Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell is a small file that executes any command an attacker sends via a web request, with the rights of the web server account. The flaw

Ivanti customers are being urged to update Connect Secure and check for compromise after attackers exploited a newly disclosed zero-day vulnerability. On Tuesday, Ivanti released updates for Connect Secure (ICS) to fix CVE-2026-104935, an authentication bypass flaw discovered by Volexity. Rated 8.6 on the CVSS scale, it allows remote, unauthenticated attackers to execute arbitrary commands. "We are aware of exploitation in the wild affecting a limited number of customers at the time of disclosure," the vendor said in its advisory. There are limited indicators of compromise available at present, it said, advising customers to refer to Volexity's report on the findings for more information, and to run the Ivanti Integrity Checker Tool regularly. Ivanti lists affected releases in the following branches: 25.1.1.1 and earlier 25.1.2.2 and earlier 22.8R2.4 and earlier The vendor said it previously identified "a portion of this vulnerability" and patched it in July's 25.1.3.0 update, and had been working on backporting the same fix since then, however, attackers began exploiting it before that work was complete. Volexity said the attackers behind the recent intrusions were previously unknown to its researchers, but are now tracked as UTA0576. Criminal motive rather than espionage is suspected by Volexity. Based on observed post-exploitation activity, attackers appeared to be most interested in using their newfound access for credential theft, data exfiltration, log tampering, and network reconnaissance. Notably, the attackers did not deploy any malware nor execute web shells, using only the commands available to them on the ICS appliance. "Because the operation was detected and disrupted, the threat actor's ultimate objectives could not be determined," said Volexity. "However, Volexity assesses with high confidence that UTA0576's actions signaled preparation for lateral movement and a broader compromise of the victim network." The researchers also suspect that the attackers were using large language models to support their endeavors. Volexity pointed to the attackers' repeated use of the exploit channel to run commands, rather than deploying web shells, and their use of "highly specific scripts using hardcoded credentials." Ivanti disclosed one CVE, but Volexity described an attack chain involving three vulnerabilities. Tuesday's updates address the authentication bypass and remote code execution stages. The third vulnerability, which allows privilege escalation, is separate from the flaws encompassed by CVE-2026-104935. Volexity said Ivanti is aware of the additional bug and plans to publish a fix "in the coming weeks." The disclosure of the zero-day this week makes it the third year running that Ivanti has had to deal with attackers exploiting undisclosed flaws in Connect Secure. The previous ICS zero-days were disclosed in January 2025, a year after the January 2024 vulnerabilities led to exploits affecting thousands of ICS appliances. In the interim, we've also seen suspected Chinese espionage groups exploiting bugs in Endpoint Manager Mobile (EPMM), and critical flaws in Sentry. Ivanti's run of January zero-days continued earlier this year, although those flaws affected EPMM rather than Connect Secure. ®

Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System. "Since January 2026, the threat actors behind these kits have been responsible for

submitted by /u/scopedsecurity
[link] [comments]

The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers and KVM devices as part of its ongoing efforts to disrupt North Korea's fraudulent remote IT worker (ITW) scheme. The indictment charges a mix of U.S. citizens and Chinese nationals for their roles in an IT worker conspiracy affecting more than 70 U.S. companies, charging them with wire fraud

Cryptography rarely fails at the math - it fails at deployment. Why post-quantum migration and AI-scale risk make open-source stewardship a core control.

The United Kingdom has issued economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomware, narcotics, darknet markets, fraud and cybercrime services that are helping Russia circumvent existing financial restrictions.

On October 8, the U.K. issued sanctions (PDF) against Cryptomus — previously known as Certa Payments and Xeltox Enterprises — for processing payments that benefit the Russian government and its financial institutions. The sanctions freeze any Cryptomus assets at U.K. banks, and bar British companies from offering it any business, virtual or otherwise. Also targeted in these sanctions were the virtual payment platforms VexPay, TokenSpot, and the Tsunami Payments service.

As explained in our December 2024 investigation, “How Cryptocurrency Turns to Cash in Russian Banks,” Cryptomus has been a key payment processor for dozens of Russian cryptocurrency exchanges and websites hawking cybercrime services. The company has changed its name several times since emerging in 2022, most recently to “Heleket” last year after Canada levied a record CAD $176 million fine against the platform for anti-money laundering violations.

The blockchain data-crunching firm Chainalysis said the U.K. sanctions target the broader infrastructure supporting Russia’s wartime economy.

“Cryptomus and Heleket have emerged as major payment hubs for illicit activity,” Chainalysis wrote in an October 8 blog post. “Together, these services received more illicit funds across tracked categories than the mixers in our dataset and the number of illicit counterparties surged to more than 900 in a single month in late 2025.”

In April 2026, the blockchain analysis firm TRM Labs found Cryptomus had processed more than $7 billion in transactions since its inception in 2022, including transactions associated with child sexual abuse material vendors, terrorist financing networks, and human trafficking operations.

TRM noted that Cryptomus’s transaction volume cratered after the platform instituted new “know your customer” or KYC rules, and that the cryptocurrency platform responded to the Canadian fines by launching Heleket as a parallel service that continued to offer no-KYC payment processing.

Richard Sanders is a blockchain analyst and investigator who spent months mapping out Cryptomus’s payment infrastructure and transacting with its customers. Sanders said the U.K. sanctions on Cryptomus are important because Canada’s sanctions against the platform were ultimately unenforceable and uncollectible.

“A fine doesn’t stop a cryptocurrency payment processor from processing payments,” Sanders wrote on LinkedIn. “Sanctions kill the operation. The distinction matters.”

As our 2024 investigation noted, Cryptomus shared a Vancouver address with dozens of other foreign currency dealers and money transfer businesses — none of which appeared to be physically located there. Following the CAD $176 million fine for alleged money laundering violations, Cryptomus appealed the penalty, launched Heleket as a parallel service, and kept on processing large volumes of sketchy transactions, Sanders said.

Sanders said the sanctions also are notable because they are the first known instance of a “Five Eyes” country (referring to the Australia, Canada, New Zealand, the U.K. and the U.S.) sanctioning a cryptocurrency operation incorporated in another Five Eyes jurisdiction.

Where do entities like Cryptomus and Heleket derive their authority to offer international financial services? The answer appears to involve fake financial institutions overseen by a phony regulatory body positioned in a country that is not widely recognized as a sovereign nation.

Our 2024 investigation found the sole shareholder of Cryptomus’s parent company Certa Payments was a 25-year-old Ukrainian woman who also headed several other firms, including the WS Management and Advisory Corporation, which bills itself as the regulatory body that exclusively oversees licenses for cryptocurrency, foreign exchange and online gaming businesses incorporated in the disputed region in northwest Africa known as the Western Sahara.

That entity’s website — crasadr.com — says it assists applicants with bank setup and formation, online gaming licenses, and the creation and licensing of foreign exchange brokers. One of Certa Payments’ former sites — certa[.]website — also shared a server with 12 other domains, including rasd-state[.]ws, a website for the Central Reserve Authority of the Western Sahara.

This month’s update also marks the first official one for Windows 11 26H2 and the end of support for Windows 11 24H2 Home and Pro.

submitted by /u/thenrich00
[link] [comments]

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday urged organizations to take steps to immediately update their Ivanti Connect Secure (ICS) appliances and deployments to the latest version following the disclosure of an actively exploited vulnerability. The security flaw, tracked as CVE-2026-104935 (CVSS score: 8.6), is a case of authentication bypass impacting ICS

Exclusive: A new Employ report shows how AI is both helping and hurting the hiring industry.

A flaw in how curl handles HTTP/2 uploads lets a malicious server receiving an upload corrupt the client's memory, and the researcher who reported it turned that into code execution on the uploading machine. The curl project fixed it on October 14 in curl 8.23.0. Taking over a client needs exact knowledge of its build and memory layout, and curl expects a real attack to end in a crash

Cloned voices and synthetic video calls now show up in payment fraud, help desk resets, and access requests. A structured drill shows security teams exactly where verification breaks down, while nothing is at stake. The call comes in at 4:40 on a Friday. It's the CFO, or it sounds exactly like her, asking the controller to push a supplier payment out before the weekend because a deal closes

A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the user only loads a web page, the company said. Its researchers built the attack in six days by directing AI agents running OpenAI's publicly available GPT-5.6 Sol model. Google has since confirmed all three bugs, fixed them, and paid XBOW its top $

Cybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking apps with purpose-built patched versions designed to bypass security checks from inside the app itself, marking a new escalation in financial fraud.  Dutch mobile security company ThreatFabric said it identified replacements for eight Indonesian banking

The bug was simple: the login let you choose where your sign-in code went. Proving it on a live website was the hard part. TL;DR During an authorized assessment, an AI pentesting agent found a critical authentication bypass on a major insurer's production website, on its own. One login request let the user choose where the one-time passcode went. The attack was the easy part. Proving it

The Department of Justice has charged an OpenAI engineer with attempting to intercept oral communications after allegedly planting a recording device in an exec conference room. Investigators claim company security staff found a second device in his bag. Saudi national Abdulrahman Alfozan, 35, is described in court documents as an engineer at OpenAI who had worked there since July 2025, and has held permanent residency in the US since September 2020. He was arrested on October 9 and made his initial federal court appearance on October 13. He is accused of installing, on or around September 28, 2026, a Seeed XIAO ESP32-S3 Sense recording device via a USB port in a TV located in OpenAI's executive conference room. According to the complaint, staff discovered the device concealed in toilet paper on September 30. OpenAI said it used its models to analyze the device. According to the complaint, it may have been modified to prevent data transfer between the recorder and the TV. The contents of the bug's microSD card may also have been encrypted, as the company could not retrieve any of the data stored on the card after making a forensic image of it. CCTV footage placed him near the room on several dates, although prosecutors say Alfozan had no authority to access or participate in meetings held in the executive conference room, which is often reserved for the highest-level discussions. Officials did not state whether the device was able to capture anything of importance, but said the room typically plays host to non-public and secret technical meetings, as well as those with government representatives. OpenAI did not have CCTV covering the executive conference room at the time when the secret device was planted, but the company subsequently installed a camera. Court documents [PDF] include an image taken on October 5 from a camera situated behind the TV into which the DoJ claims the recording device was installed, allegedly showing Alfozan checking on it. Investigators examined Alfozan's devices, according to the complaint, which alleges that between around August 17 and September 16, 2026, Alfozan used a productivity agent to inquire about company building addresses, meeting rooms, room capacities and calendars, and external-partner meeting venues. The complaint also describes an AI chatbot account associated with his spouse that shared installation identifiers, logged IP usage, and user-path references with Alfozan's account. Between September 24 and 30, it submitted prompts about building and modifying an audio-recording device. The prompts allegedly included questions related to recording reliability, how to add browser access and controls, how to develop a second unit with speech-triggered recording, and more. On October 5, the day Alfozan was allegedly recorded looking behind the executive conference room TV, company representatives say he left a bag unattended in the office's printer room. Security staff inspected the bag, finding a wallet, an ID card, and a second Seeed-manufactured recording device, before Alfozan reported the bag missing, according to the DoJ. He collected the bag the following day from the company's Lost and Found, and later claimed in a written report that several items were missing, including a credit card, around $500 in cash, two AirPods, one set of headphones, sunglasses, and a power bank. Alfozan was charged with an attempt to intercept oral communications, an offense that carries a maximum sentence of five years in prison and a $250,000 fine. "According to the complaint unsealed today, Abdulrahman Alfozan allegedly concealed a covert recording device inside his employer's executive conference room to secretly capture sensitive communications about the company's super intelligence technology," said FBI director Kash Patel. "Protecting American SI innovation is essential to safeguarding our nation's economic strength and national security, and the FBI views that mission as one of our highest counterintelligence priorities." "At this time, we have no indications of this individual inappropriately accessing or exfiltrating model weights, source code, or customer data," OpenAI said in a statement. "The employee was terminated." "We take protecting our technology, data, and people seriously, and as a matter of national importance. Our security program is designed to protect against a wide range of threat actors, from insider risks to cybercriminals to nation states, and this case is an example of how AI can help address these sophisticated security threats." ®

A flaw in Linux's vhost subsystem lets a local user read and write kernel memory at will and become root across nearly a decade of kernel versions. In one virtualization setup, it lets an untrusted virtual machine write to the host's memory and hijack the program that runs the virtual machine. The bug is tracked as CVE-2026-74580 and named Vghost. Tencent Zhuque Lab, which found the

Security researchers ran their own code inside a protected part of Windows that is meant to stay sealed off even when the rest of the computer is taken over. The protected area is a VBS enclave, an isolated slice of memory the operating system uses to guard secrets, and the one they broke into handles passwords for a Windows anti-phishing feature. The work was done in a lab as a proof of

Tim Beasley, a senior incident response consultant at Semperis, was investigating a cyberattack involving Russia’s Midnight Blizzard when a package containing nesting dolls and other regional gifts showed up on his doorstep. At the time, Beasley served as the lead investigator for Microsoft’s Detection and Response Team (DART). He assumed it was from the group, which has been linked to the Kremlin’s Foreign Intelligence Service (SVR), although the sender didn’t leave a note. “Just little souvenirs and gift basket stuff from that area of the world,” he told The Register. “We-know-where-you-are kind of stuff. It’s a real eye-opener when you get that type of thing.” While digital intrusions having physical consequences is nothing new, cybercriminals in recent years have turned to real-life harm and mental and physical trauma to force victims into paying extortion demands. Some groups even use cybercrime as a gateway drug to real-life violence. Over the summer, Europol and its partners' investigators flagged 4,340 “horrific” URLs for removal as part of an ongoing crackdown on The Com (short for community), a loosely knit network of online groups whose young members participate in a range of illicit activities including hacking, swatting, digital extortion, real-life shootings, and other physical violence. “We’ve seen violence as a service get used,” Beasley said. He’s also investigated ransomware attacks where C-suite executives receive pictures of their kids’ schools directly from the cybercriminals in an attempt to apply psychological pressure to pay the extortion fee. “I've seen threats involving people's families, from social media reconnaissance, and in our world you more and more come to expect it, which is unfortunate,” Beasley said. This type of psychological intimidation and harm against victim companies’ employees has seen an uptick in the last several years to the point where it's almost common. Thirty-seven percent of ransomware attacks involved psychological or physical threats against staff, according to Semperis’ annual ransomware risk report. The global study of 1,200 post-ransomware organizations conducted over the first half of the year found attackers threatening psychological intimidation (23 percent) and physical threats (17 percent), to force payment. They are not only targeting executives and staff, but also families of their victims. A quarter of these victims experienced doxxing – posting individuals' personal details, such as names, home and work addresses, and phone numbers online – while another 25 percent had to seek psychological and/or medical treatment in response to ransomware infections. Nearly the same number (24 percent) hired personal security teams, while 23 percent experienced swatting calls – that's when attackers phone emergency services and report a bogus incident like a bomb or active-shooter threat to trigger an armed response. Additionally, more than half (53 percent) of respondents reported that ransomware attackers carried through on threats in the past year. Some of these threats reported by ransomed organizations’ employees include: threatening texts, letters, or packages: 57 percent threats against family or friends: 37 percent physical intrusion: 19 percent abduction: 17 percent bodily harm: 13 percent stalking: 6 percent. “It's the more well-known groups,” using psychological and physical threats to force payments, Beasley said. “I've seen Scattered Spider, I've seen ShinyHunters, I've seen Lapsus$.” For what it's worth, ShinyHunters claimed in an exclusive interview with The Register that they “don't attack human beings.” They did, however, admit that “there are times in the work we do sometimes we have to push the corporate to the absolute limit to get them on the table.” The takeaway for defenders and executives from this report is to “stand your ground,” Beasley said. “Don’t buckle under the pressure, and just know that you know it's going to be okay. If you feel like you're under duress, then by all means get law enforcement involved. Don't be afraid to call the cops. Don't be afraid to get the FBI involved, sooner rather than later. And don’t pay them.” This last piece of advice is important, as once you pay, they're going to come back for more. Semperis’ report found that 69 percent of surveyed ransomware victims were targeted multiple times within the past 12 months, and 31 percent made multiple payments to attackers. “Don’t pay anything,” Beasley said. “Never pay them.”®