hacker-news · Crawled Nov 13, 2026

ThreatsDay: 59 Linux Kernel Bugs, Falcon Spyware, GSocket Backdoors + 17 More Stories

6 IoCs 1 Actors 1 Malware 3 CVEs
Read original article ↗

AI Summary

Multiple active threat campaigns were observed in November 2026, including North Korean actors laundering $640 million stolen from Binance through complex blockchain transactions and meme coins. Microsoft reported a surge in GSocket backdoor usage on Linux servers, enabling persistent access via public relay networks. Falcon browser-based spyware, linked to PeckBirdy, was used to steal credentials and session data from government webmail portals in the Middle East and Southeast Asia. A new ransomware group, Citrus, leveraged AI-generated scripts and contractor access to deploy Sn00py-family ransomware. Additionally, Proofpoint identified BluePhishing, a new OAuth abuse technique targeting Microsoft Entra AI agent consent. RevStealer malware expanded its distribution through over 100 domains and trojanized AI tools, stealing credentials and cryptocurrency data.

AI-extracted · verify before operational use

Extracted Entities 5 found

Malware PeckBirdy → Threat Actor Lazarus Group → CVE CVE-2026-64563 → CVE CVE-2025-59528 → CVE CVE-2026-41264 →

Indicators of Compromise 6 extracted

Type Value Detail
Domain FUK Details →
Domain OLCCL Details →
Domain MEILI Details →
Domain MMLI Details →
Domain DABI Details →
Domain SINU Details →

MITRE ATT&CK TTPs 70 techniques

T1059.001 PowerShell · Execution T1071.001 Web Protocols · Command And Control T1071.004 DNS · Command And Control T1085 T1085 T1090 Proxy · Command And Control T1105 Ingress Tool Transfer · Command And Control T1132.002 Non-Standard Encoding · Command And Control T1185 Browser Session Hijacking · Collection T1202 Indirect Command Execution · Defense Evasion T1212 Exploitation for Credential Access · Credential Access T1555 Credentials from Password Stores · Credential Access T1557 Adversary-in-the-Middle · Credential Access T1566 Phishing · Initial Access T1574.002 DLL Side-Loading · Persistence T1574.008 Path Interception by Search Order Hijacking · Persistence T1574.010 Services File Permissions Weakness · Persistence T1574.011 Services Registry Permissions Weakness · Persistence T1001 Data Obfuscation · Command And Control T1003 OS Credential Dumping · Credential Access T1018 Remote System Discovery · Discovery T1021.001 Remote Desktop Protocol · Lateral Movement T1021.002 SMB/Windows Admin Shares · Lateral Movement T1021.004 SSH · Lateral Movement T1021.006 Windows Remote Management · Lateral Movement T1027 Obfuscated Files or Information · Defense Evasion T1029 Scheduled Transfer · Exfiltration T1036.005 Match Legitimate Name or Location · Defense Evasion T1040 Network Sniffing · Credential Access T1053.005 Scheduled Task · Execution T1053.008 T1053.008 T1055 Process Injection · Defense Evasion T1057 Process Discovery · Discovery T1059 Command and Scripting Interpreter · Execution T1059.003 Windows Command Shell · Execution T1059.005 Visual Basic · Execution T1068 Exploitation for Privilege Escalation · Privilege Escalation T1070.001 Clear Windows Event Logs · Defense Evasion T1070.004 File Deletion · Defense Evasion T1070.006 Timestomp · Defense Evasion T1078 Valid Accounts · Defense Evasion T1082 System Information Discovery · Discovery T1083 File and Directory Discovery · Discovery T1087 Account Discovery · Discovery T1098 Account Manipulation · Persistence T1129 Shared Modules · Execution T1133 External Remote Services · Persistence T1134 Access Token Manipulation · Defense Evasion T1190 Exploit Public-Facing Application · Initial Access T1195.001 Compromise Software Dependencies and Development Tools · Initial Access T1195.002 Compromise Software Supply Chain · Initial Access T1203 Exploitation for Client Execution · Execution T1204.002 Malicious File · Execution T1210 Exploitation of Remote Services · Lateral Movement T1218 System Binary Proxy Execution · Defense Evasion T1218.011 Rundll32 · Defense Evasion T1480 Execution Guardrails · Defense Evasion T1484 Domain or Tenant Policy Modification · Defense Evasion T1485 Data Destruction · Impact T1486 Data Encrypted for Impact · Impact T1495 Firmware Corruption · Impact T1496 Resource Hijacking · Impact T1534 Internal Spearphishing · Lateral Movement T1548 Abuse Elevation Control Mechanism · Privilege Escalation T1558 Steal or Forge Kerberos Tickets · Credential Access T1566.001 Spearphishing Attachment · Initial Access T1566.002 Spearphishing Link · Initial Access T1573.001 Symmetric Cryptography · Command And Control T1583 Acquire Infrastructure · Resource Development T1610 Deploy Container · Defense Evasion T1650 Acquire Access · Resource Development