Open Cyber Threat Intelligence

Google disrupted a botnet composed of over 1.3 million Android devices, primarily TV set-top boxes manufactured by Videostrong, a Shenzhen-based company. The devices were infected with a firmware-level backdoor called x.cpe, which allowed attackers to silently install apps, capture screenshots, steal credentials, and establish reverse shells. Google attributes the backdoor to intentional actions by Videostrong, which sold access to cybercriminals for ad fraud and residential proxy services. The backdoor persists across reboots and cannot be removed by users, requiring device replacement or vendor intervention.

A Chinese state-sponsored group known as Volt Typhoon is leveraging a covert relay infrastructure called Silent Train, composed of compromised SOHO, IoT, and enterprise devices, to conduct zero-day attacks and maintain persistent access to critical infrastructure, particularly in the Indo-Pacific region. The group uses rotating chains of compromised devices to obscure attack origins and target high-value systems during geopolitical tensions. The campaign indicates a strategic effort to pre-position access within essential communications and defense ecosystems, enabling long-term espionage and disruption capabilities.

A critical remote code execution vulnerability, CVE-2026-97229, in GitLab's CI/CD Regular Expression Compiler is actively being exploited in the wild. The flaw allows unauthenticated attackers to execute arbitrary code on vulnerable GitLab servers by submitting a specially crafted regular expression in a CI/CD configuration. Despite patches released by GitLab for versions 19.4.2, 19.3.5, and 19.2.8, over 1,000 internet-exposed GitLab instances remain unpatched and are currently under attack. The US Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to remediate it immediately.

Hackers disrupted refrigeration systems across more than 115 supermarkets in multiple European countries, including Belgium, Sweden, Ireland, and Estonia, by remotely altering temperature settings or activating defrost functions. The attack impacted stores operated by ICA, Coop, Ahold Delhaize, Carrefour, and others, leading to spoilage of frozen goods and emergency interventions. The vendor Sabcobel, which supplies refrigeration systems, indicated that the attackers exploited a known vulnerability previously used in similar attacks on French supermarkets involving Danfoss and Copeland/Dixell controllers. The incident is linked to insecure internet-facing management interfaces on refrigeration controllers, with no patch fully mitigating the risk without physical modifications.

BTCPay Server disclosed a security incident involving attackers exploiting vulnerabilities in outdated instances (version 2.4.1 or earlier) to gain administrator access and drain cryptocurrency from hot wallets. The project responded with an emergency update, version 2.4.7, released after a critical vulnerability was identified through Anthropic’s Frontier OSS scanner. Users are urged to update immediately, as no hot wallet drains have been reported on the latest version. Affected users are advised to report incidents and update their instances to mitigate further compromise.

A penetration test on a major cloud provider revealed a chain of vulnerabilities that enabled complete bypass of tenant isolation. Initial access was gained via misconfigured Kubernetes worker nodes, allowing escape to the host. This was followed by exploitation of Konnectivity to achieve remote code execution on the control plane, privilege escalation using an OverlayFS vulnerability, and lateral movement across managed services including VictoriaMetrics, Kafka, Redis, PostgreSQL, and SaltStack. The attack chain ultimately allowed access to sensitive credentials, control of other tenants' resources, and full compromise of the cloud infrastructure through misconfigurations and logic flaws in multiple components.

A denial-of-service vulnerability was discovered in Intelbras IP cameras, affecting models including iM3B-C, iMX C, iM4 C, iM5 SC, iME 360 C, and iM7+ FC. The flaw exists in an unauthenticated firmware update endpoint at /firmwareUpgrade_service/Demo, which allows any user on the local network to send a POST request causing the camera to reboot, resulting in a persistent DoS condition. The vulnerability was assigned candidate ID CAN-2026-2035970 and classified as Medium severity (CVSS 4.0: 5.1). Intelbras released a patched firmware version R.260804 to address the issue by enforcing authentication on the endpoint.

NetamLoader is a previously undocumented .NET assembly-loading framework used in a sophisticated infection chain targeting government Windows 10 systems in Asia. The malware is delivered via a malicious CAB file placed in a Windows update directory, leveraging AppDomainManager injection to execute malicious payloads. It uses multiple stages of encoded and compressed XAML and .NET assemblies to load a final plugin that communicates with a command-and-control server, gathers system information, and deletes forensic traces. The attack appears to be a supply chain compromise, though no specific threat actor has been attributed.

The FBI has attributed a record $6.43 billion cryptocurrency heist from Binance to TraderTraitor, a North Korea-aligned hacking group also known as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899. The group used trojanized Terraform providers to deliver a cross-platform malware implant called FLATROOF, which deploys a Python-based information stealer and the ROOFDECK backdoor for persistent remote access. TraderTraitor employs social engineering via fake job lures hosted on tailored domains, using AI to create convincing personas and target individuals in blockchain, AI, and cybersecurity sectors. A portion of the stolen funds has been frozen on-chain by major blockchain platforms.

Hackers compromised the domain DNS records of DebugBear, a third-party real user monitoring service, and replaced a legitimate script with a malicious one loaded by Polymarket. The hijacked script exploited authenticated trading sessions to steal approximately $2.64 million worth of POL tokens and positions from 726 affected wallets by reusing existing API keys and transaction signers. The attack occurred on October 29, 2026, and was active for about an hour before detection and mitigation. Polymarket responded by pausing trading, removing the malicious script, resetting sessions, and refunding affected users a total of $3.9 million.