infrastructure were not compromised, attackers were able to access information stored within affected accounts, including contact details, delivery addresses, order history, and loyalty rewards data. The incident highlights how password reuse continues to transform third-party breaches into account takeover opportunities, even when the targeted company's own systems remain secure.

Key Takeaways and Recommended Action:

• Deploy Behavioral Bot Mitigation at Login Endpoints: Enterprise consumer platforms should move beyond static IP rate-limiting by deploying residential proxy detection, CAPTCHA mechanisms triggered by anomalous traffic spikes, and behavioral analysis to block automated login attempts.
• Enforce Multi-Factor Authentication (MFA): Move beyond basic passwords by deploying MFA solutions to mitigate password reuse issues.
• Integrate Credential Intelligence APIs: Screen newly created and existing passwords against known breached credential datasets and force resets when compromised passwords are detected.
• Promote Password Hygiene & Anti-Phishing Awareness: Remind users to adopt password managers to ensure unique passwords across all consumer accounts. Warn customers to watch out for secondary phishing or SMS scams that leverage order history details to impersonate customer support.

Upcoming Events

I'll be speaking and teaching at several conferences and community events this fall. If you're attending, I'd love to connect.

22 October VetSecCon workshop (Virtual) — PCAPs or it Didn't Happen: Network Traffic Analysis for Security Practitioners

28 October ISSA Central Maryland talk (Maryland) — Inside the Infostealer Economy: How Threat Actors Turn Stolen Credentials into Enterprise Breaches

3 November SharkFest training (Brussels) — The Proof is in the Packets: Network Threat Detection Using Wireshark

7 November BSides Bournemouth workshop (England) — The Proof is in the Packets: Network Threat Detection Using Wireshark