🚨 ACTIVE EXPLOITATION
US, Japan, Germany, Australia warn North Korean WaterPlum hackers pose as employers to steal crypto, data
US and allied agencies warn that North Korea's WaterPlum group has posed as prospective employers to infect over 30,000 devices and steal cryptocurrency.- Targets software developers and IT professionals worldwide, especially in the US, Japan and Europe
- WaterPlum (Contagious Interview), tied to the 313 General Bureau of the Munitions Industry Department, impersonates AI, cryptocurrency and NFT companies and uses recruiting services to deliver attacks
- More than 30,000 devices infected across 100+ countries; nearly $11 million in cryptocurrency transferred from over 7,000 wallets to North Korea
- Some WaterPlum actors also work as North Korean IT workers, sharing IP addresses via laptop farms and cloud-sourcing services
- Japanese authorities dismantled a laptop farm for the first time; the alert coincides with a Multilateral Sanctions Monitoring Team report
CISA adds Linux Kernel AF_ALG race condition (CVE-2025-39964) to KEV catalog
CVE-2025-39964
CISA has added a Linux Kernel AF_ALG socket race condition vulnerability (CVE-2025-39964) to its KEV catalog.- Applies to organizations running Linux Kernel, with federal agencies required to patch by 2026-09-21 under BOD 26-04
- Concurrent writes to the same AF_ALG socket cause data to be unpredictably interleaved and create inconsistencies in the socket's internal state
- CISA's Known Exploited Vulnerabilities entry requires applying vendor mitigations or discontinuing use of the product
Linux Kernel ebtables SNAT out-of-bounds write added to CISA KEV (CVE-2026-53266)
CVE-2026-53266
CISA has added CVE-2026-53266, an out-of-bounds write in the Linux Kernel ebtables SNAT target, to its Known Exploited Vulnerabilities catalog.- Affects Linux Kernel deployments using the ebtables SNAT target; some impacted products may be end-of-life or end-of-service.
- Out-of-bounds write lets an ARP sender hardware address rewrite write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page.
- Due date for required action per CISA BOD 26-04 guidance: 2026-09-21.
Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer and EDR killer
A malware campaign uses SEO-optimized fake GitHub repositories impersonating LastPass and 39 other companies to distribute the previously undocumented Rapuncel infostealer.- Targets users searching for LastPass Authenticator and other popular software; campaign impersonates LastPass and at least 39 other software firms
- Victims get ZIP archives (inflated up to 148MB to evade scans) via redirect chains; the installer is a renamed Microsoft Visual Studio CoreCLR Debugger (vsdbg.exe) that sideloads a malicious vsdbg.dll
- Deploys Rapuncel plus Alinubx.sys, a Microsoft-signed kernel driver disguised as NVIDIA's nvfsflt64.sys that kills 145 antivirus/EDR products and bypasses Protected Process Light
- Rapuncel steals credentials from 25 browsers (bypassing Chrome/Edge app-bound encryption via DLL injection), 30 crypto wallets, Discord/Steam/Telegram sessions, Credential Manager, and sensitive documents
- Stolen data is uploaded to 2.26.126[.]50 over raw TCP; malware persists via a Windows service and is assessed as a variant of BoryptGrab
New Settra ransomware variant hits retail and manufacturing firms, researchers warn
Huntress and MoxFive report a new Settra ransomware variant deployed in recent attacks against US organizations.- Affects organizations with exploitable weaknesses such as unpatched systems, weak access management, or VPN exposure; victims include a consumer services/retail firm (July) and a manufacturing firm (September).
- Settra uses compromised VPN credentials for initial access and posts victims on its leak/shaming site.
- Attackers deploy MeshAgent RMM tool for persistence, renamed mvtcs.exe pointing to a command-and-control address, before launching a ransomware executable named after the victim's domain.
- Evasion tactics include the BYOVD vulnerable-driver technique against security tools, clearing Windows Event Logs, disabling Windows Recovery Environment, and removing the recovery partition.
- Huntress described the attackers as 'capable rather than sophisticated,' using established ransomware tradecraft.
💥 BREACHES & INCIDENTS
- UPDATE: Gyazo breach exposes 23.6 million user records via exploited server vulnerability
The Gyazo screenshot-sharing platform confirmed a breach in which hackers exploited a server vulnerability to steal 23.6 million user records.- Affects Gyazo users worldwide — a cloud-based screenshot/screen-recording tool by Helpfeel popular in gaming communities, with ~23 million users.
- Attackers exploited a server vulnerability on September 11, 2026 to access Gyazo's database, stealing 23.62 million user records including emails, password hashes, session IDs, and X integration tokens.
- The incident also exposed 490 million image metadata records, mostly from uploads before January 2019, including upload IP addresses, EXIF location data, OCR text, and hashed passphrases for private images.
- Hackers obtained a list identifying private images, and Gyazo cannot rule out that some were viewed; the service has been temporarily suspended for maintenance.
- Gyazo detected the activity September 12, fixed the vulnerability, and is investigating with external experts; no data deletion or impact on its other Helpfeel and Cosense services was found.
🔓 CVEs & KEV
- CVE-2026-93603 — patriksimek vm2 — CVSS 10.0 — vm2 Critical Sandbox Escape to RCE (CVE-2026-93603)
🕵️ RESEARCH & DEEP DIVES
- Undercover Google Mandiant analyst infiltrated TeamPCP hackers behind supply chain attack spree
Google's threat intelligence unit had an undercover analyst inside the TeamPCP cybercrime group as it carried out an unprecedented software supply chain hacking spree.- Affected: developers and companies relying on open source packages, including victims like OpenAI, the European Commission, GitHub data contractor Mercor, AWS and Microsoft customers.
- TeamPCP tainted hundreds of open-source programs (Trivy, LiteLLM, Checkmarx infrastructure, TanStack, Mistral AI), stole developer credentials, and used the Mini Shai-Hulud worm, breaching over a thousand companies.
- A Mandiant undercover persona was added to the group's ~12-member core chat (CanisterWorm) from nearly day one, observing operations and stolen credential troves.
- Google had stolen credentials revoked by contacting providers like AWS and Microsoft and sent hundreds of victim notifications to disrupt TeamPCP's extortion.
- Google also intercepted an AI-developed zero-day 2FA bypass exploit, alerted the vendor to patch it, and passed opsec leads on members Ruben Ian Thomson and Louis Michael Gaebler—arrested in Australia—to law enforcement, aided by intel from rival group ShinyHunters.
Sources 📎 Coverage: wired.com · 👁 via @metacurity@infosec.exchange, @agreenberg@infosec.exchange (+2)
📋 ADVISORIES
- MoveIT Transfer September patch fixes serious security issues without CVEs or advisories
Progress has quietly patched serious security issues in MoveIT Transfer without issuing CVEs or advisories.- Applies to organizations running MoveIT Transfer.
- The September update patches serious security issues, but no CVEs or advisories have been published.
- Fixed versions are 2025.1.6 and 2026.0.4.