Summary
Attackers are scaling up extortion by automating data theft and encryption with AI-powered ransomware, as seen in the n0n campaign that hit organizations like Dediserve and Fanatics. Cyware highlights how this operation leverages credential stuffing and MITRE ATT&CK techniques to maximize disruption, leaving behind telltale files such as C:\Users\Public\n0n\ and .n0n extensions.
A persistent threat campaign is turning FreePBX phone systems into toll-fraud engines and credential theft platforms. INJ3CTOR3 exploits vulnerabilities in Asterisk-based platforms, using obfuscated webshells and encoding tricks to maintain access, exposing businesses to ongoing risk and unexpected charges.
A critical SQL injection flaw in Oracle E-Business Suite (CVE-2026-101767, CVSS 9.8) is under active attack, allowing remote code execution without authentication. Horizon3.ai and Defused observed attackers probing this vulnerability as early as October 27, with Oracle issuing a fix in its October CPU.
A suspected China-linked group used AI tools like ARTEX and Claude Code to breach 123 Reg, exposing customer account data including names, phone numbers, and preferences. The attack, traced to infrastructure in China and Singapore, prompted notifications to regulators and links to similar incidents in South Korea.
Top Malware Reported in the Last 24 Hours
n0n ransomware scales extortion with AI
n0n is a ransomware operation that is scaling up with an AI-assisted workflow, using automated tooling to speed up data theft and extortion. It uses credential stuffing to break in, then carries out data exfiltration and encryption to maximize pressure on victims. Researchers tying the campaign to an exposed server setup said its activity maps to MITRE ATT&CK techniques such as T1595.001 and T1078, reflecting reconnaissance and account misuse. The same analysis points defenders to behavioral signs including the creation of specific files and registry keys, such as the C:\Users\Public\n0n\ directory and files ending in .n0n. The group’s recent timeline (September 17 to October 22, 2026) includes incidents involving Dediserve, Inter, Fanatics, and ChiBiTek, where impacted organizations face operational disruption and the added fallout of sensitive data being pulled out before systems are locked.
INJ3CTOR3 keeps FreePBX systems exposed
INJ3CTOR3 is a long-running campaign targeting Asterisk-based phone platforms such as FreePBX, turning compromised systems into toll-fraud engines and, more recently, credential-theft beachheads. It gets in by exploiting vulnerabilities in FreePBX instances, then maintains access using cron jobs alongside obfuscated webshells that can be difficult to spot. To stay hidden, it uses techniques like base64 and ROT13 encoding and leverages .htaccess rules to conceal malicious files. Researchers say the implant now uploads SIP trunk credentials, which means attackers can place calls from anywhere even after a superficial cleanup. For businesses, the consequence is twofold: unexpected calling charges and the ongoing risk that phone infrastructure remains quietly accessible to outsiders.
Yoba malware piggybacks on fake AI
Yoba is a malware campaign that hijacks the hype around AI tools by planting lookalike GitHub projects for fake apps such as “GPT-5.6 Sol” and “GPT-6 Astra,” then tricking users into installing trojanized downloads. It relies on DLL sideloading with legitimate signed executables, helping the payload blend in as it deploys supporting components like droppers and loaders. Check Point researchers describe strong operational security around the campaign, including communications or infrastructure that touches Telegram, Tor, Catbox, and DNS over HTTPS. It also uses anti-analysis measures such as DJB2 hashing, language checks, and payload deployment via scheduled tasks to frustrate investigation. For victims, the practical impact is that a seemingly harmless download for an “AI helper” can become a foothold for unwanted software and follow-on compromise.
Top Vulnerabilities Reported in Last 24 hours
Hackers probe new Oracle EBS flaw
A critical unauthenticated SQL injection flaw in Oracle E-Business Suite’s Application Object Library (CVE-2026-101767, CVSS 9.8) can be used to reach remote code execution, potentially handing attackers full control of the affected EBS component. In practical terms, this puts core business systems at risk of takeover over HTTP without a login, turning a public-facing foothold into deeper access. Attackers are already probing this in the wild, with first attempts recorded on October 27. Horizon3.ai reported the vulnerability, and Defused said its decoys observed exploratory exploit activity. A fix is available in Oracle’s October CPU.
ShinyHunters hits Oracle PeopleSoft zero-day
A zero-day chain in Oracle PeopleSoft (CVE-2026-35273) was exploited to achieve remote code execution, enabling unauthenticated attackers to take over affected servers over the network. The reported attack path centers on SSRF in the Integration Gateway (PSIGW), using the loopback address and the allowedhosts.properties trust mechanism to reach the Environment Management Hub (PSEMHUB). Attackers exploited this as a zero-day before Oracle released a patch, and reporting describes a renewed wave of attacks. The Hacker News linked the activity to ShinyHunters, with targeting spanning education, technology, healthcare, and government. A fix is available via Oracle’s security alert, and if patching is not possible Oracle advises disabling the Environment Management Hub service or removing the PSEMHUB application.
Adobe Commerce stores exposed to uploads
CISA added a critical Adobe Commerce and Magento vulnerability (CVE-2026-48356, CVSS 9.3) to its Known Exploited Vulnerabilities catalog after reports of ongoing exploitation affecting online stores. The issue is described as an unauthorized file upload weakness that can be abused to gain elevated access or control over victim accounts, a scenario that can quickly turn into fraud, data theft, or extortion pressure for impacted merchants. Attackers are already exploiting this in the wild. According to the report, at least 953 online stores are affected. Federal agencies have a required remediation deadline of October 29, 2026 under BOD 22-01.
Top Threat Actors Reported in Last 24 hours
Suspected China-linked hackers hit 123 Reg
123 Reg has disclosed an AI-driven cyberattack that exposed customer account data, and the company said the activity is suspected to have a China nexus. The incident, dated September 18, 2026, compromised details including names, phone numbers, countries, language and currency preferences, account creation dates, and marketing preferences. The company said the attackers used AI tools including ARTEX and Claude Code, with supporting infrastructure hosted in China and Singapore. For customers, the immediate risk is that these personal and account-profile details can be reused for scams or convincing impersonation attempts that appear to come from the registrar. 123 Reg said it reported the incident to law enforcement, worked with Singapore-based ISPs to shut down attacker servers, and sent notifications to the FTC and data protection authorities in the UK and EU, while also linking the activity to similar breaches involving South Korean financial institutions.
AIA0009 and AIA0010 hijack Cairn AI panels
Attackers tracked as AIA0009 and AIA0010 compromised 17 Cairn AI penetration-testing panels by abusing unauthenticated administrative access, turning tooling meant for security testing into a beachhead for theft and malware delivery. The campaigns intensified around October 20, 2026, and the reporting notes there is no confirmed link between the two clusters. After gaining control, they directed agents to run commands that enumerated environment variables, listening ports, configuration files, and potential secrets, including AI model API credentials, then installed attacker-controlled SSH keys and checked Linux capabilities for possible container escape paths. For teams relying on these panels—whether for legitimate testing or otherwise—the impact is that credentials and internal access could be exposed through a system many would inherently trust. The intrusions also involved deploying the Poseidon Go-based implant via a Base64-encoded shell script, with communications described as running through a Bunny.net CDN.
ShinyHunters exploits Oracle PeopleSoft zero-day
ShinyHunters, a financially motivated threat actor, was reported exploiting a zero-day in Oracle PeopleSoft to remotely take over unpatched servers and set the stage for follow-on extortion. The bug, tracked as CVE-2026-35273, affects PeopleSoft Enterprise PeopleTools 8.61 and 8.62 and was abused before Oracle released a fix. The campaign targeted organizations across education, technology, healthcare, and government, raising the risk of service disruption and exposure of sensitive data in environments often tied to HR and core administrative workflows. The report describes the exploit chain as an SSRF leading to RCE, with observed approaches that could plant web shells and enable ongoing access even after initial compromise. A renewed wave of attacks was reported after the patch release, suggesting attackers moved quickly to find lagging deployments.
Frequently Asked Questions
What is n0n? n0n is a ransomware operation that is scaling up with an AI-assisted workflow, using automated tooling to speed up data theft and extortion. It uses credential stuffing to break in, then carries out data exfiltration and encryption to maximize pressure on victims.
What is INJ3CTOR3? INJ3CTOR3 is a long-running campaign targeting Asterisk-based phone platforms such as FreePBX, turning compromised systems into toll-fraud engines and, more recently, credential-theft beachheads. It gets in by exploiting vulnerabilities in FreePBX instances, then maintains access using cron jobs alongside obfuscated webshells that can be difficult to spot.
What is Yoba? Yoba is a malware campaign that hijacks the hype around AI tools by planting lookalike GitHub projects for fake apps such as “GPT-5.6 Sol” and “GPT-6 Astra,” then tricking users into installing trojanized downloads. It relies on DLL sideloading with legitimate signed executables, helping the payload blend in as it deploys supporting components like droppers and loaders.
What is CVE-2026-101767? A critical unauthenticated SQL injection flaw in Oracle E-Business Suite’s Application Object Library (CVE-2026-101767, CVSS 9.8) can be used to reach remote code execution, potentially handing attackers full control of the affected EBS component. In practical terms, this puts core business systems at risk of takeover over HTTP without a login, turning a public-facing foothold into deeper access.
What is CVE-2026-35273? A zero-day chain in Oracle PeopleSoft (CVE-2026-35273) was exploited to achieve remote code execution, enabling unauthenticated attackers to take over affected servers over the network. The reported attack path centers on SSRF in the Integration Gateway (PSIGW), using the loopback address and the allowedhosts.properties trust mechanism to reach the Environment Management Hub (PSEMHUB).
What is CVE-2026-48356? CISA added a critical Adobe Commerce and Magento vulnerability (CVE-2026-48356, CVSS 9.3) to its Known Exploited Vulnerabilities catalog after reports of ongoing exploitation affecting online stores. The issue is described as an unauthorized file upload weakness that can be abused to gain elevated access or control over victim accounts, a scenario that can quickly turn into fraud, data theft, or extortion pressure for impacted merchants.
What is 123 Reg? 123 Reg has disclosed an AI-driven cyberattack that exposed customer account data, and the company said the activity is suspected to have a China nexus. The incident, dated September 18, 2026, compromised details including names, phone numbers, countries, language and currency preferences, account creation dates, and marketing preferences.
What is AIA0009? Attackers tracked as AIA0009 and AIA0010 compromised 17 Cairn AI penetration-testing panels by abusing unauthenticated administrative access, turning tooling meant for security testing into a beachhead for theft and malware delivery. The campaigns intensified around October 20, 2026, and the reporting notes there is no confirmed link between the two clusters.
What is ShinyHunters? ShinyHunters, a financially motivated threat actor, was reported exploiting a zero-day in Oracle PeopleSoft to remotely take over unpatched servers and set the stage for follow-on extortion. The bug, tracked as CVE-2026-35273, affects PeopleSoft Enterprise PeopleTools 8.61 and 8.62 and was abused before Oracle released a fix.