Daily Brief
2026-10-23
Top Story
Extortion group n0n is demanding $1.2 billion from more than 40 ports and shipping lines; security firm CyDome says half are customers of the same maritime software vendor, South Korea's CyberLogitec
n0n has named more than 40 port authorities, terminals, shipping lines and supply-chain firms on its leak site and is demanding ransoms totaling $1.2 billion.
The International Maritime Organization counted at least 27 attacks on merchant ships in the Strait of Hormuz so far this month, the most of any month since the US-Iran war began in late February
Interfax gives 22 attacks for March by comparison.
Brent crude traded near $113.9 a barrel on Friday morning, after closing Thursday at its highest level since early May
Brent closed on Thursday at its highest level since May 4th, after a 4% daily gain to $113.17, and December futures were trading near $113.92 on Friday morning, Interfax reports, linking the rise to media reports that the US and Israel have drafted plans to resume strikes on Iran after the November midterms.
QatarEnergy signed two long-term deals to buy 4 million tons a year of liquefied natural gas from US exporter Cheniere, with deliveries running from the early 2030s to the end of 2054
The agreements cover 2 million tons a year each from Cheniere's Sabine Pass plant in Louisiana and Corpus Christi in Texas, priced against Henry Hub, the US natural gas benchmark, plus a fixed fee.
United States
Federal prosecutors charged 15 people in Los Angeles, six of them medical professionals, over more than $1.8 billion in fraudulent health care claims
The Justice Department says the schemes billed more than $1.8 billion to government and private health care programs.
The White House found that imported wind turbines threaten national security, but set no new tariff and directed trade negotiations instead
The October 22nd proclamation adopts a US Commerce Department finding, made under a trade law that lets the president restrict imports on national security grounds. The Commerce Department says networked inverters, particularly imported ones, could let attackers take remote control of power generation and disrupt the grid. Inverters convert turbine output into power the grid can use. Commerce also says turbines create clutter on ground and air radars. The proclamation orders negotiations with trading partners, with a progress report due within 180 days, and says other remedies may follow. Some turbine parts already carry the existing US tariffs on steel, aluminum and copper.
The US Treasury Department proposed restricting American investment in AI, supercomputing and hypersonics in China, Russia, North Korea and other countries of concern
The Associated Press reports Treasury issued the proposed rule on Thursday October 22nd, carrying out a law Congress passed in December 2025 that codified the outbound investment program and widened it to more technologies and more countries, including Cuba, Iran, North Korea and Russia.
The White House used the Defense Production Act to let the government buy from and finance US oil producers, refiners and pipelines, skipping six of the law's usual preconditions
The Defense Production Act is the 1950 law that lets the government buy from and fund private industry for national defense. In a declared national emergency it allows the president to waive its usual preconditions, and the October 22nd memorandum waives six of them. It finds that industry cannot supply the capacity in time because of constrained financing, long lead times, and permitting and infrastructure bottlenecks. It covers oil exploration and production, refining, pipelines, storage and marine terminals.
Around the World
Interpol's Operation Serengeti, a crackdown across 20 African countries, led to 1,462 arrests and recovered more than $105 million
Interpol, the international police cooperation body, coordinated the operation against online fraud, ransomware and business email compromise, in which scammers pose as executives or vendors to redirect payments. Participating countries disrupted more than 10,000 malicious networks. Interpol gave investigators intelligence on suspicious domains, IP addresses and command servers, the machines that direct infected computers. In Uganda, authorities broke up two fraud rings and arrested 365 foreign nationals running call centers that used fake trading platforms to talk pensioners in Asia into fictional investments. In Nigeria, authorities arrested a suspect accused of running a phishing and email-fraud operation that harvested software logins and about 2.1 million email addresses. The Record, a cybersecurity news site, does not say how the $105 million was recovered. Interpol counts just under 66,000 victims with losses above $385 million.
Microsoft says the China-aligned group that broke into ConnectWise's cloud backup service used an open-source AI penetration-testing tool published on GitHub
The attackers used stolen credentials, and ConnectWise shut down several services over the weekend.
An FSB-run cyber center told Russian critical-infrastructure operators to patch PHP, the language much of the web runs on, or restrict access to their own websites
The National Coordination Centre for Computer Incidents, which sits under the FSB, Russia's domestic security service, told operators of critical information infrastructure to update PHP, and to restrict external access or take sites offline if they cannot patch quickly.
A poisoned version of the litellm Python software package reached the main Python download site, carrying a credential stealer and a backdoor absent from the project's own source code
Anyone who installed litellm 1.107.0 from the Python Package Index on October 21st got a credential stealer and a remote code execution backdoor that the project's own published source for that version does not contain, so they were added somewhere between the source and the file users download.
The EU's sanctions envoy says a Rusal refinery in Ireland is feeding Russia's weapons supply chain with alumina, the raw material smelters turn into aluminum
David O'Sullivan, the EU's sanctions envoy, said in Dublin that material from the Aughinish refinery in Ireland, owned by Russian aluminum producer Rusal, is undoubtedly going into Russia's weapons supply chain.
Saudi Arabia's stock index fell 2.3% on Thursday, its eighth weekly decline in a row, as a new wave of Houthi attacks on the kingdom raised fears the conflict could spread
Reuters reports the Houthis, the Yemen-based armed group, launched new attacks on Saudi Arabia, and Riyadh answered with strikes on missile launcher sites. The US State Department has ordered some diplomats and family members to leave its missions in Saudi Arabia, US officials told Reuters. The Tadawul All Share Index, the Saudi exchange's main index, closed at 9,696, its lowest since 2021 and down 4.1% for the week, according to Asharq Al-Awsat, an Arabic-language daily. Saudi National Bank, the country's biggest lender by assets, fell 5.1%, and Saudi Aramco, the state oil company, fell 0.7%.
Russia's embassy in Copenhagen says Denmark is preparing to use force against ships carrying Russian cargo, and calls the plans essentially piracy
The embassy told Izvestia that Danish authorities are preparing to use force against vessels carrying Russian cargo, called the plans essentially piratical and said Moscow would respond decisively.
Managers at Russian oil producer Rosneft fear a few more months of the war with Ukraine will do the company lasting damage
Managers point to the constant cost of repairing refineries hit by Ukrainian attacks, in a Bloomberg report relayed by The Bell.
The US and Israel are drawing up a plan to resume strikes on Iran after the November 3rd midterm elections, New York Times sources say
It is not yet clear whether President Trump will approve the strikes.
Australian data center operator NextDC asked for a halt in trading of its shares over delayed power to its Melbourne site, where the grid operator says proposed data-center demand already exceeds the state's capacity
Bloomberg reports NextDC requested a trading halt on October 19th while it assesses delayed power at its M3 data center in Melbourne, including the effect on its fiscal 2027 guidance.