Open Cyber Threat Intelligence

UAT-6275, a threat actor with a likely Kazakhstan nexus, has been targeting government organizations across the Commonwealth of Independent States (CIS) since June 2025. The group uses multiple infection chains involving macro-enabled documents, PS2EXE-packaged downloaders, GitHub-hosted PowerShell scripts, and a WinRAR exploit (CVE-2025-8088) to deploy custom reverse shells such as PickleShell, Chvost, and Laplas. Exposure of staging directories and GitHub repositories revealed infrastructure changes, tooling, and preparations for post-compromise operations, including potential targeting of Linux systems. The actor shows interest in diplomatic, energy, and water resource sectors, with activity aligned to regional geopolitical developments.

The U.S. Department of Justice has charged 14 individuals and dismantled over 40 laptop farms linked to a North Korean IT worker fraud scheme known as Famous Chollima, purpledelta, and Wagemole. The operation involved North Korean IT workers using fake identities to obtain remote jobs at more than 70 U.S. companies, funneling salaries back to the DPRK to fund its nuclear and military programs. Facilitators in the U.S., including two arrested nationals, hosted company-issued laptops and laundered funds, while the threat actors used social engineering, identity theft, and laptop redirection tactics to evade detection. The FBI warns of escalating tactics, including subcontracting work to freelancers in South Asia and West Africa, and using threats of violence to coerce cooperation.

Cisco has confirmed active exploitation of a critical vulnerability, CVE-2026-76519, in its Secure Email Gateway appliances. The flaw allows an unauthenticated attacker to write files to the operating system and potentially execute commands as root by sending a maliciously crafted email attachment. The vulnerability affects systems with the File Reputation service enabled and running a vulnerable version of the Content Scanner Tools package (prior to 25.3.0.5525). Cisco has released fixes via both AsyncOS updates and a standalone Content Scanner Tools update, and advises immediate remediation due to active attacks.

Hirudo is a new Android malware that targets banking applications by replacing legitimate apps with malicious, modified versions to bypass security checks such as app-signature verification, Accessibility service detection, and Google Play Integrity. The malware is distributed through seemingly legitimate third-party apps for shopping, adult content, and short dramas, which act as loaders and prompt users to grant Accessibility permissions. Once installed, Hirudo can steal banking credentials, payment PINs, SMS messages, and device unlock secrets, while also enabling real-time remote control, screen streaming, audio recording, and camera access. The malware has primarily targeted banks in Indonesia but also affects financial institutions in China, India, Mexico, Morocco, and Thailand.

Ledger discovered hardware implants in cryptocurrency wallets sold by reseller CryptoBilis, which were modified to steal 24-word recovery phrases and transmit them via LTE using a provisioned eSIM. The implant operates as a separate component that does not alter the Secure Element or Ledger OS, making it undetectable by Ledger's self-checks. Ledger has instructed resellers across Southeast Asia and Hong Kong to halt sales while investigations continue, and users have reported compromised devices from other retailers including Metapod and MediaMarkt.

The U.S. Department of Justice disrupted operations of the North Korean threat group Famous Chollima (also known as WageMole), arresting two U.S. nationals and charging 14 individuals in connection with a scheme involving remote IT worker fraud. The group used stolen or fabricated identities to obtain technology jobs at U.S. companies, remotely accessed company-issued laptops hosted in 'laptop farms' in Texas, and laundered approximately $3 million to North Korea. The FBI operation, codenamed 'Lonestar Roundup,' seized 187 laptops and KVM devices used in the scheme, which ran from 2019 to July 2025 and impacted around 70 organizations.

A critical vulnerability in the Linux kernel's vhost subsystem, tracked as CVE-2026-74580 and named Vghost, allows local unprivileged users to achieve root privilege escalation by exploiting a flaw in memory mapping validation. The vulnerability also enables a virtual machine guest to break out to the host by writing to the host's memory via a QEMU process hijack when specific virtualization configurations are used. The bug existed due to a cache inconsistency introduced across two code changes in 2017 and 2020, affecting kernels from version 4.11 to 7.2-rc4. Tencent Zhuque Lab discovered the flaw using an AI-assisted research pipeline called Corvus AI and released a fix in August 2026, with a public write-up and working demos provided in October.

Hirudo is a new Android banking trojan that replaces legitimate banking apps with tampered versions to bypass built-in security checks. The malware is distributed via dropper apps disguised as shopping, adult video, and entertainment apps, which prompt fake in-app updates to install the payload. It enables on-device credential theft, remote control, screen and camera capture, and SMS theft by leveraging accessibility services and bypassing Play Protect using a non-functional VPN. The trojan specifically targets eight Indonesian banking apps but also has credential harvesting capabilities for users in China, India, Mexico, Morocco, and Thailand.

Researchers at XBOW leveraged OpenAI's GPT-5.6 Sol model to rapidly develop a full-chain Chrome exploit within six days, chaining three previously unknown vulnerabilities to achieve remote code execution on Windows without user interaction. The exploit bypassed Chrome's dual sandbox layers by exploiting flaws in V8, the animated WebP decoder, and Crashpad. Google has since patched all three vulnerabilities and awarded XBOW a $250,000 bug bounty. The demonstration highlights a significant reduction in the time and resources required to develop sophisticated browser exploits, raising concerns about future offensive capabilities.

A high-severity use-after-free vulnerability in curl and libcurl, tracked as CVE-2026-92392, allows a malicious HTTP/2 server to achieve client-side code execution during file uploads under specific conditions. The flaw affects versions 8.12.0 through 8.22.0 and was patched in version 8.23.0. Successful exploitation requires precise knowledge of the client's build, architecture, and memory layout, making reliable code execution difficult; crashes are more likely than full compromise. The vulnerability was discovered via Anthropic's OSS Scanner and reported through HackerOne by researcher Luna Tong.