CyberheistNews Vol 16 #43 | October 27th, 2026
[The Patching Timeline Collapsed] How to Fight Back and Close the Gap
Cybersecurity has entered a new phase. This was the week AI-driven cyber risk moved into operational crisis management. AI is accelerating vulnerability discovery, and serious flaws like the PHP emergency and supply-chain agentic attacks are no longer hypothetical. The defender's response window has collapsed.
As AI agents spread through businesses, each creates insider risk: an automated system with access attackers may exploit.
The pace is exhausting. Defenders work around the clock while everyone asks whether they should worry. However, skilled defenders, supported by practical tools and teamwork, have overcome threats before. AI can amplify their ingenuity, but cannot replace the judgment and resilience security work requires.
Here are five steps leaders should take now:
- Double your security resources. Review security spending against your actual exposure. If your environment has years of unpatched vulnerabilities, treat remediation as a business priority, not routine maintenance.
- Make security a release requirement. Review launch schedules and delay releases when serious vulnerabilities remain unresolved. Set clear standards for what must be fixed before deployment.
- Shut down abandoned systems. Find unused labs, test environments, old CI/CD projects, and other neglected assets. If they are not needed, decommission them. Every forgotten system can become an attacker's foothold.
- Make risk acceptance accountable. Some risks may need temporary exceptions, but every exception should have an owner, a business reason, compensating controls, and an expiration date.
- Automate the response. Use agents to help teams detect and contain threats faster, with human oversight for high-impact actions. The threat moves quickly; security operations must keep pace.
During an appearance at the Stanford Graduate School of Business, Sam Altman told a group of grad students that the cybersecurity crisis is worse than anyone could imagine. "I no longer think we're going to be able to just patch all the bugs," he told the audience, in part due to the ongoing advancements of AI models and in part because the targets of cyberattacks have acted too slowly to get ahead of it. Link here, watch from 20 minutes.
https://www.youtube.com/watch?v=anAmTGcewX8
But worry not, OpenAI's founder has a solution for where patching fails: more AI. "I think we're going to have to completely switch the defense model to using the same technology for a new kind of defense shield," he said.
My two cents? This sounds a bit too close to the arms dealer model of selling to both sides of a conflict.
Heroics cannot be the model. Boards must give security teams resources, authority, tools, and recovery time. AI can amplify defenders; people must govern agents. Front-line defenders: thank you. Your work protects people you may never meet. Support your peers, share what you learn and train those users.
Maximizing Your Microsoft Defender Investment with KnowBe4 Defend
When organizations deploy Microsoft 365, security leaders face a fundamental question: Is native Microsoft Defender protection enough?
Microsoft recently evaluated real-world telemetry from live enterprise tenants running seven ICES add-ons on top of Microsoft Defender. The result? KnowBe4 Defend ranked #1 across every single metric reported, catching 3.7x more dangerous emails that Microsoft Defender missed than the field average, with the lowest overlap.
Join Stuart Clark, SVP of Product at KnowBe4, for a technical breakdown of Microsoft's independent production telemetry and a live demonstration of our ICES ecosystem architecture between Microsoft Defender and KnowBe4 Defend.
We will showcase:
- The #1 Benchmark Telemetry: How Defend caught 3.7x more dangerous emails that Defender missed with the lowest overlap (0.65%)
- Adversarial AI and Model Diversity: How independent behavioral models neutralize polymorphic AI, prompt injections, and zero-payload BEC that slip through perimeter filters
- Microsoft Teams Messaging and Posture Management: Extending protection beyond the inbox into Teams and remediating insecure collaboration configurations
- Native SOC Workflows (Live Demo): Investigating Defend threat verdicts natively inside Microsoft Defender Threat Explorer
- Advanced Threat Hunting via KQL (Live Demo): Querying Defend-enriched threat metadata directly inside Microsoft Sentinel and Defender XDR
See why defense-in-depth no longer requires hopping between consoles or redundant gateway fees. Learn how to maximize your Microsoft 365 investment with cloud-native email security.
Date/Time: TOMORROW, Wednesday, Oct. 28, @ 2:00 PM (ET)
Save My Spot:
https://info.knowbe4.com/ecs-ms-demo-month1?partnerref=CHN2
AI Data Centers: Environmental Disaster or Groundbreaking Innovation?
AI data centers are one of the most debated topics in the world right now. Some people worry about the energy and water it takes to run them. Others see the foundation for the next wave of AI advances. Both camps have a point.
On episode two of the "Attempted Intelligence" podcast, Matt and Harlan each picked a side and debated it. Their goal wasn't to tell listeners what to think. It was to help them weigh the facts themselves. They framed the discussion around global versus local effects and talked through four topics: electricity, water, noise and community economics.
Electricity: Small Globally, Big Locally
Harlan made the global case. Data centers, AI and non-AI combined, used about 1.5% of global electricity in 2024. Even if that doubled, it would reach roughly 3%, which is small next to air conditioning, industry and electric vehicles.
Matt pushed back with the local picture. Data center demand grew 17% globally in 2025, against 3% overall electricity growth. In Ireland, data centers took 23% of metered electricity in 2025, up from 5% in 2015. He also cited Lawrence Berkeley National Laboratory's updated June 2026 estimate that data centers could reach as much as 15% of U.S. electricity. Cheaper inference also tends to drive more usage, not less.
Harlan agreed that local impacts matter, pointing to rate increases of roughly 28% in some Virginia areas (though inflation played a part). His answer: careful planning, requirements that data centers own their own power supply, and support from construction unions can offset the downsides.
Water: Myth, Reality and the Problem with Averages
Harlan noted that public concern was fueled by a since-debunked claim that each ChatGPT query uses gallons of water. U.S. data centers used about 17.4 billion gallons in 2023, out of roughly 228 billion gallons of water in total. That's far less than golf courses or irrigated agriculture, and indirect water use from power generation is much larger than direct cooling. His challenge: if you object to data centers but resent lawn-watering limits, reconsider.
Matt countered that the supply is often drinking water, and evaporative cooling doesn't return water to its source. Places like drought-stricken Tampa and parts of Texas, where neighbors' wells have run dry, face real strain. As he put it, you can't replenish a watershed with a national average.
They found common ground on solutions: closed-loop and zero-water designs (such as Microsoft's planned 2027 facilities) and published water studies before any new build. Matt also pointed to KnowBe4's own sustainability commitments, including net zero emissions by 2040.
Noise and Community Economics
Matt described the continuous, low-frequency tonal hum of data centers. At a Vantage site in Sterling, Loudoun County, Virginia, residents complained even though the operator met a 55-decibel limit.
Harlan noted that society has long handled loud neighbors like lumber mills and airports through zoning and mitigation. Data centers with on-site generation, he argued, should be zoned as industrial, not office space.
He also highlighted the upside for communities. Loudoun County's FY2026 data center property tax revenue was $1.2 billion, or 39% of its budget. Since 2016, the residential tax rate has dropped from $1.14 to $0.80 per $100. Add the multiplier effect of construction spending in local economies, and the benefits are real.
The Takeaway
The broader debate around AI data centers is looking at it from a global perspective and what it means for humanity overall. The impact of a data center depends on where it is built, how it gets power, and what water is available locally.
Listeners are urged not to fall exclusively on one side, to weigh both the costs and the opportunities, and to advocate for responsible decisions in their own communities, states and country.
Listen to the latest Attempted Intelligence episode here, on Spotify, Apple Podcasts and everywhere major podcasts are streamed. Blog post with links:
https://blog.knowbe4.com/ai-data-centers-environmental-disaster-or-groundbreaking-innovation
Ridiculously Easy AI-Powered Security Awareness Training Reduces Risk by 87%
68% of breaches still involve a human element. Attackers now use AI to build hyper-personalized lures that can fool even your most security-conscious users, yet most people still get the same generic training that ignores their real risk.
Join this demo to see training that adapts to each user's actual risk, and custom content you can build in minutes instead of months.
In this demo, you'll see how to:
- Change behavior with training tailored to each user's role, behavior and risk level
- Create custom, policy-aligned content in minutes with generative AI to prepare your workforce for advanced threats like vishing, deepfakes and AI phishing
- Coach users the moment risky behavior happens, not weeks later
- Eliminate language barriers from your training rollout using AI translation backed by our professional localization infrastructure
- Cut Phish-prone™ Percentage from 33.1% to 4.1% in one year, an 87% reduction in human risk
See how training that adapts in real time can close the gap generic training leaves open.
Date/Time: Wednesday, Nov. 4, @ 2:00 PM (ET)
Save My Spot:
https://info.knowbe4.com/sat-demo-month2?partnerref=CHN
Report: Ransomware Attacks Hit a Record High in Q3 2026
The third quarter of 2026 saw the highest number of ransomware attacks to date, with 2,627 total attacks, according to a new report from Comparitech.
"All four key sectors saw significantly more attacks in Q3 2026 compared to Q2 2026," the report says. "Education saw the biggest uptick with an increase of 50%, followed by healthcare (up 39%), government (up 36%) and businesses (up 27%).
"Within the business sector, all sub-industries saw a rise in attacks from Q2 to Q3 2026, bar two. Legal firms saw a 26% decrease in attacks, while the construction sector saw a minor two percent decline. The industries with the biggest increases were finance (up 72%), technology (up 70%), businesses operating in the healthcare sector (up 35%) and utilities (up 32%)."
U.S. organizations were the hardest-hit, accounting for 41% of attacks in Q3 2026.
"1,066 (or 41%) of attacks were carried out on U.S. entities," Comparitech says. "This was a 34% increase from Q2 2026. Germany saw the second highest number of attacks with 121 in total – a 22% increase from Q2 2026 (99).
"Canada (103) and Italy (86) followed and both saw increases compared to Q2 2026 (4% and 32%, respectively). But it was fifth-place India that saw one of the biggest increases in attacks, rising by 116% from 37 in Q2 2026 to 80 in Q3 2026. Argentina also saw a significant rise in attacks with 45 noted in Q3 2026, compared to 18 in Q2 2026 (a 150% increase)."
The Qilin and Gentlemen ransomware gangs led the pack, with each launching more than 300 attacks. "Qilin continued to dominate in Q3 2026 with 357 attacks in total, but was closely followed by The Gentlemen with 342 attacks," the researchers write.
"Both groups increased their attacks by similar amounts. Qilin attacks rose 24% compared to last quarter, and The Gentlemen attacks rose 29%. Bigger increases were seen by Clop (up 4,700% from one attack in Q2 2026 to 48 attacks in Q3 2026). DireWolf upped its attacks by 1,450% and Rhysida by 200%.
"In contrast, Akira's attacks declined by 23% and LockBit's by 51%. Qilin and The Gentlemen had the most confirmed attacks with 27 and 26, respectively."
Blog post with links:
https://blog.knowbe4.com/report-ransomware-attacks-hit-a-record-high-in-q3-2026
Email Security Kit: Resources for Redefining Your Defense
91% of cybersecurity leaders say their email security lets too many threats through.
While phishing remains the entry point for 70% of breaches, the gap between traditional email security and modern adversarial tactics is widening. This oversight leaves your workforce vulnerable to threats that bypass standard filters.
This kit cuts through the marketing hype, helping you navigate the needed transition from legacy systems to an integrated approach to cloud email security.
Here's what you'll get:
- Report: 2026 Phishing Threat Trends Report, Vol. Seven
- Infographic: Humans + AI: Better Than Your SEG
- Webinar: Moving Beyond Traditional Email Security
- Whitepaper: From Legacy to ICES: Separating Marketing Hype from Proven Email Defense
- Whitepaper: Critical Capabilities When Evaluating Integrated Cloud Email Security
- Infographic: KnowBe4 Integrates with Microsoft
[Warning] Calendly Phishing Pages Are Targeting Job Seekers
Researchers at Malwarebytes warn that a phishing campaign is using spoofed Calendly pages to trick users into handing over their Facebook and Google account credentials. The phishing sites pose as Calendly booking pages for job interviews at Meta, asking users to enter their information to sign up for a phone call with a recruiter.
After this, the user is taken to a spoofed Facebook or Google login page designed to steal their credentials and intercept their multifactor authentication codes.
"While the visitor is on the page, it keeps checking in with the attackers' server and waits to be told which screen to show next," the researchers write. "That allows the attackers to try the stolen password on the real Facebook site right away. If Facebook asks for a code, the fake page asks the visitor for the same code, and the attackers can use it before it expires.
"If the code doesn't work, the page simply says 'Incorrect code. Please try again.' The Google screens support the same approach. If Google sends a sign-in prompt to the visitor's phone, the fake page can tell them to 'tap Yes,' potentially approving the attackers' login. The visitor sees the fake page while the attackers attempt to sign in to the real service out of sight."
Malwarebytes offers the following advice to help users avoid falling for these attacks:
- "Check the address, not the design. Direct Calendly booking links use calendly.com, although legitimate forms can also be embedded on other websites. Treat an unfamiliar recruiting domain as a reason to verify the invitation independently.
- Don't give a booking page your Facebook password. Scheduling a call doesn't require handing your social media password to a recruiter. If a booking flow suddenly asks you to sign in elsewhere, verify both the request and the actual login domain.
- Look at your browser's real address bar. These fake login windows draw their own address bars showing Facebook or Google web addresses. For a separate pop-up, check the address displayed by the browser itself. A login window that cannot be dragged outside the webpage may be part of the page rather than a separate browser window.
- Verify the recruiter and role. Go directly to the company's official careers site. A genuine job listing doesn't prove the person contacting you represents the company, so verify unexpected invitations through an independent contact.
- Don't share codes or approve unexpected prompts. Only enter a code on the genuine service for a login you initiated. Never approve a phone prompt just because a recruiter or booking page tells you to.
- Use passkeys or a security key where you can. They resist this kind of phishing. Be wary if a page pushes you to use a password and code instead."
Blog post with links:
https://blog.knowbe4.com/warning-calendly-phishing-pages-are-targeting-job-seekers
Let's stay safe out there.
Warm regards,
Stu Sjouwerman, SACP
Executive Chairman
KnowBe4, Inc.
PS: [HEADS UP] Attackers begin launching end-of-year scams. Train your users:
https://www.netcraft.com/blog/year-end-phishing-lures-fake-raises-q4-invoices-and-access-reviews
- Monty Python - "Always Look on the Bright Side of Life"
- Marcus Tullius Cicero - Orator and Statesman (106-43 BC)
You can read CyberheistNews online at our Blog
https://blog.knowbe4.com/cyberheistnews-vol-16-43-the-patching-timeline-collapsed-how-to-fight-back-and-close-the-gap
FBI Warns of Phishing Attacks Ahead of the U.S. Midterm Elections
The U.S. FBI and the Cybersecurity and Infrastructure Security Agency (CISA) have issued joint advisories warning of election-themed scams targeting voters and spear phishing attacks targeting election officials.
"Scammers use the names, images, logos and slogans of candidates to fraudulently solicit campaign contributions, sell merchandise that is never delivered, or steal personally identifiable information (PII) that can be used for other fraud," the FBI says.
"Scammers also exploit artificial intelligence (AI) tools to generate highly realistic voices, images and written messages that impersonate candidates, campaigns, government entities and trusted contacts. The realism makes these schemes harder for victims to detect and increases the likelihood of financial loss or exposure of PII."
These scams include soliciting donations for phony Super PACs, campaign investment pool schemes and phishing attacks using voter registration as a lure.
Additionally, attackers are launching more targeted social engineering attacks against people involved in politics, using AI tools to craft extremely realistic messages.
"Election officials, candidates and their political organizations are attractive targets to malicious cyber criminals due to their access to voter registration data, current government officials, or sensitive campaign information,"
"In recent years, these actors have crafted increasingly sophisticated phishing and smishing campaigns that closely resemble legitimate communications, making it difficult for targets to distinguish fraudulent messages."
The FBI and CISA advise organizations and individuals to follow security best practices to thwart social engineering attacks:
- "Implement or enhance existing security infrastructure. Ensure your organization has the latest antivirus/anti-malware software installed that detects and defends against inbound malware, spam, and new and sophisticated phishing campaigns. Further, ensure your organization has implemented phishing-resistant MFA. For information on newly exploited vulnerabilities please refer to CISA's Known Exploited Vulnerabilities catalog.
- Educate employees on how to identify phishing and smishing attempts. Advise employees to be cautious when providing sensitive information — such as login credentials — electronically or over the phone, particularly if unsolicited or anomalous. Employees should confirm, if possible, requests for sensitive information through secondary channels.
- Create processes for employees to send suspicious emails to IT departments for confirmation and advise personnel within your organization not to open email attachments from senders they do not recognize."
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 Platform to strengthen their security culture and reduce workforce risk.
The FBI has the story:
https://www.ic3.gov/PSA/2026/PSA261015-3
Ransomware Gangs Use AI-Driven Ecosystems to Fuel Attacks
Researchers at SOCRadar discovered an AI-fueled attack ecosystem used by affiliates of the INC Gentlemen ransomware operations. The attackers abuse legitimate AI tools by telling them that the malicious operations are part of a red team exercise, spending more than $23,000 on these services.
"The operators ran intrusions through OpenCode with commercial models hosted on OpenRouter, using a 'WormGPT' persona prompt and MCP servers," the researchers write. "The AI planned reconnaissance, generated commands, triaged data and drafted extortion material, while a human operator approved each step.
"When models refused, the operator rewrote requests as authorized red team assessments instead of switching models." Once the attackers are inside an organization, they usually focus on exfiltrating data for extortion rather than deploying encrypting ransomware.
"AI-authored extortion records reveal a data-centric playbook that prefers data extortion over encryption," SOCRadar says. "The operators estimate what a victim can pay from its own stolen financials, map compliance and customer data for leverage, send masked proof samples and open with text-only emails to owners or executives without a price. Pressure then escalates through scripted vishing calls, customers and partners, regulators and finally publication, with 24 to 72-hour deadlines."
The researchers note, "This incident underscores a significant evolution in contemporary cyber threats: AI-driven attack workflows have transitioned from experimental models to central operational components for ransomware groups."
The use of AI tools allows ransomware groups to massively increase the speed and scale of their attacks, while giving unskilled threat actors access to sophisticated capabilities. AI-powered security awareness training can give your organization an essential layer of defense against ransomware attacks.
SOCRadar has the story:
http://socradar.io/blog/inc-gentlemen-ransomware-ai-infrastructure/
What KnowBe4 Customers Say
"Mr. Palma, we are extremely happy with KnowBe4. The content is top notch and timely.
"Most importantly, your support staff is amazing. Our previous support was a gentleman named Les. He was very helpful and quick in assisting us while we launched and got things into a routine.
"We recently got a new person, Thales, who works from Brazil. He's awesome. He was also helpful and quick and is very likable. You've got a great team and we look forward to continuing our relationship with you."
– V.A., IT Specialist/HR
- Ransomware attacks are surging in 2026:
https://www.infosecurity-magazine.com/news/rival-gangs-vie-for-market/ - Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site:
https://krebsonsecurity.com/2026/10/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site/ - Social Engineering: The Analog Threat to Digital Defenses:
https://www.insurancejournal.com/magazines/mag-features/2026/10/19/889096.htm - Hacker gets eight years for stealing $3.3 million from taxpayers:
https://www.bleepingcomputer.com/news/security/hacker-gets-8-years-for-stealing-33-million-from-taxpayers/ - Hackers Used Claude and Grok to Fully Automate Attacks on Banks:
https://www.theinformation.com/articles/hackers-used-claude-grok-fully-automate-attacks-banks? - From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage:
https://www.wiz.io/blog/from-phishing-to-llmjacking - How AI is Transforming Cybersecurity Into a Continuous, Automated Cat-and-Mouse Game:
https://oodaloop.com/briefs/technology/how-artificial-intelligence-is-transforming-cybersecurity-into-a-continuous-automated-cat-and-mouse-game/ - Authorities disrupt nearly 11,000 cybercrime networks in Africa:
https://www.interpol.int/en/News-and-Events/News/2026/Cybercrime-crackdown-in-Africa-nets-1-462-arrests-recovers-over-USD-105-million - Phishing campaigns are abusing legitimate infrastructure to bypass security filters:
https://blog.talosintelligence.com/parasitizing-trust-how-legitimate-infrastructure-becomes-a-delivery-pipeline-for-attackers/ - Chinese threat actor used AI to target thousands of ConnectWise tenants per minute :
https://www.infosecurity-magazine.com/news/microsoft-chinese-ai-connectwise/
- Virtual Vaca #1 - Pakistan in 4K - Incredible Scenes & Hidden Gems:
https://youtu.be/-LKemwGgJg8?si=fNErK0tIDGmRXLYi - Virtual Vaca #2 - Tuscany, Italy - In-depth tour city #18 of 30:
https://youtu.be/7XgwxKCIQtM - Virtual Vaca #3 - 10 BEST Places & Things To Do In Rwanda 2026:
https://youtu.be/l2czbIYe-XU - Magician Fools Penn & Teller with Key Magic Trick:
https://youtu.be/0WNSqqj5Ou8 - Everest: The Other Side | Official Trailer | Experience It In IMAX®:
https://youtu.be/wZh87r-Y2tY - Gitschen / Wingsuit Base Flight down to the Lake:
https://youtu.be/ZFCz208bhj0 - 70 road-legal amphibious cars from around the world drive straight into the lakes around Berlin:
https://www.flixxy.com/when-cars-go-swimming-70-amphibious-vehicles-take-to-the-water.htm?utm_source=chn&utm_medium=email - Fastest Skateboard Speed Downhill w/ Red Bull Guinness World Records:
https://youtu.be/lwrcOSB87Nw - Unitree Introducing: H2-X Kung Fu Legend Guardian. This looks real, hope it's not AI:
https://youtu.be/Y3zb4o47yqA - Need some space? Truly spectacular nature in 4K/8K:
https://youtu.be/lGy5vC-QMaw - The Skyscraper That's Dividing Europe:
https://youtu.be/h8wpG_A3_6g - For Da Kids #1 - Hero Turtles Rush To Save Struggling Friend:
https://youtu.be/ZeXr_p2V8ZM - For Da Kids #2 - Cats React to My Halloween Costume:
https://youtube.com/shorts/yeaCqK2Zzl8 - For Da Kids #3 - Dog Brings Mom A Treasure Every Time She Takes A Bath:
https://youtu.be/fygKegSIidg - For Da Kids #4 - Wild Stoats Flood Woman's Garden After She Saves Them:
https://youtu.be/WxNsusy7Its
