{
  "schema_version": 3,
  "report_contract_version": 5,
  "report_plan": {
    "control_implications": [
      {
        "control_id": "vulnerability_management",
        "evidence_excerpt": "Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls…",
        "evidence_origin": "summary",
        "focus": "PAN-OS RCE zero-day",
        "priority": "high",
        "source_ids": [
          1
        ]
      },
      {
        "control_id": "vulnerability_management",
        "evidence_excerpt": "A flaw in Linux's vhost subsystem lets a local user read and write kernel memory at will and become root across nearly a decade of kernel versions. In one virtualization setup, it lets an untrusted virtual machine write to the host's memory and hijack the program that runs the virtual machine. The bug is tracked as CVE-2026-74580 and named Vghost. Tencent Zhuque Lab, which found the…",
        "evidence_origin": "summary",
        "focus": "Linux's vhost subsystem",
        "priority": "high",
        "source_ids": [
          3
        ]
      },
      {
        "control_id": "access_management",
        "evidence_excerpt": "A bug in Claude Code Desktop's preview pane can allow adversaries to quietly steal credentials from developers, including SSH private keys, AWS credentials, and Claude 0Auth tokens.",
        "evidence_origin": "summary",
        "focus": "Claude Code Desktop's preview pane",
        "priority": "high",
        "source_ids": [
          5
        ]
      },
      {
        "control_id": "third_party_risk",
        "evidence_excerpt": "The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group's operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean remote IT worker schemes…",
        "evidence_origin": "summary",
        "focus": "North Korean remote IT worker schemes",
        "priority": "medium",
        "source_ids": [
          6
        ]
      },
      {
        "control_id": "incident_response",
        "evidence_excerpt": "Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System. \"Since January 2026, the threat actors behind these kits have been responsible for…",
        "evidence_origin": "summary",
        "focus": "three phishing kits",
        "priority": "medium",
        "source_ids": [
          11
        ]
      },
      {
        "control_id": "vulnerability_management",
        "evidence_excerpt": "Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco said in an advisory on Wednesday. The attacker sends an email with a crafted attachment through the gateway and, if it succeeds, could then run commands as root. The appliance filters an organization's email for spam, malware…",
        "evidence_origin": "summary",
        "focus": "Cisco Secure Email Gateway",
        "priority": "high",
        "source_ids": [
          7
        ]
      }
    ],
    "executive_brief": {
      "decision_frame": "exposure",
      "source_ids": [
        1,
        5,
        3
      ]
    },
    "industry_impacts": [],
    "regulatory_changes": []
  },
  "generated_at": "2026-10-15T03:25:06.000314Z",
  "feed_url": "https://ricomanifesto.github.io/SentryDigest/feed.xml",
  "feed_home_url": "https://ricomanifesto.github.io/SentryDigest/",
  "digest_issue_date": "2026-10-15",
  "digest_issue_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-15/",
  "requested_model": "openrouter/nvidia/nemotron-3-ultra-550b-a55b:free",
  "resolved_model": "nvidia/nemotron-3-ultra-550b-a55b:free",
  "sources": [
    {
      "title": "Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks",
      "url": "https://www.bleepingcomputer.com/news/security/palo-alto-networks-warns-of-pan-os-rce-flaw-exploited-in-attacks/",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-15/#reporting-10dada637c3e",
      "cves": [
        "CVE-2026-0322"
      ],
      "snippet": "Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls… Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls…",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls…",
          "text": "Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls…",
          "text": "Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles",
      "url": "https://www.darkreading.com/vulnerabilities-threats/ivanti-ics-zero-day-attacks-vendor-patching",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-15/#reporting-788400810f90",
      "cves": [
        "CVE-2026-104935"
      ],
      "snippet": "Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles CVE-2026-104935, a high-severity authentication bypass + RCE vulnerability, was only partially discovered and patched in July, leaving an opening for threat actors to capitalize on. CVE-2026-104935, a high-severity authentication bypass + RCE vulnerability, was only partially discovered and patched in July, leaving an opening for threat actors to capitalize on.",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "CVE-2026-104935, a high-severity authentication bypass + RCE vulnerability, was only partially discovered and patched in July, leaving an opening for threat actors to capitalize on.",
          "text": "CVE-2026-104935, a high-severity authentication bypass + RCE vulnerability, was only partially discovered and patched in July, leaving an opening for threat actors to capitalize on."
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "CVE-2026-104935, a high-severity authentication bypass + RCE vulnerability, was only partially discovered and patched in July, leaving an opening for threat actors to capitalize on.",
          "text": "CVE-2026-104935, a high-severity authentication bypass + RCE vulnerability, was only partially discovered and patched in July, leaving an opening for threat actors to capitalize on."
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host",
      "url": "https://thehackernews.com/2026/10/ai-found-linux-kernel-flaw-gives-local.html",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-15/#reporting-dce2d98112cc",
      "cves": [
        "CVE-2026-74580"
      ],
      "snippet": "AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host A flaw in Linux's vhost subsystem lets a local user read and write kernel memory at will and become root across nearly a decade of kernel versions. In one virtualization setup, it lets an untrusted virtual machine write to the host's memory and hijack the program that runs the virtual machine. The bug is tracked as CVE-2026-74580 and named Vghost. Tencent Zhuque Lab, which found the… A flaw in Linux's vhost subsystem lets a local user read and write kernel memory at will and become root across nearly a decade of kernel versions. In one virtualization setup, it lets an untrusted virtual machine write to t",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "A flaw in Linux's vhost subsystem lets a local user read and write kernel memory at will and become root across nearly a decade of kernel versions. In one virtualization setup, it lets an untrusted virtual machine write to the host's memory and hijack the program that runs the virtual machine. The bug is tracked as CVE-2026-74580 and named Vghost. Tencent Zhuque Lab, which found the…",
          "text": "A flaw in Linux's vhost subsystem lets a local user read and write kernel memory at will and become root across nearly a decade of kernel versions. In one virtualization setup, it lets an untrusted virtual machine write to the host's memory and hijack the program that runs the virtual machine. The bug is tracked as CVE-2026-74580 and named Vghost. Tencent Zhuque Lab, which found the…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "A flaw in Linux's vhost subsystem lets a local user read and write kernel memory at will and become root across nearly a decade of kernel versions. In one virtualization setup, it lets an untrusted virtual machine write to the host's memory and hijack the program that runs the virtual machine. The bug is tracked as CVE-2026-74580 and named Vghost. Tencent Zhuque Lab, which found the…",
          "text": "A flaw in Linux's vhost subsystem lets a local user read and write kernel memory at will and become root across nearly a decade of kernel versions. In one virtualization setup, it lets an untrusted virtual machine write to the host's memory and hijack the program that runs the virtual machine. The bug is tracked as CVE-2026-74580 and named Vghost. Tencent Zhuque Lab, which found the…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "Yam Store: The Phishing Network Behind a Billion Messages",
      "url": "https://www.darkreading.com/cyberattacks-data-breaches/yam-store-phishing-network-behind-billion-messages",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-15/#reporting-203b618871b5",
      "cves": [],
      "snippet": "Yam Store: The Phishing Network Behind a Billion Messages A sprawling cybercrime marketplace supplied cloud infrastructure and phishing kits that helped fuel more than 1 billion phishing messages worldwide. A sprawling cybercrime marketplace supplied cloud infrastructure and phishing kits that helped fuel more than 1 billion phishing messages worldwide.",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "A sprawling cybercrime marketplace supplied cloud infrastructure and phishing kits that helped fuel more than 1 billion phishing messages worldwide.",
          "text": "A sprawling cybercrime marketplace supplied cloud infrastructure and phishing kits that helped fuel more than 1 billion phishing messages worldwide."
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "A sprawling cybercrime marketplace supplied cloud infrastructure and phishing kits that helped fuel more than 1 billion phishing messages worldwide.",
          "text": "A sprawling cybercrime marketplace supplied cloud infrastructure and phishing kits that helped fuel more than 1 billion phishing messages worldwide."
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "Anthropic 'SneakPeek' Flaw Is a Silent Zero-Click Threat",
      "url": "https://www.darkreading.com/threat-intelligence/new-anthropic-sneakpeek-silent-zero-click-threat",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-15/#reporting-27378f9eca71",
      "cves": [],
      "snippet": "Anthropic 'SneakPeek' Flaw Is a Silent Zero-Click Threat A bug in Claude Code Desktop's preview pane can allow adversaries to quietly steal credentials from developers, including SSH private keys, AWS credentials, and Claude 0Auth tokens. A bug in Claude Code Desktop's preview pane can allow adversaries to quietly steal credentials from developers, including SSH private keys, AWS credentials, and Claude 0Auth tokens.",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "A bug in Claude Code Desktop's preview pane can allow adversaries to quietly steal credentials from developers, including SSH private keys, AWS credentials, and Claude 0Auth tokens.",
          "text": "A bug in Claude Code Desktop's preview pane can allow adversaries to quietly steal credentials from developers, including SSH private keys, AWS credentials, and Claude 0Auth tokens."
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "A bug in Claude Code Desktop's preview pane can allow adversaries to quietly steal credentials from developers, including SSH private keys, AWS credentials, and Claude 0Auth tokens.",
          "text": "A bug in Claude Code Desktop's preview pane can allow adversaries to quietly steal credentials from developers, including SSH private keys, AWS credentials, and Claude 0Auth tokens."
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested",
      "url": "https://www.bleepingcomputer.com/news/security/fbi-raids-dprk-it-worker-laptop-farms-in-texas-us-nationals-arrested/",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-15/#reporting-f5298475776f",
      "cves": [],
      "snippet": "FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group's operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean remote IT worker schemes… The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group's operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean remote IT worker schemes…",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group's operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean remote IT worker schemes…",
          "text": "The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group's operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean remote IT worker schemes…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group's operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean remote IT worker schemes…",
          "text": "The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group's operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean remote IT worker schemes…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability",
      "url": "https://thehackernews.com/2026/10/cisco-warns-of-active-attacks.html",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-15/#reporting-402aaeff71af",
      "cves": [],
      "snippet": "Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco said in an advisory on Wednesday. The attacker sends an email with a crafted attachment through the gateway and, if it succeeds, could then run commands as root. The appliance filters an organization's email for spam, malware… Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco said in an advisory on Wednesday. The attacker sends an email with",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco said in an advisory on Wednesday. The attacker sends an email with a crafted attachment through the gateway and, if it succeeds, could then run commands as root. The appliance filters an organization's email for spam, malware…",
          "text": "Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco said in an advisory on Wednesday. The attacker sends an email with a crafted attachment through the gateway and, if it succeeds, could then run commands as root. The appliance filters an organization's email for spam, malware…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco said in an advisory on Wednesday. The attacker sends an email with a crafted attachment through the gateway and, if it succeeds, could then run commands as root. The appliance filters an organization's email for spam, malware…",
          "text": "Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco said in an advisory on Wednesday. The attacker sends an email with a crafted attachment through the gateway and, if it succeeds, could then run commands as root. The appliance filters an organization's email for spam, malware…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "Ledger asks sellers across Asia to halt sales after supply-chain attack",
      "url": "https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-15/#reporting-0077d1f981ae",
      "cves": [],
      "snippet": "Ledger asks sellers across Asia to halt sales after supply-chain attack Ledger has asked resellers and distributors of its wallets in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend device sales and remove products from shelves while it investigates device tampering… Ledger has asked resellers and distributors of its wallets in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend device sales and remove products from shelves while it investigates device tampering…",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "Ledger has asked resellers and distributors of its wallets in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend device sales and remove products from shelves while it investigates device tampering…",
          "text": "Ledger has asked resellers and distributors of its wallets in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend device sales and remove products from shelves while it investigates device tampering…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "Ledger has asked resellers and distributors of its wallets in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend device sales and remove products from shelves while it investigates device tampering…",
          "text": "Ledger has asked resellers and distributors of its wallets in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend device sales and remove products from shelves while it investigates device tampering…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App",
      "url": "https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-15/#reporting-2720649a8fdd",
      "cves": [],
      "snippet": "Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell is a small file that executes any command an attacker sends via a web request, with the rights of the web server account. The flaw… Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on Septem",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell is a small file that executes any command an attacker sends via a web request, with the rights of the web server account. The flaw…",
          "text": "Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell is a small file that executes any command an attacker sends via a web request, with the rights of the web server account. The flaw…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell is a small file that executes any command an attacker sends via a web request, with the rights of the web server account. The flaw…",
          "text": "Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell is a small file that executes any command an attacker sends via a web request, with the rights of the web server account. The flaw…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "Cisco patches new Secure Email Gateway zero-day exploited in attacks",
      "url": "https://www.bleepingcomputer.com/news/security/cisco-patches-actively-exploited-secure-email-gateway-zero-day/",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-15/#reporting-9960150300a6",
      "cves": [],
      "snippet": "Cisco patches new Secure Email Gateway zero-day exploited in attacks Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges… Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges…",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges…",
          "text": "Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges…",
          "text": "Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages",
      "url": "https://thehackernews.com/2026/10/microsoft-disrupts-3-phishing-kits.html",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-15/#reporting-fbe33babcbab",
      "cves": [],
      "snippet": "Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System. \"Since January 2026, the threat actors behind these kits have been responsible for… Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System. \"Since January 2026, the threat actors behind these kits have been responsible for…",
          "text": "Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System. \"Since January 2026, the threat actors behind these kits have been responsible for…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System. \"Since January 2026, the threat actors behind these kits have been responsible for…",
          "text": "Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System. \"Since January 2026, the threat actors behind these kits have been responsible for…"
        }
      ],
      "effective_date_evidence": null
    },
    {
      "title": "U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud",
      "url": "https://thehackernews.com/2026/10/us-shuts-down-over-40-laptop-farms.html",
      "digest_url": "https://ricomanifesto.github.io/SentryDigest/archive/2026-10-15/#reporting-6d011349c01c",
      "cves": [],
      "snippet": "U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers as part of its ongoing efforts to disrupt North Korea's fraudulent remote IT worker (ITW) scheme. The indictment charges a mix of U.S. citizens and Chinese nationals for their roles in an IT worker conspiracy affecting more than 70 U.S. companies, charging them with wire fraud conspiracy, money… The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers as part of its ongoing efforts to disrupt North Korea's fraudulent remote IT worker (ITW) scheme. The indictment charges a mix o",
      "article_evidence": [
        {
          "extraction_version": 1,
          "origin": "summary",
          "raw_text": "The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers as part of its ongoing efforts to disrupt North Korea's fraudulent remote IT worker (ITW) scheme. The indictment charges a mix of U.S. citizens and Chinese nationals for their roles in an IT worker conspiracy affecting more than 70 U.S. companies, charging them with wire fraud conspiracy, money…",
          "text": "The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers as part of its ongoing efforts to disrupt North Korea's fraudulent remote IT worker (ITW) scheme. The indictment charges a mix of U.S. citizens and Chinese nationals for their roles in an IT worker conspiracy affecting more than 70 U.S. companies, charging them with wire fraud conspiracy, money…"
        },
        {
          "extraction_version": 1,
          "origin": "content",
          "raw_text": "The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers as part of its ongoing efforts to disrupt North Korea's fraudulent remote IT worker (ITW) scheme. The indictment charges a mix of U.S. citizens and Chinese nationals for their roles in an IT worker conspiracy affecting more than 70 U.S. companies, charging them with wire fraud conspiracy, money…",
          "text": "The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers as part of its ongoing efforts to disrupt North Korea's fraudulent remote IT worker (ITW) scheme. The indictment charges a mix of U.S. citizens and Chinese nationals for their roles in an IT worker conspiracy affecting more than 70 U.S. companies, charging them with wire fraud conspiracy, money…"
        }
      ],
      "effective_date_evidence": null
    }
  ]
}