💥 BREACHES & INCIDENTS
- OpenAI engineer arrested after hidden recording device found in executive conference room
An OpenAI engineer was arrested by the FBI for allegedly planting a hidden audio recording device in an executive conference room.- Saudi national Abdulrahman Alfozan, 35, an OpenAI engineer since July 2025, was arrested October 9 and charged with illegally intercepting oral communications.
- The device was found September 30 concealed in toilet paper and plugged into a USB port behind a TV in a conference room used for confidential discussions of proprietary research, product plans, and government engagements.
- The device, installed around September 28, contained encrypted data; a second similar recording device was found in a bag Alfozan left unattended.
- A chatbot account linked to Alfozan's spouse submitted prompts about building, concealing, and remotely accessing recording devices, including the device's custom header and MAC address.
- OpenAI used its own AI models to trace the device to the employee; no exfiltration of model weights, source code, or customer data was found.
Sources 📄 Source: justice.gov · 📎 Coverage: bleepingcomputer.com · 👁 via SecurityWeek, BleepingComputer (+1)
🕵️ RESEARCH & DEEP DIVES
DOJ charges 14 in North Korean remote IT worker scheme, seizes 187 computers
The Justice Department charged 14 people and seized roughly 187 computers in Operation Lonestar Roundup targeting a North Korean remote IT worker scheme.- Applies to U.S. companies employing remote IT workers; more than 70 employers were infiltrated from 2019 through 2025.
- North Korean operatives used stolen or fabricated identities to hold remote jobs and collected about $3 million funneled back to Pyongyang.
- U.S. facilitators ran 'laptop farms' — including two dozen laptops kept online by an Ohio resident — installing remote-access software and moving over $320,000 through accounts under false names.
- Two U.S. citizens, Michael James Bostelle and Juan Cecilio Pena Carrillo, were arrested; searches hit more than 40 Texas residences, and false records were filed with DHS, IRS and SSA in the names of over 25 identity theft victims.
- Per CrowdStrike, the group (Famous Chollina) has spoofed device identifiers to make video capture cards appear as webcams since May, and now pays U.S. citizens to appear in interviews or hires freelancers in Pakistan, India and Nigeria to do the work.
Hardware hacker found implants in Trezor wallets despite company's 'no compromise' claim
Hardware hacker Joe Grand found implants in two Trezor devices and reported them to Trezor in August, contradicting the company's public claim that none of its devices were compromised.- Trezor One and Trezor Model T wallets purchased from unauthorized third-party sellers (Facebook Marketplace in Canada, a TikTok shop) were found with hardware implants; Trezor says no authorized-channel devices were compromised.
- Attackers replaced the devices' microcontrollers with chips generating one of ~a dozen pre-determined recovery seed phrases, letting them drain victims' crypto accounts; one victim lost about $50.
- Because Trezor's code is open source, attackers modified it and programmed it into unsecured replacement chips; a modified external microSD card held legitimate firmware to pass integrity checks.
- The implants differ from Ledger's, which record seed phrases on-screen and exfiltrate them over LTE via eSIM; Ledger confirmed such implants in wallets sold by reseller CryptoBilis, with ~$86 million in suspected thefts traced.
- Trezor is ending reseller authorizations on January 1, 2027 as a preventive step; Kaspersky previously found a similar implanted Trezor sold on a Russian marketplace in 2022-2023.
North Korean TA406/Kimsuky phishes Ukrainian government for war intelligence
North Korean state-sponsored hackers are spear-phishing Ukrainian government, policy, and academic targets to gather intelligence on the Russia-Ukraine war.- Targets include Ukrainian government agencies, think tanks, foreign affairs and security experts, and academic circles.
- TA406 (Konni/Opal Sleet) and Kimsuky-linked activity seeks intel on North Korean troop casualties, POW handling, and Ukraine's war trajectory.
- Attackers use reply-baiting freemail emails impersonating think tank fellows or conference organizers, with lures based on Ukrainian political events.
- Victims are sent MEGA-hosted password-protected RAR archives or LNK files disguised as PDFs (.pdf.lnk) that run PowerShell for host reconnaissance.
- Persistence via scheduled tasks posing as Windows updates; infrastructure includes hxxp://pokijhgcfsdfghnj.mywebcommunity[.]org and jetmf[.]com.
Unit 42: Unsophisticated attacker breached European bank via misconfigured third-party VPN gateway
Unit 42 details how an opportunistic attacker accessed a European bank through a poorly configured third-party gateway and was stopped before gaining persistence.- A European bank's central IT system was targeted after unauthorized VPN-based access attempts spanning several months were detected.
- The intrusion originated through a third-party-managed external gateway appliance not enforcing strict authentication, using compromised credentials.
- The attacker ran noisy host and network scans across thousands of systems, brute-forced administrator accounts, and scraped internal documentation and data shares.
- The intruder attempted to exploit a WSUS remote code execution vulnerability on the bank's central configuration management server; Cortex XDR contained the attempt before privilege escalation.
- Forensic review found no persistent backdoors, and the bank rotated all compromised credentials.
- The case highlights gaps like missing MFA on VPNs and unpatched edge devices as entry points for opportunistic attackers.
🔓 CVEs & KEV
CVE-2026-84790 — OpenVPN — CVSS 7.6 — OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to imperso...
CVE-2026-77207 — The Libreswan Project libreswan — CVSS 7.5 — Null Pointer Dereference in PKCS#7 bundle with no certificatesLibreswan has a...
CVE-2026-77206 — The Libreswan Project libreswan — CVSS 7.5 — IKEv2 pre-authentication Null Pointer Dereference in EAP codeLibreswan's IKEv...
CVE-2026-94453 — The Libreswan Project libreswan — CVSS 7.5 — IKEv2 Use-After-Free bug when using IKE-over-TCPLibreswan's pluto daemon has ...
CVE-2026-88964 — OpenVPN — CVSS 7.1 — An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows a...
CVE-2026-105390 — OpenVPN ovpn-dco-win — CVSS 6.9 — Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6...
CVE-2026-53563 — Citrix UniconOS — CVSS 6.9 — Persistent Command ExecutionVulnerability in Citrix UniconOS leading to Persi...
CVE-2026-84419 — Citrix Workspace app for Windows — CVSS 6.8 — Out-of-Bounds WriteOut-of-bounds write vulnerability in Citrix Workspace app ...
📋 ADVISORIES
- 📄 Source for Critical Ghostscript flaw CVE-2026-39919 enables RCE via crafted PDF uploads — cve.org