News
Short, sourced readings of developments in cybercrime, the Dark Web, OSINT and cyber-geopolitical risk, and news from Intellidark and its founder.
Cybercrime
CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency added two flaws, one in Check Point products and one in UnrealIRCd, to its Known Exploited Vulnerabilities catalog, as reported by Security Affairs. Federal agencies must fix both by 16 November 2026.
Source: Security Affairs
Cybercrime
Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper
BleepingComputer reports, citing Check Point, that attackers exploited vulnerable Check Point Security Gateway instances through PHP2Shell flaws and deployed a data wiper on VMware ESXi hosts.
Source: BleepingComputer
Cybercrime
Trezor Confirms Hidden Implants in Safe 5 Wallets Sold by CryptoBilis
Hardware wallet maker Trezor said that three Safe 5 wallets bought from the reseller CryptoBilis contain an implant that can copy recovery phrases, according to The Hacker News.
Source: The Hacker News
Cybercrime
Hackers Use 4,837 Stolen GitHub Accounts in wfx-loot Campaign Against Repositories
Hackread reports, citing Aikido Security, that attackers used 4,837 compromised GitHub accounts to open probe pull requests across 61,764 repositories, with credential-stealing code confirmed to have run in at least 1,835 of them.
Source: Hackread
Cybercrime
Citrix Patches 28 NetScaler Vulnerabilities, Including Critical Flaws
According to SecurityWeek, Citrix announced patches for 28 vulnerabilities in NetScaler ADC and NetScaler Gateway, nine of them rated critical, and a further critical flaw in NetScaler Console.
Source: SecurityWeek
Cybercrime
Hackers Target N-central Zero-Days as N-able Rushes Patches
According to SecurityWeek, N-able has patched several zero-days in N-central after a researcher published proof-of-concept code for more than 30 flaws and the company reported in-the-wild scanning targeting them.
Source: SecurityWeek
Cybercrime
Poland takes ePUAP e-government platform offline after cyberattack
Poland temporarily shut down its ePUAP e-government platform after detecting and stopping a cyberattack, according to Security Affairs, citing the Digital Affairs Minister Krzysztof Gawkowski.
Source: Security Affairs
Cybercrime
Hackers Deploy Malware in New ScreenConnect Campaign
According to Huntress, a threat actor compromised 288 hosts across 48 organizations using ConnectWise ScreenConnect, exploiting a flaw in the third-party RMM+ extension.
Source: SecurityWeek
Cybercrime
Zoom Fixes Critical Windows Flaw Allowing Unauthenticated Privilege Escalation
Security Affairs reports that Zoom has released updates for two vulnerabilities in Zoom Workplace for Windows, one rated critical (CVSS 9.6) and allowing privilege escalation over a network without logging in.
Source: Security Affairs
Cybercrime
Europol-led action seizes 257 domains and 235 servers used by Gootloader, CastleRAT and StealC
According to BleepingComputer, Europol and law enforcement partners from nine countries seized hundreds of servers and domains used by the Gootloader, CastleRAT and StealC malware operations, as part of Operation Endgame.
Source: BleepingComputer
Cybercrime
SCKit worm-like malware targets MSPs in ScreenConnect attacks
BleepingComputer reports that a worm-like toolkit named SCKit was deployed in ScreenConnect attacks on managed service providers, which Huntress and Blackpoint Cyber have not seen spreading successfully.
Source: BleepingComputer
Cybercrime
Krebs on Security Links Qilin Administrator to Named St. Petersburg Man
Krebs on Security reports that the administrator of the Qilin ransomware affiliate program, who uses the handle Haise, is linked to a 36-year-old man in St. Petersburg, Russia, based on identity links drawn from several intelligence firms.
Source: Krebs on Security
Cybercrime
Attackers Abuse AntiFox AI Pentest Platform to Steal AWS Credentials
Arctic Wolf Labs reports that attackers used the open-source, Chinese-language AntiFox agentic penetration testing platform to hit IIS servers and AWS accounts, as reported by Security Affairs.
Source: Security Affairs
Cybercrime
Critical Xen Orchestra Authentication Bypass Exploited in Attacks
According to software maker Vates, a threat actor is exploiting a critical authentication bypass and a zero-day flaw in Xen Orchestra, as reported by SecurityWeek.
Source: SecurityWeek
Cybercrime
N-able releases hotfixes for N-central zero-day vulnerabilities
N-able released N-central 2026.4 HF2 with patches for zero-day flaws that a researcher disclosed without notice, according to BleepingComputer, which reported that the company had taken hosted environments offline.
Source: BleepingComputer
Cybercrime
WhiteArmor Claims 100 GB Theft from Maersk Unit and Demands $5 Million
Maersk confirmed an IT security incident involving unauthorized access to a local legacy system, as reported by Security Affairs, while the cybercrime group WhiteArmor claims to have stolen 100 GB of data and demands a $5 million ransom.
Source: Security Affairs
Cybercrime
Microsoft November Patch Tuesday fixes about 1,090 flaws, one exploited Outlook bug
Security Affairs reports that Microsoft's November Patch Tuesday addresses about 1,090 new vulnerabilities, including one exploited Outlook spoofing flaw, CVE-2026-124194, and 30 bugs that ZDI considers potentially wormable.
Source: Security Affairs
Cybercrime
Nitori says hackers may have stolen 37.62 million customer records
Japanese furniture retailer Nitori said in a notice that an attacker accessed a system on its network and may have stolen up to 37.62 million customer records.
Source: BleepingComputer
Cybercrime
Attackers Abuse Qubole's AWS Role Trust to Access Customer Accounts and Steal Data
According to Wiz, an attacker entered AWS accounts of multiple Qubole customers between 14 and 26 October, stealing stored secrets and data by using credentials for the AWS account that Qubole's platform uses.
Source: The Hacker News
Cybercrime
N-able takes N-central offline after researcher discloses more than 30 zero-days
According to BleepingComputer, N-able took its hosted N-central environments offline and urged on-premises customers to shut down their servers after security researcher Sean Bales published more than 30 alleged zero-day vulnerabilities.
Source: BleepingComputer
Cybercrime
Ukraine arrests four suspects in €4.3 million crypto investment scam
According to BleepingComputer, Ukrainian law enforcement arrested four suspects in a case involving more than €4.3 million stolen through a network of cryptocurrency investment scam call centers, with 135 German victims.
Source: BleepingComputer
Cybercrime
Fake GitHub Security Tools Infect Over 2,000 PCs With Malware
Doctor Web, as reported by Security Affairs, found malware hidden in GitHub projects posing as security tools, with more than 2,000 PCs infected and attackers now targeting information security professionals.
Source: Security Affairs
Cybercrime
DigiCert Data Breach Exposes Customer Identity Documents
BankInfoSecurity reports that a botched system migration at DigiCert allowed unauthorized access to an internal archive containing customer identity documents.
Source: BankInfoSecurity
Cybercrime
SonicWall Patches Exploited SonicOS Flaw That Weakens SAML VPN Logins
SonicWall has patched CVE-2026-19868, a SonicOS SSL VPN flaw that can let a user with valid credentials for another login method bypass SAML authentication, as reported by SecurityWeek.
Source: SecurityWeek
Cybercrime
ENISA Warns of Attacks on Refrigeration Systems Across Europe
Reporting by Security Affairs says ENISA, the European Commission, Europol and EU cybersecurity bodies issued a joint warning after attacks on commercial refrigeration systems in several Member States, with about 300 Intermarché and Netto stores affected in France.
Source: Security Affairs
Cybercrime
FBI and CISA warn of attacks on refrigeration and cold-chain systems
BleepingComputer reports that the FBI and CISA warn hackers are actively targeting industrial refrigeration and cold-chain monitoring systems worldwide.
Source: BleepingComputer
Cybercrime
Residential Proxy Traffic Found Exiting Through White House Network
Layer3 Intel, as reported by Security Affairs, found residential proxy exit activity on AS2650, a network registered to the Executive Office of the President, between 5 October and 3 November.
Source: Security Affairs
Cybercrime
OpenSSH Patches ‘SSHole’ Authentication Bypass on Linux Systems Using musl libc
SecurityWeek reports that OpenSSH has released emergency patches for a high-severity flaw, tracked as CVE-2026-123158 and scored 8.1, that lets attackers log in with very long passwords on some Linux distributions.
Source: SecurityWeek
Cybercrime
CISA Warns Hackers Are Exploiting 18-Year-Old WordPress Core Vulnerability
The US Cybersecurity and Infrastructure Security Agency (CISA) has warned that attackers are exploiting CVE-2026-119977, a WordPress core flaw that can allow takeover of websites during an update, as reported by Hackread.
Source: Hackread
Cybercrime
Fake OpenAI and SpaceX event pages steal Microsoft and Google accounts
According to Push Security, as reported by BleepingComputer, attackers use fake OpenAI, SpaceX and Anthropic event invitations to steal Microsoft and Google credentials and sessions.
Source: BleepingComputer
Cybercrime
Fake ChatGPT and Claude Apps Deliver Yoba Malware Through GitHub
According to Check Point research reported by Hackread, attackers distribute fake ChatGPT and Claude desktop apps on GitHub that bundle malware with genuine executables signed by OpenAI and Anthropic.
Source: Hackread
Cybercrime
APT29 Linked to Mobile Watering Hole Campaign Using n-Day Exploit Chains
Sekoia reports a watering hole campaign targeting iOS and Android users through hacked websites and a compromised Ukrainian analytics service, which it links with moderate to high confidence to APT29.
Source: Security Affairs
Cybercrime
CISA adds Apple flaw CVE-2024-27834 to Known Exploited Vulnerabilities catalog
Security Affairs reports that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added Apple flaw CVE-2024-27834 to its Known Exploited Vulnerabilities catalog, with federal agencies ordered to fix it by 18 November 2026.
Source: Security Affairs
Cybercrime
Zyxel GS1900 Patch 2 Does Not Block Zero-Day Root Command Execution Exploit
Researchers at Binarly found that Zyxel GS1900 switches with the earlier Patch 2 firmware remain open to a zero-day exploit that runs commands without login, as reported by The Hacker News.
Source: The Hacker News
Cybercrime
Zyxel patches zero-day exploited to compromise nearly 1,000 GS1900 switches
BleepingComputer reports that Zyxel has patched CVE-2026-107441, a zero-day in its GS1900 series switches that attackers exploited to compromise 996 devices across 48 countries, according to GreyNoise.
Source: BleepingComputer
Cybercrime
Synology warns of C3RB3R ransomware hitting outdated NAS devices
BleepingComputer reports that Synology urged customers to update DiskStation Manager after attackers exploited a flaw patched in December 2024 to encrypt NAS devices.
Source: BleepingComputer
Cybercrime
Money-stealing scams outpace credential phishing, Akamai finds
BankInfoSecurity reports Akamai data showing online scams doubled to 6.4 million detected cases between July 2025 and June 2026, outpacing credential phishing for the first time.
Source: BankInfoSecurity
Cybercrime
FBI probe ties ransom negotiators to ShinyHunters extortion
Krebs on Security reports that investigators found executives at two ransomware negotiation firms in close contact with ShinyHunters, one allegedly helping run its extortion site.
Source: Krebs on Security
Cybercrime
FBI and CISA warn election officials of phishing and smishing
A public service announcement of 16 October 2026 warns that phishing and smishing campaigns target election officials, candidates and campaigns before the 2026 US midterms.
Source: FBI IC3
Cybercrime
Leaked chats show an extortion crew posing as IT staff at law firms
GuidePoint Security analyzed 5,692 leaked messages it attributes to Silent Ransom Group, a crew that phones staff as their own IT department and sends people on site.
Source: GuidePoint Security
Cybercrime
Ransomware: record 2,760 victims in Q3 2026 as payment rates fall
GuidePoint's GRIT team counts 112 active groups and a 75% year-on-year rise in claimed victims, while fewer organisations pay and those who do pay more.
Sources: GuidePoint Security · Business Wire via FinancialContent
Cybercrime
Europol: KillSec ransomware group disrupted, suspected leader is 16
Europol reported on 1 October 2026 three arrests and the seizure of KillSec's leak site, in an investigation into some 1,000 attacks attributed to the group.
Source: Europol
Cybercrime
Operation Endgame takes down 326 servers behind three malware families
A June 2026 action week coordinated by Europol and Eurojust hit SocGholish, Amadey and StealC, the loaders and stealers that feed ransomware crews with access and credentials.
Sources: Europol · Eurojust
Contact