🚨 ACTIVE EXPLOITATION
- Kiteworks warns of imminent zero-day attack; researcher urges taking servers offline
Kiteworks has warned customers of an imminent zero-day extortion attack, prompting researcher Kevin Beaumont to urge taking Kiteworks servers offline.- Kiteworks (formerly Accellion) customers are exposed, including government agencies, law firms, and enterprises like Pfizer, IRS, CDC, Kirkland & Ellis, and Abbott.
- A zero-day vulnerability is reportedly about to be exploited by an extortion group; Kiteworks urged customers to shut down servers temporarily.
- Kiteworks was previously hit hard by the Cl0p extortion group's Accellion zero-day attacks, prompting its rebrand.
- Over 2,600 internet-facing Kiteworks instances can be found via Shodan favicon hash -1215318992, including FedRAMP and government systems.
- Beaumont recommends monitoring outbound network traffic from Kiteworks boxes for very high volumes indicating mass data exfiltration.
Sources 📄 Source: cyberplace.social · 📎 Coverage: heise.de · 👁 via @GossiTheDog@cyberplace.social (+3)
💥 BREACHES & INCIDENTS
- Bitget confirms $351.6 million hot wallet breach, North Korean hackers suspected
Crypto exchange Bitget suffered a $351.6 million theft from its hot wallets, with North Korean hackers suspected.- Bitget users of its centralized exchange custodial hot wallets are affected; cold wallets and the separate self-custodial Bitget Wallet product were not affected.
- Approximately $351.6 million in Ether, USDT, USDC, AVAX, and BNB was moved via unauthorized transfers to a fresh address, which began swapping funds onchain.
- The attacker compromised a critical backend system in Bitget's wallet infrastructure, spoofed transaction data, and invoked the authorization process to move funds; private keys were not compromised.
- Transfers were detected at 6:31 p.m. UTC on Sept. 24, 2026; withdrawals are suspended, deposits and trading remain available, and the loss falls within Bitget's $464 million User Protection Fund.
- Mandiant and SlowMist are assisting the investigation, law enforcement has been notified, and North Korean hackers are suspected.
🕵️ RESEARCH & DEEP DIVES
- Kosovar Owner of Rydox Cybercrime Marketplace Pleads Guilty in US Court
Ardit Kutleshi, the Kosovar creator of the Rydox cybercrime marketplace, has pleaded guilty in a US court.- Ardit Kutleshi, 28, pleaded guilty to identity theft and money laundering conspiracy charges for creating and operating the Rydox marketplace; he was arrested in December 2024 and extradited to the US.
- Rydox, disrupted in December 2024 with its Rydox.cc domain and servers seized along with roughly $225,000 in cryptocurrency, hosted over 321,000 cybercrime products and had about 18,000 users.
- Listings included stolen PII, payment card data, account credentials, Social Security numbers, phishing kits, stealer logs, and spamming tools.
- More than 7,600 transactions occurred between 2016 and 2024, generating at least $232,000 in revenue; Kutleshi faces two mandatory years for aggravated identity theft and up to 20 years for money laundering, with sentencing set for February 9, 2027.
📋 ADVISORIES
CISA's 2026 Election Infrastructure Security Plan flags patching barriers, voter database attacks
CISA has published its 2026 Election Infrastructure Security Plan describing cyber and physical threats to election systems.- Applies to state, local, tribal and territorial election offices and the 10,000+ local jurisdictions managing US elections.
- Certification ecosystem constraints limit vendors' ability to release patches and system owners' ability to apply them quickly; SLTT offices often struggle with basic cyber hygiene.
- Election infrastructure is often reachable from enterprise networks, letting attackers who compromise email or workstations move laterally.
- Hackers have attempted to breach voter registration systems in all 50 states, with confirmed success in at least 20 states; insider risk spans staff, volunteers, contractors and vendors.
- For 2026, CISA offers a no-cost information-sharing platform plus free scanning, penetration testing, assessments, and decoy/canary services; 96 of 107 election-related incidents since January 2022 were bomb threats.
📄 Source for WordPress Comment2Shell PoC turns anonymous comments into admin webshell via CVE-2026-93485 — github.com
📄 Source for ServiceNow patches five AI Platform flaws, including critical SQL injection and authorization bypasses — support.servicenow.com