The TIE Brief
Leads 5
Check Point researchers detail Storm ransomware's fast expansion to over 50 victims across multiple sectors, its polished leak platform, and a revenue‑share model offering affiliates up to 90% of proceeds. Claims of AI‑powered, quantum‑resistant capabilities remain unsubstantiated.
Key points
- Storm appeared in August 2026, claiming more than 50 victims in six weeks across North America, Europe and Oceania, targeting healthcare, finance, manufacturing and critical infrastructure.
- The group runs a Ransomware‑as‑a‑Service model with a tiered affiliate program that can pay up to 90% of ransom proceeds once earnings exceed $750,000.
- Its public leak site resembles a commercial platform, offering an interactive victim map, sector filters, searchable listings and document previews.
- Despite marketing itself as the “first AI‑powered, quantum‑resistant ransomware,” researchers found no evidence of AI use in the attack chain.
- Initial Access Broker “BigBro” promoted Storm on darknet forums before its first victim disclosures.
On Oct. 30 2026 a canary observed an unauthenticated exploit of CVE‑2026‑58115 in Node‑RED, delivering a Linux bot through a multi‑layered base64 payload. The request originated from an IP in Microsoft’s ASN and targeted the SIMATIC IoT2050 Advance used in industrial control systems.
Key points
- The exploit sent a crafted Node‑RED flow that used an inject node and an exec node to run a base64‑encoded shell command, which decoded to a wget/curl dropper.
- The dropper writes the binary to /dev/shm/.b, sets execute permissions, and launches it detached via setsid/nohup, ensuring it runs even after Node‑RED exits.
- Sixteen separate events from the same IP were recorded, each delivering the same payload with three layers of encoding.
- The vulnerability is assigned by Siemens and affects the SIMATIC IoT2050 Advance, indicating exposure of critical infrastructure devices.
- No patch or mitigation was mentioned, and the bot binary was not analyzed for capabilities.
Multiple AI developer platforms suffer credential‑theft incidents in October, dubbed “Black October”
At least nine AI developer platforms reported security breaches in October, many involving credential theft and agent‑swarm attacks. Some incidents led to cryptocurrency theft of roughly $371,000 and downstream abuse of enterprise keys. The attacks show a pattern of targeted exploitation across the AI development ecosystem.
Multiple AI developer platforms suffer credential‑theft incidents in October, dubbed “Black October”
Key points
- Nine AI developer platforms disclosed breaches in October, with additional incidents reported for Brev, Trigger.dev, and Chainstack.
- Attacks often used “agent swarm” techniques and targeted stored environment variables granting AI access.
- Root causes include credential compromise, supply‑chain dependencies, privilege escalation, and legacy systems.
- Impacts include theft of cryptocurrency (~$371,000) and downstream abuse of compromised enterprise credentials.
- Analysts note the campaign aligns with broader trends in agentic attacks, LLM jacking, and distillation threats.
OPSSHIELD disclosed that attackers hijacked the cPGuard update distribution infrastructure, injecting a script that collected Linux credential files and uploaded them to a compromised licensing server. A corrective update (5.88.25) removes the backdoor, and administrators are urged to verify versions and rotate credentials.
Key points
- Attackers used stolen credentials to infiltrate OPSSHIELD’s CDN and inject a malicious script into cPGuard updates 5.88.12‑5.88.19.
- The script harvested /etc/shadow, /etc/passwd, MySQL config, shell history, and SSH files, uploading them to the vendor’s licensing server for later retrieval.
- OPSSHIELD secured the compromised account, halted distribution, and released cPGuard 5.88.25 to remove the backdoor.
- Administrators should check update logs, apply the new version, and rotate all affected credentials.
- The incident’s scope and data loss remain under investigation, with no specific victims or financial losses disclosed.
F6’s threat intel team observed that Russian actor VasyGrek continued phishing attacks against Russian firms from August to November 2025, delivering PureCoder‑crafted malware and occasional Pay2Key ransomware payloads. The campaign shifted to BAT and VBS attachments while retaining data‑stealing capabilities.
Key points
- VasyGrek sent phishing emails with malicious attachments or links to GitHub‑hosted files, primarily using PureCoder’s PureCrypter, PureHVNC, and PureLogs Stealer.
- Pay2Key ransomware‑as‑a‑service was observed in a few infections, built on the Mimic encryptor.
- In November the payload delivery changed to BAT and VBS archives, still culminating in PureHVNC deployment via a new loader.
- The actor ceased using BurnsRAT after a July 2024 disclosure but otherwise maintained a consistent attack pattern.
- All observed activity targeted Russian organizations across multiple economic sectors for credential and data theft.
Developing 25
Qurium critiques the mishandled public release of PHP2Shell bugs, noting widespread misinformation and potential exposure of many systems.
Key points
- The 2026 PHP2Shell bugs (CVE‑2026‑109618, CVE‑2026‑109619) allow remote code execution when PHP mishandles fatal errors in internal structures.
- Researchers Calif and Wiz uncovered the flaws via an OpenAI “Patch the planet” program, echoing a 2004 memory‑limit vulnerability (CVE‑2004‑0594) discovered by Stefan Esser.
- Despite patches not yet being available, numerous PoC scripts and AI‑generated articles spread, many deviating from the actual exploit logic.
- Qurium argues the uncontrolled disclosure increased risk, potentially affecting millions of PHP installations before defenses could be deployed.
- The piece calls for coordinated vulnerability disclosure to prevent similar “disclosure fiascos” in the future.
Sources
qurium.org
Twitter/msuiche
SecurityWeek
blue-initiative.org
CSO Online
The Record by Recorded Future
Bleeping Computer
CSO Online
The Hacker News
crowdstrike.com
europa.eu
bbc.co.uk
theregister.com
Twitter/HackingLZ
The Hacker News
Bleeping Computer
Bleeping Computer
SecurityWeek
arstechnica.com
Twitter/IceSolst
The Record by Recorded Future
Bleeping Computer
The Hacker News
sans.edu
SecurityWeek
Bleeping Computer
The Register Security
qualys.com
arcticwolf.com
linkedin.com
The Hacker News
Twitter/HackingLZ
Twitter/HackingLZ
Twitter/HackingLZ
virustotal.com
openai.com
Twitter/blackorbird
Bleeping Computer
SecurityWeek
The Hacker News
The Hacker News
The Record by Recorded Future
linkedin.com
amazon.com
hadrian.io
google.com
CSO Online
Twitter/lorenzofb
Bleeping Computer
SecurityWeek
SecurityWeek
The Hacker News
Twitter/HackingLZ
dshield.org
sans.edu
eliastaylor.com
CSO Online
amazon.com
The Record by Recorded Future
SecurityWeek
thephp.foundation
Krebs on Security
Rapid7 Research Blog
Securelist
Twitter/blackorbird
The Record by Recorded Future
cloudflare.com
Bleeping Computer
openai.com
The Hacker News
Twitter/AndrewMohawk
Twitter/AndrewMohawk
Twitter/craiu
Twitter/AndrewMohawk
wiz.io
Cyberscoop
CISA Cybersecurity Advisories
The Hacker News
@msuiche
@HackingLZ
@IceSolst
@HackingLZ
@HackingLZ
@HackingLZ
@JohnHultquist
@JohnHultquist
@blackorbird
@lorenzofb
@craiu
@HackingLZ
@blackorbird
@AndrewMohawk
@AndrewMohawk
@craiu
@AndrewMohawk
78 articles
A sandbox bypass in ChatGPT’s share function let attackers take over accounts, prompting an OpenAI patch.
Key points
- Researchers showed that a crafted shared conversation could inject JavaScript through the HTML Preview and MathLive library, crossing the sandbox boundary.
- The injected code could enumerate conversation lists, read private chats and invoke authenticated ChatGPT APIs as the victim.
- Exploitation required only opening the malicious share link; no app installation or developer tools were needed.
- OpenAI classified the issue as P1 severity and deployed a fix on October 26, 2026.
- The vulnerability stemmed from unchecked postMessage handling and unsafe innerHTML insertion in the MathLive component.
WorkOS confirmed a breach of its internal sales tool where an AI‑driven pentesting framework exposed customer contact information.
Key points
- The intrusion was detected on October 30, 2026 and involved unauthorized access to a sales‑team application.
- Exfiltrated data included names, emails, job titles, account histories, and excerpts from sales calls and Slack chats.
- The attacker employed the ARTEX AI framework, previously linked to Chinese‑origin cyber‑espionage group Vapor Panda.
- WorkOS disabled external access, engaged a forensics firm, and is notifying affected customers.
- The ARTEX AI tool originated as an open‑source project from Chinese developers and has been used in multiple incidents this year.
Sources
Bleeping Computer
CSO Online
Bleeping Computer
crowdstrike.com
The Hacker News
Cyberscoop
The Hacker News
cybersecuritydive.com
arcticwolf.com
The Hacker News
The Hacker News
expel.com
SecurityWeek
huntress.com
The Record by Recorded Future
CSO Online
The Hacker News
Cyberscoop
Twitter/HackingLZ
Microsoft Threat Intelligence Blog
@HackingLZ
20 articles
Analyst tracks $106 M crypto theft from EU entity and a $40 M outflow at Brazil's Mercado Bitcoin, both contained without user data breach.
Key points
- ZachXBT identified large withdrawals in USDC and USDT from an unnamed EU entity on Nov 1, followed by rapid swaps to ETH via WellWallet and Kyrrex and conversion to Monero through Wagyu.
- The analyst is confident the activity is not tied to the Lazarus Group, citing laundering patterns.
- Brazilian exchange Mercado Bitcoin reported $40 M of flagged outflows across ten networks; the firm contained the incident, suspended deposits/withdrawals, and reported no customer data breach.
- Both incidents involve significant financial loss but no confirmed victim data exposure or ransomware use.
Sources
cryptopotato.com
Bleeping Computer
Chainalysis Blog
The Hacker News
The Record by Recorded Future
CSO Online
SecurityWeek
SecurityWeek
citationneeded.news
The Record by Recorded Future
Bleeping Computer
The Hacker News
Bleeping Computer
npr.org
wired.com
Twitter/craiu
Chainalysis Blog
Bleeping Computer
Twitter/blackorbird
SecurityWeek
The Hacker News
decrypt.co
The Record by Recorded Future
Bleeping Computer
@craiu
@blackorbird
24 articles
Red Hat issues a critical RHEL 8 kernel patch for CVE‑2026‑98432, urging prompt installation and reboot.
Key points
- The advisory (RHSA‑2026:93414) fixes a kernel vulnerability that could allow improper memory release after an RCU grace period.
- The fix is distributed as updated kernel packages for x86_64, s390x, ppc64le, and aarch64 RHEL 8 releases, including extended life‑cycle variants.
- Red Hat rates the issue as Critical and provides CVSS details via the linked CVE page.
- Systems must be rebooted after applying the update to activate the protection.
- Red Hat recommends treating all kernel errata as security‑relevant and applying them without delay.
Zelenskyy disclosed Ukraine’s hack of Russia’s emergency alert system as retaliation for a Russian attack on Ukraine’s own alerts.
Key points
- Ukraine’s emergency alert mobile app was previously compromised by Russian hackers who sent false nuclear warnings, prompting a temporary suspension of the service.
- Zelenskyy stated Kyiv responded by infiltrating and manipulating Russia’s counterpart emergency alert system, though details of the operation were not disclosed.
- The incident underscores the tit‑for‑tat cyber warfare between the two countries, with both sides using false alerts to sow confusion among civilians.
- Zelenskyy also discussed broader issues, including requests to lift U.S. limits on the Starshield satellite communications service used by Ukrainian forces.
- The interview touched on political dynamics with the United States, but the primary focus remained the cyber retaliation between Ukraine and Russia.
Barracuda patches critical auth‑bypass and command‑injection bugs that could give attackers root on its appliances.
Key points
- The pre‑authentication authorization bypass (CVE‑2026‑116606) scores 9.3 CVSS, while the command‑injection flaw (CVE‑2026‑111560) scores 8.6.
- Both flaws affect the Email Security Gateway and, for CVE‑2026‑111560, also the Web Security Gateway, WAF, ADC and Message Archiver.
- Exploitation requires access to the device’s admin interface; Barracuda advises limiting this interface to trusted internal networks.
- Security patches are available and customers should verify firmware versions and apply updates immediately.
- The advisory does not confirm active exploitation but warns that internet‑exposed admin interfaces increase risk.
A China‑based fake Microsoft support scam leveraged Azure and Cloudflare to reach dozens of US firms through malicious ads.
Key points
- The scam presents counterfeit system error and firewall pop‑ups with a toll‑free number, hosted on Azure static sites with random subdomains.
- Page scripts fetch phone numbers from a Chinese‑registered domain (adhelper.one) and log impression data for ad‑buyer attribution.
- Infrastructure is hidden behind Cloudflare and the domain registration lists an address in Hubei province, indicating Chinese operators.
- Ads were placed on legitimate US publisher sites, and new landing pages continued to appear daily as of early November 2026.
Google‑led effort disables X.CPE botnet across 1.3 million set‑top boxes, halting illicit bandwidth resale and ad‑fraud operations.
Key points
- The X.CPE malware was pre‑installed in firmware of TV set‑top boxes before sale, giving attackers remote access and the ability to use home broadband for proxy traffic, ad fraud and other illicit activities.
- Coordinated takedown dismantled the botnet’s C2 infrastructure and blocked domains that could have compromised up to 10 million more devices.
- Google updated its app review process and banned the responsible OEM from future devices with preloaded Google apps.
- Partners contributed expertise in device security, malware analysis, network visibility and digital fraud to achieve the disruption.
- The case highlights hidden supply‑chain risks in consumer broadband equipment and the value of cross‑industry intelligence sharing.
Ica, Coop and Axfood stores experienced a coordinated hack that raised freezer temperatures, ruining food and forcing closures.
Key points
- Ica stores in Sjöbo and Tomelilla found freezers set to +50 °C, causing food loss valued in the hundreds of thousands of kronor.
- Coop reported six mid‑Sweden locations with similar cooling failures.
- Axfood’s home‑delivery hub in Gothenburg was impacted after an external supplier’s cooling system was breached.
- Ica’s central office said the affected stores operate outside its main network, suggesting a supply‑chain compromise.
- The incidents mirror a recent wave of refrigerator hacks in French supermarkets.
CISA confirms active exploitation of a WordPress core race‑condition vulnerability and urges immediate patching.
Key points
- The high‑severity TOCTOU flaw (CVE‑2026‑119977, CVSS 8.1) lets attackers run code on servers during the WordPress core upgrade process.
- Wordfence observed over 18,500 exploit attempts in the first 21 hours after disclosure, with 12,632 blocked in the last day.
- Previdian’s honeypot recorded three exploitation attempts from a UK IP on Oct 30, 2026.
- CISA’s advisory mandates Federal Civilian Executive Branch agencies to apply the fix by Nov 6, 2026.
- The vulnerability was patched in late October and the fix is publicly available on GitHub.
Sources
The Hacker News
CISA Cybersecurity Advisories
Rapid7 Research Blog
Bleeping Computer
SecurityWeek
Bleeping Computer
The Hacker News
CISA Cybersecurity Advisories
SecurityWeek
The Hacker News
CISA Cybersecurity Advisories
CISA Cybersecurity Advisories
CISA Cybersecurity Advisories
CISA Cybersecurity Advisories
CISA Cybersecurity Advisories
CISA Cybersecurity Advisories
CISA Cybersecurity Advisories
CISA Cybersecurity Advisories
Bleeping Computer
19 articles
European supermarkets suffered food loss after attackers exploited unsecured refrigeration controllers with default passwords.
Key points
- Attacks impacted supermarkets in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden, forcing freezers to 50 °C and destroying perishable goods.
- Intermarché reported 150 French stores affected, with losses estimated in the hundreds of thousands of euros.
- CERT‑FR issued an advisory urging removal of Danfoss AK‑SM/AK‑SC and Copeland XWEB controllers from internet exposure and recommending firmware updates.
- Research by Team82 disclosed three Danfoss vulnerabilities – authentication bypass, command injection for RCE, and Nginx config injection – that were likely leveraged in the attacks.
- Experts advise placing internet‑facing controllers behind firewalls, disabling default passwords, and ensuring regular patching.
Volt Typhoon employs a disposable “Silent Train” of compromised devices to stealthily breach U.S. critical‑infrastructure targets.
Key points
- Lumen’s Black Lotus Labs published a report describing “Silent Train,” a constantly evolving network of procured and compromised SOHO routers and IoT devices used by Volt Typhoon to gain rapid entry to high‑value networks.
- Each device chain is used once to infiltrate a single target—often government agencies, defense contractors, telecoms, energy, water, rail and satellite operators—then discarded to erase traces.
- The group’s tactics emphasize extreme operational security, with intrusions lasting only minutes or hours before all artifacts are removed.
- Researchers have notified hundreds of victims across multiple sectors, highlighting the strategic selection of targets for potential military advantage.
Polymarket will refund $3.9 million after a compromised third‑party script stole cryptocurrency from user wallets.
Key points
- The breach stemmed from a malicious script injected into Polymarket’s site via the DebugBear performance‑monitoring service, enabling attackers to sell positions and transfer funds from active sessions.
- Polymarket plans to reimburse $2.7 million for direct losses and $1.2 million for downtime‑related losses, with 95% of wallets already fully refunded.
- Hudson Rock identified “wallet‑draining code” in the compromised script and linked the attack to a third‑party supply‑chain compromise.
- Polymarket removed the malicious script, paused trading, reset all login sessions and added additional integrity controls while notifying law enforcement.
- DebugBear said its own systems appear uncompromised and is investigating the domain‑registrar breach that enabled the attack.
Node‑RED’s unauthenticated admin API flaw is being exploited in the wild, threatening unpatched IoT/IIoT gateways that link IT and OT systems.
Key points
- Siemens disclosed and patched the Node‑RED authentication vulnerability in August 2026, but many deployments remain unpatched.
- VulnCheck’s research recorded exploitation on October 30, 2026, with an attacker using the flaw to download a Linux bot and, in some cases, leave web shells.
- Node‑RED’s default configuration disables authentication, making it a credential vault and bridge across IT/OT boundaries when deployed by non‑technical staff.
- Unpatched gateways in critical infrastructure may stay vulnerable for months due to scheduled maintenance windows.
- The vulnerability is identified as CVE‑2026‑58115 and has an official Siemens advisory.
Former Syrian regime hacker sentenced for a multi‑target campaign that briefly erased $136 billion from U.S. stocks.
Key points
- A federal judge in Virginia imposed a 42‑month prison term on Ahmad Umar Agha for leading a hacking conspiracy from 2011‑2014 that targeted roughly 47 media, business, NGO and government victims.
- The intrusion campaign was directed by members of Bashar al‑Assad’s inner circle and aimed to silence press coverage, intimidate opponents, and sow discord among U.S. military personnel.
- One of Agha’s attacks triggered a flash crash, temporarily wiping $136 billion from the Dow Jones Industrial Average.
- Co‑conspirator Firas Dardar remains at large; another associate, Peter Romar, was extradited and pleaded guilty in related charges.
- The sentencing highlights U.S. law‑enforcement focus on state‑sponsored cyber actors.
Sources
justice.gov
SecurityWeek
Cyberscoop
The Record by Recorded Future
The Hacker News
5 articles
Kaspersky details an AI‑orchestrated campaign using the open‑source CyberStrikeAI framework against education sector targets.
Key points
- The campaign leverages a Go‑based open‑source tool, CyberStrikeAI, which combines a large language model orchestrator with a traditional C2 agent to automate reconnaissance, lateral movement, and data exfiltration.
- Initial access is achieved via a compromised SQL Server, after which the AI‑driven agent takes over to plan and execute subsequent steps without direct human command for each action.
- Artifacts such as the process "not_before" timestamp, Go build metadata, and a fixed X‑Implant‑Token header enable detection and attribution of the framework’s instances.
- Kaspersky notes this is among the first documented instances of an LLM being embedded in the post‑exploitation phase of a real‑world attack.
The X.CPE botnet, controlling millions of set‑top boxes, was taken down by Plume and Google after extensive investigation.
Key points
- Plume Security Labs identified X.CPE as a botnet that infected inexpensive streaming boxes via firmware backdoors.
- Compromised devices were used to provide unauthorized residential proxy services and other malicious functions.
- The botnet’s scale exceeded 1.3 million worldwide devices.
- Collaboration with Google and other security partners led to the botnet’s disruption.
- The research details the botnet’s evolution, operation, and takedown process.
A malicious Claude Code extension in Cursor's marketplace tried to install an SSH backdoor and exfiltrate system information.
Key points
- The compromised extension (versions 2.1.312 and 2.1.313) was live for about 11 hours on Oct 29 before Cursor removed it.
- Malware inserted at the start of the JavaScript ran automatically, adding an SSH key to authorized_keys and attempting persistence via scripts and startup entries.
- Analysis by Phorion and Microsoft showed the payload collected machine details, environment variables and Git email addresses, but did not require user interaction.
- Cursor cautioned that simply uninstalling the extension may leave the planted SSH key and scripts behind, recommending key rotation and log review.
DHS bans Acronis products from federal civilian procurement and requires their removal from agency IT environments.
Key points
- The Secretary of Homeland Security signed an order excluding Acronis‑developed IT products and any covered articles supplied by the company from all civilian agency purchases.
- All existing Acronis hardware and software must be removed from federal civilian executive branch information technology systems.
- The action is based on authority under the Federal Acquisition Supply Chain Security Act of 2018 and related regulations.
- The order follows a recommendation from the Federal Acquisition Security Council after a review of affiliated evidence.
- The notice was published in the Federal Register (2026‑22215, 91 FR 68528).
Threat actors hijack LLM APIs, resell access, and drive fraudulent cloud spend up to $1 million.
Key points
- Google and Mandiant identified two attacker groups: scanners of public LLM endpoints and thieves of valid API keys.
- Compromised credentials are sold to “LLM mixers” such as Jet Night and newapi.pro, which relay requests and inflate token usage.
- One actor generated over 500,000 API calls in eight hours, pushing costs near $1 million for the victim.
- Attackers also exploit CVE‑2026‑40217 in LiteLLM to run code on servers and host unauthorized proxies.
- Mitigations focus on strict IAM, secret rotation, MFA, usage limits, and comprehensive logging.
Li Auto master‑account thefts in Russia enable remote vehicle control and ransom demands of up to 250 k RUB per victim.
Key points
- Over 47 master accounts were re‑registered in a month, many of which were later hijacked.
- Attackers use duplicated physical SIMs, expired virtual SIMs via Esender/WeChat, or insecure Chinese‑origin numbers to gain control.
- Compromised accounts allow full remote functions: lock/unlock, climate, software updates, and engine start.
- Victims are forced to pay an average of 200‑250 k RUB to restore access, far above the official 17‑18 k RUB service fee.
- Dealers advise owners to obtain their own Esender numbers, use strong passwords and enable two‑factor authentication.
SANS Stormcast reports active attacks on IoT refrigerators, Siemens industrial controllers, cPGuard updates, and iPhone AirDrop despite Lockdown Mode.
Key points
- Refrigerators and freezers across Europe (and some U.S. bases) are being forced into defrost mode via exposed control panels, likely using default passwords and old exploits.
- A recently patched CVE in Siemens SIMATIC devices running Node-RED is now being actively exploited to download malware and gain persistent access.
- OPSSHIELD’s cPGuard update channel was compromised, allowing attackers to inject a malicious script that exfiltrates credentials.
- A security firm demonstrated an iPhone 18 AirDrop exploit that works even with Lockdown Mode enabled, achieving full device compromise.
German officials' iPhones may be compromised by suspected spyware, prompting BSI warnings and device replacement advice.
Key points
- The federal digital minister verified a hacker intrusion targeting Apple devices of politicians and Bundestag members.
- The BSI reported that affected iPhones received Apple security notifications and recommends setting up new phones with new numbers.
- The suspected malware is described as "mercenary spyware," with Pegasus from NSO Group cited as an example.
- No specific attacker or victim list was disclosed, and the attack’s success remains uncertain.
Experts warn that Russia's AI-enabled cyber attacks are intensifying the conflict in Ukraine and demand new defensive measures.
Key points
- The discussion features Patrick Gray, The Grugq, and UnderDefence CEO Nazar Tymoshyk examining recent Russian cyber operations that employ artificial intelligence for rapid exploitation.
- AI automation is enabling attacks at scale, reducing the time between discovery and exploitation, and complicating traditional detection methods.
- The guests stress the importance of integrating AI-aware threat hunting, behavior analytics, and robust incident response to counter state-backed AI threats.
- They note that while specific Ukrainian victims are not named, the attacks have caused operational disruption and heightened cyber risk across the region.
- Listeners are directed to the full episode and a YouTube version for deeper insight into the tactics and mitigation strategies.