Open Cyber Threat Intelligence

The npm package @ethersphere/bee-js version 13.3.0 was compromised and published with malicious code that executes during installation. The postinstall script retrieves platform-specific JavaScript payloads from an attacker-controlled domain, which target Swarm Desktop wallet data for exfiltration and establish persistence on Linux, macOS, and Windows systems. The attack leveraged a compromised release identity (bee-worker), with the malicious commit bypassing normal signed pull request workflows, and the package was published with valid SLSA provenance, making detection more difficult.

A backdoor named 'cwpdoor' has been discovered in the Control Web Panel (CWP) server, a tool used for managing Linux hosting servers. The malicious version of the cwpsrv binary allows attackers to execute commands via specially crafted HTTP requests with custom headers starting with X-Ngx-Integrity, which are not logged. The backdoor is installed via a shell script that replaces the legitimate cwpsrv binary and hides its modifications by restoring original file timestamps. Researchers identified multiple IOCs including hashes, a malicious IP address, and URLs used for distribution, and recommend checking for infection using socket, process, and file indicators.

French banking group Crédit Mutuel Arkéa suffered a cyberattack that enabled attackers to initiate fraudulent transactions worth up to $133 million via a compromised service provider. The attackers used Arkéa’s own internal account to transfer funds to other financial institutions and convert them into USDC and USDT stablecoins, bypassing customer accounts. The bank confirmed the incident was a sophisticated attack, not due to human error, and emphasized that customer assets were unaffected. Investigations are ongoing with judicial authorities to determine the full scope and origin of the breach.

In December 2025, threat actor Storm-2603 exploited CVE-2025-53770 and CVE-2025-53771 (ToolShell vulnerabilities) in on-premises Microsoft SharePoint to achieve remote code execution, deploying a fileless webshell within the IIS worker process (w3wp.exe). The attack used in-memory execution via a VirtualPathProvider-based implant to maintain persistence without writing to disk, enabling command and control, lateral movement, and data exfiltration. The actor deployed Velociraptor for post-compromise operations, attempted to deploy Warlock ransomware, and used EDR-killing techniques, but was partially blocked by security controls.

Kaspersky GERT investigated two ransomware incidents involving ESXi and Proxmox virtualization environments. In the first case, attackers exploited a monitoring system (PRTG) that stored reusable root credentials, enabling SSH access to multiple ESXi hosts. They disabled the execInstalledOnly security policy and deployed the BlackNevas ransomware binary 'esx' to encrypt systems. In the second case, attackers obtained plaintext credentials from a compromised administrator workstation, allowing them to access Proxmox via the root account and activate VNC websockets to execute ransomware across the cluster. Both attacks leveraged misconfigurations such as credential reuse, unsafe storage, and excessive privileges rather than software vulnerabilities.

A malicious RubyGems package named strutil-core version 1.0.1 was discovered that executes a credential-stealing worm during installation. The package, published by the RubyGems account jamnajiea, delivers a JavaScript-based payload using the Bun runtime, which collects cloud, CI/CD, package registry, SSH, AI coding tool, and cryptocurrency wallet credentials, then exfiltrates them to paleasbest[.]top. The malware includes self-propagation capabilities across RubyGems, npm, and PyPI, poisons AI development environments by injecting malicious configurations, and installs a Python backdoor that executes scripts from signed GitHub commits. A conditional wiper is triggered if a stolen GitHub token is revoked, leading to deletion of the user's home directory.

A critical vulnerability in Ruby on Rails' Active Storage component, when used with ImageMagick, allows unauthenticated attackers to write arbitrary files to the server and potentially read sensitive files such as secret keys and database credentials through crafted uploads. The vulnerability arises because Active Storage does not restrict dangerous ImageMagick coders that can access files outside the uploaded image. Exploitation can lead to remote code execution, especially in applications using the Disk service. The Rails team released patches in versions 8.0.5.2 and 8.1.4.1, while Socket has provided a free interim Certified Patch for GHSA-f3w6-w445-fwh9 to help organizations mitigate the issue before full upgrades.

CVE-2026-123158, dubbed *sshole, is a password authentication bypass vulnerability in OpenSSH when running on musl libc-based systems like Alpine Linux without PAM. The flaw allows an unauthenticated network attacker to log in to accounts with a shadow password field set to '*' by submitting an overlong password (longer than 256 bytes) after a failed initial attempt, exploiting how musl's crypt() function handles input length and returns values. The vulnerability affects Alpine Linux 3.16 and later, OpenWrt with OpenSSH, and other musl-based systems under specific configuration conditions, including PasswordAuthentication enabled and at least one local account with a real SHA-crypt password hash. OpenSSH released version 10.6p2 to fix the issue, and Alpine backported patches across all supported and unsupported branches.

Unidentified threat actors conducted cyberattacks on refrigeration systems across Europe starting in October 2026, targeting at least 700 supermarkets in France and later expanding to over 10 additional countries, impacting over 100 retail locations. The attackers manipulated refrigeration controllers to enter defrost mode, raising temperatures to as high as 50°C, leading to food spoilage and in some cases, fires. French medical facility refrigeration systems were also affected, though no blood product spoilage was confirmed. Initial access may have exploited default credentials or vulnerable software, and pro-Russian hacktivist groups NoName057(16) and Z-Pentest claimed responsibility, though unverified. CISA issued an advisory warning of exploitation via authentication bypass, arbitrary code injection, and weak configurations.

Cisco Talos discovered VOLTA, a sophisticated Windows infostealer that leverages AI to automate victim profiling and prioritize stolen data for monetization. The malware harvests credentials, browser sessions, and cryptocurrency wallets, then uses large language models (LLMs) to analyze and rank the value of stolen assets, enriching the data by searching victims' emails for purchase receipts. If an LLM refuses to process the data, VOLTA fails over to an alternative model to ensure continuous operation, reducing the need for manual effort by attackers and enabling even low-level threat actors to conduct high-impact attacks.