This Week in Cyber: 5 Attacks You Need to Know About

Quick answer: The five biggest cybersecurity stories this week (September 22-29, 2026) were: Citrix NetScaler zero-days exploited before a patch existed, ShinyHunters’ claimed breach of the FBI’s applicant portal, a Pentagon data breach exposing records on 3 million people, an AI-directed campaign (Storm-3168) that used compromised Azure service principals to mass-delete cloud resources, and an Android banking trojan (RatHat) that uses Gemini AI to pick out higher-value victims automatically.

This week’s roundup leans heavily on one theme: attackers are moving faster than patch cycles, and AI is showing up on both sides of the fight — as a targeting tool for criminals and as a documented feature of one destructive campaign. Here’s what happened and what it means for your SOC.

1. Citrix NetScaler Zero-Days Exploited Before a Patch Existed

Two critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway (rated CVSS 9.5) were confirmed under active exploitation before Citrix had a fix available, including a flaw that lets an attacker with no credentials run commands on appliances still on factory settings. CISA added both to its Known Exploited Vulnerabilities catalog with a remediation deadline of September 30.

Why it matters for your SOC: if you run NetScaler ADC or Gateway anywhere in your environment, treat any unpatched instance internet-facing before this week as potentially already compromised, not just vulnerable. Patch first, then hunt for post-exploitation activity rather than assuming a clean patch means a clean system.

2. ShinyHunters Claims a Breach of the FBI’s Applicant Portal

The extortion group ShinyHunters announced it had compromised the FBIJobs.gov applicant portal, defacing the site and claiming to hold sensitive data on a large share of FBI employees and job applicants. The group says it exploited a previously unknown vulnerability in Oracle PeopleSoft HR software; the FBI has confirmed it is investigating but has not yet said whether the entry point was a third-party provider or an internal system.

Why it matters for your SOC: this is the second major claimed intrusion tied to the bureau this year, and it’s a reminder that HR and applicant-tracking systems are treated by attackers as a soft, high-value target — often carrying more sensitive personal data than the “crown jewel” systems a SOC spends most of its attention defending.

3. Pentagon Data Breach Exposes Records on 3 Million People

A breach of a Defense Manpower Data Center system exposed unencrypted personal information belonging to more than 3 million people. Breach notification letters went out starting September 18, and affected individuals are being offered a year of free credit monitoring. Investigators are still working to determine how the intrusion happened.

Why it matters for your SOC: “unencrypted PII at rest” continues to turn ordinary access-control failures into headline-scale breaches. If your organization hasn’t audited which systems store sensitive data unencrypted “because it’s internal only,” this is this week’s reminder to do it.

4. Storm-3168: An AI-Directed Campaign That Deleted Azure Resources at Scale

Microsoft documented a threat group, tracked as Storm-3168, using AI-assisted automation to identify and mass-delete Azure resources through compromised service principals — the non-human identities apps and services use to authenticate to cloud environments. Related reporting also linked this activity to attackers deleting Azure resources tied to JADEPUFFER infrastructure.

Why it matters for your SOC: service principals are exactly the kind of identity that tends to get created, over-permissioned, and then forgotten. If your identity monitoring is tuned mainly around human user accounts, this is a live example of why non-human identities need the same scrutiny.

5. RatHat: An Android Banking Trojan That Uses Gemini to Pick Its Victims

A malware-as-a-service Android banking trojan called RatHat has been observed using Google’s Gemini AI model inside its control console to help operators identify which infected phones belong to higher-value victims worth the effort of manual exploitation. Security researchers have traced close to 100 separate deployments of the console since April.

Why it matters for your SOC: this isn’t “AI-generated malware” in the dramatic sense — it’s a much more mundane and more concerning use case: AI as a triage assistant that makes an attacker’s limited human attention span go further. Expect this pattern (AI doing victim prioritization, not code generation) to show up more, because it’s cheap, effective, and doesn’t require any novel exploit to work.

The Pattern This Week

Four of this week’s five stories share a common thread: the gap between exploitation and remediation (NetScaler exploited pre-patch), or between compromise and detection (FBI, Pentagon, Storm-3168), kept being the deciding factor — not the sophistication of the initial access technique. The RatHat story is the outlier, and it’s arguably the most important one long-term: AI lowering the cost of the tedious parts of an attack, not the technical parts.

Frequently Asked Questions

What was the biggest cybersecurity story this week? The two actively-exploited Citrix NetScaler zero-days (CVE-2026-88771 and CVE-2026-88772) were arguably the most operationally urgent, since CISA set a same-week remediation deadline for federal agencies due to confirmed pre-patch exploitation.

Did the FBI actually get breached this week? The extortion group ShinyHunters made the claim publicly and defaced the FBIJobs.gov portal; as of this writing the FBI has confirmed it is investigating but has not independently verified the scope of the claimed data theft.

How is AI actually being used in real attacks right now, as opposed to hype? This week’s clearest examples were AI used for victim triage (the RatHat Android trojan using Gemini to flag higher-value infected devices) and AI-assisted automation directing mass resource deletion in a cloud environment (Storm-3168) — both are AI supporting attacker efficiency, not AI generating novel exploits.

What should a SOC prioritize based on this week’s news? Patching any internet-facing Citrix NetScaler ADC/Gateway instance immediately, auditing non-human identities like service principals for excessive permissions, and confirming whether any internal systems store PII unencrypted.

Related reading: 10 Real Attacks a SOC Analyst Sees Every Single Day and MITRE ATT&CK Cheat Sheet: The 10 Techniques SOCs See Most — see how this week’s headline attacks map to the everyday techniques your team already tracks.