Summary
Automated ransomware is slashing through enterprise defenses as Qilin, also known as Agenda, pivots to cross-platform attacks that scan Active Directory and target VMware ESXi environments. Cyware spotlights Seqrite’s analysis of Qilin’s eight-phase run, which ends with mass encryption and anti-forensics, leaving healthcare, manufacturing, and technology organizations facing widespread downtime and blocked access to critical systems.
A critical flaw in the Linux kernel’s TCP stack, tracked as CVE-2026-98432 with a CVSS score of 9.8, is raising alarms after Anthropic developed a working exploit that enables remote root command execution. With no Ubuntu patch yet released and the NCSC warning about the rarity of such remotely reachable bugs, organizations are urged to monitor for updates and deploy compensating controls to avoid credential-free takeovers.
Espionage groups are intensifying their campaigns, with Gorbag APT targeting Ukrainian courts and city councils near the front lines using spearphishing and BeautyStealer malware. Meanwhile, the Belarusian Cyber Partisans and Silent Crow claim access to 25,000 devices inside Russia’s Rosstat, exfiltrating census and economic data before launching a destructive operation that briefly replaced official statistics with Ukrainian military loss figures.
Top Malware Reported in the Last 24 Hours
Qilin ransomware shifts to automated attacks
Qilin (also known as Agenda) ransomware has evolved in 2026 from a more manual operation into an automated, cross-platform threat designed to spread faster inside enterprise networks. Once inside, it scans Active Directory to map its next moves, then pushes toward environments like VMware ESXi to expand its reach before locking systems. Seqrite’s analysis describes an eight-phase run that moves from authentication and privilege checks through hypervisor profiling and crypto negotiation, ending with mass encryption and anti-forensics. For healthcare, manufacturing, and technology organizations, the practical outcome is downtime and blocked access to business-critical systems when encryption hits at scale. Mitigations referenced in the report include network segmentation, monitoring for unusual Active Directory queries and ESXi activity, and using endpoint detection; it uses AES-256-CTR or ChaCha20 for encryption.
Node-RED flaw fuels OT malware installs
CVE-2026-58115, a max-severity Node-RED vulnerability, is being exploited to run commands on exposed systems and drop Linux malware in operational technology environments. Because Node-RED is widely used to wire together industrial workflows, a successful break-in can translate into attackers issuing unauthorized commands with real-world consequences, not just data loss. The Register reports exploitation observed from October 30 to November 1 and describes activity consistent with opportunistic mass scanning rather than carefully chosen targets. The campaign activity was linked to a single attacking source, underscoring how quickly internet-exposed OT/ICS tooling can be swept up in broad exploitation waves. A fix is available, and the article’s guidance centers on restricting external reachability, applying updates, and monitoring for suspicious access attempts.
Stylesmuggler hits Magento with PSK Agent
A coordinated campaign dubbed Stylesmuggler has been exploiting Magento and Adobe Commerce stores via CVE-2026-75650 to install the PSK Agent RAT, with victims observed across Western Europe and North America (as well as Asia-Pacific). After compromise, it establishes persistent access using server-side tooling such as webshells and droppers, turning an online store into a foothold attackers can reuse. Imperva says the operators also used DNS-based tracking to confirm when exploitation succeeded, giving them rapid feedback on which targets they control. For retailers and brands, that can mean stolen data and disruptive tampering with commerce infrastructure while the malware lingers in the environment. A vendor hotfix is available (Adobe’s VULN-39341), and the report highlights investigating for signs of compromise and monitoring known campaign infrastructure.
Top Vulnerabilities Reported in Last 24 hours
Linux kernel TCP bug enables root RCE
A critical flaw in the Linux kernel’s TCP code can let remote attackers run commands as root without any user interaction (CVE-2026-98432, CVSS 9.8). The issue is a race condition in the IPv4 TCP stack, and the scenario described involves an attacker sending specially crafted network packets to a vulnerable server to seize control. Attackers are not reported as actively exploiting it in the wild in the source material, but Anthropic says it has developed a working exploit, raising the pressure to fix it quickly. The NCSC also underscored how rare and dangerous remotely reachable TCP-stack bugs can be because they don’t require credentials or prior access. Ubuntu users are watching closely because Ubuntu has not yet released a patch, and the delay has drawn public criticism; in the meantime, organizations are being urged to monitor for Ubuntu updates, apply patches as soon as they’re available, and consider temporary workarounds or compensating controls.
Node-RED flaw exploited to drop Linux malware
Attackers are exploiting a max-severity vulnerability in Node-RED to execute commands on exposed systems and deploy Linux malware (CVE-2026-58115, CVSS 10.0). The problem centers on unauthenticated access to Node-RED’s HTTP interface, which can be abused to run system commands and turn an automation server into an entry point for broader compromise. Attackers are already exploiting this in the wild, with activity observed from October 30 to November 1, and reporting characterizes it as opportunistic mass scanning rather than carefully targeted intrusions. The same wave of probing also targeted other products, including Apache Solr, Camunda, Gitea, MLflow, Traefik, and Joomla, reflecting how quickly internet-exposed tooling gets swept into bot-driven campaigns. For defenders, the immediate priority is to check whether Node-RED is reachable from outside the network, restrict access where possible, apply updates when available, and implement detections to reduce the risk of repeat compromise.
WordPress cryptopayment plugin hit by active attacks
An unpatched flaw in the CryptoPayment Gateway WordPress plugin lets unauthenticated attackers delete files and extract wallet credentials, creating a direct path to financial theft (CVE-2026-81648). The weakness is an authorization bypass caused by missing authorization checks on AJAX endpoints, enabling unauthorized administrative actions without a valid login. Attackers are already exploiting this in the wild, according to Defused Cyber, which tracked exploitation attempts against affected sites. The plugin was closed on the WordPress Plugin Directory on August 28, 2026 due to the security issue, but it has still been downloaded 1,845 times, including 20 times in the last week—suggesting some sites may remain newly exposed. With no patch mentioned, the guidance in the report is to remove the plugin immediately, rotate wallet keys, audit for suspicious changes or unauthorized access, and monitor for updates.
Top Threat Actors Reported in Last 24 hours
Gorbag APT hits Ukrainian frontline courts
Gorbag APT, a Russia-aligned espionage group, has been hunting for wartime intelligence by targeting Ukrainian courts, city councils, and defense-related entities near front-line regions. They have been running spearphishing campaigns since February 2025, first using macro-enabled Excel attachments and later shifting to RAR archives that exploit CVE-2025-8088 to keep malware running even after a restart. The group’s main tool, BeautyStealer, focuses on stealing browser credentials, VPN configurations, and authentication-related files—data that can let intruders move deeper into a victim’s environment. For local administrations and justice bodies operating under pressure, the consequence is that sensitive internal access can be quietly captured and reused long after the initial email is opened. Earlier activity also used Prime ReverseShell, which included a comment seemingly meant to mislead AI-based detection, though tests cited in the report found AI assistants could still flag it.
DarkBlinders spies on Israeli Kurdish targets
DarkBlinders, an Iran-aligned espionage group, has been compromising high-profile targets in Israel and the Kurdistan Region of Iraq through spear-phishing and social engineering. After victims are lured into executing a decoy application, they use techniques including AppDomainManager injection to load malware such as SHELBYLOADER and SHELBYC2. They also rely on DLL sideloading to run SHELBYC2, which supports remote control and data theft, with GitHub used as part of their command-and-control workflow and a tunneling utility called Blackwood. For government-linked and politically exposed entities, the stakes are prolonged access that can expose internal communications and operational details. The report also links activity to the Prince of Persia group, which is said to be hosting a C2 server in the U.S. for the first time in a decade, suggesting a shift in infrastructure choices.
Cyber Partisans claim deep Rosstat breach
The Belarusian Cyber Partisans and pro-Ukraine group Silent Crow have claimed a long-running intrusion into Russia’s federal statistics agency, Rosstat, pairing data theft with disruptive action. They say they spent months inside the network collecting information before triggering a destructive operation that disrupted Rosstat’s systems. According to the hackers, the stolen haul includes economic and demographic datasets, personal information, census records, internal correspondence, and even mortality records that could shed light on Russian military casualties. If accurate, the breach would put sensitive government data—and the people represented in those records—at risk of exposure or manipulation. The groups also claim access across roughly 25,000 devices and say they briefly replaced server content with Ukrainian statistics on Russian military losses for about an hour.
Frequently Asked Questions
What is Qilin? Qilin (also known as Agenda) ransomware has evolved in 2026 from a more manual operation into an automated, cross-platform threat designed to spread faster inside enterprise networks. Once inside, it scans Active Directory to map its next moves, then pushes toward environments like VMware ESXi to expand its reach before locking systems.
What is CVE-2026-58115? CVE-2026-58115, a max-severity Node-RED vulnerability, is being exploited to run commands on exposed systems and drop Linux malware in operational technology environments. Because Node-RED is widely used to wire together industrial workflows, a successful break-in can translate into attackers issuing unauthorized commands with real-world consequences, not just data loss.
What is Stylesmuggler? A coordinated campaign dubbed Stylesmuggler has been exploiting Magento and Adobe Commerce stores via CVE-2026-75650 to install the PSK Agent RAT, with victims observed across Western Europe and North America (as well as Asia-Pacific). After compromise, it establishes persistent access using server-side tooling such as webshells and droppers, turning an online store into a foothold attackers can reuse.
What is CVE-2026-98432? A critical flaw in the Linux kernel’s TCP code can let remote attackers run commands as root without any user interaction (CVE-2026-98432, CVSS 9.8). The issue is a race condition in the IPv4 TCP stack, and the scenario described involves an attacker sending specially crafted network packets to a vulnerable server to seize control.
What is CVE-2026-58115? Attackers are exploiting a max-severity vulnerability in Node-RED to execute commands on exposed systems and deploy Linux malware (CVE-2026-58115, CVSS 10.0). The problem centers on unauthenticated access to Node-RED’s HTTP interface, which can be abused to run system commands and turn an automation server into an entry point for broader compromise.
What is CVE-2026-81648? An unpatched flaw in the CryptoPayment Gateway WordPress plugin lets unauthenticated attackers delete files and extract wallet credentials, creating a direct path to financial theft (CVE-2026-81648). The weakness is an authorization bypass caused by missing authorization checks on AJAX endpoints, enabling unauthorized administrative actions without a valid login.
What is Gorbag APT? Gorbag APT, a Russia-aligned espionage group, has been hunting for wartime intelligence by targeting Ukrainian courts, city councils, and defense-related entities near front-line regions. They have been running spearphishing campaigns since February 2025, first using macro-enabled Excel attachments and later shifting to RAR archives that exploit CVE-2025-8088 to keep malware running even after a restart.
What is DarkBlinders? DarkBlinders, an Iran-aligned espionage group, has been compromising high-profile targets in Israel and the Kurdistan Region of Iraq through spear-phishing and social engineering. After victims are lured into executing a decoy application, they use techniques including AppDomainManager injection to load malware such as SHELBYLOADER and SHELBYC2.
What is Belarusian Cyber Partisans? The Belarusian Cyber Partisans and pro-Ukraine group Silent Crow have claimed a long-running intrusion into Russia’s federal statistics agency, Rosstat, pairing data theft with disruptive action. They say they spent months inside the network collecting information before triggering a destructive operation that disrupted Rosstat’s systems.