https://www.threatintelligence.co.za/ Weekly South African cyber threat intelligence. Ransomware activity, critical CVEs, data breaches and POPIA developments affecting SA organisations — published free every week. en-za © 2026 Digital Progression info@dpcyber.co.za (Digital Progression) Cyber Threat Intelligence Mon, 05 Oct 2026 06:00:00 +0200 Mon, 05 Oct 2026 06:00:00 +0200 https://www.rssboard.org/rss-specification https://www.threatintelligence.co.za/images/favicon.png https://www.threatintelligence.co.za/ 64 64 https://www.threatintelligence.co.za/reports/threat-intel-w41-26.html https://www.threatintelligence.co.za/reports/threat-intel-w41-26.html Mon, 05 Oct 2026 06:00:00 +0200 HIGH Threat Level: the state air navigation operator discloses ransomware-linked malware in airport OT through a tender, INC Ransom lists BCX, and the MIP breach reaches a second insurer through a binder holder. ATNS OperationalTechnology BCX INCRansom Guardrisk CoverCubed TheGentlemen LegalWise CitrixNetScaler POPIASection22 https://www.threatintelligence.co.za/reports/threat-intel-w40-26.html https://www.threatintelligence.co.za/reports/threat-intel-w40-26.html Mon, 28 Sep 2026 06:00:00 +0200 HIGH Threat Level: the regulators rule that the insurer owes the notification whatever the supplier did and that paying a ransom does not discharge it, while a second South African insurer is listed in three weeks. Guardrisk TheGentlemen MIPHoldings BidvestBank RelyComply TelkomBCX GautengEPanic CheckPoint MikroTik POPIASection22 https://www.threatintelligence.co.za/reports/threat-intel-w39-26.html https://www.threatintelligence.co.za/reports/threat-intel-w39-26.html Mon, 21 Sep 2026 06:00:00 +0200 HIGH Threat Level: one policy-administration vendor held identity numbers for the customers of 45 insurers, one compliance platform held the FICA records of six regulated institutions — and a paid ransom did not stop publication. MIPHoldings RelyComply Hollard TheGentlemen DireWolf EasyEquities SupplyChain CiscoISE POPIASection22 CybercrimesAct https://www.threatintelligence.co.za/reports/threat-intel-w38-26.html https://www.threatintelligence.co.za/reports/threat-intel-w38-26.html Mon, 14 Sep 2026 06:00:00 +0200 HIGH Threat Level: two financial institutions notify customers over a supplier's breach, South Africa's largest private insurer is listed on a leak site, and three vendor advisories contradict the exploitation catalogue. BidvestBank EasyEquities Hollard TheGentlemen LockBit Cartrack CitrixNetScaler CiscoFMC MikroTik FSCA https://www.threatintelligence.co.za/reports/threat-intel-w37-26.html https://www.threatintelligence.co.za/reports/threat-intel-w37-26.html Mon, 07 Sep 2026 06:00:00 +0200 HIGH Threat Level: Africa's largest bulk water utility confirms a breach, the Information Regulator reveals it holds over 8,000 unpublished breach notifications, and SonicWall tells customers to re-image rather than patch. RandWater CriticalInfrastructure InformationRegulator SABS SonicWall PaperCut Cartrack DireWolf FSCA POPIACompliance https://www.threatintelligence.co.za/reports/threat-intel-w36-26.html https://www.threatintelligence.co.za/reports/threat-intel-w36-26.html Mon, 31 Aug 2026 06:00:00 +0200 HIGH Threat Level: a statutory council publishes its own ransomware notice, the Lengau supercomputer crypto-mining cause reaches Parliament, and AI appears on both sides of the vulnerability. FurnitureBargainingCouncil Deadlock LengauSupercomputer CHPC UAT10147 OracleWebLogic SharePoint INTERPOL CISAKEV InformationRegulator https://www.threatintelligence.co.za/reports/threat-intel-w35-26.html https://www.threatintelligence.co.za/reports/threat-intel-w35-26.html Mon, 24 Aug 2026 06:00:00 +0200 HIGH Threat Level: two South African companies named by ransomware groups with no acknowledgment from either, while nine KEV additions land in five days and six are already overdue. TheCourierGuy MedusaLocker Babcock TheGentlemen SharePoint VMwarevCenter WindowsIKE Zimbra CISAKEV POPIASection22 https://www.threatintelligence.co.za/reports/threat-intel-w34-26.html https://www.threatintelligence.co.za/reports/threat-intel-w34-26.html Mon, 17 Aug 2026 06:00:00 +0200 HIGH Threat Level: three South African confirmations, every one of them on a supply chain — including a retailer breached through a reporting tool two companies further down the chain. LEGOCertifiedStores Metabase Marsello ToyotaSA EuphoriaTelecom SupplyChain Storm1175 CiscoASA POPIASection22 InformationRegulator https://www.threatintelligence.co.za/reports/threat-intel-w33-26.html https://www.threatintelligence.co.za/reports/threat-intel-w33-26.html Mon, 10 Aug 2026 06:00:00 +0200 HIGH Threat Level: a regulated payment distribution agency confirms ransomware, Fidelity's breach is confirmed and published, and INTERPOL puts South Africa at 92% of Africa's ransomware detections. DCPartner Krybit FidelityServices RansomHouse INTERPOL SABRIC NAbleNCentral Langflow ApacheTomcat POPIASection22 https://www.threatintelligence.co.za/reports/threat-intel-w32-26.html https://www.threatintelligence.co.za/reports/threat-intel-w32-26.html Mon, 03 Aug 2026 06:00:00 +0200 HIGH Threat Level: four South African ransomware victims surface at once including the region's largest security services provider, while SARS confirms taxpayer phishing is now AI-generated. FidelityServices RansomHouse IncRansom SARS AIPhishing AristaVeloCloud CiscoFMC Fastjson CISAKEV POPIASection22 https://www.threatintelligence.co.za/reports/threat-intel-w31-26.html https://www.threatintelligence.co.za/reports/threat-intel-w31-26.html Mon, 27 Jul 2026 06:00:00 +0200 HIGH Threat Level: Rectron confirms a DragonForce breach and notifies the Regulator, the SA ransomware tally corrects upward to 115, and two new KEV entries defeat patch-only remediation. Rectron DragonForce Qilin SharePoint CheckPoint WordPress OracleCPU CISAKEV POPIASection22 FICDeadline https://www.threatintelligence.co.za/reports/threat-intel-w30-26.html https://www.threatintelligence.co.za/reports/threat-intel-w30-26.html Mon, 20 Jul 2026 06:00:00 +0200 HIGH Threat Level: South Africa's six-week quiet ends with two confirmed incidents, a probable breach at a top-four technology distributor, and the largest Microsoft patch release ever recorded. BETravel ArcusMedia GautengBreach Rectron DragonForce PatchTuesday ADFS SharePoint CISAKEV POPIACompliance https://www.threatintelligence.co.za/reports/threat-intel-w29-26.html https://www.threatintelligence.co.za/reports/threat-intel-w29-26.html Mon, 13 Jul 2026 06:00:00 +0200 HIGH Threat Level: six KEV additions in seven days on three-day fuses, four of them Joomla extension flaws targeting the unmanaged SA web estate, while SA breach volume goes public at 3,219 notifications and R141.96 billion. Joomla SPPageBuilder ColdFusion Gitea OracleEBS CISAKEV ICASA SIMBoxing POPIACompliance InformationRegulator https://www.threatintelligence.co.za/reports/threat-intel-w28-26.html https://www.threatintelligence.co.za/reports/threat-intel-w28-26.html Mon, 06 Jul 2026 06:00:00 +0200 HIGH Threat Level: Capitec replaces cards over the Pick n Pay legacy-app breach, the mystery medical-aid breach resolves to Profmed via PPSHA with a five-scheme blast radius, and Oracle EBS Payments is exploited before it even reaches the KEV. PicknPay Capitec Profmed PPSHA SimpleHelp SharePoint OracleEBS BlueHammer FICA POPIACompliance https://www.threatintelligence.co.za/reports/threat-intel-w27-26.html https://www.threatintelligence.co.za/reports/threat-intel-w27-26.html Mon, 29 Jun 2026 06:00:00 +0200 HIGH Threat Level: Hacktivists breach two SA state entities into a 30 June flashpoint, IR serves notices on both major credit bureaus, Standard Bank leak attributed to Prinz Eugen/ROOTBOY publishing 100,000 rows/day. OpSouthAfrica Hacktivism CorrectionalServices TransUnion Experian PrinzEugen ROOTBOY StandardBank FortiBleed FICA https://www.threatintelligence.co.za/reports/threat-intel-w26-26.html https://www.threatintelligence.co.za/reports/threat-intel-w26-26.html Mon, 22 Jun 2026 06:00:00 +0200 HIGH Threat Level: FortiBleed exposes ~74,000 FortiGate firewalls with plaintext credentials, Splunk pre-auth RCE under active exploitation, and the year's biggest supply-chain campaign attributed to a SA-based operator. FortiBleed Fortinet Splunk TeamPCP SupplyChain JoomlaJCE PeopleSoft AVBOB CannaLeaks POPIACompliance https://www.threatintelligence.co.za/reports/threat-intel-w25-26.html https://www.threatintelligence.co.za/reports/threat-intel-w25-26.html Mon, 15 Jun 2026 06:00:00 +0200 HIGH Threat Level: AVBOB knocked offline (350+ branches), record 208-CVE Patch Tuesday led by a wormable kernel RCE, SAPS WC medical records breach, PeopleSoft 0-day mass-compromise, Ivanti Sentry 10.0 weaponised in under 24h. AVBOB PatchTuesday WormableRCE ExchangeOWA SAPS PeopleSoft ShinyHunters IvantiSentry OpenSSL POPIACompliance https://www.threatintelligence.co.za/reports/threat-intel-w24-26.html https://www.threatintelligence.co.za/reports/threat-intel-w24-26.html Mon, 08 Jun 2026 06:00:00 +0200 HIGH Threat Level: National supercomputer Lengau offline after credential breach, Standard Bank 1.2 TB publicly released, SA confirmed #1 globally for DDoS against banking, Cisco SD-WAN 7th zero-day with no patch. Lengau CSIR StandardBank ROOTBOY NETSCOUT DDoS CiscoSDWAN CitrixNetScaler PatchTuesday POPIACompliance https://www.threatintelligence.co.za/reports/threat-intel-w23-26.html https://www.threatintelligence.co.za/reports/threat-intel-w23-26.html Mon, 01 Jun 2026 06:00:00 +0200 HIGH Threat Level: PAN-OS GlobalProtect CVSS 9.3 mass exploitation, Pick n Pay/Bottles breach confirmed, first China-APT compromise of a SA university, Exchange OWA deadline passes unpatched, ransomware tally flat at 111. PANOS GlobalProtect PicknPay Webworm ChinaAPT ExchangeOWA OracleORDS 0daySyndicate SupplyChain POPIACompliance https://www.threatintelligence.co.za/reports/threat-intel-w22-26.html https://www.threatintelligence.co.za/reports/threat-intel-w22-26.html Mon, 25 May 2026 06:00:00 +0200 HIGH Threat Level: SA ISP/hosting RDoS wave peaks 676Gbit/s, Defender OOB patches after 7+ weeks, new CVSS 10.0 cPanel vuln, SA added to Lazarus APT target geography, ransomware tally holds at 111. RDoS 1Grid Xneelo Seacom BlackMatter DefenderOOB cPanelCVSS10 Lazarus ExchangeOWA POPIACompliance https://www.threatintelligence.co.za/reports/threat-intel-w21-26.html https://www.threatintelligence.co.za/reports/threat-intel-w21-26.html Mon, 18 May 2026 06:00:00 +0200 HIGH Threat Level: 3 new SA victims (SANBS unverified, Merensky Timber, Sew Treat), tally hits 111, Cisco SD-WAN CVSS 10.0 KEV deadline passes, Exchange OWA zero-day with no permanent patch. SANBS KillSec BlackSuit MerenskyTimber ExchangeOWA CiscoSDWAN Canvas ShinyHunters DefenderZeroDay POPIACompliance https://www.threatintelligence.co.za/reports/threat-intel-w20-26.html https://www.threatintelligence.co.za/reports/threat-intel-w20-26.html Mon, 11 May 2026 06:00:00 +0200 HIGH Threat Level: Standard Bank on ransomware.live (108th victim), Ekurhuleni R2B fraud at SCOPA, ShinyHunters 12 May Canvas deadline hits 5 SA institutions, APT28 SAMA financial expansion flagged. StandardBank Ekurhuleni ShinyHunters Canvas Polmed APT28 SAMA PANOS DefenderZeroDay POPIACompliance https://www.threatintelligence.co.za/reports/threat-intel-w19-26.html https://www.threatintelligence.co.za/reports/threat-intel-w19-26.html Mon, 04 May 2026 06:00:00 +0200 HIGH Threat Level: Stormous claims CGCSA (151K+ docs, Unilever/Nestlé partner data), SA victim count 107, IR files first major court action against Blouberg Municipality, 15 CISA KEV entries. CGCSA Stormous StandardBank BloubergMunicipality POPIAEnforcement ConnectWise MedusaRansomware APT28 NTLMExploit DefenderZeroDay https://www.threatintelligence.co.za/reports/threat-intel-w18-26.html https://www.threatintelligence.co.za/reports/threat-intel-w18-26.html Mon, 27 Apr 2026 06:00:00 +0200 HIGH Threat Level: Standard Bank scope expands to cards/passports, XP95 deadline lapsed, Polmed breaks publicly, Defender zero-day trilogy, 13 new CISA KEV entries. StandardBank XP95 Polmed ShinyHunters DefenderZeroDay BitwardenSupplyChain CISAKOV OracleCPU POPIACompliance https://www.threatintelligence.co.za/reports/threat-intel-w17-26.html https://www.threatintelligence.co.za/reports/threat-intel-w17-26.html Mon, 20 Apr 2026 06:00:00 +0200 CRITICAL Threat Level: Standard Bank 1.2TB released, XP95 deadline arrives, Polmed/SAPS data exposed, Adumo POS on dark web, Cisco IOS-XE zero-day. SA's most severe concurrent cyber crisis on record. StandardBank ROOTBOY Polmed ShinyHunters Adumo XP95 CiscoIOSXE SaltTyphoon POPIACompliance CriticalThreat https://www.threatintelligence.co.za/reports/threat-intel-w16-26.html https://www.threatintelligence.co.za/reports/threat-intel-w16-26.html Mon, 13 Apr 2026 06:00:00 +0200 HIGH Threat Level: XP95 deadline 7 days away, Salt Typhoon first SA telecom breach confirmed, Krybit claims Megasurf, IR compels dual-entity Liberty/Standard Bank disclosure. XP95 SaltTyphoon StatsSA GCRA Megasurf Krybit LibertyBreach StandardBank POPIACompliance NationState https://www.threatintelligence.co.za/reports/threat-intel-w15-26.html https://www.threatintelligence.co.za/reports/threat-intel-w15-26.html Mon, 06 Apr 2026 06:00:00 +0200 HIGH Threat Level: XP95 claims Stats SA and GCRA, DragonForce hits Singita, three critical edge-device CVEs actively exploited, SA victim count reaches 103, and Liberty investigation escalates to CEO level. XP95 StatsSA GCRA DragonForce Singita F5BIGIP CitrixNetScaler FortiClientEMS LibertyBreach POPIACompliance https://www.threatintelligence.co.za/reports/threat-intel-w14-26.html https://www.threatintelligence.co.za/reports/threat-intel-w14-26.html Mon, 06 Apr 2026 06:00:00 +0200 HIGH Threat Level: XP95 claims Stats SA, Liberty breach hits 3.2M customers, DragonForce leak volume confirmed at 316GB, F5 BIG-IP RCE exploited by Chinese state actors, and AI-powered banking fraud surges. XP95 StatsSA LibertyBreach DragonForce F5BIGIP AIBankingFraud Tycoon2FA POPIAEnforcement https://www.threatintelligence.co.za/reports/threat-intel-w13-26.html https://www.threatintelligence.co.za/reports/threat-intel-w13-26.html Thu, 26 Mar 2026 06:00:00 +0200 HIGH Threat Level: Cisco FMC CVSS 10.0 actively exploited by Interlock ransomware, SA insurance sector hit, and POPIA enforcement escalates to real fines. InterlockRansomware CiscoFMC DragonForce POPIAEnforcement BECFraud AIVoiceSpoofing GautengBreach NFCScam https://www.threatintelligence.co.za/reports/threat-intel-w12-26.html https://www.threatintelligence.co.za/reports/threat-intel-w12-26.html Mon, 23 Mar 2026 06:00:00 +0200 HIGH Threat Level: Gauteng 3.8TB data breach, Chinese state-sponsored telecom espionage, and new POPIA health regulations now in force with R10M penalties. GautengBreach SaltTyphoon Ransomware POPIAHealth ChromeZeroDay CiscoAlert PatchTuesday BECFraud https://www.threatintelligence.co.za/reports/threat-intel-W11-26.html https://www.threatintelligence.co.za/reports/threat-intel-W11-26.html Fri, 13 Mar 2026 06:00:00 +0200 ELEVATED Threat Level: Analysis of critical CVSS 10.0 vulnerabilities in Cisco infrastructure and new POPIA enforcement trends. CiscoAlert ChromeZeroDay POPIAHealth PatchTuesday