Summary
This week’s threat intelligence briefing from cyware.com reveals a surge in both the scale and sophistication of cyberattacks across ransomware, vulnerability exploitation, and state-linked threat actor operations. Ransomware groups have automated and diversified their tooling, while critical vulnerabilities in widely used infrastructure are being actively exploited. State-aligned actors have executed record-setting financial thefts and targeted espionage campaigns, often leveraging supply-chain and multi-stage attack chains. The convergence of these trends underscores the need for rapid patching, enhanced monitoring, and cross-sector vigilance as attackers increasingly blend automation, AI, and advanced exploitation techniques.
Top Malware Reported This Week
Qilin (Agenda) ransomware automates cross-platform attacks on enterprise sectors
Qilin (Agenda) ransomware is a cross-platform ransomware threat that has evolved from manual deployment to an automated, modular tool targeting healthcare, manufacturing, and technology sectors. Qilin uses automated Active Directory scanning, exploits the VMware ESXi platform, and leverages Windows API calls for lateral movement and defense evasion. Qilin’s execution lifecycle includes eight phases, such as privilege validation, hypervisor profiling, and anti-forensics, and employs AES-256-CTR or ChaCha20 encryption while skipping critical files to maintain system stability. Qilin spreads through automated exploitation of enterprise infrastructure, including Active Directory and ESXi environments. Qilin targets organizations globally across multiple enterprise sectors.
Implement network segmentation to limit lateral movement.
Monitor for unusual Active Directory queries and VMware ESXi activities.
Deploy endpoint detection systems to identify and block Qilin's known signatures.
Regularly back up data and test restoration processes to mitigate data loss.
Block IOCs and monitor for ransom note distribution across network printers.
Reference: https://www.seqrite.com/blog/the-evolution-of-qilin-agenda-a-comparative-reverse-engineering-analysis-of-qilin-agenda-ransomware-across-2026/
Nova ransomware expands RaaS operations with Rust-based encryptor
Nova ransomware, formerly known as RALord, is a financially motivated Ransomware-as-a-Service (RaaS) group that rebranded in April 2025 and expanded its affiliate program. Nova uses a Rust-based encryptor, employs PowerShell, registry changes, and service manipulation for defense evasion, and disables Microsoft Defender protections while clearing Windows Event Logs. Nova features multiple locker types for different privilege levels, a Linux variant, and a boot locker, using XChaCha20-Poly1305 for file encryption and RSA-2048 for key protection, and deletes Volume Shadow Copies to inhibit recovery. Nova gains initial access by exploiting weaknesses in victim environments, without targeting specific industries or regions. Nova has targeted 177 organizations across 45 countries and 10 industry sectors, with a surge of 74 claimed victims in three months.
Enforce multi-factor authentication on all VPN and RDP access, and disable internet-facing RDP where not required.
Maintain offline or immutable backups and test recovery procedures regularly.
Extend EDR coverage to Linux hosts and hypervisor management interfaces.
Alert on unauthorized changes to Microsoft Defender policy and bulk deletion of Volume Shadow Copies.
Enable tamper protection on endpoint security products and alert on attempts to disable them.
Maintain an allowlist of approved remote access software and alert on unauthorized installations.
Integrate Dark Web and threat intelligence monitoring to detect exposed credentials and access listings.
Reference: https://socradar.io/blog/dark-web-profile-nova-ransomware/
VOLTA infostealer leverages AI models for targeted data theft on Windows
VOLTA is a Windows infostealer that uses AI models such as anthropic/claude-opus-4.6, moonshotai/kimi-k2, and google/gemini-2.5-flash to profile victims and prioritize stolen data for monetization. VOLTA targets browser passwords, cookies, payment cards, cryptocurrency seed phrases, and data from applications like Discord, Telegram, and Slack, using a self-deleting mechanism and fallback routines to ensure continuous operation. VOLTA’s enrichment stage leverages Gmail searches and other applications to corroborate information, features a customizable builder, and encrypts customer-specific credentials using a key derived from executable constants. VOLTA is distributed through methods that enable it to automate identity enrichment and submit structured evidence bundles to AI models. VOLTA targets Windows systems globally, as identified by Cisco Talos researchers.
Monitor for unexpected processes launching Chrome with –headless to detect VOLTA's App-Bound Encryption bypass path.
Restrict unauthorized headless Chrome execution to disrupt collection techniques.
Preserve %APPDATA%\volta_debug.txt for forensic analysis.
Revoke exposed sessions and tokens, reset passwords, and migrate assets from compromised wallets.
Increase monitoring across EDR, SIEM, and network logs to detect anomalous behavior and unauthorized access.
Reference: https://gbhackers.com/volta-infostealer/
Mirax Android banking trojan abuses accessibility for remote fraud
Mirax is an Android banking trojan distributed via fake streaming apps, enabling attackers to remotely control devices and execute fraudulent transactions. Mirax uses advanced evasion techniques, including changing hosts, ports, and TLS settings, employs randomized package names and hidden launcher icons, and features a SOCKS5 module to convert infected devices into residential proxies. Mirax impersonates legitimate apps to gain Android Accessibility Service access, granting full device control and facilitating unauthorized transactions. Mirax spreads through low-reputation streaming apps that redirect users to download a dropper. Mirax has caused thousands of infections across the META region, with activity peaking during specific holidays and being advertised on Russian-language criminal forums.
Correlate active transactions with remote-control, screen-sharing, and accessibility-abuse signals to identify suspicious activity.
Block the identified IOCs and monitor for any related activity.
Educate users to reject accessibility requests from non-trusted apps and avoid installing apps from unverified sources.
Implement security measures to detect and block unauthorized access and transactions.
Reference: https://gbhackers.com/mirax-android-malware/
CWPdoor Linux backdoor targets web servers via trojanized CWP binaries
CWPdoor is a Linux backdoor distributed through a trojanized version of the CWP (CentOS Web Panel) web server, providing passive access to compromised systems. CWPdoor uses a trojanized 'cwpsrv' binary with zero detections, suppresses logs, and employs encrypted HTTP headers for command execution, using AES-256-CBC encryption for both commands and output. CWPdoor is activated by encrypted requests and ensures stealth by suppressing logs and using encrypted communication. CWPdoor is delivered via compromised CWP server binaries, often found alongside other Linux malware such as Ebury. CWPdoor targets Linux web servers, with over 340,000 CWP instances exposed on the public web.
Check for 'ngx_http_integrity_helper' Unix socket and suspicious 'cwpsrv' processes.
Look for 'X-Ngx-Integrity' strings in server binaries.
If compromised, replace the backdoored binary, upgrade to the latest version, and rotate credentials.
Investigate the host for additional malware.
Reference: https://www.bleepingcomputer.com/news/security/hackers-backdoor-linux-servers-using-trojanized-cwp-web-server/
Top Vulnerabilities Reported This Week
CVE-2026-98432 enables remote root code execution in Linux kernel via use-after-free flaw
CVE-2026-98432 is a critical race-condition-induced use-after-free vulnerability in the Linux kernel's IPv4 TCP networking stack, with a CVSS score of 9.8. CVE-2026-98432 allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting mishandling of IP options during TCP connection establishment, potentially leading to complete system compromise. CVE-2026-98432 is actively exploited in the wild, with Anthropic developing a working exploit and public criticism mounting over Ubuntu's delay in releasing a patch. Anthropic discovered CVE-2026-98432, and the NCSC has highlighted the rarity and danger of such remotely exploitable flaws. Mitigation steps include applying kernel updates (5.10.272, 5.15.223, 6.6.159, 6.1.190, 6.12.113, 6.18.56, 7.2.10, 7.3-rc7), using Red Hat's interim nftables rule to filter IPv4 packets containing IP options, and disabling MPTCP where possible. CVE-2026-98432 affects Linux kernel version 4.4 and later, with systems running MPTCP listeners at heightened risk.
Ivanti Connect Secure VPN servers targeted via authentication bypass, RCE, and privilege escalation vulnerabilities
Ivanti Connect Secure VPN servers are affected by three critical vulnerabilities: authentication bypass (CVE-2026-104935), remote code execution (CVE-2026-111357), and privilege escalation (CVE-2026-118527). Successful exploitation of these vulnerabilities allows attackers to gain full control over VPN servers, enabling code execution as root and compromising the underlying network. Attackers have actively exploited CVE-2026-104935 as the initial vector in an exploit chain, followed by CVE-2026-111357 and CVE-2026-118527, with incidents observed since October 3. Ivanti released patches for all three vulnerabilities, prioritizing CVE-2026-104935 due to its critical role in the attack sequence. Organizations are advised to apply the patches immediately, monitor network traffic for signs of exploitation, and enhance VPN server security configurations. CISA has directed U.S. government agencies to patch these vulnerabilities within three days.
CVE-2026-107441 exploited in Zyxel GS1900 switches using Python-based TFTP attack and malware deployment
CVE-2026-107441 is a critical remote code execution vulnerability in Zyxel GS1900 switches, allowing unauthenticated attackers to execute commands as root. CVE-2026-107441 enables remote attackers to compromise network integrity and access sensitive data by exploiting a memory overflow in the dispatcher.cgi web program, where a long value in slot 139 can overwrite a counter and trigger arbitrary command execution. CVE-2026-107441 has been actively exploited worldwide, with attackers using a Python script to retrieve and execute a collector script via TFTP, and deploying JITTERLY and SIXZUT malware as part of the campaign. Binarly assessed the severity of CVE-2026-107441 as higher than Zyxel's initial evaluation, and GreyNoise reported attacks on 996 switches across 48 countries. Administrators should update all Zyxel GS1900 switches to firmware released on October 22, 2026, or newer, remove web management interfaces from the internet, and rotate all passwords on potentially compromised devices.
Top Threat Actors Reported This Week
TraderTraitor orchestrates record $6.43 billion Binance heist and targets cryptocurrency and talent sectors
TraderTraitor (suspected North Korean state-linked) is primarily motivated by financial gain and has been attributed to the $6.43 billion cryptocurrency theft from Binance. TraderTraitor used AI-crafted recruitment-themed lures targeting individuals in cybersecurity, AI, blockchain, and talent recruitment sectors, and deployed trojanized Terraform providers to distribute malware. TraderTraitor leveraged a Bash loader to deliver the FLATROOF cross-platform implant, which steals sensitive data and deploys the ROOFDECK backdoor for remote control. TraderTraitor targeted cryptocurrency platforms including Binance, DMM Bitcoin, Bybit, KelpDAO, and Bitget, as well as developer environments. The Binance attack began in June 2026 with a compromised Homebrew installation, escalated in September via a fraudulent job interview, saw lateral movement by October 20, and culminated in the compromise of wallet infrastructure on October 29. On-chain analysis revealed the use of Tornado Cash and a sweeper contract to move funds, with $2.85 billion frozen by Tether, Circle, Ripple, Arbitrum, and Optimism, as reported by the FBI, U.S. Secret Service, and IRS-CI.
APT29 leverages n-day exploits in large-scale watering hole campaign targeting mobile devices
APT29 (suspected Russian state-affiliated, also known as Cozy Bear) is primarily engaged in cyber espionage and has launched a large-scale watering hole campaign targeting iOS and Android devices. APT29 used JavaScript injections on legitimate websites and adversary-in-the-middle-like domains to deliver the DarkSword iOS exploit chain, exploiting CVE-2025-43529 and CVE-2024-27834 in unpatched devices. APT29 deployed malware that exfiltrates cookies, Wi-Fi passwords, and full device data, with payloads tailored for both iOS and Android platforms. APT29 targeted regions including the United States, Ukraine, Czech Republic, and Bulgaria, focusing on organizations and individuals in these areas. The campaign involved a supply-chain attack on a Ukrainian web analytics service and coordination with CERTs to disrupt infrastructure and support victim identification. Researchers from SEKOIA observed the campaign and ongoing mitigation efforts.
Gorbag APT targets Ukrainian institutions with self-deleting malware and credential theft tools
Gorbag (aligned with Russian interests) is focused on wartime intelligence collection and has targeted Ukrainian courts, city councils, law enforcement, justice bodies, local administrations, and defense sector entities. Gorbag initially used spearphishing emails with macro-enabled Excel files and later shifted to RAR archives exploiting CVE-2025-8088, a WinRAR vulnerability, to achieve persistence and execution upon system restart. Gorbag deployed BeautyStealer to collect browser credentials, VPN configurations, and files with extensions such as .kdbx, .jks, .rdp, .pfx, and .zs2, and previously used Prime ReverseShell, which included misleading comments to evade AI detection. Gorbag focused attacks on regions near the front line in Ukraine, aligning with Russian operational priorities. The campaign has been active since February 2025, with malware designed to self-delete after execution to hinder forensic analysis. Researchers recommend updating WinRAR and monitoring for spearphishing activity.
Lazarus Group suspected in PHP2Shell vulnerability scanning across critical sectors
Lazarus Group (suspected North Korean state-linked) is believed to be conducting cyber espionage and infrastructure compromise operations by scanning for PHP2Shell vulnerabilities. Lazarus Group exploited memory corruption and use-after-free vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, enabling remote code execution. Lazarus Group used 21 compromised nodes to conduct low-volume scans, demonstrating operational restraint and separating scanning infrastructure from previously identified staging addresses. Lazarus Group targeted government, financial, manufacturing, logistics, and aviation sectors in the United States, Japan, South Korea, and other regions. Successful exploitation could result in credential theft, data collection, and persistent access to compromised systems. Researchers recommend immediate patching of affected PHP versions and enhanced monitoring for unusual PHP session behavior.
DarkBlinders conducts cyber espionage against Israeli and Iraqi Kurdish entities using advanced malware
DarkBlinders (aligned with Iranian interests) is engaged in cyber espionage and has targeted high-profile entities in Israel and the Kurdistan Region. DarkBlinders used spear-phishing and social engineering to deploy malware such as SHELBYLOADER and SHELBYC2, leveraging AppDomainManager injection and StarkMeet as a decoy application. DarkBlinders utilized GitHub for command-and-control and employed the Blackwood tunneling utility, with DLL sideloading to execute SHELBYC2 for data exfiltration and remote control. DarkBlinders focused on Israeli and Iraqi Kurdish organizations, with the Prince of Persia group hosting a C2 server in the U.S. for the first time in a decade, indicating a strategic shift. The campaign involved the use of domains such as gcc-sg[.]cloud and stark-meet[.]com to facilitate malware delivery and C2 operations.
Frequently Asked Questions
What is Qilin (Agenda)? Qilin (Agenda) ransomware is a cross-platform ransomware threat that has evolved from manual deployment to an automated, modular tool targeting healthcare, manufacturing, and technology sectors. Qilin uses automated Active Directory scanning, exploits the VMware ESXi platform, and leverages Windows API calls for lateral movement and defense evasion.
What is Nova? Nova ransomware, formerly known as RALord, is a financially motivated Ransomware-as-a-Service (RaaS) group that rebranded in April 2025 and expanded its affiliate program. Nova uses a Rust-based encryptor, employs PowerShell, registry changes, and service manipulation for defense evasion, and disables Microsoft Defender protections while clearing Windows Event Logs.
What is VOLTA? VOLTA is a Windows infostealer that uses AI models such as anthropic/claude-opus-4.6, moonshotai/kimi-k2, and google/gemini-2.5-flash to profile victims and prioritize stolen data for monetization. VOLTA targets browser passwords, cookies, payment cards, cryptocurrency seed phrases, and data from applications like Discord, Telegram, and Slack, using a self-deleting mechanism and fallback routines to ensure continuous operation.
What is Mirax? Mirax is an Android banking trojan distributed via fake streaming apps, enabling attackers to remotely control devices and execute fraudulent transactions. Mirax uses advanced evasion techniques, including changing hosts, ports, and TLS settings, employs randomized package names and hidden launcher icons, and features a SOCKS5 module to convert infected devices into residential proxies.
What is CVE-2026-98432? CVE-2026-98432 is a critical race-condition-induced use-after-free vulnerability in the Linux kernel's IPv4 TCP networking stack, with a CVSS score of 9.8. CVE-2026-98432 allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting mishandling of IP options during TCP connection establishment, potentially leading to complete system compromise.
What is CVE-2026-104935? Ivanti Connect Secure VPN servers are affected by three critical vulnerabilities: authentication bypass (CVE-2026-104935), remote code execution (CVE-2026-111357), and privilege escalation (CVE-2026-118527). Successful exploitation of these vulnerabilities allows attackers to gain full control over VPN servers, enabling code execution as root and compromising the underlying network.
What is CVE-2026-111357? Ivanti Connect Secure VPN servers are affected by three critical vulnerabilities: authentication bypass (CVE-2026-104935), remote code execution (CVE-2026-111357), and privilege escalation (CVE-2026-118527). Successful exploitation of these vulnerabilities allows attackers to gain full control over VPN servers, enabling code execution as root and compromising the underlying network.
What is CVE-2026-118527? Ivanti Connect Secure VPN servers are affected by three critical vulnerabilities: authentication bypass (CVE-2026-104935), remote code execution (CVE-2026-111357), and privilege escalation (CVE-2026-118527). Successful exploitation of these vulnerabilities allows attackers to gain full control over VPN servers, enabling code execution as root and compromising the underlying network.
What is CVE-2026-107441? CVE-2026-107441 is a critical remote code execution vulnerability in Zyxel GS1900 switches, allowing unauthenticated attackers to execute commands as root. CVE-2026-107441 enables remote attackers to compromise network integrity and access sensitive data by exploiting a memory overflow in the dispatcher.cgi web program, where a long value in slot 139 can overwrite a counter and trigger arbitrary command execution.
What is TraderTraitor? TraderTraitor (suspected North Korean state-linked) is primarily motivated by financial gain and has been attributed to the $6.43 billion cryptocurrency theft from Binance. TraderTraitor used AI-crafted recruitment-themed lures targeting individuals in cybersecurity, AI, blockchain, and talent recruitment sectors, and deployed trojanized Terraform providers to distribute malware.