📋 ADVISORIES
US Treasury sanctions 10 tied to Tren de Aragua ATM jackpotting scheme behind $40.7M in losses
The U.S. Treasury sanctioned a Tren de Aragua network accused of ATM jackpotting attacks linked to $40.73 million in losses across 1,500+ incidents.- Applies to U.S. banks and ATM operators; attacks targeted ATMs, often in remote areas, with losses of $40.73 million across more than 1,500 incidents as of August 2025.
- OFAC designated eight individuals and two Mexico-based companies, plus a TdA leader tied to illicit gold mining, and added seven TRON addresses to the SDN List.
- The scheme uses malware (linked by DOJ to the Ploutus family) to force ATMs to dispense cash; attackers physically open the ATM, connect a laptop, install the malware, and activate it remotely.
- Principal target Anibal Alexander Canelon Aguirre ('Prometheus'), alleged malware developer, is on the FBI's Ten Most Wanted list; proceeds were laundered via cryptocurrency and Mexican companies.
- TRM Labs found the seven sanctioned TRON addresses received ~$6.1 million since March 2022; all are exchange-hosted deposit addresses.
Android 17 Advanced Protection restricts AccessibilityService to verified Accessibility Tools
Google announced that Android 17's Advanced Protection mode restricts accessibility services to verified Accessibility Tools to block malware abuse.- Applies to Android 17 devices with Advanced Protection enabled; USB Protection and Failed Authentication Lock only on select devices (USB Protection on Pixel 6+).
- The AccessibilityService API, a main conduit for banking trojans and spyware, is restricted to verified apps categorized as Accessibility Tools like screen readers and Braille support.
- Malware abuses accessibility access to initiate fraudulent transfers, log keystrokes, overlay fake login screens, and block uninstallation after social-engineering users into enabling it.
- Android 17 also adds Intrusion Logging, USB Protection, WebGPU disabling, Failed Authentication Lock, and a View Supporting Apps transparency page.
- Non-assistive apps like AppBlock, automation tools, and password managers lose accessibility access and may lose functionality under the restriction.
📄 Source for Fortinet warns of critical FortiMail zero-day CVE-2026-104286 exploited in the wild, no patch yet — cisa.gov
🕵️ RESEARCH & DEEP DIVES
- Risky Bulletin: KillSec dismantled, Germany suspends 9.3k scam numbers, Cisco SD-WAN zero-day
Catalin Cimpanu's Risky Bulletin news roundup covers law enforcement action against KillSec and a range of new malware, zero-day, and espionage stories.- Applies to security teams tracking ransomware, APT, and cybercrime activity across Europe, SE Asia, and beyond.
- Authorities dismantled the KillSec group and arrested members across Europe; Montenegro extradited an Iranian APT member; the US sanctioned Venezuelan ATM hackers.
- New threats include a Cisco SD-WAN zero-day, Zammad zero-days behind the DIVD hack, a Zimbra bug exploited in the wild, the DirtyBlanket npm worm, new DragonForce backdoors, and a Milk Dragon PhaaS platform.
- Other items: Germany suspended 9,300 scam phone numbers, the SleepyDuck campaign returned, UAT-11587 targets SE Asia, half a million credentials remain on GitHub, and AI agents leak business secrets through images.
- Morocco reportedly used telecoms to deploy spyware, and a ransomware attack could have crippled South Africa's air traffic.
🔓 CVEs & KEV
CVE-2026-63569 — Legion of the Bouncy Castle Inc. bc-csharp — CVSS 9.1 — MTI/A0 DHAgreement does not validate the peer's ephemeral valueImproper input...
CVE-2026-17507 — Legion of the Bouncy Castle Inc. BC-JAVA — CVSS 8.7 — MLS membership checks compare a uint32 leaf_index as signed, admitting an out...
CVE-2026-103604 — Legion of the Bouncy Castle Inc. bc-csharp — CVSS 8.7 — Quadratic-time escaping when converting X.509 distinguished names to stringsI...
CVE-2026-103603 — Legion of the Bouncy Castle Inc. bc-csharp — CVSS 8.7 — Unbounded HSS public key level count allows huge array allocation during sign...
CVE-2026-103600 — Legion of the Bouncy Castle Inc. bc-csharp — CVSS 8.7 — Unbounded ASN.1 nesting depth causes process-terminating stack overflowUncont...
CVE-2026-63574 — Legion of the Bouncy Castle Inc. bc-csharp — CVSS 8.7 — Unbounded allocation from OpenPGP signature and user attribute subpacket leng...
CVE-2026-63571 — Legion of the Bouncy Castle Inc. bc-csharp — CVSS 8.7 — Attribute certificate path validation does not verify the attribute certifica...
CVE-2026-63568 — Legion of the Bouncy Castle Inc. bc-csharp — CVSS 8.7 — Unbounded CMP/CRMF password-based MAC iteration count allows CPU exhaustionAl...
CVE-2026-63566 — Legion of the Bouncy Castle Inc. bc-csharp — CVSS 8.7 — DTLS handshake reassembler allocates buffer from unchecked 24-bit lengthMemor...
CVE-2026-103602 — Legion of the Bouncy Castle Inc. bc-csharp — CVSS 8.2 — Name constraints bypass via trailing dot in rfc822Name, dNSName and URI hosts...
CVE-2026-103601 — Legion of the Bouncy Castle Inc. bc-csharp — CVSS 8.2 — CcmBlockCipher and KCcmBlockCipher leave unverified plaintext in the output b...
CVE-2026-63577 — Legion of the Bouncy Castle Inc. bc-csharp — CVSS 8.2 — Name Constraints bypass: directoryName constraint matched at any position in ...
CVE-2026-63576 — Legion of the Bouncy Castle Inc. bc-csharp — CVSS 8.2 — URI name constraints checked against a mis-parsed hostImproper certificate va...
CVE-2026-63573 — Legion of the Bouncy Castle Inc. bc-csharp — CVSS 8.2 — Bleichenbacher padding oracle in CMS RSA PKCS#1 v1.5 key-transport unwrapObse...
CVE-2026-63567 — Legion of the Bouncy Castle Inc. bc-csharp — CVSS 8.2 — IesEngine block-cipher mode checks padding before MAC (CBC padding oracle)Obs...
CVE-2026-63578 — Legion of the Bouncy Castle Inc. bc-csharp — CVSS 7.1 — Unbounded PBE iteration count when decrypting PKCS#8 private keysAllocation o...
CVE-2026-63575 — Legion of the Bouncy Castle Inc. bc-csharp — CVSS 7.1 — PKCS#12 key derivation loops about 2^32 times on a zero or negative iteration...
CVE-2026-63572 — Legion of the Bouncy Castle Inc. bc-csharp — CVSS 7.1 — Unbounded MAC and bag-decryption iteration counts when loading PKCS#12 filesA...
CVE-2026-63570 — Legion of the Bouncy Castle Inc. bc-csharp — CVSS 7.1 — Pkcs12Store.GetCertificateChain loops forever on cyclic issuer linksLoop with...