n0n ransomware breached ~100 maritime orgs via AI-assisted attacks

🚨 ACTIVE EXPLOITATION

• n0n ransomware group breached ~100 maritime orgs using AI-assisted attacks
  The n0n ransomware group breached nearly 100 organizations, many of them port authorities and maritime companies, using AI-assisted attacks.

  • Targets include port authorities and maritime organizations; the group launched about six weeks before disclosure.
  • Close to 100 organizations were breached with only about $7,000 in LLM costs, showing AI dramatically lowers attack costs.
  • The operation is described as AI-assisted extortion, with LLMs used to drive the hacking workflow.
  • Maritime ransomware incidents like LockBit's attack on the port of Nagoya (15,000 containers affected) illustrate the sector's exposure.
  Sources 📎 Coverage: socradar.io · 👁 via @campuscodi@mastodon.social

• Hackers target 61 GitHub repos with command injection to steal CI/CD secrets
  Attackers targeted 61 public GitHub repositories with command injection attacks aimed at stealing CI/CD secrets via GitHub Actions workflows.

  • Attackers targeted 61 public GitHub repositories, including Google LangExtract, Trivy, Brave Browser, MLflow, ToolJet, and PX4-Autopilot.
  • Radware researchers identified 83 malicious issues, pull requests, and comments posted on September 1, 2026; 77 appeared within about 43 minutes and 6 more in a second wave.
  • The attack exploited GitHub Actions workflows that insert user-controlled text from issues, PR titles, or comments directly into shell scripts, executing Bash $() command substitutions.
  • Payloads ran env to collect environment variables, Base64-encoded the output, and used curl to POST it to 54.205.16[.]142 on port 8443 over plain HTTP, with a unique collection identifier per attempt.
  • Injected commands were confirmed executed inside two GitHub Actions workflows; exposure depends on what each job could access, as secrets are not automatically available to every workflow.
  Sources 📎 Coverage: cryptika.com · 👁 via cryptika.com (discovered)

• Attackers hit 61 GitHub repos with command injection via issues and PRs to steal CI/CD secrets
  A coordinated command injection campaign targeted 61 public GitHub repositories to steal CI/CD secrets via GitHub Actions workflows.

  • Targets included Google LangExtract, Trivy, Brave Browser, MLflow, ToolJet, PX4-Autopilot, and workout-cool; 83 malicious issues, pull requests, and comments were posted on September 1, 2026.
  • Attackers embedded Bash command substitution expressions ($()) in issue titles, PR titles, and comments; vulnerable workflows that inserted this text into shell scripts executed the payload.
  • Payloads ran env to collect environment variables, Base64-encoded the output, and attempted to exfiltrate it via curl HTTP POST to 54.205.16[.]142 on port 8443 (plain HTTP despite the port).
  • Injected commands were confirmed executing inside two GitHub Actions workflows (PX4-Autopilot title-check and workout-cool issue notification); some attacker accounts appear to have been hijacked.
  • Radware did not confirm actual secret theft, repository write access, or compromised releases; risk depends on what each workflow job could access.
  Sources 📄 Source: radware.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News

💥 BREACHES & INCIDENTS

• BTCPay Server warns attackers are draining hot wallets on instances running versions 2.4.1 or older
  Attackers are draining Bitcoin hot wallets on BTCPay Server instances running outdated software.

  • BTCPay Server operators, especially self-hosted merchants holding funds in server-managed hot wallets, are affected.
  • Hot wallets on instances running version 2.4.1 or earlier (2.4.1 released July 23, 2026) are being swept by unauthorized attackers; no credible drains reported on latest version 2.4.7.
  • Founder Nicolas Dorier said affected servers ran versions older than 2.4.2 and attackers logged in as administrators; the initial entry point remains unconfirmed.
  • BTCPay issued a November 1, 2026 warning telling operators to shut down instances with ./btcpay-down.sh while it investigates; no patch or technical details disclosed yet.
  • The incident follows an August attack that exploited a vulnerability to obtain Lightning Network Daemon (LND) credentials and steal funds; any connection is unclear.
  Sources 📄 Source: docs.btcpayserver.org · 📎 Coverage: tradingview.com · 👁 via cryptika.com (discovered)

• BTCPay Server warns of hot wallet thefts on instances running outdated software
  Attackers are draining Bitcoin hot wallets on self-hosted BTCPay Server instances, prompting an urgent shutdown warning.

  • Affects operators of self-hosted BTCPay Server instances holding funds in hot wallets, which store signing seeds on the server.
  • BTCPay identified an attack vector targeting instances running version 2.4.1 or earlier (released July 23, 2026); no credible reports of drains on the latest 2.4.7 release.
  • Founder Nicolas Dorier said attackers had logged in as administrators on affected servers, but the initial entry point remains unconfirmed.
  • BTCPay urged operators to shut down servers with ./btcpay-down.sh pending investigation; no patch or loss total has been disclosed.
  • The warning follows an August attack that exploited a vulnerability to obtain Lightning Network Daemon credentials, and version 2.4.7's release fixing 85 security findings; no confirmed link to either.
  Sources 📄 Source: x.com · 📎 Coverage: cointelegraph.com · 👁 via Cyber Security News

🔓 CVEs & KEV

• CVE-2026-120238 — WAVLINK WN553X1-B — CVSS 8.6 — WAVLINK WN553X1-B OS Command Injection via OVPN Handler Enables Remote Code Execution

• CVE-2026-120230 — WAVLINK WN701AE — CVSS 8.6 — WAVLINK WN701AE OS Command Injection Enables Remote System Compromise