🚨 ACTIVE EXPLOITATION
- FBI warns FortiBleed credential-harvesting campaign compromised 86,644 Fortinet devices
The FBI and Secret Service warn the FortiBleed credential-harvesting campaign remains active against internet-facing Fortinet FortiGate firewalls and SSL VPN gateways.- Targets are internet-facing Fortinet FortiGate firewalls and SSL VPN gateways; over 86,644 devices across 194 countries have been compromised, with more than half in India, the US, Taiwan, Mexico and Turkey.
- The campaign exploits reused or leaked credentials, credential stuffing, password spraying, and legacy SHA-256 password storage rather than a software vulnerability; FortiOS versions older than 7.6.1, 7.4.8 and 7.2.11 stored admin credentials with weaker SHA-256 hashing.
- Attackers use a Golang-based tool called FortigateSniffer to passively intercept authentication traffic across 24 protocols, then crack password hashes offline on a GPU-accelerated cluster using Hashmat and Hashtopolis.
- The suspected initial access broker creates new admin accounts for persistence and in some cases deletes or changes original administrator passwords, locking victims out of their own devices; access has been linked to INC, Lynx and Payload ransomware operations.
- IOCs include C2 at 45.154.12.132, proxy IPs 154.202.59.169 and 103.27.186.156, and suspicious accounts such as forticloud-sync, fgtsecure, forti_support2 and Technical_support.
💥 BREACHES & INCIDENTS
Southern Company breach exposes data of ~400,000 Georgia Power and Alabama Power customers
An unauthorized third party accessed utility account information for roughly 400,000 Southern Company customers through its online customer portal.- Affects customers of Southern Company subsidiaries Georgia Power (~300,000 accounts), Alabama Power (~100,000 of 1.6 million accounts), and Mississippi Power (figure undisclosed)
- Exposed data includes names, mailing addresses, phone numbers, email addresses, last 4 digits of Social Security numbers, and other basic account details; bank account numbers, payment card numbers, and driver's license numbers were not accessed
- The attacker gained access via Southern Company's online customer portal; the company has not disclosed when the intrusion occurred or how access was obtained
- Southern Company detected suspicious portal activity, stopped the access, engaged law enforcement, and says it found no evidence of ongoing unauthorized access
- Affected customers are being notified by mail and email and offered one year of free credit monitoring through Equifax
Hackers Breach Yoido Full Gospel and Sarang Churches, Exposing Data of Over 1 Million People
Hackers breached two major South Korean churches, exposing more than one million congregant records and financial and administrative data.- Affects Yoido Full Gospel Church and Sarang Community Church in Seoul; Yoido estimates personal data of 850,000 members may have been leaked, and Oasis Security found ~960,000 member records and ~330,000 donation records tied to one church and ~89,000 member records plus 286 staff records tied to the other.
- Stolen data includes names, resident registration numbers, dates of birth, donation and accounting files, 68,000 electronic approval documents, 14,706 internal messenger conversations, and employee records — about 47.3 GB across 13,939 files staged on a compromised MinIO bucket.
- At the first church, attackers planted a web shell (codex_x.aspx) in the ERP system, reversed application files to decrypt database settings, gained Microsoft SQL Server admin access, and used xp_cmdshell to move across linked systems, reaching MariaDB and NAS backup storage via hardcoded credentials.
- At the second church, attackers used leaked credentials and IDOR flaws in groupware (EKP) and SIMS services to view other users' plaintext PINs, reset a manager-privileged account, and reach the ERP via single sign-on.
- Oasis Security recovered tooling and stolen data from attacker server 192.3.239.164 between August 28 and September 1, 2026; some infrastructure may have been reused from a breach of a U.S. religious streaming service, though the same actors are not confirmed.
🔓 CVEs & KEV
CVE-2026-107194 — Sungrow iSolarCloud — CVSS 9.2 — Sungrow iSolarCloud before 2026 allows authentication bypass and account take...
CVE-2026-107181 — Telegram Desktop — CVSS 8.6 — Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via inte...
CVE-2026-106510 — backstage — CVSS 7.7 — Backstage: Remote code execution via crafted markdown_extensions in TechDocs ...
🕵️ RESEARCH & DEEP DIVES
PoeLLM botnet hijacks 3,400+ exposed AI servers for cryptomining, hides C2 in GitHub poem
Lumen's Black Lotus Labs reports the PoeLLM malware has compromised thousands of internet-exposed AI and developer servers since April, using a poem on GitHub to conceal its C2 addresses.- Targets organizations running internet-exposed AI and developer tools — LiteLLM, Ollama, Gotenberg, Gitea — plus signs of Ivanti Sentry targeting, mainly in the US and Western Europe.
- More than 3,400 servers compromised since April 2026, with up to 800 infected systems active in a single day; compromised hosts mine cryptocurrency via XMRig and Iron miners and communicate with the Russian mining service Kryptex.
- The malware (ELF file named libgcrypt) extracts four words from a poem, 'On the Nature of Connection,' in a dash.css file in a GitHub repo appearing to fork Node.js, mapping them via a hard-coded dictionary to build the C2 IPv4 address; editing the poem rotates C2 without updating the malware.
- Infected servers scan ports 3000 and 4000 and attempt exploitation of CVE-2026-42271 (LiteLLM MCP server test endpoints), which Horizon3 showed can chain with CVE-2026-48710 (Starlette Host-header bypass) for unauthenticated RCE; LiteLLM 1.74.2–1.83.6 with vulnerable Starlette versions are affected.
- The malware includes remote-shell functionality; Black Lotus Labs assesses with moderate confidence the operator is Italian, based on code comments and Italy-based infrastructure.
CyberXero IAB pairs Claude Code, PentAGI and Cobalt Strike in AI-augmented attacks on WordPress sites and Ukrainian energy
SOCRadar documented CyberXero, a Russian-speaking initial access broker using AI agents to mass-exploit WordPress sites and target Ukrainian energy infrastructure.- Targets: WordPress and e-commerce sites worldwide, plus Ukrainian energy and utility organizations; 40+ organizations affected globally, including Poland, China and Pakistan.
- Impact: 628,000+ Ukrainians' confirmed data in the actor's possession; a Kharkiv district heating provider lost 564,073 subscriber records; one automated run scanned 4,708 targets and placed 32 webshells in 61 seconds.
- Tooling: up to 51 Claude Code agents for discovery, password testing, exploitation and data theft; PentAGI connected to a Cobalt Strike Team Server via an AI provider API with task-based model/token budgets.
- Delivery: internal wp2shell package abused the WordPress REST API batch endpoint for SQL injection, rogue admin creation and WSO webshell install; Magento targeted and Support Board CVE-2026-4815 exploited within 30 days of disclosure.
- Discovery: an exposed open directory leaked 90,000+ files including AI session logs, plaintext tokens and stolen data; infrastructure first observed July 2026 across European hosting and Tencent Cloud; IOCs include 42.193.227.214 (Cobalt Strike/PentAGI) and SHA-256 92a789444708fa1cb4cc5a89e0aa6cc7a279b62a7b8a4d2857255a18197d0090 (stager3).
Earth Sirrush Uses PNG Steganography and Malicious Notepad++ Plugins in Espionage Against Ukraine
Russia-aligned Earth Sirrush has run sustained espionage campaigns against Ukrainian organizations since 2022, evolving tooling that now hides malware in PNG images and malicious Notepad++ plugins.- Targets Ukrainian government agencies, defense organizations, border guards, and logistics operators; overlaps with CERT-UA's UAC-0099 (previously SHADOW-EARTH-065).
- Uses 10+ malware families across PowerShell, Go, and .NET, including the undocumented ASHVEIN stealer/RAT ('TelemetryBrowser') that steals browser credentials, captures screenshots, and runs remote PowerShell.
- Delivery via spear-phishing, malicious archives, HTA files, exploitation of WinRAR CVE-2023-38831, DLL sideloading, VHD containers, and droppers like AnswerFromPolice impersonating Ukraine's National Police.
- 2026 campaigns (CINDERBLOT/BadPaw, drone-parts supplier lure) hid payloads in PNG images including KittyCat.png, extracted via PowerShell from appended or pixel data; July 2026 chain used the LUNCHPOKE malicious Notepad++ plugin with renamed schtasks.exe.
- C2 infrastructure relies on Regery.com registrations, Cloudflare fronting, and backend IPs in AS399629; ESET assesses UAC-0099 may have provided Sandworm initial access.
Russia-aligned Earth Sirrush uses PNG steganography, Notepad++ plugins and 10+ malware families to spy on Ukraine
TrendAI researchers linked four years of Earth Sirrush espionage campaigns against Ukrainian government, defense, border security, and logistics organizations to more than ten evolving malware families.- Targets Ukrainian government agencies, defense organizations, border guards, and logistics operators since at least 2022; overlaps with CERT-UA's UAC-0099 (previously SHADOW-EARTH