SA Threat Brief: Week 42

What Business Owners Need to Know This Week

Week 42 (4–10 October 2026): twice this week the record was already public, and the people who needed it had not read it. A South African medical scheme sat on a ransomware leak site for eleven days under the wrong country flag. An insurer’s own breach notice sat in its media centre for three months while everyone, this report included, checked only its home page. Both organisations had told their members in June that a supplier, MIP Holdings, had been breached; in the last week of September the group holding MIP’s data listed both of them, with timers. Separately, a ransomware group that did not exist a week earlier named Tharisa, the JSE-listed platinum and chrome producer, with an 856 GB claim the company has not yet answered. And on the technical side, Citrix NetScaler took its third zero-day in a fortnight, while CISA added five flaws from 2015 to 2023 to its Known Exploited Vulnerabilities catalogue because a Chinese state-linked operator is exploiting them now, with victims in Africa.

The Bottom Line: If your organisation disclosed a supplier breach this year, the extortion stage is the predictable second act, and the question for a board is whether it planned for it: a holding statement ready, your own name watched on leak sites under any country tag, and the regulator notification record in order before an attacker sets a timer. On the technical side the week’s work is an inventory, not a patch cycle: 125 NetScaler instances and 185 ProFTPD servers are exposed in South Africa, and the FBI advisory on FortiBleed lists nineteen account names that, if present on your FortiGate, mean you have already been compromised.

The Week in Numbers

• 136 cumulative SA ransomware victims — up 1 from 135; HIGH threat level for the 25th consecutive week.
• 856 GB — claimed from Tharisa by UmBra, a group whose leak site was first reported on 6 October and carried nine victims in six countries four days later. The claim is unconfirmed.
• 4 South African names — now linked to the June MIP Holdings breach on The Gentlemen’s site: Hollard, Guardrisk, LegalWise and Samwumed. Samwumed was found this week under a South Korean country tag.
• 960 victims — The Gentlemen’s index, up 39 in a week, again the largest move of any group. Comparitech ranks it second in the world for the third quarter with 342 claimed victims, in a record quarter of 2,627 claims of which only 247 were confirmed by the organisations named.
• 6 new CISA KEV additions — NetScaler CVE-2026-88779 and five flaws from 2015 to 2023 (ProFTPD, ISC BIND, Apache Struts, ONLYOFFICE and Strapi) from a seven-nation advisory on Chinese government-linked operators; all six were past their deadline on Monday 12 October.
• 3 fixed builds in 12 days — what a NetScaler owner has had to apply since 28 September; the latest, 14.1-73.46 or 13.1-64.29, covers both SAML flaws.
• 125 NetScaler and 185 ProFTPD instances — exposed to the internet in South Africa.
• 86,644 compromised FortiGate devices — SOCRadar’s worldwide count, cited in a 6 October FBI and Secret Service advisory on the FortiBleed credential campaign; 2,750 FortiGates are exposed in South Africa.
• 8 cases, 1 arrest — the Hawks’ cybercrime record over three years, in a parliamentary reply from the acting police minister.
• 15 April 2027 — when the National Consumer Commission says it will enforce the opt-out registry in full; it launched on 7 October and the comment window on its draft guidelines closes on 17 October.

Major Incidents: Who Was Hit and How

Tharisa — Listed by a Group Six Days Old

UmBra’s leak site was reported to the ransomware.live aggregator on 6 October. By 10 October it carried nine victims, four of them universities, with a data figure against every one. Tharisa, the Cyprus-incorporated group with its primary listing on the JSE and its mining operations in South Africa, was indexed on 7 October with an 856 GB claim and a leak screenshot, but no sample and no deadline. The company had published nothing by the close of the window: its newest SENS announcement is the 30 September board change, and its investor calendar gives 13 October for the fourth-quarter production report, the first scheduled document that could address the listing. Tharisa disclosed a separate cyber incident by SENS in December 2024, so it has a precedent of its own. The listing is rated CLAIMED: the volume, the data and the intrusion itself are the actor’s assertions, and the aggregator itself marks the group as emerging and its claims as unverified. Nine listings in five days from a site that did not exist on 5 October reads as an affiliate or a rebrand bringing an existing stock of access to a new name, which is an inference from the first week and nothing more.

Samwumed — Found Under a South Korean Tag, Had Named MIP in June

Samwumed, the closed medical scheme for municipal workers in Cape Town, was listed by The Gentlemen at 03:40 UTC on 30 September, in the same minute as LegalWise and Edcon. The aggregator gave the record a South Korean country tag, so it was absent from the ZA-scoped feed and from last week’s edition; TechCentral’s reporting surfaced it this week. The scheme’s own section 22 notice of 29 June names MIP Holdings as its former administration platform provider and says that historical member data in MIP’s legacy environment had not been deleted; names, historical membership numbers and treating doctors’ details may be affected, and the scheme is engaging MIP on its contractual obligations. The listing is CLAIMED; the scheme’s MIP exposure is CONFIRMED by its own notice. Whether the group holds the scheme’s data, and whether it came from MIP, is unconfirmed and not inferred from the timing. The notice does add something to the MIP record that no other client has put in writing: a former supplier still holding a client’s historical data after the contract ended.

LegalWise — Its Own Statements Settle Last Week’s Question

Last week asked whether LegalWise was an MIP client and said a LegalWise statement would settle it. The statement had existed for three months. LegalWise’s media centre carries a statement of 26 June and an update of 6 July naming MIP Holdings as the third party, listing identity numbers, contact details, membership information and banking details as the categories under assessment, and recording that its insurer LEZA notified the Information Regulator. That corrects last week’s edition. TechCentral reported countdown timers on the LegalWise, Samwumed and Edcon listings expiring around 9 October, with directory-style profiles and no samples, and none of the three carried a published-data marker on 11 October. The listings stay CLAIMED; LegalWise’s MIP exposure is CONFIRMED on its own statements. The statements also surface a conflict worth stating plainly: the Regulator told TechCentral on 25 September that it had received only MIP’s notification, while LegalWise says LEZA notified it and Guardrisk says its binder holder CoverCubed did too. The report records the conflict and does not resolve it.

Shoprite — Four Breaches Disclosed in an Integrated Report

Shoprite’s 2026 integrated report, as reported by TechCentral, ranks information security including cyber risk first of its six core risks, rates its controls partially effective (the weakest rating of the six), and discloses four data breaches in the financial year, up from three and one in the two years before, all involving personal information and affecting 44 customers. The incidents are not described. The item is carried for what it shows about disclosure practice: a listed retailer has put a breach count and a controls rating into a public document, which is more than any South African organisation named on a leak site this quarter has done in a statement.

Citrix NetScaler — A Third Zero-Day, and Two Fixes in Six Days

CVE-2026-88779 is a memory overflow reachable only on appliances configured as a SAML identity or service provider. Administrators reported crashes and reboot loops on fully patched appliances before Citrix published the fix on 3 October; Citrix confirmed targeted attacks, and CISA listed it on Sunday 4 October with a due date of 7 October. The established effect is a crash, and watchTowr told The Register it suspects the crashes have been used on purpose to speed up exploitation of September’s pre-authentication flaw CVE-2026-88771. Then on 9 October Citrix published CVE-2026-107406, another memory overflow in the same SAML configurations that could allow code execution, with no known exploitation; the fixed builds moved again, to 14.1-73.46 and 13.1-64.29, which cover both. An appliance patched on 4 October needs patching again. Outside the catalogue: SonicWall’s SMA 1000 took a CVSS 10 request forgery (CVE-2026-102255) on 6 October, and three days later a honeypot operator reported attempts consistent with it, including an attempt to reach the appliance’s internal database with the credentials admin:admin.

Five Old Flaws, a State-Linked Actor, and Africa on the Victim List

A joint advisory of 8 October from the FBI, CISA, NSA and partner agencies in six other countries (AA26-281A) describes Chinese government-linked operators working through the contractor Integrity Technology Group, with tactics consistent with the cluster vendors call Flax Typhoon, against government, manufacturing, healthcare and IT organisations in Southeast Asia, Africa and North America. Their scanning scripts carried eight working exploits; five were not yet in CISA’s KEV catalogue and were added the same day: ProFTPD CVE-2015-3306, ISC BIND CVE-2015-5477, Apache Struts CVE-2016-3081, ONLYOFFICE CVE-2021-3199 and Strapi CVE-2023-22894. The hands-on tooling sprays passwords at Exchange, pulls mailboxes with a PHP bot, runs DCSync-style replication, and persists with a SoftEther VPN client renamed conhost.exe or dllhost.exe. For a South African reader the relevance is the exploit list: these are components under old web applications, file-transfer portals and DNS resolvers that no patch cycle finds because no inventory lists them, and 185 ProFTPD instances are exposed in the country.

POPIA and Regulatory

Who has told whom. Samwumed’s section 22 notice and LegalWise’s July update add two filings to the MIP notification record, both predating the Regulator’s statement that it had received only MIP’s; Samwumed’s notice does not mention the Regulator at all. A former supplier holding a client’s historical data is the clearest version yet of the question the Regulator has been asked, and the first a client has put in writing. Parliament: a written reply from acting police minister Firoz Cachalia to Dianne Kohler Barnard MP, reported by MyBroadband, records that the Hawks registered eight cases under what the article calls the Cybercrimes Regulatory Framework in three years and made one arrest, in an international sextortion matter; the investigation into the January 2025 ransomware attack on the South African Weather Service is ongoing with no arrest. Opt-out registry: the National Consumer Commission launched the national opt-out registry on 7 October. Marketer registration runs to December at R2,574 with renewal at R1,930.50; cleansing is free from December to April 2027; enforcement in full from 15 April 2027; penalties up to R1 million or 10% of turnover, with up to twelve months’ imprisonment in serious cases. Moonstone reads financial institutions and insurers as in scope whenever a service call turns into promotion, and notes that a registered block invalidates prior consent. Werksmans warns that monthly uploads of customer databases to a state platform may be an information matching programme under POPIA, with no security or retention terms in the draft; the fifteen-day comment window closes on 17 October. Fraud advisories: the FSCA warned on 6 October of regulatory examination certificates bearing its and Moonstone’s branding being sold through Facebook and WhatsApp; Capitec is rolling out a Scam Checker in its app that rates a suspicious link or message without blocking anything; and MyBroadband reports Interpol’s finding that 70% of business email compromise detections in Africa originated in South Africa. The Information Regulator’s enforcement register still carries nothing later than 10 June.

Corrections to Week 41

Two items. First, the Week 41 edition counted three South African leak-site claims in its window. There were four: The Gentlemen listed Samwumed at 03:40 UTC on 30 September, in the same minute as LegalWise and Edcon, and the aggregator’s South Korean country tag kept it out of the feed and the edition. It is the second South African victim the aggregator’s country field has hidden, after RelyComply under GB in Week 39. Second, Week 41 stated that LegalWise’s website carried no notice and that whether LegalWise was an MIP client was unknown. Both were wrong at publication: the media centre has carried a statement since 26 June and an update since 6 July naming MIP Holdings, and the Week 41 check read the home page only. The LegalWise listing stays CLAIMED; the company’s MIP exposure is CONFIRMED on its own statements. Both corrections are recorded in the report’s Section 1 and Section 12.

Full Intelligence Report

The complete Week 42 technical report covers the Tharisa listing and the UmBra group's first week, the Samwumed and LegalWise records and the MIP notification conflict, Shoprite's disclosure, all six KEV additions with the NetScaler SAML configuration test and fixed builds, the AA26-281A tooling and domains, the FortiBleed account names, the SonicWall SMA 1000 request pattern, VERIFIED South African exposure counts, the opt-out registry sequence and fees, seven structured hunt missions with a 105-row IOC table, the two corrections to Week 41, and the full source list.

What Your Business Should Do Right Now

• Find every NetScaler that authenticates through SAML, check it, then upgrade it: Two configuration strings decide scope, add authentication samlAction and add authentication samlIdPProfile. An appliance carrying either is exposed to the CVE-2026-88779 crashes and the CVE-2026-107406 overflow whatever it was patched to in September. Pull the support bundle before patching any appliance with a reboot loop or a run of SAML failures since 1 October, run last week’s web-shell checks and Citrix’s indicator script, then move to 14.1-73.46 or 13.1-64.29 (13.1-37.283 on the FIPS line).
• If you disclosed a supplier breach this year, prepare for the extortion stage by Friday 16 October: A holding statement naming the supplier and the data categories already disclosed; a watch on your own name and domain across leak-site aggregators with the country tag ignored; a decision taken in advance on whether and how to engage; and the dates and reference numbers of every notification already made to the Information Regulator and, for a regulated financial institution, the Prudential Authority and FSCA.
• Insurers and schemes: get a written answer from every binder holder, administrator and former provider: Was it an MIP or RelyComply client, and does it still hold your data? Neither breach has a public client list, so the written answer is the only test; a deletion certificate from each former provider is the evidence a board can show.
• Inventory the five old components and patch or retire them by Friday 16 October: Every internet-facing ProFTPD (check whether mod_copy is loaded), Apache Struts (disable Dynamic Method Invocation), Strapi, ONLYOFFICE Document Server and BIND instance. A product inventory will not list them; scan your own address ranges.
• Audit every FortiGate’s local user list this week: Match it against the nineteen account names in the FBI advisory (adminin, fortiAdmin, forticloud-sync, itadmin, IT_Manager and the rest); any match is an incident regardless of firmware. Then end sessions, reset administrator and VPN credentials, require phishing-resistant MFA, take management off the internet and confirm passwords are stored with PBKDF2.
• Apply the SonicWall SMA 1000 hotfix and read the logs: Move to 12.4.3-03670 or 12.5.0-03082 (the appliance restarts), then search the WorkPlace access logs since 6 October for OPTIONS requests to the Extraweb interface and for 5984 or _rewrite in any request.
• Watch your own name on leak sites without trusting the country tag: Samwumed sat under KR for eleven days. A monitoring rule keyed on the organisation’s name, domain and common misspellings, with the country field ignored, would have caught it on 30 September.
• Put four generic ransomware signals into standing detections: A svchost.exe running outside System32, procdump or rclone under C:\PerfLogs, four endpoint-protection service stops in a minute, and the WMI shadow-copy deletion command. Huntress’s September Akira case produced all four, and none needs a threat intelligence subscription to detect.
• Decide by 16 October whether to comment on the opt-out registry guidelines, and who owns the registry relationship: On Werksmans’ reading the draft turns every telephone or digital marketing function into a monthly data transfer to a state platform with no stated security terms, and a registered block overrides prior consent. That is an information officer and board decision, not only a marketing one.