Cybersecurity Weekly News (October 5–11, 2026): Double-Extortion Ransomware, Image-Based Blackmail and AI Agents Used in Bank Attacks
Cybersecurity Weekly News (October 5–11) highlighted several notable trends, from double-extortion ransomware and blackmail using manipulated images and videos to reports of AI Agents being used in attacks against banks. Together, these incidents show that businesses are facing overlapping risks from Social Engineering, credential theft, cloud and third-party exposure, and AI-driven attack automation.
In Vietnam, key developments included warnings related to The Gentlemen and Trigona ransomware in Hung Yen, nearly 20 reported cases of extortion using manipulated images and videos in Thanh Hoa, and a fake concert-ticket scheme on Threads that caused more than VND 2 billion in losses.
Internationally, ASOS confirmed that customer data was accessed following a Social Engineering attack, an AI Agent called ARTEX was reportedly used in attacks against South Korean banks, IDCF Cloud in Japan was disrupted by ransomware, and an Accenture contractor was removed from work with the FBI following an Oracle PeopleSoft-related breach.
Businesses can continue following new developments through the IPSIP Vietnam cybersecurity news.
I. Cybersecurity news in Vietnam
1. “The Gentlemen” and Trigona ransomware highlight the growing risk of double extortion
One of the week’s notable warnings involved the The Gentlemen and Trigona ransomware families in the context of suspicious activity affecting information systems in Hung Yen.
The Gentlemen operates under a Ransomware-as-a-Service model and uses double extortion tactics: attackers first steal data, then encrypt systems and use both the outage and threat of data publication to pressure victims into paying.
For businesses, the important point is that ransomware is no longer just about “files being encrypted.”
Even if an organization has working backups and can restore its systems, exfiltrated data may still be used for:
additional extortion;
publication on leak sites;
resale to third parties;
phishing or fraud;
reputational and regulatory pressure.
Internet-facing services such as VPN, RDP, SSH and SMB, along with stolen administrative credentials, remain valuable entry points for ransomware operators.
Recommended action: Reduce unnecessary Internet-facing exposure, enforce MFA on privileged accounts, segment networks, monitor endpoint behavior and ensure backups are isolated from production credentials.
IPSIP Vietnam's article: “The Gentlemen” ransomware and the threat of double extortion
2. Nearly 20 people in Thanh Hoa targeted with blackmail using manipulated images and videos
On October 5, 2026, Vietnam’s Ministry of Public Security warned about extortion schemes using manipulated sensitive images and videos.
According to the published information, since the beginning of October, Thanh Hoa’s cybercrime unit had received reports from nearly 20 victims, including one case in which the attacker demanded as much as VND 1.5 billion.
Attackers typically collect publicly available photos, videos or personal information from social media, then manipulate the material and send it to victims in order to create psychological pressure.
This form of Social Engineering is especially relevant as image-generation, video-editing and AI tools become easier to access.
Attackers do not necessarily need to compromise an account or device. Enough public information may be sufficient to create a convincing extortion scenario targeting reputation, employment or family relationships.
Recommended action: Include deepfake, sextortion and impersonation scenarios in awareness training. Employees should be instructed not to pay or negotiate independently and should know how to escalate suspected extortion or impersonation cases internally.
3. Fake concert-ticket sales on Threads: more than 200 victims and over VND 2 billion in losses
On October 6, 2026, Tay Ninh Police announced the prosecution of a suspect accused of using multiple fake social-media accounts to sell fraudulent concert tickets.
According to investigators, the suspect posted ticket offers on Threads and then moved conversations to Zalo to complete transactions.
More than 200 victims were identified, with estimated losses of over VND 2 billion.
The scheme combined several familiar elements:
Fake account → Social Engineering → mule/bank account → payment fraud
Recommended action: Monitor fake accounts impersonating the brand, clearly communicate official sales channels, establish a fraud-reporting process and proactively warn customers when impersonation campaigns are detected.
4. Fake “iPhone 18 prize” scams continue to exploit user psychology
On October 6, authorities in Quang Ninh warned about fraudulent messages claiming that users had won an “iPhone 18.”
The typical pattern is straightforward: victims are told they have won a high-value prize and are then asked to provide personal information, pay a fee or complete verification steps through an untrusted link.
Although the technique itself is not new, attackers continue to update the “bait” based on trending products, events and consumer interest.
Recommended action: Use scenario-based, multi-channel awareness training rather than relying only on email-phishing simulations. IPSIP Vietnam provides additional guidance through its cybersecurity awareness training for employees
II. International cybersecurity news
5. ASOS confirms customer data exposure following Social Engineering
On October 8, 2026, ASOS confirmed a cybersecurity incident that exposed some customer information.
Attackers impersonated a trusted contact to obtain an employee’s credentials, then used those credentials to access third-party platforms used by ASOS.
The incident demonstrates a common attack chain:
Social Engineering → Credential Theft → Third-party Platform Access → Data Exposure
Attackers do not need to compromise core infrastructure directly if they can persuade an employee to disclose valid credentials. Third-party platforms should be treated as part of the organization’s attack surface, not as security problems owned entirely by the vendor.
Recommended action: Deploy phishing-resistant MFA, Conditional Access and anomalous sign-in monitoring, and enforce stricter access controls for SaaS and third-party platforms containing customer data.
6. AI Agent ARTEX reportedly used in attacks against at least nine South Korean banks
One of the week’s most significant developments involved ARTEX, an AI Agent reportedly used in attacks targeting at least nine banks in South Korea.
The important shift is that cybersecurity is moving beyond hypothetical warnings.
Automation does not necessarily create entirely new techniques, but it can reduce the time and staffing required to execute a campaign.
Recommended action: Strengthen behavior-based detection, control API and service accounts, apply segmentation and place additional safeguards around financial systems, identity platforms and cloud consoles.
7. Ransomware disrupts Japan’s IDCF Cloud, affecting around 495 organizations
On October 7, a ransomware attack forced Japanese cloud provider IDCF Cloud to isolate and shut down one of its infrastructure regions.
The case is particularly important because the target was not a single organization, but a cloud service provider.
When shared infrastructure is compromised, the blast radius can extend across many customers simultaneously.
Threat actors claimed to have encrypted large volumes of databases, virtual disks and snapshots, but those figures should be treated as attacker claims until independently confirmed.
Recommended action: Review Business Continuity plans for cloud-provider outages, maintain independent backups outside the same trust boundary, monitor cloud administrative privileges and avoid relying on the same credentials for production, snapshots and backups.
8. Contractor removed from FBI work following Oracle PeopleSoft breach
On October 5, an Accenture contractor was removed from work with the FBI following a breach involving Oracle PeopleSoft.
The incident was linked to a critical Oracle PeopleSoft patch that was not deployed in time, allowing attackers to exploit the system and access sensitive employee information.
Organizations may know that a vulnerability exists, but still fail to answer a critical operational question: Who is actually responsible for patching it?
If the vendor assumes the customer owns patching, while the customer assumes the contractor handles it, a critical vulnerability can remain exposed even when all parties have formal security processes.
Recommended action: Vendor SLAs should clearly define patch ownership, timelines for critical vulnerabilities, escalation procedures and evidence of completion. Systems holding sensitive data should also be inventoried so that no asset exists outside a clearly assigned operational owner.
III. What should businesses prioritize after October 5–11?
This week’s developments highlight four major trends.
Ransomware continues to evolve toward double extortion. Backups remain essential, but they are no longer sufficient. If data has already been exfiltrated, organizations still face leak and extortion risk even after systems are restored.
Social Engineering increasingly relies on real data and manipulated content. A public photo, employee credential or fake social account can all become the starting point of an incident.
AI Agents are beginning to appear in real-world attack cases, increasing the level of automation available for reconnaissance, processing and exploitation.
Third-party risk and patch governance remain major weaknesses. A compromised vendor, contractor or cloud provider can extend the blast radius to systems that businesses do not directly control.
For businesses, the critical question is no longer whether a single security tool is strong enough. The more important objective is to control identity, privilege and third-party access while maintaining the ability to detect and respond quickly when these risks become connected.
References
Ministry of Public Security – Warning about image-manipulation extortion schemes in cyberspace
Ministry of Public Security – Fake concert-ticket seller on Threads accused of defrauding more than 200 victims
Reuters – South Korean banks were likely hacked by a China-based actor with an AI agent, CrowdStrike says
BleepingComputer – Ransomware attack disrupts Japan's IDCF Cloud used by govt clients
