💥 BREACHES & INCIDENTS
- Four crypto projects breached in September: Nostra, Neutron, Astroport/Drop, Duelbits lose millions
Four crypto projects — Nostra, Neutron (Astroport/DropDotMoney), and Duelbits — lost a combined ~$17 million to oracle manipulation, a governance takeover, and a suspected private key compromise.- Nostra (Starknet lending protocol) lost ~$3.5M after an attacker-seeded thin NSTR/SolvBTC pool fed a manipulated GeckoTerminal-derived quote into Pragma's oracle, inflating NSTR collateral ~8,306x to borrow ETH, STRK, USDC, USDT, WBTC, and DAI against ~$421 of real collateral.
- Pragma's aggregation used only two price sources (a clean AVNU quote near $0.006 and a poisoned one near $99), producing a ~$49.52 midpoint; a mandatory three-source minimum would have rejected the manipulated response.
- Neutron governance attack on September 22 drained ~$9.4M from Astroport and DropDotMoney contracts: a proposal disguised as AI governance research passed after the attacker bought 31.62M NTRN (~$20K) 11 minutes before the tally, exploiting wasmd's chain-level MsgUpdateAdmin to override app multisigs; ~$1.96M was already bridged out.
- Duelbits hot wallets on Ethereum, BSC, and Tron saw ~$4.2M in outflows (836 ETH, 1.62M USDT, 97K USDC, 209 BNB, 192K TRX) to newly created addresses in a suspected private key compromise, with most funds swapped to ETH.
- Stolen funds were laundered via Near Intents, CCTP, and LayerZero OFT off Starknet (Nostra), and spread across Neutron, Cosmos Hub, Noble, Axelar, dYdX, Osmosis, and Ethereum (Neutron attack).
🔓 CVEs & KEV
CVE-2026-97360 — rejetto hfs2 — CVSS 10.0 — HFS2 Unauthenticated Arbitrary File Access Leads to Full Host Compromise
CVE-2026-97359 — rejetto hfs2 — CVSS 10.0 — HFS2 Unauthenticated RCE via Filename Template Injection
CVE-2026-19072 — Rapid7 Velociraptor — CVSS 9.9 — Velociraptor API Authorization Bypass Enables Arbitrary VQL Execution as Administrator
CVE-2026-78308 — Deltaww DIAEnergie — CVSS 9.8 — DIAEnergie Authentication Bypass Enables Unauthenticated Administrative Access
🕵️ RESEARCH & DEEP DIVES
Konni-linked 'Operation Conflict Compass' uses fake PDF LNK lures to deploy VelvetCake downloader in Ukraine
SOCRadar has identified a Konni-linked campaign, Operation Conflict Compass, targeting Ukraine-focused organizations with fake PDF LNK files that deploy the VelvetCake downloader.- Targets people and organizations focused on Ukraine, likely in diplomacy, policy research, and NGOs; infrastructure active since August 2026, no verified victim count.
- VelvetCake malware collects system details, security software info, running processes, recent files, and screenshots, then exfiltrates files to attacker servers.
- Delivery via targeted emails with ZIP attachments containing LNK files disguised as PDFs on peace proposals, food prices, and researcher resumes; a modified video meeting installer was also observed.
- Opening the LNK launches PowerShell to fetch components, creates a scheduled task running every minute for persistence, and displays a decoy document; lures were hosted on a South Korean hosting service and a Ukrainian apparel website.
- IOCs include GitHub staging URLs (github.com/omskiwdcvoiuyfd0998), domain p1o2i3u4y5t6r7e8w9q0.medianewsonline.com, IP 111.92.246.145 (port 12345), and files update1.vbs, update1.ps1, update2.ps1.
Sources 📄 Source: socradar.io · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)Two Oxygen Forensics officers arrested for lying to US government about Russian ownership
Two corporate officers of Oxygen Forensics were arrested for allegedly concealing the firm's Russian ownership and Russian software development from US government customers.- Applies to US federal customers of Oxygen Forensics, including the Department of War, Secret Service/NCFI, DHS, IRS, US Army, and Justice Department.
- CEO Lee Reiber (arrested in Idaho) and Russian co-founder/CTO Oleg Davydov (arrested at Heathrow) are charged with conspiracy to commit wire fraud.
- After Russia's 2022 invasion of Ukraine, the firm renamed Oxygen Russia to MKO-Systems, removed Russian owners from filings, and moved build servers to US cloud infrastructure to hide Russian ties.
- Software continued to be developed by Russian programmers in Russia; Reiber allegedly falsely certified in 2024 that no foreign person controlled the company.
- No allegation of malicious code or unauthorized access; the charges focus on the deception itself. Oxygen's customers also include Russia's FSB and Ministry of Internal Affairs.
Hackers Use Forgotten M365 Service Accounts to Steal Data From Chilean Organizations
An unidentified threat actor breached Chilean organizations' Microsoft 365 environments via forgotten service accounts and exfiltrated data.- Targets were organizations in Chile: two major banks, a third financial institution, and a major Chilean retailer; Proofpoint tracks the actor as UNK_CondorFiltration.
- The compromised accounts were nonhuman functional/service accounts with no login history, no MFA, and likely default or shared credentials — six were taken over in seven minutes.
- The attacker used the open source TeamFiltration M365 hacking kit with credential spraying, account enumeration, and rotating infrastructure to avoid IP blocking.
- The campaign spanned more than 5,700 accounts across 28 M365 tenants without breaching a single employee account; only the overlooked service accounts fell.
- Using TeamFiltration's auto-exfiltration, the actor pulled emails, chats, and files from Outlook, Teams, and OneDrive, and in one case probed the VPN and accessed the M365 management, Azure, and SharePoint portals.
Rapid7 and Zimbra research uncovers 50+ vulnerabilities enabling BEC attacks that rewrite mail environments
Rapid7's collaborative research with Zimbra uncovered over 50 vulnerabilities that let attackers impersonate senders, control inbox visibility, and alter shared documents and calendars.- Applies to organizations running Zimbra Collaboration Suite, which has faced repeated exploitation of BEC-enabling bugs.
- Several of the 50+ vulnerabilities allow attackers to impersonate senders without credentials, control inbox visibility, and alter shared documents and calendars — going beyond passive mailbox monitoring.
- Recent exploited Zimbra bugs include CVE-2024-45519 (unauthenticated command injection in postjournal, added to KEV October 2024), CVE-2025-27915 (stored XSS via crafted .ICS attachments, used as a zero-day against Brazilian military targets, KEV October 2025), and CVE-2026-73570 (unauthenticated command injection via SNMP handling, KEV August 2026).
- Shadowserver has counted over 260 compromised Zimbra instances; CISA's July 2026 advisory (AA26-204A) details Russian state-supported 'LAUNDRY BEAR' exploiting CVE-2025-66376 via a view-based exploit that exfiltrates 90 days of email and the Global Address List.
- Earlier exploitation includes CVE-2022-27925 and CVE-2022-37042 (path traversal plus auth bypass dropping JSP shells) and CVE-2023-37580, used by four separate threat groups against government email systems.
📋 ADVISORIES
- FedRAMP VDR & VER rules mandate continuous vulnerability detection from December 7, 2026
FedRAMP's new VDR and VER rules make continuous vulnerability detection and response mandatory for all cloud service offerings starting December 7, 2026.- Applies to all cloud service offerings obtaining or maintaining FedRAMP certification; mandatory December 7, 2026, with a grace period through March 7, 2027 for offerings under a corrective action plan.
- Scan frequency now scales by certification class under VDR-TFR-PSD: machine-based resources scanned every 14 days (Class A), 7 days (Class B), 3 days (Class C), or daily (Class D); machine verification runs monthly for Rev5 and as often as every three days at 20x classes.
- Remediation deadlines under VDR-TFR-PVR are tiered by PAIN rating and exploitability, from 192 days down to 12 hours for extreme cases.
- VER-EVA-AIA requires providers to assume exploits are automatable by default unless evidence proves otherwise, and VDR-CSO-FAV requires failures in the detection/response process itself to be treated as vulnerabilities.
- The flat monthly scan-and-POA&M model is retired; POA&Ms are replaced with a list of Accepted Weaknesses, and FedRAMP 20x rules become mandatory for all stakeholders on January 1, 2027.