Summary
Attackers are quietly turning everyday web browsing into a high-stakes risk, as a watering-hole campaign orchestrated by APT29 leverages compromised legitimate sites and supply-chain attacks to push mobile exploit chains onto iOS and Android devices. Cyware highlights that Sekoia and national CERTs are working to identify victims and disrupt the infrastructure, with the campaign exploiting n-day flaws like CVE-2025-43529 and CVE-2024-27834 to steal sensitive data from unpatched phones.
A critical Node-RED vulnerability, CVE-2026-58115, is being actively exploited to seize control of exposed servers through unauthenticated access via the HTTP interface. Attackers are deploying malicious flows to download Linux bots and webshells, with Siemens SIMATIC IoT2050 gateways among the affected devices. VulnCheck reports that a fix is available, but organizations relying on Node-RED automation face immediate risk if left unpatched.
TraderTraitor, a North Korea-linked hacking group, has drained $6.34 billion from Binance hot wallets by exploiting internal AI tools to move laterally between teams. Vectra’s investigation reveals that the attackers used social engineering and a tampered software download to gain initial access, then leveraged a shared AI service to bypass traditional boundaries and reach the wallet signing service, exposing the dangers of unchecked internal automation in fintech environments.
Top Malware Reported in the Last 24 Hours
APT29 poisons websites to hack phones
APT29 has launched a large-scale watering-hole campaign that compromises legitimate websites to push mobile exploit chains at visiting targets on iOS and Android. It uses JavaScript injections and fake, Adversary-in-the-Middle-like domains to deliver the DarkSword iOS exploit chain, alongside a supply-chain compromise of a Ukrainian web analytics service to widen reach. The activity exploits known, n-day flaws including CVE-2025-43529 and CVE-2024-27834 against unpatched devices, then steals data such as cookies, Wi‑Fi passwords, and full device information. Researchers at Sekoia reported the campaign and said coordination with national CERTs is underway to identify victims and disrupt the infrastructure. For people and organizations caught in the traffic, the fallout is quiet but severe: attackers can siphon sensitive mobile data without the victim realizing their phone was ever targeted.
C3RB3R ransomware hunts unpatched Synology NAS
C3RB3R ransomware is hitting Synology NAS devices by exploiting weaknesses in older DSM installations, turning widely used storage and backup boxes into encryption targets. The campaign is believed to abuse CVE-2024-10441, described as a critical unauthenticated remote code execution flaw, with patches available since November–December 2024. Reports say at-risk systems include devices running DSM versions below the fixed builds for DSM 7.2.2, 7.2.1, 7.2, 7.1, and 6.2, leaving many still exposed despite available updates. Synology has not released IoCs for the activity, but victim reports cited by BleepingComputer describe a ransom note named read-me3.txt and encrypted files carrying the .L0CK3D extension. For small and mid-sized suppliers, MSPs, and branch offices that depend on these appliances, an infection can mean losing access to core business data and backups at the same time.
3AM ransomware cripples UK school network
3AM ransomware hit a UK school estate and encrypted 37 machines, in an intrusion investigators described as suspected AI-assisted due to the speed and automation of attacker actions. It used tools and techniques such as Mimikatz and LSASS memory-dumping, then moved through Windows infrastructure with PowerShell before deploying a Rust-based encryptor. The attackers also leveraged credential access to create two backdoor domain administrator accounts, stole financial data, and set up two-way trusts between Active Directory domains. BleepingComputer linked reporting on the incident, while noting it has been associated with criminal ecosystems tied to Conti and Royal. The UK NCSC urged critical infrastructure to prepare for AI-powered ransomware by 2028, calling for organizations to enhance security measures and monitor for suspicious activity as attacks become more automated.
Top Vulnerabilities Reported in Last 24 hours
Hackers infect Node-RED servers with malware
Attackers are exploiting a critical Node-RED vulnerability (CVE-2026-58115) to get unauthenticated access and run arbitrary code on exposed servers, a path that can quickly turn a simple automation tool into a beachhead. Reports describe intruders reaching in through the Node-RED HTTP interface, then using that access to run system commands and take over the host. Attackers are already exploiting this in the wild. VulnCheck reported the campaign and said attackers deploy a malicious Node-RED flow to download and execute malware, including a Linux bot and a webshell. A fix is available via Siemens updates for affected deployments such as the Siemens SIMATIC IoT2050 gateway.
Barracuda bugs could hand over root
Two critical Barracuda flaws could let an attacker who reaches an administrative interface jump from management access to root-level command execution across several widely deployed security products. The issues span an authentication weakness in Email Security Gateway (CVE-2026-116606) and a command injection bug (CVE-2026-111560), a combination that can translate into full device control and exposure of sensitive email and network data. No active exploitation was stated in the source report, but the risk profile echoes prior real-world attacks on Barracuda gear. BleepingComputer highlighted historical cyber-espionage activity tied to the UNC4841 group against Barracuda vulnerabilities such as CVE-2023-7102 and CVE-2023-2868, including targeting of government agencies. Patches are available for affected products including Email Security Gateway (BNSF-40425 and BNSF-40430), Load Balancer ADC (BNADC-16586), Message Archiver (BNMA-32468), WAF Control Center (BNWF-60060), Web Application Firewall (BNADC-16586), and Web Security Gateway (BNYF-24789).
CISA flags exploited WordPress core bug
A vulnerability in WordPress Core tracked as CVE-2026-119977 is now a live security problem for website owners because it is listed in CISA’s Known Exploited Vulnerabilities catalog, signaling attackers are already using it. The advisory does not disclose the exploitation method or vulnerability type, but it warns that affected WordPress sites could face unauthorized actions or access that undermines site integrity. Attackers are already exploiting this in the wild, per the KEV listing referenced by the alert. The alert was published as a WordPress security advisory by cyber.gc.ca. A fix is available in WordPress 7.1.4.
Top Threat Actors Reported in Last 24 hours
APT29 poisons sites to hack phones
APT29 (also tracked as Cozy Bear), a Russia-linked espionage group, is running a large-scale watering hole campaign designed to quietly compromise iOS and Android devices using known (n-day) flaws. They are abusing compromised legitimate websites and lookalike, Adversary-in-the-Middle-style domains to steer victims into platform-specific exploit chains, including an iOS chain described as DarkSword. The activity has been observed in the US, Ukraine, the Czech Republic, and Bulgaria, putting travelers, journalists, government staff, and other mobile-heavy workforces at risk of covert surveillance. Once infected, the malware is described as able to pull sensitive data such as cookies, Wi‑Fi passwords, and full device information, turning everyday browsing into a data-loss event. Researchers said coordination with the CERTs of affected countries is ongoing to identify victims and disrupt the watering hole infrastructure. Organizations in targeted regions were advised to collaborate with CERTs and monitor for campaign IOCs.
TraderTraitor drains Binance via internal AI
TraderTraitor, a North Korea-linked hacking unit focused on financial theft, was blamed for a Binance breach that Vectra said led to $6.34 billion stolen from hot wallets on 29 October 2026. They reportedly gained early footholds through social engineering starting in June 2026, including a tampered software download on a Wallet DevOps engineer’s machine and, later, a fake job interview that delivered a malicious binary to another engineer. The twist, according to the report, is that an internal AI tool acting as a shared service helped them move laterally between teams without triggering alerts, ultimately enabling a malicious container to reach the wallet signing service. For exchanges and fintech firms, the episode shows how a single cross-team productivity layer can become a bridge between roles that were assumed to be separated, with direct consequences for customer assets and trust. Vectra recommended organizations treat internal AI tools as potential trust boundaries and implement monitoring to detect lateral movement across teams.
leepsmarts raids universities for LLM keys
leepsmarts, the actor tied to the “KeyHunter Operation,” is behind a campaign that blends credential theft with academic fraud, targeting LLM API credentials and university systems across 20 institutions. They are reported to have stolen 2,233 API keys and to be linked to exposure of Harvard alumni data and fraudulent account creation at multiple schools, a mix that can fuel both reputational damage and downstream financial abuse. The operation spans multiple phases—from reconnaissance through credential extraction—using tools named env_hunter and cpanel_check[.]py to harvest secrets and prepare exploitation workflows. The campaign affected 19 US institutions and one in Argentina, putting students, alumni, and staff at risk when access tokens and identity data leak beyond campus systems. Researchers said they staged activity around CVE-2026-41940 (a cPanel & WHM authentication bypass) against universities including the University of Utah and Arizona Christian University, even though successful exploitation was not confirmed. Universities and organizations were advised to secure cloud configurations, monitor for unauthorized access, and patch CVE-2026-41940.
Frequently Asked Questions
What is APT29? APT29 has launched a large-scale watering-hole campaign that compromises legitimate websites to push mobile exploit chains at visiting targets on iOS and Android. It uses JavaScript injections and fake, Adversary-in-the-Middle-like domains to deliver the DarkSword iOS exploit chain, alongside a supply-chain compromise of a Ukrainian web analytics service to widen reach.
What is C3RB3R? C3RB3R ransomware is hitting Synology NAS devices by exploiting weaknesses in older DSM installations, turning widely used storage and backup boxes into encryption targets. The campaign is believed to abuse CVE-2024-10441, described as a critical unauthenticated remote code execution flaw, with patches available since November–December 2024.
What is 3AM? 3AM ransomware hit a UK school estate and encrypted 37 machines, in an intrusion investigators described as suspected AI-assisted due to the speed and automation of attacker actions. It used tools and techniques such as Mimikatz and LSASS memory-dumping, then moved through Windows infrastructure with PowerShell before deploying a Rust-based encryptor.
What is CVE-2026-58115? Attackers are exploiting a critical Node-RED vulnerability (CVE-2026-58115) to get unauthenticated access and run arbitrary code on exposed servers, a path that can quickly turn a simple automation tool into a beachhead. Reports describe intruders reaching in through the Node-RED HTTP interface, then using that access to run system commands and take over the host.
What is CVE-2026-116606? Two critical Barracuda flaws could let an attacker who reaches an administrative interface jump from management access to root-level command execution across several widely deployed security products. The issues span an authentication weakness in Email Security Gateway (CVE-2026-116606) and a command injection bug (CVE-2026-111560), a combination that can translate into full device control and exposure of sensitive email and network data.
What is CVE-2026-119977? A vulnerability in WordPress Core tracked as CVE-2026-119977 is now a live security problem for website owners because it is listed in CISA’s Known Exploited Vulnerabilities catalog, signaling attackers are already using it. The advisory does not disclose the exploitation method or vulnerability type, but it warns that affected WordPress sites could face unauthorized actions or access that undermines site integrity.
What is APT29? APT29 (also tracked as Cozy Bear), a Russia-linked espionage group, is running a large-scale watering hole campaign designed to quietly compromise iOS and Android devices using known (n-day) flaws. They are abusing compromised legitimate websites and lookalike, Adversary-in-the-Middle-style domains to steer victims into platform-specific exploit chains, including an iOS chain described as DarkSword.
What is TraderTraitor? TraderTraitor, a North Korea-linked hacking unit focused on financial theft, was blamed for a Binance breach that Vectra said led to $6.34 billion stolen from hot wallets on 29 October 2026. They reportedly gained early footholds through social engineering starting in June 2026, including a tampered software download on a Wallet DevOps engineer’s machine and, later, a fake job interview that delivered a malicious binary to another engineer.
What is leepsmarts? leepsmarts, the actor tied to the “KeyHunter Operation,” is behind a campaign that blends credential theft with academic fraud, targeting LLM API credentials and university systems across 20 institutions. They are reported to have stolen 2,233 API keys and to be linked to exposure of Harvard alumni data and fraudulent account creation at multiple schools, a mix that can fuel both reputational damage and downstream financial abuse.