n0n extortion operator exposed AI-aided attack files on open server
SOCRadar says every examined break-in used weak or stolen credentials, not a software vulnerability.
74
Country
South Korea
- Mentions · 7d36
- Mentions · 30d96
- All mentions133
- First seenAug 12, 2026
- Last mentioned4h ago
Timeline
133 articles · newest firstUnauthorized relays disable Codex and Claude Code sandboxes at 12 firms
A post-install script points the genuine CLIs at relay servers, swaps API keys, and sets danger-full-access; abuse has not been observed.
62
Suspected Chinese actor roots PAN-OS firewalls via chained PHP2Shell
The chain rooted 25 servers in four countries and reached a US government Active Directory domain, Unit 42 says.
86
Palo Alto confirms PHP2Shell attacks on exposed PAN-OS management
Unit 42 verified tools that pair the PHP flaws with kernel bug CVE-2026-46300 for root; about 0.02% of the installed base was exposed.
86
Grey-market relays reroute Codex and Claude Code traffic
Symantec says lookalike-domain scripts disable sandboxes and send prompts, files and tokens through operator servers at about a dozen firms.
74
GhostWriter linked to first Belarus data wipe at Ukrainian firm
ESET ties FrostyNeighbor to the wipe and says Belarus-aligned operators increasingly mirror Russian priorities in Ukraine.
64
php2shell RCE confirmed on honeypots and some network appliances
Public PoCs often fail unless tuned to one PHP build, but shared appliance images let one exploit hit many devices.
82
Attackers chain PHP2Shell with Fragnesia kernel bug for root
Dream Security says the chain rooted Palo Alto firewalls and reached Active Directory on 25 servers, three tied to the US government.
84
Japan Airlines says Amadeus breach exposed about 92,000 passengers
About 2,000 also had passport numbers and contacts exposed; access ran from August 2023 to September 2026.
74
Reports say PHP2Shell bugs were exploited, including on firewalls
GreyNoise reports at least six successful hits; Dream claims 24 firewalls and two US-linked servers were compromised.
84
Suspected Chinese attackers rooted 25 servers with custom PHP2Shell chain
The chain hit PAN-OS 12.1 and 12.2 from October 23; Dream says remote access likely remains.
84
Warp Panda used VMware ESX zero-day; firewalls rooted and crashed
CISA set November 11 and October 31 federal deadlines; Cisco says CVE-2026-76418 is crashing firewalls with no workaround.
84
Wiz says AI agents are running hands-on intrusions
Named cases include ARTEX at Korean banks and ConnectWise, Hermes at Thailand's finance ministry, and AI-assisted API attacks in Japan.
68
Wiz says AI agents are doing hands-on intrusion work
Named cases include ARTEX and Hermes, plus three Wiz investigations that begin with an exposed Flowise service.
68
CISA warns Fragnesia Linux flaw is chained in PHP2Shell attacks
Agencies must patch CVE-2026-46300 by Saturday 10; researchers say the chain rooted 25 servers, including three US government-affiliated hosts.
88
Chained PHP2Shell exploit roots 25 firewalls, including US government systems
Dream says a custom PHP2Shell build plus the Fragnesia kernel bug yielded unauthenticated root and Active Directory access.
78
Unauthorized AI relay disables Codex and Claude Code sandboxes
Symantec says the relay has installed genuine CLIs at a dozen organizations, mostly in mainland China, since early 2026.
52
PHP2Shell flaws exploited on exposed Palo Alto management interfaces
Unauthenticated RCE hits internet-facing PAN-OS management; CISA set an October 31 deadline for kernel bug CVE-2026-46300.
88
Attackers chain PHP2Shell flaws to root 25 firewall servers
Dream says the chain, including kernel flaw CVE-2026-46300, rooted devices in the US, Japan, Taiwan, and South Korea in under 15 minutes.
76
Attackers chain PHP2Shell and kernel exploits for root on 25 servers
Dream says custom exploits for CVE-2026-109618, CVE-2026-109619 and CVE-2026-46300 reached government-affiliated firewalls and Active Directory.
76
Discord will let search engines index public server messages
About 63,000 Discoverable Servers get public web pages from November 16; new-message indexing starts mid-December.
52
PHP2Shell campaign roots 25 servers, including U.S. government-linked hosts
Dream says a custom exploit plus a Linux kernel bug rooted firewalls in the U.S., Japan, Taiwan, and South Korea.
86
South Korean financial firms hit by another wave of cyberattacks
Daishin says names, emails, and phone numbers of 38,490 customers were exposed; Mirae and Bithumb have not confirmed theft.
72
Bithumb discloses employee-system breach amid other Korean finance hacks
The exchange is still checking whether member data leaked; Daishin reported about 38,490 affected customers.
64
China-linked hackers root firewalls via PHP2Shell and Fragnesia
Dream says attackers exploited 25 of 19,000 internet-facing firewalls on October 23-24 and planted root webshells on 24.
80
123 Reg says AI-driven attack exposed customer contact and account data
The GoDaddy-owned registrar says the September 18 intrusion was limited to reading and suspects China-linked use of ARTEX.
70
ESET maps APT activity from April through September 2026
China-, Iran-, North Korea- and Russia-aligned groups hit governments, semiconductors, drones, crypto firms and Ukraine.
72
Lazarus abuses INISAFE CrossWeb EX in Operation FlashHole
Kaspersky says at least three South Korean firms were targeted since July 2025 via spear-phishing and in-memory loaders.
76
Police arrest man accused of stealing 8.2 million Korean records
About 90 organizations were hit from September 2025; extortion demands totaled 360 million won, not confirmed payments.
74
South Korean police arrest suspect in theft of 8.2 million records
Investigators link AI-assisted intrusions at 60 victims and extortion demands totaling 360 million won.
74
Rapid7 says 71% of tracked exploitation starts within a week
Across 43 newly exploited high- and critical-severity flaws, disclosure-to-exploitation averaged three days.
54
South Korea arrests gang that used ARTEX AI to steal 8.2 million records
Police say seven suspects hit more than 90 organizations; ransom was demanded in 38 cases, and only the leader remains detained.
74
Boston Dynamics staff petition to halt Spot robot sale to ICE
DHS awarded Radeco $1.3 million on September 25 for four modified Spot robots branded Cerberus; executives kept the deal.
34
Check Point weekly brief covers Onamae intrusion, PHP exploits, GitLab RCE
The October 26 bulletin also flags an exploited Arista flaw, a LiteLLM package compromise, and the Aokigahara infostealer.
66
Suspected North Korean campaign targets 216 vulnerable PHP hosts
Cyfirma links a Lazarus-linked group using AI-ranked public exploits to monitor and scan 216 unpatched PHP hosts via private I2P channel.
75
PHP2Shell exploited at a European government entity, Unit 42 says
Within two hours the attackers reached password hashes, MFA secrets, and an NTLM-relay path toward Domain Admin.
86
DDoS waves took North Korean state websites offline for about 32 hours
Kentik tied failures starting October 20 to traffic from Vietnam, Venezuela and elsewhere, but named no operator.
48
Storm-0940 used AI tool Artex in ConnectWise customer intrusions
Microsoft logged more than 151,000 failed logons and successful sign-ins with ConnectWise cloud application identities.
80
Akamai post says ARTEX shows overlooked attack surfaces
Visible headings cite South Korean regulators, financial services, and AI speeding attacks rather than changing fundamentals.
Akamai Blog16
n0n ransomware reaches 40+ shipping firms via maritime IT supplier
Victims were listed on October 12; the claimed ransom total is $1.2 billion, and most data was leaked.
78
Related CVEs
by mentions- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-4630016%7.8Shared-frag marker loss in Linux kernel skb coalescing (LPE)
- CVE-2026-7289899%10.0Unauthenticated SQL Injection in Metabase Grants Admin Access
- CVE-2021-35394100%9.8Remote Code Execution via Memory Corruption in Realtek Jungle SDK
- CVE-2026-2158999%9.3Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
- CVE-2026-72733%8.8Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
- CVE-2014-8361100%—Improper Input Validation in Realtek SDK miniigd SOAP Service Enables Remote RCE
- CVE-2025-3403791%10.0Unauthenticated OS Command Injection in Linksys E-Series Routers
- CVE-2016-2001686%9.8MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI
Appears with
- Claude Codeproduct · 15
- Palo Alto Networksvendor · 15
- CrowdStrikeorganization · 14
- DeepSeekai model · 12
- Artexmalware · 12
- Claudeai model · 12
- Artexproduct · 12
- Microsoftvendor · 11
- Anthropicvendor · 11
- Dreamorganization · 10
- CISAorganization · 10
- PHPproduct · 9
- Shinhan Bankvictim · 8
- Storm-0940threat actor · 8
- Microsoft 365product · 7
- ConnectWisevendor · 7
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.