Threat Intel Feed | Hacking Activity

SonicWall warns of actively exploited SMA1000 zero-day flaws

SonicWall has warned of an actively exploited zero-day vulnerability chain affecting its SMA1000 appliances, involving two critical command injection flaws. The first vulnerability (CVE-2026-83548) is a server-side request forgery (SSRF) in the WorkPlace interface, while the second (CVE-2026-83549) allows command injection in the Management Console by authenticated administrators. These vulnerabilities enable remote code execution, and attackers are actively exploiting them in the wild. Customers are urged to apply hotfixes immediately, though specific IOCs have not been released by SonicWall.

Sality botnet infrastructure dismantled in joint global takedown

10h ago · bleeping-computer

The Sality botnet, active for over two decades and responsible for infecting more than 15,000 devices, has been disrupted in a joint global takedown operation led by international law enforcement and private sector partners including Europol, FBI, and CrowdStrike. The botnet, attributed to the threat actor group SALTY SPIDER believed to be operating from Russia's Republic of Bashkortostan, used a peer-to-peer (P2P) architecture to distribute malware payloads, primarily EggJagger in recent years. EggJagger is a clipjacking tool that monitors and replaces cryptocurrency wallet addresses in the clipboard with attacker-controlled ones. The disruption was achieved by sinkholing the botnet’s super peer infrastructure, effectively severing communication between infected machines and preventing further propagation of malicious payloads.

1 Actors 1 Malware

US charges Russian for infecting 80,000 freelancers with malware

9h ago · bleeping-computer

A Russian national, Searzhudin Tamirlanovich Aktulaev, has been indicted for conducting a phishing campaign between June 2016 and November 2017 that infected approximately 80,000 freelancers with TVRAT and DarkVNC malware. The attacker used 255 fake accounts on a freelance platform to send malicious Excel attachments containing macros, which downloaded malware enabling remote access via TeamViewer and VNC Viewer. The malware exfiltrated stolen data, including e-commerce credentials and personally identifiable information, to command-and-control servers paid for with virtual currency, with thousands of infected systems in the U.S., particularly in the Northern District of California.

2 Malware

Hackers abuse Faronics Deploy admin tool to install ScreenConnect

21h ago · bleeping-computer

Hackers are exploiting the legitimate Faronics Deploy endpoint management tool to gain remote administrative access to victim systems by tricking users into installing a maliciously repurposed, signed installer disguised as an Adobe-related executable. The installer enrolls the victim's machine into an attacker-controlled Faronics deployment, enabling the execution of PowerShell scripts that deploy additional payloads, including ConnectWise ScreenConnect, a remote access tool used for persistent and interactive control. The attack uses phishing emails with business-themed lures, such as fake invoices, and includes anti-analysis techniques to evade detection in sandboxed environments. Activity declined after Faronics implemented anti-abuse measures in response to disclosure by Huntress.

1 IoCs

Critical Langflow flaw exploited to steal OpenAI and AWS keys

1d ago · bleeping-computer

Threat actors are actively exploiting a critical unauthenticated remote code execution vulnerability, CVE-2026-0768, in Langflow, an open-source AI application framework, to steal sensitive credentials including OpenAI and AWS API keys. The flaw exists in the code validator of Langflow's custom component editor, allowing arbitrary Python code execution with root privileges. Attack activity has been observed on honeypots, primarily originating from Russia, with over 360 exploitation attempts detected. Attackers query environment variables and sensitive files to harvest credentials and maintain persistence.

6 CVEs

Nearly 22,000 Microsoft Exchange servers vulnerable to hijack attacks

1d ago · bleeping-computer

A high-severity authentication bypass vulnerability, CVE-2026-62911, affects unpatched Microsoft Exchange Server 2016, 2019, and Subscription Edition systems, allowing attackers with basic privileges to hijack all user mailboxes. Exploit code for this flaw is now publicly available, according to the Netherlands NCSC-NL. Despite Microsoft's patch release in August 2026, nearly 22,000 Exchange servers remain exposed online and unpatched, with the majority located in the United States and Germany. German authorities report approximately 85% of on-premises Exchange servers in Germany are still vulnerable.

Novocure data breach affects more than 1,400 cancer patients

1d ago · bleeping-computer

Novocure, a healthtech company specializing in cancer treatment, suffered a cyberattack in mid-August that led to unauthorized access to its information systems. The breach exposed data of over 1,400 U.S. cancer patients, including patient ID numbers, and for fewer than 50 patients, identifying and healthcare provider contact information. Employee contact details and job titles were also accessed, though no medical devices were compromised and systems remain operational. The company is assessing regulatory obligations and has not disclosed the breach vector or whether ransom demands were made.

Hackers push malicious Virtualizor update in BGP hijacking attack

1d ago · bleeping-computer

Hackers conducted a BGP hijacking attack against Hetzner-hosted IP addresses used by Softaculous to redirect traffic from its software update systems and client portal. During the incident window from August 28 to August 30, 2026, a malicious Virtualizor update was delivered to a small number of installations. The attack allowed threat actors to intercept update requests and potentially compromise affected servers. Softaculous has since restored routing, revoked the fraudulent certificate, and released a new secure version of Virtualizor with improved security tooling.

1 IoCs

Recently patched PaperCut zero-days used in data theft attacks

1d ago · bleeping-computer

Two recently patched zero-day vulnerabilities in PaperCut NG and MF print management software, tracked as CVE-2026-81578 and CVE-2026-82078, are being actively exploited in data theft attacks. Attackers are chaining the flaws to bypass authentication and access backend databases via PaperCut's external user-lookup functionality, using the vulnerabilities to dump database tables through Derby without executing remote code. Threat intelligence firm Defused observed the exploit activity in honeypots starting August 29, 2026, indicating ongoing abuse by unidentified actors.

Five Venezuelans plead guilty to ATM jackpotting attacks in US

1d ago · bleeping-computer

Five Venezuelan nationals have pleaded guilty to conducting ATM jackpotting attacks in the United States, attempting to install malware on ATMs to force them to dispense cash. The attacks occurred in Wamego and Manhattan, Kansas, but were unsuccessful due to alarm triggers and surveillance detection. The individuals were part of a larger wave of ATM jackpotting incidents linked to the Tren de Aragua criminal organization, which has been associated with the use of Ploutus malware in a broader campaign targeting financial institutions across the U.S.

Berlin confirms data theft after Rhysida ransomware attack claims

2d ago · bleeping-computer

The city administration of Berlin has confirmed a ransomware attack by the Rhysida group, which claims to have exfiltrated 5.79 TB of data from its administrative network. The stolen data includes sensitive government records, personal information, credentials, and critical infrastructure assessments, with attackers threatening to publish the data unless a ransom is paid. The incident was discovered in mid-August 2026, and investigations are ongoing, involving the State Criminal Police Office, public prosecutor, and federal security agencies. No evidence was found that election data was compromised, and the affected departments were disconnected from the state network on August 14.

Chinese Fire Ant hackers turn Cisco routers into spying platforms

2d ago · bleeping-computer

The Chinese state-sponsored threat actor Fire Ant has shifted tactics to compromise Cisco IOS XR routers, TACACS servers, and Linux management systems, turning routers into surveillance platforms via concealed GRE tunnels. The group deployed a custom backdoor named 'BridgeAgent', disguised as a Zabbix agent, enabling reverse shells and execution of additional payloads. Fire Ant uses stealthy persistence mechanisms, suppresses syslog messages, and exfiltrates network traffic PCAPs to FTP servers, aiming to map and access high-value networks through a 'target behind the target' strategy. The group's activity overlaps with UNC3886 but shows distinct implementation differences.

1 IoCs 1 Actors

Microsoft warns of TerminalFix attacks deploying reverse tunnels

1d ago · bleeping-computer

Microsoft has identified a new variant of ClickFix attacks dubbed TerminalFix, which uses fake Cloudflare CAPTCHA prompts on compromised websites to trick users into executing malicious PowerShell commands in Windows Terminal. The attack chain involves downloading a ZIP containing a signed executable and a malicious DLL, followed by steganographic retrieval of additional payloads from PNG images. A custom Python-based reverse-tunnel module establishes an encrypted WebSocket connection to gitnow[.]dev:443, enabling attackers to pivot into internal networks via SOCKS5-style proxying and perform reconnaissance on domain controllers, databases, and other critical systems.

2 IoCs

Cronos blockchain restarts after $74 million Tectonic exploit

1d ago · bleeping-computer

The Cronos blockchain was exploited via a price-manipulation attack on the Tectonic DeFi lending platform, resulting in the attacker borrowing $74 million worth of assets by artificially inflating the value of the TONIC token by 100x within 20 minutes. The attacker successfully withdrew approximately $6 million in Ethereum, while the remainder of the funds were frozen due to the blockchain's emergency response. Cronos halted operations, rolled back the chain state to before the exploit occurred, and has since resumed normal operations. A post-mortem analysis is expected to follow.

Pokémon Center data breach exposes customer info, cancels some orders