30
60
57
57
60
60
60
55
45
57
Only at TechCrunch Disrupt 2026: What happens when OpenAI ships your roadmap?
TechCrunch Disrupt 2026 panel will discuss AI startup defensibility when OpenAI, Anthropic, or Google ship features startups built.
TechCrunch promotes a Builders Stage session at Disrupt 2026 (October 13-15, Moscone West, San Francisco) titled 'What Happens When OpenAI Ships Your Roadmap.' Speakers include Airbyte CEO Michel Tricot, Radical Ventures partner Rob Toews, and Webflow CEO Linda Tong. The session examines how founders differentiate when foundation model providers absorb startup capabilities, emphasizing proprietary data, embedded workflows, customer relationships, and trust as remaining moats.
10
FBI Publishes First-Ever Cyber Strategy, With Focus on Disrupting Threat Actors
The FBI published its first-ever Cyber Strategy on September 9, outlining four pillars for investigating and disrupting cyber threat actors and supporting victims.
The FBI's Cyber Strategy, published September 9, defines four pillars: investigate and impose costs on cyber adversaries, support victims, expand partnerships, and enhance the agency's cyber capabilities. It reflects a broader US shift toward proactive disruption, building on an August memorandum signed by President Trump authorizing collaboration with private firms on offensive cyber operations. The strategy includes expanding the Industrial Control Systems Coordinator program to every field office and deploying AI-enabled tools for triage, malware analysis, and attribution.
45
Srsly Risky Biz: China's Private Sector Botnets Are Worth Disrupting
DoJ seized domains of Chinese espionage botnet platforms QScan and QTRouter, run by private firm QTFY for MSS and PLA targeting.
The US Department of Justice disrupted QScan, a distributed vulnerability scanning system with nearly a decade of internet scanning data, and QTRouter, a covert communications platform routing traffic through compromised IoT devices, operated by QTFY under Chinese company Nanjing Xinjiuwei Network Technology. FBI and NSA advisories say QTFY customers include China's Ministry of State Security and the People's Liberation Army, targeting federal agencies, the US Senate, hospitals, telecoms and financial institutions. This is the third Chinese state-backed botnet disrupted since December 2023, following the KV botnet (Volt Typhoon) and Raptor Train (Flax Typhoon), and a sister network, JDY, has more than doubled since the KV disruption. Separately, the Qilin ransomware group claimed a breach of the ATF's CALEA system, briefly publishing 6.3 GB of case folders and forensic data.
76
60
42
57
Detect and disrupt AI-themed attacks with Microsoft Defender
Microsoft Threat Intelligence reports criminal campaigns impersonating ChatGPT, Copilot, Claude, and DeepSeek in phishing, AiTM, and malvertising attacks reaching 100,000 emails daily.
Microsoft Threat Intelligence observed a growing set of campaigns that abuse trust in popular AI brands: a ChatGPT-themed phishing campaign sent up to 100,000 emails in one day to steal payment card data, and a Claude-themed campaign used adversary-in-the-middle techniques to harvest credentials and access tokens. Other campaigns included malvertising for a fake AI Windows plugin delivering the Vidar stealer and fraudulent DeepSeek installers distributed via GitHub. Initial access broker Storm-3075 used AI-themed malvertising to distribute payloads for multiple downstream actors, and Microsoft notes the AI services themselves were not compromised. Microsoft also details Defender protections such as Safe Links, Safe Attachments, and attack disruption against these multi-stage lures.
65
42
42
55
60
57
30
60
57
30
60
42
30
55
60
60
30
60
60
Ransomware isn’t always about gangs making money. Sometimes it’s about nations manufacturing mayhem.
60
International Operation Disrupts Sality P2P Botnet
US-led international operation with Europol, CrowdStrike, and Shadowserver sinkholed the 20-year-old Sality P2P botnet, once exceeding one million infected machines.
On August 31, 2026, authorities from the US, Bulgaria, Hungary, and Romania, supported by Europol, CrowdStrike, and the Shadowserver Foundation, disrupted the Sality P2P botnet by sinkholing communications and seizing domains. Sality has operated for over 20 years, at its peak controlling more than one million infected machines used for credential theft, spam, proxy services, crypto-theft, and DDoS attacks, with over 11 million unique IP addresses linked to its infrastructure since 2017. The disruption exploited the botnet's super-peer reputation mechanism by removing legitimate peers via protocol-level manipulation and inserting sinkhole entries into emptied peer lists.
62
55
60
57