🚨 ACTIVE EXPLOITATION
- Multiple DDoS attack waves knocked North Korean state websites offline for ~32 hours
North Korea's public internet suffered a roughly 32-hour outage this week caused by multiple waves of DDoS attacks, per Kentik.- More than 40 websites on North Korea's .kp domain were affected, including the Ministry of Foreign Affairs and Korean Central News Agency.
- Traffic floods began at 02:01 UTC on October 20, originating from Vietnam, the Philippines, Venezuela, and other countries, per Kentik's Doug Madory.
- Repeated downtime hit the 175.45.176.0/24 block containing .kp name servers; routing shifted between Cenbong (AS134544) and Russia's TTK (AS20485) involving North Korea's AS131279 network.
- Kentik has not identified who was responsible, and no specific botnet has been publicly linked to the incident.
- Services returned around 7 p.m. local time on October 21 after repeated downtime and brief recoveries.
📄 https://www.reuters.com/world/china/north-korean-internet-was-hit-by-ddos-cyberattack-network-monitoring-firm-says-2026-10-23/ · 📎 https://cybersecuritynews.com/multiple-waves-of-ddos-attacks-caused-in-north-korea/ · 👁 via https://cybersecuritynews.com/multiple-waves-of-ddos-attacks-caused-in-north-korea/, https://www.cryptika.com/multiple-waves-of-ddos-attacks-caused-this-weeks-outage-in-north-korea/ (+1)
💥 BREACHES & INCIDENTS
- Hackers leak 281 GB of AfD party emails stolen via breached hosting provider
Hackers have published 281 GB of stolen emails from Germany's far-right AfD party following a breach of its hosting provider.- Germany's far-right AfD party confirmed hackers breached its hosting provider in September 2026, copying mailboxes including those of party figures such as co-leader Alice Weidel.
- The Hexane.cc leak site published 421,179 internal emails plus over 100,000 files (281 GB total), including bank statements, academic certificates and membership lists, distributed via torrent.
- Rather than posting emails directly, the leak site shows AI-generated summaries categorizing messages under topics like racism and antisemitism, rated Low to Critical; party sources say summaries contain inaccuracies though the emails appear authentic.
- Access was reportedly gained via an unpatched website, though this is unverified; the hacker claims the leak exposes the party's 'degeneracy and hypocrisy' and says a Proton Mail user offered €100,000 to take the site down.
- The leak, also shared via Distributed Denial of Secrets, reveals the AfD's decade-long efforts to court Trump and MAGA allies; German authorities may use the material in their extremism investigation of the party.
📄 https://www.heistberlin.com/news/afd-leak-what-421-179-hacked-emails-show-about-the-german-far-right/ · 📎 https://www.bitdefender.com/en-us/blog/hotforsecurity/hacker-leaks-281-gb-data-germany-afd · 👁 via Graham Cluley
🔓 CVEs & KEV
- https://www.thehackerwire.com/cve-2026-53921-openwrt-odhcpd-dhcpv6-stack-buffer-overflow-enables-unauthenticated-root-rce/ — CVE-2026-53921 — openwrt odhcpd — CVSS 9.8 — OpenWrt odhcpd DHCPv6 Stack Buffer Overflow Enables Unauthenticated Root RCE
🕵️ RESEARCH & DEEP DIVES
New BlackX UEFI bootkit, successor to BlackLotus, used in APT41 espionage attacks in Central Asia
Kaspersky discovered BlackX, a revamped BlackLotus UEFI bootkit used by APT41-linked actors to bypass Windows Secure Boot in espionage attacks on diplomatic organizations in Central Asia.- Targets diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan; Windows systems with Secure Boot, including fully patched machines.
- BlackX exploits the Baton Drop vulnerability (CVE-2022-21894 / CVE-2023-24932) to bypass Secure Boot and install custom Machine Owner Keys.
- The 2023 Microsoft fix requires manual post-install steps (registry value and scheduled task) that many organizations never completed, leaving them vulnerable.
- Deployed after network compromise with admin privileges via inst.exe and an RC4-encrypted payload file (PVMDIJGKAX2); used for persistence and long-term espionage.
- Data is exfiltrated via cloud services like Google Drive, OneDrive, and Yandex Disk; attribution to APT41/FishMonger (I-SOON) with medium confidence.
📎 https://securelist.com/uefi-bootkit-blackx/121539/ · 👁 via https://www.cryptika.com/hackers-use-new-blackx-bootkit-to-bypass-windows-secure-boot-on-fully-patched-systems/
k0t Campaign Breaches FortiGate and GlobalProtect Edge Devices, Exposing 70,000+ Credentials
A threat actor known as k0t has breached exposed Fortinet and Palo Alto Networks edge devices worldwide, harvesting over 70,000 credentials.- Targets are internet-exposed Fortinet FortiGate, FortiWeb, and Palo Alto Networks GlobalProtect/PAN-OS firewalls and VPNs across all sectors, with 38% of victims in APAC, 31.9% in Latin America, 15.8% in Europe, and 12.7% in MENA.
- Over 70,000 exposed credentials tied to network devices and LDAP dumps have been identified; operators gained persistent remote access and exfiltrated data from numerous organizations worldwide.
- The actor k0t (aliases CryptoFeel, Member19, QazWsxShop) has links to Qilin and The Gentlemen ransomware groups, likely as an initial access broker; many victims later appeared on their leak sites.
- Attacks use FOFA/ZoomEye reconnaissance, exploitation of CVE-2025-64446 (FortiWeb path traversal) and CVE-2026-0257 (PAN-OS auth bypass) via Python scripts fortnew.py and exploit_2026_0257.py, plus brute force, with OpenConnect VPN footholds.
- Post-exploitation uses MeshCentral, Atera, Teramind, AnyDesk, and AdaptixC2 for persistence, tools like NetExec, Impacket, and Mimikatz for lateral movement, and Rclone to exfiltrate data to Wasabi S3 and MEGA.
- Most compromises occurred February–June 2026, overlapping the FortiBleed credential-harvesting campaign, though researchers found negligible data overlap between the two.
📄 https://www.group-ib.com/blog/stray-cat-network-edge/ · 📎 https://thehackernews.com/2026/10/hackers-breach-enterprise-firewalls-and.html · 👁 via https://thehackernews.com/2026/10/hackers-breach-enterprise-firewalls-and.html
Sandworm and UAC-0099 team up in wiper attack on Ukrainian grain firm via new Yggdrasil backdoor
ESET found that Russia-aligned UAC-0099 handed access to Sandworm, which wiped a Ukrainian grain logistics company in a 2025 attack featuring a new backdoor hidden in the Yggdrasil mesh network.- Targets: a Ukrainian grain logistics company; ESET says UAC-0099 has also hit Ukrainian government, energy, logistics, transportation, media and financial sectors
- On July 16, 2025, UAC-0099 (Earth Sirrush) gained access via a spear-phishing email with a malware-laced attachment, deploying the MATCHBOIL downloader and MATCHWOK backdoor
- A previously unknown Go-based backdoor, MythicRatatoskr, was deployed a day later; it communicates with its C2 inside the Yggdrasil mesh network — the first documented state-actor abuse of Yggdrasil
- MythicRatatoskr can take screenshots, upload/download files, execute shell commands via cmd.exe, spawn a reverse SOCKS5 proxy, and some builds include a 10-minute startup delay to evade detection; code references to 'crond' suggest a possible Linux variant
- On September 17, 2025, Sandworm (GRU Unit 74455) conducted the data-wiping attack by dropping the SDelete utility via Active Directory Group Policy
📄 https://www.welivesecurity.com/en/eset-research/mythicratatoskr-yggdrasil-enabled-backdoor-deployed-uac0099-sandworm-collaboration/ · 📎 https://thehackernews.com/2026/10/russian-linked-hackers-used-new-mesh.html · 👁 via https://thehackernews.com/2026/10/russian-linked-hackers-used-new-mesh.html
Kaspersky: New BlackX UEFI bootkit bypasses Secure Boot in APT41 espionage attacks
Kaspersky discovered a new UEFI bootkit, BlackX, used by likely APT41 actors to bypass Windows Secure Boot in espionage attacks on diplomatic organizations in Central Asia.- Targets are diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan; victims had Windows updates installed but the required Secure Boot revocation steps were not completed.
- BlackX is a modernized successor to the BlackLotus bootkit, exploiting the Baton Drop vulnerability (CVE-2022-21894 / CVE-2023-24932 guidance) to install custom Machine Owner Keys and load arbitrary EFI files.
- Deployed after attackers gain network access and administrator privileges, via inst.exe and an RC4-encrypted file PVMDIJGKAX2 (command line C:\ProgramData\Intel\inst.exe PVMDIJGKAX2 Q46F6MDLI3RX2KV1).
- A kernel driver disrupts security tooling (process/thread/registry callbacks, ETW) and hides files by returning handles to calc.exe; payloads include a RAT using Google Drive, OneDrive, or Yandex Disk for C2 and OxiDLLRunner running a Rust payload.
- IOCs include googleupdate.exe (MD5 AF8A983B9ADA07EAE1259BF2953ABD40), v8_context_snapshot.bin, C2 domain www[.]archivetj[.]com, and driver certificate serial 0bcdf5e0da32d68900b8b7638459d072.
📄 https://www.kaspersky.com/about/press-releases/beneath-the-operating-system-kaspersky-discovers-blackx-bootkit-targeting-diplomatic-organizations-in-central-asia · 📎 https://securelist.com/uefi-bootkit-blackx/121539/ · 👁 via https://cybersecuritynews.com/hackers-use-new-blackx-bootkit/
New Aokigahara infostealer targets AI apps, developer tools, and cloud credentials
Check Point Research has identified a new infostealer, Aokigahara, that steals credentials from AI applications and developer tools alongside traditional data theft targets.- Affects users of AI tools and developers on Windows machines, targeting Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and JetBrains AI Assistant.
- Steals authentication files, session data, and configuration files from AI apps, plus Git credentials, SSH private keys, and AWS, Azure, and Google Cloud credential files.
- Also performs classic infostealer actions: browser password and cookie theft for Chromium and Firefox, crypto wallet and exchange extension data, Discord/Telegram tokens, Steam, password managers, VPN, FTP, and email client credentials.
- Stolen AI credentials and session tokens can enable unauthorized access to paid AI services or resale of compromised accounts; an earlier version may have been known as Kamidere or Stygian.
- Includes a clipper component dropped under C:\Microsoft\Vault for clipboard manipulation, alongside screenshot capture and file grabbing from Desktop, Documents, and Downloads.
📎 https://research.checkpoint.com/2026/infostealer-riding-the-ai-train/ · 👁 via https://research.checkpoint.com/2026/infostealer-riding-the-ai-train/
SecurityWeek roundup: Tor exits hijacked, rogue bank AI agents, self-rebuilding macOS ransomware
SecurityWeek's weekly roundup covers hijacked Tor exit relays harvesting SSH passwords, banks spotting rogue AI agents, a self-rebuilding macOS ransomware sample, and other under-the-radar security stories.- Tor users: 333 exit relays (about a tenth of all exits) were redirecting SSH connections to attacker-run servers that captured passwords and tried to infect targets with Ebury; the relays ran on Ebury-compromised servers and were pulled within three days.
- Major US banks including Morgan Stanley, JPMorgan, Bank of America and Citi are detecting and restricting unauthorized third-party AI agents operating inside customer accounts using user credentials.
- A Rust-based macOS ransomware called Heartbreaker, uploaded to VirusTotal in May 2025 and undetected by all engines, encrypts the Downloads folder and recompiles itself with randomized code to change its hash, but