AOMEI Backupper Supply Chain Attack Delivers ShinyRoad Backdoor

🚨 ACTIVE EXPLOITATION

• AOMEI Backupper Hit by Short-Burst Supply Chain Attacks Delivering ShinyRoad Backdoor
  A threat actor repeatedly tampered with AOMEI Backupper's update servers in brief windows to deliver the ShinyRoad backdoor to users.

  • Affects AOMEI Backupper, Windows backup/disk-cloning software used by 186M+ people; METAL examined version 8.3.0; AOMEI's AnyViewer uses the same update flow
  • Attacker UNC7017 tampered with server config files (down_html.ini, Notifycfg.ini) in 5-10 minute windows on May 28, July 16, and July 20, 2026; neither file is cryptographically authenticated
  • Systems checking for updates during a window downloaded a package delivering the CROSSROAD dropper, a side-loaded malicious DLL via legitimate Radmin Server, and the SHINYROAD modular backdoor; Adaptix C2 was later deployed disguised as Nitro PDF
  • A July 20 variant used a 1x1-pixel WebDAV pop-up to harvest NetNTLMv2 authentication hashes without executing code
  • Victims identified in higher education, IT services, and telecom across 11 countries; CROSSROAD aborts on systems in China or with certain security agents
  Sources 📎 Coverage: securityweek.com · 👁 via SecurityWeek

• Citizen Lab confirms Pegasus zero-click infection of Belgrade University rector's iPhone
  Citizen Lab confirmed the iPhone of University of Belgrade Rector Vladan Đokić was infected with NSO Group's Pegasus spyware via a zero-click exploit days before Serbia's snap election.

  • Targets: University of Belgrade Rector Vladan Đokić, a supporter of Serbia's student protest movement, plus at least 15 others in Serbian civil society targeted with mercenary spyware in 2026
  • Đokić's iPhone was infected in 2026 with NSO Group's Pegasus spyware via a zero-click exploit requiring no user interaction; Citizen Lab confirmed with high confidence
  • A second case: prosecutor Rade Bajić, who worked on the Kushner-linked 'Generalštab' corruption case, received Apple Threat Notifications in August 2025 as a high-confidence sign of mercenary spyware targeting
  • Pegasus gives operators the same access as the phone's owner, including private and encrypted messages, and can silently activate the microphone and camera
  • Police raided Đokić's offices in March, seizing computers and servers; Đokić called the infection 'another attempt of intimidation' and demanded an independent investigation
  Sources 📎 Coverage: thehackernews.com · 👁 via The Hacker News

🔓 CVEs & KEV

• CVE-2026-113620 — Eclipse Foundation Eclipse ioFog — CVSS 9.8 — Eclipse ioFog Controller Critical Authentication Bypass via Unverified WebSocket JWT

🕵️ RESEARCH & DEEP DIVES

• 333 malicious Tor exit nodes ran SSH MITM attack to steal credentials and drop Ebury backdoor
  333 compromised Tor exit nodes intercepted SSH connections to steal passwords and install the Ebury backdoor before being taken down.

  • On Oct 2, 333 of Tor's ~3000 exit relays (~10%) began redirecting port 22 traffic to 12 SSH interception servers.
  • Attackers had compromised the servers in August and deployed Ebury 1.8.3, an OpenSSH backdoor and credential stealer for Linux.
  • The MITM stole SSH passwords, observed typed commands, and attempted to install Ebury via a base64-encoded Perl payload.
  • The interception tooling used paramiko, a Python SSH library; the attack also harvested unencrypted mail traffic by blocking other ports.
  • The Tor network health team flagged the relays BadExit on Oct 4 and all infected servers were shut down by Oct 5.
  • IOC: fake ED25519 host key fingerprint SHA256:6baCZCPsl+AfQuujUS81fMEE/C7UeJ+AwjrImqmDB3E.
  Sources 📄 Source: lists.torproject.org · 📎 Coverage: kaba.cx · 👁 via r/netsec

• WP2Shell chain chains two WordPress Core flaws for unauthenticated admin creation and web shell install
  Researchers documented WP2Shell, a WordPress Core exploit chain combining CVE-2026-63030 and CVE-2026-60137 that enables unauthenticated remote code execution.

  • Affects WordPress Core versions 6.9.0–6.9.4 and 7.0.0–7.0.1 for the full chain; 6.8.0–6.8.5 affected by CVE-2026-60137; fixed in 6.8.6, 6.9.5, and 7.0.2.
  • CVE-2026-63030 (CVSS 9.8) is a REST API batch controller flaw at /wp-json/batch/v1 letting nested requests reach authenticated functionality; CVE-2026-60137 (CVSS 5.9) is SQL injection in the posts endpoint via the author_exclude parameter.
  • The chain moves from an unauthenticated REST API request to code execution, creating an administrator account, staging a ZIP archive in uploads, and installing a plugin-based web shell in wp-content/plugins.
  • Flaws were disclosed in July 2026 by Searchlight Cyber, with PoCs on GitHub within hours and scanning observed in telemetry; Seqrite's October 16 analysis does not establish widespread live exploitation.
  • IOCs include wp2shell_4e9b3641.zip archives, temp-write-test-* files, wp2shell_ plugin folders and PHP files, and unexpected administrator accounts.
  Sources 📄 Source: seqrite.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

• FortiSIEM gRPC path traversal flaw CVE-2026-106173 allows unauthenticated RCE CVE-2026-106173
  Fortinet fixed a critical unauthenticated path traversal flaw in FortiSIEM's gRPC phQueryMaster service that enables arbitrary file write and RCE.

  • Affects FortiSIEM 7.5.0; FortiSIEM 7.6 is not affected and FortiSIEM Cloud is not affected; fixed in 7.5.1 or above
  • The phQueryMaster gRPC service on tcp/27918 accepts connections without requesting client certificates, so any remote client can reach it unauthenticated
  • The SendQueryResult RPC builds file paths from attacker-controlled query-id and src-ip values without validation, enabling path traversal, arbitrary file writes, and code execution
  • CVSSv3 score 9.4 (Critical); no known exploitation at publication; advisory FG-IR-26-180 published October 13, 2026
  Sources 📄 Source: fortiguard.fortinet.com · 📎 Coverage: horizon3.ai · 👁 via r/netsec

• Hackers abuse open banking account-linking to test stolen credentials for free
  Fraudsters abused a spend-management platform's open banking account-linking process to test stolen credentials and send phishing messages at no cost.

  • Targets: users of online marketplaces like Poshmark, which was impersonated but not compromised, and a spend-management platform whose account-linking flow was abused
  • What was abused: the platform's open banking account-linking process was used as a free credential checker to verify stolen bank/card details and whether accounts held funds
  • How phishing worked: attackers added recipients to accounts and triggered genuine-looking payment notifications claiming a Poshmark sale needed verification, linking to fake pages harvesting card details, OTPs, and banking credentials
  • Attribution: Group-IB assessed the activity as consistent with the Classiscam scam-as-a-service operation; the platform absorbed the checking costs via its open-banking provider
  Sources 📎 Coverage: cryptika.com · 👁 via cryptika.com (discovered)

• Check Point: AI-powered antidetect browsers Kameleo, AdsPower, MultiLogin fuel fraud and influence ops
  Check Point Research reports that AI-integrated antidetect browsers now let single operators run thousands of fake accounts for fraud and influence operations.

  • Affects social platforms (Facebook, Instagram, TikTok, YouTube, X, LinkedIn, Reddit), banks, crypto exchanges, and e-commerce sites targeted via spoofed identities
  • Antidetect browsers Kameleo, AdsPower, and MultiLogin spoof fingerprints (canvas, WebGL, fonts, timezone, user agent) and route each profile through different proxies to evade detection
  • Stolen session cookies from infostealer malware are injected into clean profiles for account takeover of banking and crypto accounts without triggering MFA alerts
  • Used for carding, fraudulent loan applications, fake ad-revenue accounts, and a documented campaign against cryptocurrency exchanges combining residential proxies, CAPTCHA-solving, and KYC bypass tools
  • AI integration (automation templates, MCP servers piping LLM content into pre-warmed profiles) lets one actor with a subscription replace an entire coordinated team
  Sources 📎 Coverage: research.checkpoint.com · 👁 via Check Point Research

• reverse-dns-injection-research — r/netsec

📋 ADVISORIES

• Go emergency update blocks eight eMudhra CA keys over undisclosed security concerns
  Go has released an emergency update blocking eight intermediate CA keys over undisclosed security concerns.

  • Affects programs built on Go 1.27.3 and Go 1.26.10 (released October 20); Go 1.25 and older are unsupported and get no fixes.
  • The certificate verifier now rejects any chain passing through eight intermediate keys, six TLS and two code-signing intermediates matched to eMudhra's emSign Root TLS/CS CA - G3.
  • The filter hashes each certificate's public key, catching cross-signed copies, applies in Go's verifier and macOS/Windows OS-verification paths, and cannot be disabled.
  • Rejected chains return the error 'x509: no valid chains built'; sites whose certificates chain through the blocked keys will need new intermediates.
  • Mozilla separately added six emSign Root TLS CA - G3 intermediates to Firefox's OneCRL blocklist on October 17; neither Go nor Mozilla has disclosed the reason.
  Sources 📄 Source: groups.google.com · 📎 Coverage: thehackernews.com · 👁 via The Hacker News

• 📄 Source for Hackers abuse open banking account-linking to test stolen credentials for free — <https://www.group-ib.com/blog/spend-management-ab