🕵️ RESEARCH & DEEP DIVES
FBI disrupts FAMOUS CHOLLIMA laptop farms used by North Korean IT workers, with CrowdStrike help
The FBI, assisted by CrowdStrike, disrupted U.S.-based laptop farms used by North Korea-linked FAMOUS CHOLLIMA operatives to fraudulently work remotely at American companies.- U.S. companies hiring remote IT workers were targeted by DPRK-nexus group FAMOUS CHOLLIMA, which used fraudulent or stolen identities to gain employment.
- Operatives relied on U.S.-based 'laptop farms' to receive and operate employer-issued laptops, concealing their true location and maintaining persistent access to victim organizations.
- Illicit wages were siphoned back to the North Korean regime, and operatives leveraged AI to create convincing fake identities.
- In late September 2026, CrowdStrike's Counter Adversary Operations team provided threat intelligence and technical analysis that helped the FBI disrupt several laptop farms.
- Coordinated FBI and Justice Department actions included charges against 14 individuals, two arrests, seizure of nearly 190 devices, and operations at more than 40 suspected laptop farms.
Doyensec Researchers Escape Windows VBS Enclave Isolation via Four-Byte Write and Timing Bug (CVE-2026-83498)
Doyensec researchers demonstrated running attacker-chosen code inside Windows' protected VBS enclave used for Enhanced Phishing Protection, a flaw Microsoft patched in September 2026.- Affects Windows 11 24H2 and 25H2 systems using the SFAPE.dll VBS enclave behind Enhanced Phishing Protection in Microsoft Defender SmartScreen, loaded by lsass.exe
- CVE-2026-83498 is a Critical elevation-of-privilege flaw (CVSS 7.8) allowing data leakage from or code execution inside a VBS enclave; Microsoft fixed it in the September 8, 2026 update KB5124008
- The attack requires local low-privileged code already running on the machine that calls the enclave; calling the enclave's Initialize function twice triggers a four-byte write that skips an address check, corrupting the enclave's memory-boundary value
- A timing bug in another function then triggers a controlled wipe, redirecting object lookups to gain read/write access and replace the table deciding which code the enclave may run
- Windows lacks a general blocklist for vulnerable enclaves; the new policy only blocks the old SFAPE file, leaving Microsoft Edge's vulnerable enclave (CVE-2023-36880) loadable for 'bring your own vulnerable enclave' evasion
Google Search malvertising pushes trojanized PuTTY installer with EtherHiding C2
Unit 42 identified a malvertising campaign delivering a trojanized PuTTY installer to IT admins via poisoned Google Search results.- Targets IT administrators searching Google for PuTTY, a popular SSH client used for remote access and system administration.
- Fake site puty[.]ink imitates the official PuTTY download page and serves a trojanized Putty-x86_64.msi from a Backblaze B2 bucket.
- The MSI runs a legitimate Sectigo-signed PuTTY 0.85 as a decoy while dropping an obfuscated Node.js loader via batch and JScript files.
- The loader resolves its C2 server through Ethereum smart contracts via seven public RPC services (EtherHiding), refreshing the address every five minutes.
- The operator pushes JavaScript for system recon, browser cookie theft, data exfiltration, and near-live screen streaming (~5 screenshots/second).
Sources 📄 Source: x.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)Ransomware Gangs Turn to Physical Threats, Family Stalking as Payment Rates Fall
Survey data and reporting indicate ransomware groups are increasingly threatening victims' employees and families with physical violence and intimidation.- Organizations worldwide are affected, with healthcare, education, and critical infrastructure singled out because disruption there creates immediate real-world pressure.
- Semperis's 2026 Ransomware Risk Report found 40% of organizations faced intimidation tied to ransomware attacks: 57% of threatened victims got threatening texts, letters, or packages, 37% saw threats against family or friends, 19% physical intrusion, 17% abduction threats, 13% bodily harm, and 6% stalking.
- 53% of survey respondents claimed attackers carried out their threats, though Dark Reading could not verify a single documented case of violence in service of a ransomware attack.
- Attackers harvest employees' personal data such as home addresses to intimidate victims, and often recruit third parties via message boards to carry out threats rather than getting their own hands dirty.
- FBI Internet Crime Report data shows complaints involving threats of violence rose 250% year over year, from 1,360 in 2024 to 4,826 in 2025.
🔓 CVEs & KEV
CVE-2026-88070 — Microsoft Windows 10 Version 1607 — CVSS 7.8 — Windows BitLocker Vulnerabilities Security Feature Bypass and Privilege Elevation Attacks
CVE-2026-85920 — Microsoft Windows 10 Version 1607 — CVSS 7.0 — Windows BitLocker Vulnerabilities Security Feature Bypass and Privilege Elevation Attacks
CVE-2026-83500 — Microsoft Windows 10 Version 1607 — CVSS 6.1 — Windows BitLocker Vulnerabilities Security Feature Bypass and Privilege Elevation Attacks