Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Kiteworks Urges 6-Hour Server Shutdown Over Potential Zero-Day Attacks

  Secure file-sharing provider Kiteworks issued an urgent advisory urging customers to power down their servers for a six-hour window follow...

All the recent news you need to know
North Korea
bitget Crypto Breach cryptocurrency Cyber Crime Hackers Lazarus Group North Korea

Bitget Hack Climbs to $387.5 Million as Exchange Launches Recovery Bounty and Points to North Korea

 



Crypto exchange Bitget confirmed on September 25 that hackers stole approximately $387.5 million from its hot and warm wallets a day earlier, revising an initial estimate upward as investigators traced funds across multiple blockchains and accounting for assets on Zcash and TRON that were missed in the first tally. The exchange has since launched a structured bounty program for anyone who helps freeze or recover stolen funds, and has brought in independent cybersecurity firms Mandiant and SlowMist to assist with the investigation.

Bitget's security systems first flagged the unauthorized transfers at 18:31 UTC on September 24. By the time the exchange confirmed the breach publicly, the damage figure had already reached $351.6 million. The revised total of $387.5 million reflects a more complete accounting of transfers that occurred during the incident, adding affected assets on Zcash and TRON not captured in the initial estimate. The exchange confirmed no further unauthorized transfers occurred after the incident was contained.


How the Attack Worked

Bitget CEO Gracy Chen clarified that attackers did not steal private keys or forge user withdrawal requests. Instead, they broke into a backend system inside Bitget's wallet infrastructure and used it to spoof transaction data, tricking the exchange's own authorization process into approving payouts that looked routine.

The mechanics were methodical. The attacker's first transfer was a small 0.84 ETH test payment to a fresh address, after which Bitget's main Ethereum hot wallet made roughly 380 transactions during the attack. Every time the hot wallets refilled from the warm wallet layer, the attacker drained them again. The warm wallet, which normally only pays the exchange's own hot wallets, sent 13,966 ETH worth approximately $37 million to an address less than an hour old, with no approved list check and no secondary authorization on a wallet holding over $40 million.

The single largest piece of the haul was roughly 103 million XRP, valued at approximately $157 million at the time of the theft. About $75 million of the stolen funds were held in stablecoins including USDT and USDC.

Some of that ETH moved quickly into mixers: on-chain analysis shows around 6,300 ETH, close to $19 million, funneled through Tornado Cash within hours of the breach.

The confirmed affected assets span XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX and TRX, spread across Ethereum and several EVM-compatible networks, the XRP Ledger, Zcash, and TRON.


User Funds and the Protection Fund

Bitget operates a three-tier wallet architecture, and the breach touched only portions of the hot and warm wallet layers. Cold wallets remained fully secure throughout the attack. Bitget's User Protection Fund, which holds more than $464 million, will cover the full loss, meaning customer account balances stay intact even though the funds themselves were taken. The protection fund was set aside in 2023 specifically to cover hacks and theft so users would not absorb the impact.


North Korea in the Frame

During a three-hour livestream on X, CEO Gracy Chen said Bitget suspects North Korean attackers exploited the backend authentication system, making fraudulent withdrawals appear legitimate. Chen added that she has personally been targeted by the same group before, losing about $80,000 from a personal wallet unconnected to Bitget. North Korea's Lazarus Group, also tracked under the codename TraderTraitor, has been blamed for the industry's biggest thefts, including Bybit's $1.4 billion hack in February 2025, which the FBI confirmed weeks later was North Korean work.


The Recovery Bounty

Bitget has launched a Recovery Bounty Program covering eligible voluntary actions that have already resulted in affected funds being frozen, as well as future actions that directly contribute to freezing or recovering funds. The structure is straightforward: 5% of successfully frozen funds goes to the eligible person or entity whose efforts directly caused the freeze, and 5% of successfully recovered funds is available on the same terms. Bitget will also use Bybit's LazarusBounty initiative as a core channel for the effort.

To support the hunt, Bitget published a real-time fund tracing dashboard at trace.bgblockchain.xyz, an API tracking attacker-controlled addresses updated continuously, and a submission portal for anyone with freezing or recovery information. Exchanges, stablecoin issuers, bridges, custodians, and other infrastructure providers have been encouraged to monitor the flagged addresses and report relevant information through the recovery portal.

The attack is the largest cryptocurrency breach of the year to date and lands in an already turbulent stretch for the industry. Earlier in September, Liquid Network suffered a $319 million security breach, and in late July, hardware wallet maker Coldcard was hit in a separate incident that drained around $116 million in Bitcoin.

Bitget said it will publish a full incident report including root-cause analysis once technical teams complete remediation. Withdrawal restoration was expected to be announced by September 26, 4:00 AM UTC.


Read more »
Grok
AI cybersecurity risks AI technology Botnet botnet cybersecurity Credential Theft Cyber Security DDoS Google Window Grok

x47.c Windows Botnet Uses xAI Grok for Persistence and AI Credit Draining

 

A new Windows botnet called x47.c is being sold with a range of capabilities, including credential theft, distributed denial-of-service (DDoS) attacks, SOCKS5 proxy access and a method designed to drain paid AI credits. According to Qrator, the malware also uses artificial intelligence to help maintain persistence on infected systems. 

The botnet is advertised by a threat actor known as WraithTools. In early August, the operator offered the base x47.c package for $200, with a DDoS add-on priced at $150. The complete package, including its full range of capabilities, was offered for $950. Customers receive access to a command-and-control panel that allows them to manage infected machines and access features including fast-flux configuration, information-stealing logs, proxies, concealment capabilities and DDoS operations. 

The DDoS section provides 18 attack methods, including HTTP floods, slow HTTP attacks, TCP and UDP floods, TLS stresser activity, and reflection and amplification techniques. One feature specifically targets paid artificial intelligence services. The AI drain mode is designed to consume a victim’s AI credits by sending requests directly to an AI provider. The operator supplies a model name and a valid API key for accounts using OpenAI, xAI and compatible chat APIs. Because the requests are sent directly to the provider, the targeted website can remain accessible while the account’s available AI credits are depleted. x47.c also incorporates an “AI stealth” module designed to maintain persistence on compromised Windows systems. 

The feature is advertised as using xAI Grok to select actions from a predefined list, including startup entries and scheduled tasks. Optional process hollowing and privilege escalation capabilities are also available. According to Qrator, the operator activates the AI functionality by including an xAI key in the botnet build. Status messages can indicate startup changes, persistence repairs and Windows Defender exclusions. The malware also has local fallback actions that allow maintenance operations to continue when an AI model call fails. 

The botnet provides operators with additional control over infected systems. They can select DDoS targets and download, update or remove software from compromised hosts. A rootkit module is also promoted for removing artifacts associated with rival malware. Beyond DDoS activity, x47.c can harvest passwords and cookies from browsers, along with Discord tokens, cryptocurrency wallet data and AI-service tokens. 

Its SOCKS5 module allows compromised systems to relay traffic, while operators can monitor proxy connections and review their health status and timeouts. The combination of AI-assisted persistence, credential theft, proxy capabilities, DDoS functions and AI credit draining makes x47.c a broad Windows botnet offering multiple ways to abuse compromised systems and online services.
Read more »
Telecom Hacking
Cameron Wagenius Credential Theft Cyber Extortion CyberCrime Data Breach Data Theft SIM Swapping Snowflake Attacks Telecom Hacking

Hacking and Extortion Operation Targeting U.S. Official Ends in Conviction


A former U.S. Army soldier, Cameron John Wagenius, has been sentenced to 70 months in prison for participating in a hacking and extortion campaign which exposed sensitive information and targeted telecommunication companies. According to the U.S. Department of Justice, Wagenius has also been ordered to pay $294,978 in restitution. Wagenius was involved in the cybercrime operation while serving as an active duty military member. 

In April 2023 and December 2024, he and other conspirators obtained credentials allowing them to access protected networks belonging to at least ten organizations. The stolen information was then used to extort victims by threatening publication or sale of the data without their payment.

Investigators have stated Wagenius was an online hacker known as “kiberphant0m” and he contributed to the development of the hacking tool SSH Brute, which was used to obtain login credentials. To exchange stolen credentials and coordinate access to victim networks, the group communicated via Telegram. Additionally, public threats were made on cybercrime forums.

Stolen information was made available for sale on platforms including BreachForums and Wagenius published two posts in November 2024 that contained stolen non-content call detail records associated with a former US government official and relatives of another former official. As part of the threats, the Justice Department also stated that additional confidential records would be released if a ransom was paid.

One of the posts indicated that the activity may be partly motivated by retaliation for the arrest of another cybercriminal. There have been several attacks involving major telecommunications companies and other companies. According to cybersecurity researchers, Wagenius' possession of data was related to broader attacks targeting Snowflake customer environments. Several companies were affected by the campaign, including AT&T, Ticketmaster, Advance Auto Parts, and Santander. 

Wagenius pleaded guilty in separate proceedings filed in the Western District of Washington in support of the charges. A conviction for wire fraud, extortion using computers, and aggravated identity theft was obtained in July 2025. Prior to this, he had pleaded guilty to two counts of unlawfully transferring confidential phone records related to the same operation in March 2025. Additionally, Wagenius appears to be tied to the wave of attacks against organizations using Snowflake cloud environments that took place in 2024. 

According to AT&T, attackers accessed call and text records covering nearly all of its mobile customers in December 2022. The stolen information was later associated with extortion activity involving several cyber criminals. Moreover, court records and the investigation report indicate that Wagenius attempted to sell stolen information to an email address he believed was affiliated with a foreign military intelligence service. Moreover, the prosecution alleges that he searched the Internet for information about leaving the United States for Russia. 

The intelligence services involved have not yet been publicly identified by the government. Based on the findings of the investigation, the hacking operation was primarily a result of the use of stolen credentials, rather than an exploit of a specific software vulnerability. The credentials were used by Wagenius and his associates to gain access to company networks and cloud environments, using Telegram to communicate access details and coordinate further intrusions. 

After invading victim networks, the group aimed at obtaining data to be monetized. In some cases, information was provided to other criminals, whereas other records were used for fraud schemes, such as SIM swapping. Additionally, extortion demands were extorted through private communications as well as public postings on cybercrime forums. 

The FBI, Defense Criminal Investigative Service, and other law enforcement agencies investigated these activities. A warrant was issued for Wagenius' arrest in December 2024, bringing to a close the hacking activities he allegedly conducted for more than a year while remaining an active duty soldier.
Read more »
IT Security
Critical Vulnerability CVE CVE vulnerability CVEs Cyber Security Flaws IT Security

SolarWinds Patches Critical Unauthenticated RCE Vulnerabilities in Observability Self-Hosted

 

SolarWinds has issued security updates for two critical vulnerabilities in its Observability Self-Hosted product that could enable remote code execution without authentication. The flaws, tracked as CVE-2026-28324 and CVE-2026-28325, are present in multiple versions of the IT monitoring solution and have been patched in the latest release. Observability Self-Hosted is an on-premises and hybrid IT monitoring platform that enables organizations to centrally monitor their environments. 

It also features configuration management and control over operations data and security compliance. The first vulnerability, CVE-2026-28324, has a CVSS score of 9.8 and is described as an insufficient integrity check leading to remote code execution. SolarWinds reported that the problem affects deployments that use a non-default and non-secure configuration. Since the weakness is an unauthenticated remote code execution (RCE) vulnerability, SolarWinds warned that such deployments could be at risk of exploitation. 

The second flaw, CVE-2026-28325, has a CVSS score of 8.8 and is described as a deserialization of untrusted data issue that affects the instances of the application running in a specific communication mode. The company stated that it also allows for an unauthenticated RCE, meaning that the affected systems could be compromised by an attacker. Both weaknesses impact Observability Self-Hosted up to and including version 2026.2.2. SolarWinds has already released updates in the 2026.2.3 version of the product which resolves the identified issues. 

The company credited Kai Huang of Armadin for reporting the problems. The recent updates to Observability Self-Hosted follow the patch for an unauthenticated RCE vulnerability in SolarWinds Access Rights Manager (ARM). The flaw, tracked as CVE-2026-28326, has a CVSS score of 8.8 and impacts ARM versions up to and including 2026.2. This vulnerability also resides in a hardcoded static key for the affected system version. SolarWinds released the patch for CVE-2026-28326 last week after receiving the report from the anonymous security researcher. 

According to the company, this is the third high-severity flaw discovered in its products this year. Moreover, SolarWinds warned that all three could be actively exploited. However, the company added that there were no reports of exploitation for any of the three vulnerabilities. More information on the discovered issues can be found in the company’s advisory. 

The affected organizations should update their Observability Self-Hosted instances to version 2026.2.3 as it includes the fixes for two newly discovered RCE flaws. In particular, the update is recommended for the deployments that feature the non-default, insecure configurations described by the vendor.
Read more »
Linux
Accomplish Bug Bounty Programs CloudFlare Container Security Data Breach Linux

Cloudflare Patches Cross-Tenant Container Flaw That Let Tenants Read Each Other's Leftover Disk Data

 




Cloudflare has patched a vulnerability in its Containers product that could have allowed a paying customer to pull residual data out of disk storage blocks previously used by a different tenant. The company disclosed the issue on September 24, three weeks after security researcher Oren Yomtov from the firm Accomplish filed a report through Cloudflare's HackerOne bug bounty program.

The flaw was rooted in how Cloudflare configured the Linux storage subsystem underpinning its container infrastructure. Cloudflare Containers run each workload inside a dedicated virtual machine powered by the Firecracker virtual machine monitor. Each VM gets a writable root disk backed by Linux device mapper thin provisioning, known as dm-thin, a storage technology that allocates physical disk space on demand rather than upfront. When a container's thin volume was deleted, the physical 64 KiB blocks it had occupied were handed back to a shared pool that served workloads from multiple customer accounts.

The problem was a single configuration option: `skip_block_zeroing`. With this flag set, dm-thin does not wipe a block before reassigning it. That is a performance trade-off operators sometimes make deliberately, but in a multi-tenant environment the consequences were significant. A freshly assigned block would carry the previous tenant's data intact unless the incoming workload happened to overwrite every byte of it.

Yomtov and his team worked out a way to exploit this behavior without needing any privileged access. A tenant with a standard Workers Paid account could open their container's raw root disk at `/dev/vdc` and identify regions that the guest ext4 filesystem had marked as free space. Writing a small 4 KiB block into a 64 KiB-aligned free region would force dm-thin to pull a physical block from the shared pool. Because zeroing was disabled, only the 4 KiB the attacker wrote got replaced. The remaining 60 KiB stayed exactly as the previous owner had left it. A subsequent raw-device read could then pull those bytes out.

What the researchers found across production runs was striking in scope. They tested the technique across 24 placements and found residual data on 18 of them, across 20 of 22 underlying nodes and spanning four continents. The recovered material included directory structures, database pages, and structurally complete SQLite databases. Using ext4's `metadata_csum` checksum feature, the team was able to confirm that recovered directory blocks did not originate from their own test filesystem. Across six placements they identified 2,700 distinct foreign directory inodes. All proof-of-concept materials submitted to Cloudflare were scrubbed of third-party identifiers and content values, and the researchers confirmed they securely deleted the recovered data after submission.

The vulnerability carried real limits. An attacker could not pick a target. Which blocks dm-thin reassigned to a new container depended entirely on Cloudflare's workload scheduler, so exploitation was opportunistic rather than directed. The technique also could not touch any actively mounted disk or modify another tenant's live data.

Cloudflare moved fast. Yomtov filed the report on September 4 at 15:26 UTC. The engineering team opened a security incident and confirmed the production setup behind the flaw within about three hours. A runtime fix was merged by 21:27 UTC the same day. Rolling out the change across the fleet began by 23:15 UTC. But removing `skip_block_zeroing` only stops future misallocation. Blocks already mapped into running containers or cached in pre-built snapshot layers were unaffected. To clean those up, Cloudflare drained hosts during off-peak hours, restarted their VMs, and wiped each host's image cache so every disk would be rebuilt using zeroed allocations. That final cleanup finished on September 19. The researchers confirmed their proof of concept stopped working on September 14.

Cloudflare said it reviewed all available historical disk I/O telemetry and found no activity consistent with the exploit technique other than what came from the researchers and from Cloudflare engineers during authorized validation. No customer-side action is needed.

The disclosure adds to a recent pattern in cloud infrastructure research. Yomtov's team at Accomplish has a track record of finding platform-level flaws; they also reported a sandbox escape in Anthropic's Cowork tool this year. In the wider cloud industry, Wiz researchers disclosed a separate cross-tenant issue in Microsoft Azure Cosmos DB this year, called CosmosEscape, which could have let attackers escalate from a crafted Gremlin query to retrieving primary account keys for other customers' databases. Microsoft said it found no evidence of customer impact in that case either.

Cloudflare co-authored its disclosure with Yomtov and the Accomplish research team, a relatively transparent move for a company of its size. The company's bug bounty sits on HackerOne and remains open for further researcher submissions.


Read more »
WSO2
Adobe Commerce CISA KEV Catalog Vulnerabilities and Exploits WSO2

CISA Adds Actively Exploited WSO2 and Adobe Commerce Flaws to KEV Catalog

 

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities affecting WSO2 and Adobe Commerce to its Known Exploited Vulnerabilities (KEV) catalog, citing clear evidence of active exploitation. These flaws, tracked as CVE-2026-5430 and CVE-2026-71362, carry CVSS scores of 9.8 and 9.1 respectively, and pose severe risks to enterprises relying on these platforms for API management and e-commerce operations. 

CVE-2026-5430 is a path traversal vulnerability impacting WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway. It enables unauthenticated attackers to upload arbitrary files and achieve remote code execution without user interaction. Security firm watchTowr reported observing in-the-wild exploitation since at least September 13, 2026, including forged JWT tokens targeting the flaw. Yordan Ganchev, a principal threat intelligence specialist at watchTowr, emphasized that WSO2 serves nearly 1,000 customers across banking, government, telecom, and logistics—sectors that cannot afford delayed patching. 

The second flaw, CVE-2026-71362, affects Adobe Commerce and Magento through an incorrect authorization bug that allows attackers to hijack customer sessions and switch accounts without interaction. This grants unauthorized access to private customer data and sensitive resources. Dutch e-commerce security company Sansec detected and blocked exploitation attempts in August 2026, while Previdian telemetry recorded a lone Australian IP targeting honeypots on September 10, 2026. Although Adobe has not yet confirmed active exploitation in its advisory, the evidence strongly suggests coordinated abuse of this vulnerability. 

CISA’s inclusion of both flaws in the KEV catalog triggers mandatory remediation timelines for Federal Civilian Executive Branch (FCEB) agencies, which must apply patches by September 27, 2026. This deadline underscores the urgency for all organizations using WSO2 or Adobe Commerce to prioritize updates immediately. With threat actors already weaponizing these vulnerabilities, waiting for formal advisories or public proof-of-concept code could leave networks exposed to data theft, account takeover, and full system compromise. 

Organizations should audit their deployments of WSO2 and Adobe Commerce without delay, ensuring all systems are patched to the latest secure versions. For WSO2, this means updating API Manager and related components to close the path traversal vector. Adobe Commerce and Magento users must apply authorization fixes to prevent session hijacking. Given the high CVSS scores, broad industry usage, and confirmed exploitation, treating these vulnerabilities as critical priorities is essential to safeguarding digital infrastructure and customer data from escalating cyber threats.
Read more »
Subscribe to: Posts (Atom)

Featured