[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgv3J1ee0eAzuexAblqvudcFBUWAOo6q8c7MK8eO070s":3},{"article":4,"iocs":54,"watch_terms":58,"solutions":59,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"1ad8910c-298c-4da2-b859-5d61855a474e","ATF confirms cyberattack hit system containing info on its investigation targets","atf-confirms-cyberattack-hit-system-containing-info-on-its-investigation-targets-7707ff","The prolific ransomware group Qilin claimed responsibility for the attack. ATF insists the incident was limited to a standalone system and hasn’t impacted critical operations. The post ATF confirms cyberattack hit system containing info on its investigation targets appeared first on CyberScoop.","The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) has confirmed a cyberattack that impacted a standalone system containing information on investigation targets. The ransomware group Qilin has claimed responsibility for the incident, though the ATF has not independently confirmed this. The agency stated that the affected system was not connected to critical operations and that its mission capabilities remain unaffected.","ATF confirms cyberattack on system containing investigation targets; Qilin claims responsibility.","https:\u002F\u002Fcyberscoop.com\u002Fatf-doj-cyberattack-qilin-ransomware\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F08\u002FGettyImages-1240263561.jpg","2026-08-28T20:29:38+00:00","2026-08-28T22:00:41.88266+00:00",7,[17,20,23,25,27,29],{"name":18,"type":19},"Qilin","threat_actor",{"name":21,"type":22},"ATF","vendor",{"name":24,"type":22},"Halcyon",{"name":26,"type":22},"Google",{"name":28,"type":19},"Scattered Spider",{"name":30,"type":19},"Moonstone Sleet","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":31,"icon":33,"name":34,"slug":35},null,"Ransomware","ransomware",[37,42,47,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55],{"type":56,"value":18,"context":57},"malware","Ransomware group claiming responsibility for the attack.",[26,21,24],{"controls":60,"vendors":148},[61,90,119],{"slug":62,"name":63,"problem":64,"products":65},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":91,"name":92,"problem":93,"products":94},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"slug":120,"name":121,"problem":122,"products":123},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[124,132,140],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",[],{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":165},"atf-ransomware-attack-exposes-investigation-target-data","ATF Ransomware Attack Exposes Investigation Target Data","The ATF suffered a ransomware attack — claimed by the Qilin group — that compromised a standalone system holding sensitive information on active investigation targets. While the agency noted the system was not connected to critical operations, the exposure of law enforcement investigative data poses serious risks to ongoing cases, witness safety, and operational security. This incident highlights that even 'standalone' or isolated systems must be hardened and monitored, as adversaries actively seek out less-protected nodes to exploit. The fact that a ransomware group was able to exfiltrate or encrypt sensitive federal law enforcement data underscores the need for robust data classification, segmentation, and access controls across all systems — not just those deemed mission-critical.",[154,155,156,157,158,159,160,161,162,163,164],"NIST SP 800-53 SC-7 (Boundary Protection)","NIST SP 800-53 AC-4 (Information Flow Enforcement)","NIST SP 800-53 IR-4 (Incident Handling)","NIST SP 800-53 SI-3 (Malicious Code Protection)","CIS Control 3 (Data Protection)","CIS Control 13 (Network Monitoring and Defense)","CIS Control 17 (Incident Response Management)","CISA Ransomware Guidance (StopRansomware.gov)","FISMA (Federal Information Security Modernization Act) Section 3554","NIST Cybersecurity Framework PR.DS-1 (Data-at-rest protection)","NIST Cybersecurity Framework DE.CM-1 (Network monitoring)",{}]