Summary
Attackers are turning everyday IT tools into deep-access threats, as seen in the Anubis ransomware crew’s latest campaign. By planting the custom Backdoor.Lindnor and using AnyDesk configured for Safe Mode, they mapped out a U.S. organization’s environment and loaded five known vulnerable drivers for kernel-level control. Cyware highlights how this operation’s network activity, including msrcontrib[.]com, signals a push for persistent, stealthy access.
Critical infrastructure faces immediate risk as hackers exploit a remote command-execution flaw in Zyxel GS1900 switches. With 996 devices across 48 countries already targeted, attackers are running commands as root over the internet, bypassing authentication. The initial patch failed to address the real issue, and Binarly researchers warn that only firmware released after October 22, 2026, offers effective protection.
State-backed espionage is escalating, with APT29 (Cozy Bear) hijacking trusted websites to spy on diplomatic delegations and high-profile guests. By injecting malicious JavaScript through compromised domains like america250[.]holiday, the group profiles visitors’ devices and seeks access to sensitive data. The campaign’s use of zero-click exploits and targeting of Ukraine’s president underscores the stakes for government and event security.
Top Malware Reported in the Last 24 Hours
Anubis ransomware crew plants Lindnor backdoor
Anubis ransomware operators hit a U.S. organization after deploying a custom backdoor, Backdoor.Lindnor, disguised as healthcontroller64.exe and svchelper.exe. Once running as a service, it phoned home with identifying system details—such as the computer and user names, OS version, and domain—so the attackers could map and control the environment before impact. The intruders also dropped at least 13 executables, including gbbsym.exe and symgooq.exe, to disrupt security services and used AnyDesk configured to run even in Safe Mode, increasing their ability to stay connected. In a sign of how aggressively they pushed for deep access, the campaign used a BYOVD approach by loading five known vulnerable drivers to reach kernel-level control, while the operation’s network activity included msrcontrib[.]com and cfgsync-relay.eastus.cloudapp.azure[.]com.
NIKKE launcher breach pushes K2F malware
NIKKE’s PC game launcher was compromised in a supply-chain attack that pushed malware designed to steal credentials and cryptocurrency wallet data. Attackers hid the malicious logic inside legitimate JavaScript files, using obfuscation to mask the infrastructure at insightjs[.]com and insightjs[.]org before pulling down additional payloads. The downloaded component installed a remote-access agent called K2F, which can run commands, take screenshots, and harvest credentials—turning a routine game update into a hands-on takeover risk for players. Developers confirmed script tampering on November 4, and while three replaced files were swapped back on November 3, a tampered copy of the fourth was still being served as of 22:26 GMT; investigators also pointed to a check for the string k2f_chan registered in Launcher/intl_service/debug.log as an on-host clue of compromise.
Marsalek infostealer hides inside game cheats
Marsalek Infostealer operated as a malware-as-a-service scheme by disguising payloads as game cheats for titles including Counter-Strike 2, Minecraft, and Grim Dawn. After infection, it goes after browser passwords and cookies, targets Chromium and Firefox data, and also hunts for cryptocurrency wallets and extensions—putting both accounts and funds at risk for victims who thought they were downloading mods. The operators expanded reach through multiple delivery paths, including PowerShell, fake CAPTCHA pages, Python scripts, and Windows executables, and it leaned on a CMSTP UAC bypass technique to escalate privileges. The campaign ran from December 2025 to May 2026 and primarily affected users in the United States, Germany, and the United Kingdom (along with India and Brazil), with reporting noting many customers were teenagers; activity to watch for included unexpected Python runtimes in user directories and cmstp.exe launched with the /au flag.
Top Vulnerabilities Reported in Last 24 hours
Hackers seize Zyxel switches as root
A critical remote command-execution flaw in Zyxel GS1900 switches (CVE-2026-107441) lets attackers run commands as root over the internet with no authentication, putting network infrastructure directly in an attacker’s hands. The weakness sits in the dispatcher.cgi web program, where an oversized request value in memory slot 139 can overwrite the counter and drive it negative, opening the door to arbitrary command execution. Attackers are already exploiting this in the wild, with GreyNoise reporting attacks against 996 switches across 48 countries. Researchers at Binarly tied the activity to a campaign using Gitea-linked tooling and the JITTERLY and SIXZUT malware families, and said the severity is higher than Zyxel’s initial assessment after Zyxel’s first patch proved ineffective due to misidentifying where the flaw lived in global memory. A fix is available in Zyxel firmware released on October 22, 2026 or newer.
APT bug turns updates into root code
A high-severity flaw in the APT package manager used by Debian and Ubuntu (CVE-2026-109518, CVSS 7.7) can let a man-in-the-middle attacker swap “verified” packages and execute code as root, effectively turning software updates into a takeover path. The issue can be triggered by manipulating HTTP traffic between APT and a package server, allowing the attacker’s content to be accepted under certain retry conditions. No active exploitation has been reported so far. The exposure is default on Debian 12 and Ubuntu 22.04 onward, while older releases like Debian 11 and Ubuntu 20.04 are only affected if the retry setting is enabled. Fixed versions of APT have been released.
Xen VM escape risk via memory access
Two critical flaws in the Xen hypervisor (CVE-2026-102703 and CVE-2026-102704) can let a malicious virtual machine read and write the memory of other VMs — including dom0 — raising the risk of host takeover in shared environments. The bugs sit in Xen’s grant copy operation, where a hostile guest can manipulate memory sharing so it accesses data it does not own. No active exploitation has been observed, and Xen’s advisory does not describe the access level required inside the attacking VM. The issues were discovered by Anthropic using its Claude model and validated by Stephan Lipp of Ada Logics. The affected scope is Xen 4.6 and later, while 4.5 and earlier are not vulnerable; patches are available for xen-unstable through Xen 4.19.x and for Xen 4.18.x to 4.17.x, but Xen 4.6 to 4.16 have no patches available.
Top Threat Actors Reported in Last 24 hours
APT29 hijacks websites to spy
APT29 (also tracked as Cozy Bear), a Kremlin-linked espionage group, was tied to a mobile targeting campaign aimed at diplomatic delegations and high-profile guests—including Ukraine’s president during his stay at Raffles London at The OWO. They abused the trust people place in event- and venue-adjacent websites by impersonating america250[.]org via a proxy domain, america250[.]holiday, and by compromising a Ukrainian web analytics service. Those footholds let them inject malicious JavaScript into legitimate web traffic, quietly profiling visitors’ devices and serving tailored payloads. For government delegations and their staff, the stakes are direct: the attackers sought access to browser cookies, Wi‑Fi passwords, and full mobile device data that could expose private communications and movement. The campaign used three zero-click exploit chains, including DarkSword, to hit outdated iOS and Android versions, according to reporting cited by Ars Technica.
TraderTraitor steals $6.34B from Binance
TraderTraitor, a North Korea-linked operation the FBI has publicly blamed for major crypto thefts, was attributed to the $6.34 billion Binance heist described by ReversingLabs. They built their access over months, starting in June 2026 with a compromised Homebrew installation and then using a fraudulent job interview in September to plant malicious code in a developer environment. The group moved laterally inside Binance on October 20, then escalated to a decisive blow when wallet infrastructure was compromised on October 29. For customers and exchanges, the immediate impact is financial loss and disrupted services, while the broader consequence is that day-to-day hiring and developer tooling can become the entry point for nation-state theft. ReversingLabs said the attackers also used a trojanized Terraform provider that hid malicious code inside legitimate software.
Storm-2603 abuses SharePoint for remote code
Storm-2603, a threat actor linked in reporting to exploitation of Microsoft SharePoint, used vulnerabilities CVE-2025-53770 and CVE-2025-53771 to reach remote code execution and push deeper into networks, according to Kaspersky’s Securelist. They reportedly began by using ONYPHE to fingerprint exposed systems before timing exploitation and post-exploitation activity across late December 2025. Once in, the group deployed a fileless webshell design where Prog.cs served as the entry point and G.cs coordinated execution and C2 communication from inside the IIS worker process, keeping persistence in memory. For organizations running SharePoint, that kind of access can translate into stolen data, privileged account compromise, and business disruption if attackers succeed in lateral movement. Securelist said the intrusion included attempts to deploy ransomware that were ultimately blocked by security measures.
Frequently Asked Questions
What is Backdoor.Lindnor? Anubis ransomware operators hit a U.S. organization after deploying a custom backdoor, Backdoor.Lindnor, disguised as healthcontroller64.exe and svchelper.exe. Once running as a service, it phoned home with identifying system details—such as the computer and user names, OS version, and domain—so the attackers could map and control the environment before impact.
What is K2F? NIKKE’s PC game launcher was compromised in a supply-chain attack that pushed malware designed to steal credentials and cryptocurrency wallet data. Attackers hid the malicious logic inside legitimate JavaScript files, using obfuscation to mask the infrastructure at insightjs[.]com and insightjs[.]org before pulling down additional payloads.
What is Marsalek Infostealer? Marsalek Infostealer operated as a malware-as-a-service scheme by disguising payloads as game cheats for titles including Counter-Strike 2, Minecraft, and Grim Dawn. After infection, it goes after browser passwords and cookies, targets Chromium and Firefox data, and also hunts for cryptocurrency wallets and extensions—putting both accounts and funds at risk for victims who thought they were downloading mods.
What is CVE-2026-107441? A critical remote command-execution flaw in Zyxel GS1900 switches (CVE-2026-107441) lets attackers run commands as root over the internet with no authentication, putting network infrastructure directly in an attacker’s hands. The weakness sits in the dispatcher.cgi web program, where an oversized request value in memory slot 139 can overwrite the counter and drive it negative, opening the door to arbitrary command execution.
What is CVE-2026-109518? A high-severity flaw in the APT package manager used by Debian and Ubuntu (CVE-2026-109518, CVSS 7.7) can let a man-in-the-middle attacker swap “verified” packages and execute code as root, effectively turning software updates into a takeover path. The issue can be triggered by manipulating HTTP traffic between APT and a package server, allowing the attacker’s content to be accepted under certain retry conditions.
What is CVE-2026-102703? Two critical flaws in the Xen hypervisor (CVE-2026-102703 and CVE-2026-102704) can let a malicious virtual machine read and write the memory of other VMs — including dom0 — raising the risk of host takeover in shared environments. The bugs sit in Xen’s grant copy operation, where a hostile guest can manipulate memory sharing so it accesses data it does not own.
What is APT29? APT29 (also tracked as Cozy Bear), a Kremlin-linked espionage group, was tied to a mobile targeting campaign aimed at diplomatic delegations and high-profile guests—including Ukraine’s president during his stay at Raffles London at The OWO. They abused the trust people place in event- and venue-adjacent websites by impersonating america250[.]org via a proxy domain, america250[.]holiday, and by compromising a Ukrainian web analytics service.
What is TraderTraitor? TraderTraitor, a North Korea-linked operation the FBI has publicly blamed for major crypto thefts, was attributed to the $6.34 billion Binance heist described by ReversingLabs. They built their access over months, starting in June 2026 with a compromised Homebrew installation and then using a fraudulent job interview in September to plant malicious code in a developer environment.
What is Storm-2603? Storm-2603, a threat actor linked in reporting to exploitation of Microsoft SharePoint, used vulnerabilities CVE-2025-53770 and CVE-2025-53771 to reach remote code execution and push deeper into networks, according to Kaspersky’s Securelist. They reportedly began by using ONYPHE to fingerprint exposed systems before timing exploitation and post-exploitation activity across late December 2025.