Summary
Attackers are slashing through corporate defenses with a wave of ransomware that locks systems, wipes backups, and disables security tools—Nova Ransomware alone has hit 177 organizations across 45 countries, with 74 new victims in just three months. Cyware spotlights how this Rust-based operation is scaling up its affiliate program and targeting enterprises worldwide.
A critical OpenSSH flaw is letting intruders bypass passwords entirely on Linux systems using musl libc, exposing distributions like Alpine Linux and OpenWRT to real-world attacks. With active exploitation already underway and a fix only just released, defenders are racing to patch and monitor for unauthorized logins before automated tools find more targets.
Everyday websites are being weaponized to silently steal data from outdated iPhones and Android devices, as APT29’s latest campaign leverages injected JavaScript and hijacked analytics scripts. By chaining exploits for Chrome, Qualcomm drivers, and Apple’s pointer authentication, the group is putting corporate accounts at risk whenever employees use personal phones for work.
Top Malware Reported in the Last 24 Hours
Dark Project ransomware spreads via affiliates
Dark Project is a financially motivated ransomware operation that pairs encryption with data theft, then pressures victims by threatening to leak stolen files. It breaks in through phishing, exposed RDP, compromised credentials, and VPN access, giving the crew multiple paths into the same kinds of environments. The group runs a ransomware-as-a-service setup, where affiliates handle deployments while operators manage negotiations, and it recruits partners via Tox contact followed by vetting, onboarding, and assigning a partner identifier. Healthcare and manufacturing organizations are the primary targets, meaning disruptions can quickly spill into patient care or production downtime. The crew has claimed either 38 or 40 victims across eight countries: the US (30), the UK (2), and Germany, Brazil, the Philippines, Turkey, Mexico, and Canada (1 each).
Nova ransomware rebrands and scales up
Nova Ransomware (formerly RALord) is a financially motivated ransomware-as-a-service group that rebranded in April 2025 while keeping prior victim listings and expanding its affiliate program. It uses a Rust-based encryptor and leans on PowerShell, registry changes, and service manipulation to evade defenses and complicate incident response. For victims, the immediate impact is locked systems and business interruption, with added pain when it disables Microsoft Defender protections, stops security services, and clears Windows Event Logs to hinder investigation. It also deletes Volume Shadow Copies, reducing the chances of straightforward recovery, and encrypts files with XChaCha20-Poly1305 while protecting keys with RSA-2048. Between April 2025 and July 2026, it claimed 177 targeted organizations across 45 countries, including a surge of 74 victims in three months in mid-2026.
CWPdoor backdoor rides trojanized web server
CWPdoor is a new Linux backdoor hidden inside a trojanized version of the CWP web server (CentOS Web Panel), a control panel used to administer web hosting much like cPanel or Plesk. It keeps a low profile by acting as a passive implant that only responds to specially crafted, encrypted requests, helping attackers maintain quiet access to servers. XLab researchers discovered it on June 29, and they found it packaged alongside the long-running Ebury backdoor, hinting at a broader compromise ecosystem around Linux hosting infrastructure. For hosting providers and businesses running exposed admin panels, the consequence can be persistent, hard-to-spot server access that enables follow-on theft or service disruption. It uses AES-256-CBC to encrypt commands and output, and reported on-host artifacts include an `ngx_http_integrity_helper` Unix socket and `X-Ngx-Integrity` strings in server binaries; over 340,000 CWP instances have been exposed on the public web.
Top Vulnerabilities Reported in Last 24 hours
OpenSSH bug lets attackers bypass logins
A critical OpenSSH vulnerability nicknamed sshole can let attackers log into certain accounts without a real password on Linux systems that use musl libc, exposing distributions including Alpine Linux, OpenWRT, Buildroot, and Yocto. Under the specific conditions of musl libc without PAM, PasswordAuthentication yes, and the presence of a salt donor account, an attacker can authenticate to an account whose shadow password field is "*" by sending a password longer than 256 characters (between 257 and 1024 bytes). Attackers are already exploiting this in the wild. Researcher Kevin Beaumont reported active exploitation, and OpenSSH developer Damien Miller highlighted the urgency of shipping a fix given the risk of automated discovery by AI agents. A fix is available in OpenSSH 10.6p2; Alpine Linux also urged disabling password logins where updates aren’t possible and monitoring for unauthorized access attempts.
Firecracker microVM escape reaches host root
A VM-escape flaw in Firecracker microVMs (CVE-2026-99999) shows how an attacker inside a guest can break out and execute code as root on the host under a narrow but high-impact setup. The published proof of concept targets Firecracker v1.16.1 on x86-64 and works by manipulating a vCPU thread’s saved register frame so that when the thread returns from KVM_RUN (via the KVM_RUN ioctl), execution is redirected to an attacker-chosen call. A working proof of concept has been released, and it requires Firecracker to be running as root without a jailer. The technique was documented by pwn.ai, which demonstrated control by redirecting execution to write a string to stderr from the host process context. Recommended mitigations in the report include deploying Firecracker with a jailer, keeping systems updated with the latest security patches, and monitoring for unusual activity.
Top Threat Actors Reported in Last 24 hours
APT29 booby-traps websites for mobile theft
APT29 (also tracked as Cozy Bear) is being linked to a campaign dubbed Poisoned Source that turns everyday websites into silent data-stealing traps for outdated iPhones and Android phones. After a vulnerable device visits a compromised site, they use injected JavaScript and hijacked analytics tooling (including the Plerdy script) to trigger exploitation with no user interaction. The activity is tied to exploit chains described as the DarkSword exploit kit for iOS and an AndroSnitch Android payload, aiming to steal passwords, browser cookies, messages, and other sensitive information. That puts employees who use personal phones to access work accounts at risk of account takeover and corporate data exposure. The report cites CVE-2026-3910 (Google Chrome), CVE-2025-27038 (Qualcomm graphics drivers), and CVE-2024-27834 (an Apple Pointer Authentication bypass), affecting iOS 16.7 and 18.5 and Chrome for Android 139–145 (excluding 143).
Nova ransomware expands after RALord rebrand
Nova Ransomware (formerly known as RALord) is a financially motivated Ransomware-as-a-Service group that rebranded in April 2025 and carried its victim listings into an expanded affiliate program. Since then, they have claimed attacks on 177 organizations across 45 countries and 10 sectors, with a mid-2026 surge that included 74 victims in just three months. For victims, the immediate consequence is operational shutdown paired with pressure from data theft and encryption, with recovery made harder by their attempts to disable Microsoft Defender, stop security services, and clear Windows Event Logs. Their tooling includes multiple “locker” types for different privilege levels, plus a Linux variant and a boot locker, reflecting an operation built to travel across mixed enterprise environments. The encryptor uses XChaCha20-Poly1305 for file encryption and RSA-2048 for key protection, and it deletes Volume Shadow Copies to blunt recovery options. SOCRadar’s profile highlights common defensive themes organizations are leaning on in response, including MFA for VPN/RDP, offline or immutable backups, and extending EDR coverage to Linux hosts.
Fake OpenAI and SpaceX invites steal logins
A phishing campaign built around fake event invitations using brands like OpenAI and SpaceX is targeting corporate Microsoft and Google accounts, using polished registration pages to push victims into signing in. The operators rely on phishing-as-a-service tooling—Kali365 for device-code phishing against Microsoft accounts and VoidProxy as an adversary-in-the-middle to intercept Google sign-ins—then hide behind Cloudflare CAPTCHA, URL shorteners, and redirection chains. For businesses, the risk is straightforward: a single employee lured by an event like “ChatGPT for Social & Digital Marketing Teams” can hand attackers access to mailboxes, files, and downstream cloud apps tied to those identities. Researchers also point to shared infrastructure between phishing kits ZoomMock and MSDRoot, suggesting coordination across campaigns rather than isolated scams. BleepingComputer reports defenders are responding by limiting device code authentication where it isn’t needed and moving users toward phishing-resistant MFA such as FIDO2 security keys.
Frequently Asked Questions
What is Dark Project? Dark Project is a financially motivated ransomware operation that pairs encryption with data theft, then pressures victims by threatening to leak stolen files. It breaks in through phishing, exposed RDP, compromised credentials, and VPN access, giving the crew multiple paths into the same kinds of environments.
What is Nova Ransomware? Nova Ransomware (formerly RALord) is a financially motivated ransomware-as-a-service group that rebranded in April 2025 while keeping prior victim listings and expanding its affiliate program. It uses a Rust-based encryptor and leans on PowerShell, registry changes, and service manipulation to evade defenses and complicate incident response.
What is CWPdoor? CWPdoor is a new Linux backdoor hidden inside a trojanized version of the CWP web server (CentOS Web Panel), a control panel used to administer web hosting much like cPanel or Plesk. It keeps a low profile by acting as a passive implant that only responds to specially crafted, encrypted requests, helping attackers maintain quiet access to servers.
What is OpenSSH? A critical OpenSSH vulnerability nicknamed sshole can let attackers log into certain accounts without a real password on Linux systems that use musl libc, exposing distributions including Alpine Linux, OpenWRT, Buildroot, and Yocto. Under the specific conditions of musl libc without PAM, PasswordAuthentication yes, and the presence of a salt donor account, an attacker can authenticate to an account whose shadow password field is "*" by sending a password longer than 256 characters (between 257 and 1024 bytes).
What is CVE-2026-99999? A VM-escape flaw in Firecracker microVMs (CVE-2026-99999) shows how an attacker inside a guest can break out and execute code as root on the host under a narrow but high-impact setup. The published proof of concept targets Firecracker v1.16.1 on x86-64 and works by manipulating a vCPU thread’s saved register frame so that when the thread returns from KVM_RUN (via the KVM_RUN ioctl), execution is redirected to an attacker-chosen call.
What is APT29? APT29 (also tracked as Cozy Bear) is being linked to a campaign dubbed Poisoned Source that turns everyday websites into silent data-stealing traps for outdated iPhones and Android phones. After a vulnerable device visits a compromised site, they use injected JavaScript and hijacked analytics tooling (including the Plerdy script) to trigger exploitation with no user interaction.
What is Nova Ransomware? Nova Ransomware (formerly known as RALord) is a financially motivated Ransomware-as-a-Service group that rebranded in April 2025 and carried its victim listings into an expanded affiliate program. Since then, they have claimed attacks on 177 organizations across 45 countries and 10 sectors, with a mid-2026 surge that included 74 victims in just three months.
What is OpenAI? A phishing campaign built around fake event invitations using brands like OpenAI and SpaceX is targeting corporate Microsoft and Google accounts, using polished registration pages to push victims into signing in. The operators rely on phishing-as-a-service tooling—Kali365 for device-code phishing against Microsoft accounts and VoidProxy as an adversary-in-the-middle to intercept Google sign-ins—then hide behind Cloudflare CAPTCHA, URL shorteners, and redirection chains.