BAE Systems incident halts US bankruptcy court notices nationwide

💥 BREACHES & INCIDENTS

• BAE Systems security incident halts bankruptcy notices from US courts nationwide
  A cybersecurity incident at BAE Systems has knocked out the Bankruptcy Noticing Center, halting bankruptcy notices nationwide since October 9.
  • Affects all US federal bankruptcy courts, which rely on the BAE-operated Bankruptcy Noticing Center (BNC) for notice production and delivery
  • BAE Systems' IT and BNC websites, including bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov, and the National Creditor Registration Service, are offline
  • No paper or electronic notices have been delivered since October 9; BAE first reported the problem to the Administrative Office of the US Courts late that day
  • Electronic filing notifications to attorneys, trustees and the US Trustee continue, and courts still accept filings and open new cases
  • Neither BAE nor the judiciary has disclosed the cause, whether it was an attack, or whether data was compromised; no restoration date announced
  Sources 📎 Coverage: securityweek.com · 👁 via SecurityWeek, CyberScoop

🔓 CVEs & KEV

• CVE-2026-108082 — sensiolabs symfony — CVSS 8.7 — Symfony ReDoS. One request. Seconds of CPU

• CVE-2026-110806 — Devolutions Server — CVSS 6.5 — Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0...

🕵️ RESEARCH & DEEP DIVES

• 37-Year-Old OpenBSD Kernel Flaws Chained in PoC Exploit to Gain Root Access
  Researchers at Calif published a proof-of-concept exploit chaining two OpenBSD kernel flaws to gain root access.

  • Affects OpenBSD systems running System V shared memory; OpenBSD 7.9 errata 018 and 026 fix the flaws for all architectures, with syspatch binaries for amd64, i386 and arm64.
  • A signed 16-bit shared memory attachment counter (shm_nattch), dating back ~37 years to original BSD code, overflows past 32,767 and wraps negative, enabling a race condition leading to kernel use-after-free.
  • A second flaw provides a conditional out-of-bounds write into struct ip_moptions via IP_MULTICAST_TTL, letting the exploit overwrite kernel pointers and open a root shell.
  • The exploit maps 127 shared memory segments, forks 259 processes, races IPC_RMID against segment attach, and uses sysctl(KERN_MALLOCSTATS) for heap shaping; it bypassed KARL, SMAP and SMEP without a separate info leak.
  • Local privilege escalation only; no active real-world exploitation reported. PoC source is public in Calif's MAD Bugs GitHub repository.
  Sources 📄 Source: github.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

• AI-Generated Scripts Used to Hijack Linux Sudo and Steal Passwords in Govt Espionage Campaign
  Unit 42 tracked an AI-assisted espionage campaign that hijacked Linux sudo via .bashrc tampering to steal credentials from government infrastructure.

  • Targets government entities and state-affiliated Linux infrastructure; activity tracked as CL-UNK-1211, observed October 2025–April 2026.
  • Attackers replaced users' .bashrc with a malicious sudo alias that mimics the password prompt, logs entered passwords to a file named Solarwinds.StatusLog.txt, then passes them to the real sudo command.
  • Payloads contained conversational AI-generated comments, Base64-encoded commands, and code switching between PHP, JavaScript, Bash and Python; initial access via custom and open-source web shells with persistence through modified auto_prepend_file PHP settings.
  • Toolkit includes a custom Go-based cross-platform RAT (SysGoRAT, default C2 104.194.158[.]65:443), credential harvesting from PHP login pages and config files, mailbox and database exfiltration, and defense evasion such as log deletion and fake red-team markers (RedTeamOps2025, pentest123).
  • IOCs include SHA-256 hashes for web shells, a GSocket reverse shell, CVE-2025-55182 scanners, and IPs such as 45.88.188[.]140 and 198.23.185[.]234.
  Sources 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News

• AI-powered CL-UNK-1211 campaign hijacks Linux sudo via .bashrc to steal passwords
  Unit 42 tracked an AI-assisted espionage campaign, CL-UNK-1211, that hijacked sudo on government Linux servers to steal administrator passwords.

  • Targets government entities and state-affiliated Linux infrastructure; activity observed October 2025 through April 2026, tracked by Unit 42 as CL-UNK-1211.
  • Attackers replaced users' .bashrc with a copy containing a malicious sudo alias that shows a fake password prompt, logs the password, and passes it to the real sudo command.
  • Stolen passwords were saved to a file named Solarwinds.StatusLog.txt as camouflage; no SolarWinds compromise was involved.
  • Toolkit included custom and open-source web shells, PHP auto_prepend_file persistence, the Go-based SysGoRAT backdoor (C2 at 104.194.158[.]65:443 over WebSocket), systemd/cron persistence, and mailbox and database theft.
  • Scripts contained AI-style conversational comments and Base64 encoding, suggesting LLM-generated payloads; IOCs include 45.88.188[.]140 and 198.23.185[.]234.
  Sources 📎 Coverage: cyberpress.org · 👁 via cryptika.com (discovered)

• Canadian ransomware negotiator Edward Dubrovsky arrested on extortion charges tied to ShinyHunters FBI breach
  Canadian ransomware negotiator Edward Dubrovsky, 54, was arrested in Pennsylvania on federal extortion charges in connection with the ShinyHunters hack of FBIjobs.gov.

  • Edward Dubrovsky, 54, a former CYPFER managing director (until December 2025) later affiliated with CyberSteward, was arrested Oct. 8 in the Philadelphia area; FBI Director Kash Patel announced the arrest of another suspected ShinyHunters co-conspirator.
  • He faces charges of conspiracy to threaten the confidentiality of information to extort money and Hobbs Act extortion; the underlying criminal case in the Eastern District of Texas is sealed, and he is held at the Federal Detention Center in Philadelphia.
  • The ShinyHunters breach of FBIjobs.gov, run by an Accenture contractor, exploited an unpatched Oracle PeopleSoft vulnerability, moving laterally to AWS GovCloud and exfiltrating 2-3TB of FBI employee data including Social Security numbers and counterintelligence staff records.
  • ShinyHunters has reportedly netted over $70 million via credential theft, SaaS compromise, and extortion; prior arrests include Pepijn van der Stap in the Netherlands and a 17-year-old known as 'Rey' in Jordan.
  • The case highlights that crisis vendors like ransomware negotiators typically bypass standard third-party risk vetting despite access to sensitive breach data and direct contact with threat actors.
  Sources 📄 Source: cnn.com · 📎 Coverage: shattered.io · 👁 via Dark Reading

• Forescout uncovers ROMULUS, a multi-payload ClickFix malware delivery platform
  Forescout's Vedere Labs has identified ROMULUS, a new multi-payload ClickFix delivery platform used to distribute malware including LegionLoader.

  • Windows users are targeted via ClickFix social engineering lures that trick them into running attacker-supplied commands, delivering LegionLoader and trojanized Stardock DeElevation packages.
  • Six IP addresses host ROMULUS panels; routes use twelve-character tokens to serve PowerShell staging scripts or malicious MSI installers, with an exposed stats page tracking installs and countries.
  • One chain abuses legitimate Stardock software via DLL sideloading; another downloads password-protected nested 7z archives with an executable inflated to ~842-882 MB to evade size-limited scanning.
  • LegionLoader registers infected systems, executes PowerShell, downloads payloads, harvests Chrome browser data, and uses RC4-encrypted, Base64-encoded C2 traffic to smashshape[.]com.
  • Key IOCs include 86.109.75[.]7, 96.62.224[.]81, orbitflownetwork[.]lol, and hxxp://86.109.75[.]7/app/19481b28bd67/IconEdit2Turb.msi; operators remain unknown and it is unrelated to Proofpoint's RomulusLoader.
  Sources 📄 Source: forescout.com · 📎 Coverage: infosecurity-magazine.com · 👁 via Cyber Security News, cryptika.com (discovered)

• New YuanKong Android RAT hijacks phones to steal banking PINs and passwords
  Researchers have analyzed YuanKong, a multi-tenant Android RAT that steals banking PINs and passwords via Accessibility abuse and screen control.

  • Targets Android users, especially banking and payment app activity; analyzed by Star Labs across 110 droppers and 57 child payloads all signed by one shared YuanKong certificate.
  • Steals passwords and payment PINs by reading the accessibility tree, using fake numeric keypad overlays, and mapping digit-button touch coordinates; also captures screens, clipboard, notifications, files and location.
  • Dropper apps (e.g. com.system.loader.va363d031, signed 'Nova') unpack a hidden child app using a two-key XOR scheme with the key and IV stored in cleartext in assets/vault-config.json.
  • Child app (com.remote.control.RemoteControlApp) connects to C2 over Socket.IO/WebSocket with TLS-only transport; it self-pairs with local ADB via Wireless Debugging to gain shell-level access and install a persistence daemon.
  • IOCs: C2 domains apppanda[.]xyz, ktxapp[.]com, ktx123[.]net, IP 206[.]82[.]1[.]14; shared child-app cert SHA-256 73cbe8e3730cacfdd208f22eab468bb5495a78c0eb2cb37eff5af0cafe321387; 42 operator accounts identified across builds.
  Sources 📄 Source: starlabs.sg · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

📋 ADVISORIES

• FBI and CISA warn of phishing and smishing threats to 2026 midterm election and campaign officials
  The FBI and CISA issued a joint PSA warning that cyber actors are using phishing and smishing to target election and campaign officials ahead of the 2026 U.S.