Open Cyber Threat Intelligence

Swallowtail, a Russian cyberespionage group also known as APT28 or Fancy Bear, conducted a targeted campaign against defense and law enforcement organizations in two NATO countries. The attacks involved the use of the Hookedge backdoor, delivered via malicious Word documents, which communicated through webhook.site and later switched to a dedicated C2 IP. Attackers performed hands-on-keyboard operations, stole credentials using SSH tunneling and NTLM relay techniques, and deployed a previously undocumented reflective loader named ld.exe. The intrusion persisted for at least two months, indicating a sustained espionage effort focused on national security targets.

On November 9, 2026, a threat actor compromised the Ethersphere project's release pipeline by gaining access to maintainer accounts and publishing a malicious @ethersphere/bee-js 13.3.0 package to npm and a trojanized Swarm Desktop 0.56.2 release on GitHub. Both artifacts contain a loader that fetches and executes JavaScript from api.frameworkmetrics.xyz, leveraging the same infrastructure previously used in the SleepyDuck/EtherDuck Open VSX campaign. The attack reused an Ethereum smart contract (0xf8a900Db...) for command-and-control, allowing the actor to exfiltrate node wallet credentials and deploy a persistent Go-based backdoor or ScreenConnect for remote access. npm removed the malicious package after 75 minutes, but the GitHub release remained for over eight hours, impacting users who auto-updated.

A Taiwan-based individual leveraged a custom AI agent framework called BOSSAI to conduct cyber espionage operations targeting emergency services, universities, banks, and government systems across at least 11 countries. The attacker used locally hosted, safety-removed ('abliterated') AI models—primarily DeepSeek, GLM, and Qwen—to power 12 AI agents, nine of which were actively used for reconnaissance, exploitation, and infrastructure management. The operation successfully exfiltrated emergency dispatch records from Taipei, patient data from a fire department platform, and personal data from a Taiwanese lender and multiple Thai universities via SQL injection. The attacker's infrastructure was exposed due to operational security failures, including reused identities and an exposed home IP address in SSH logs.

LNbits, an open-source Bitcoin Lightning wallet system, has urged all operators to immediately shut down their servers due to ongoing attacks exploiting a vulnerability in an unspecified extension. One operator reported a loss of approximately 0.023 BTC (2,285,545 satoshis) before the attack was halted. The project has not yet released a patch, but developers estimate fixes will be available within 24–48 hours. The attacks began over three hours before the initial warning, and the exploited extension has not been publicly identified.

A security flaw in Web3Auth's infrastructure was exploited to steal cryptocurrency from Keplr wallets that used Google or Apple sign-in methods. The breach led to a private key compromise, allowing attackers to access affected wallets. Web3Auth responded by proactively emptying at-risk wallets into secure recovery wallets across multiple blockchains to prevent further theft. While no official figures were released, security firm GoPlus estimated at least $1 million stolen, and blockchain analysis showed over $6 million moved to recovery wallets. The incident has impacted only wallets using social login; those using recovery phrases or hardware wallets are unaffected.

Security researchers Shubham Shah and Sam Curry discovered that two automakers' mobile apps used ForgeRock's identity platform with the default admin credentials 'admin:admin' still in place on production servers. By exploiting a path confusion vulnerability, they bypassed edge protections to access the Apache Felix administrative console, execute code, and gain full control over customer accounts. This allowed them to modify account details, obtain valid access tokens, and remotely unlock and start vehicles belonging to consenting owners in the U.S. A second attack vector in Australia involved hardcoded admin credentials in the app code, enabling similar access across multiple regions including Canada.

The cyber espionage group Bitter, also known as APT-C-08 and other aliases, has deployed a new remote access trojan called PapRAT targeting organizations in South Asia. The malware, available in both C++ and Rust variants, enables command execution, file manipulation, screenshot capture, and PowerShell execution. The campaign uses multiple infection chains involving LNK files, VHDX disk images, and URL shortcuts to deliver PapRAT via MSI installers, leveraging living-off-the-land techniques and C2 infrastructure for reconnaissance and data exfiltration.

Hackers are actively exploiting a critical vulnerability in OpenSSH, dubbed 'SSHole' (CVE-2026-123158), to bypass authentication and gain unauthorized access to Linux systems, particularly those based on musl, such as Alpine Linux. The flaw allows attackers to log in to accounts with a password hash set to '*' by sending an oversized password, which triggers an error in musl's password hashing function that OpenSSH misinterprets as a valid match. Exploitation began shortly after public disclosure and proof-of-concept release, with confirmed attacks involving system reconnaissance, credential theft, persistence via SSH authorized_keys modification, and deployment of the TAC Agent Python-based implant.

A threat actor using the 'ShinyHunters' alias claimed to have breached Binance and offered for sale data allegedly containing KYC documents, passwords, private keys, and transaction history of 335 million users. Binance denied the claims, stating there was no evidence of a breach and that the claims were likely a scam, possibly based on infostealer malware data from users' devices rather than a direct compromise. The actor demanded $900,000, but inconsistencies in the claim and skepticism from forum users cast doubt on its legitimacy. Separately, Binance recently disclosed a prior incident involving North Korean hackers from the Lazarus Group compromising an employee via a fake job interview, leading to a $6.34 billion cryptocurrency theft.

Russian cloud services provider Beget suffered a destructive cyberattack on November 1, 2026, in which an attacker gained access to its management systems and deployed data-wiping malware across its infrastructure. The attack erased data from VPS, S3, Kubernetes, and CDN configurations, with only partial backups surviving. Beget is rebuilding its systems from scratch, treating all infrastructure as potentially compromised, and has not found evidence of data exfiltration—indicating the attack was purely destructive in nature.