Weekly threats: kernel bugs, Falcon spyware, GSocket, Europol seizures
Original title: ThreatsDay: 59 Linux Kernel Bugs, Falcon Spyware, GSocket Backdoors + 17 More Stories
Microsoft reports working root exploits for eight kernel CVEs, including CVE-2026-64563, while Europol seized 235 servers.
The Hacker News weekly bulletin collects several disclosures. Elliptic says North Korean actors linked to a claimed $6.43 billion Binance theft laundered funds across more than 20,000 wallets; a DPRK spokesperson denied involvement. Microsoft says GSocket detections on Linux rose 356.2% from March through August 2026 and persisted after patched web flaws. Europol and partners seized 235 servers and 257 domains tied to GootLoader, CastleRAT, and StealC and identified over 6 million victim credentials. Unit 42 says the Falcon JavaScript framework targeted government webmail and apps in one Middle Eastern and four Southeast Asian countries. Microsoft’s kernel scan produced 59 upstream reports and 33 CVEs.
Unconfirmed: Binance-theft figures and North Korean attribution are Elliptic’s claims; Pyongyang denies a role, and in-the-wild use of the kernel bugs is not stated.
- Elliptic says about $3.0 billion remains in theft-linked addresses, mostly ETH and BTC.
- GSocket activity mainly hit PHP, cPanel, and Apache hosts, led by education and research.
- Falcon, assessed as related to PeckBirdy, can sideload Chrome extensions and deliver Antino via OneDrive.
- Eight kernel CVEs have working root exploits; CVE-2026-64563 is a one-line state-reset bug.
- The kernel scan ran from late May to mid-June 2026 and started from 26,502 raw findings.
Impact: Root privilege escalation, stolen credentials, and persistent remote access
| Product | Affected |
|---|---|
| Linux kernel | — |
- 1.Hunt Linux hosts for GSocket persistence and outbound relay use, not only patched web apps.
- 2.Review government and webmail sites for injected Falcon JavaScript and rogue Chrome extensions.
- CVEs
- CVE-2026-64563
- ATT&CK
- T1219 Remote Access SoftwareT1059.007 JavaScriptT1539 Steal Web Session CookieT1068 Exploitation for Privilege Escalation
- Products
- Linux kernel
- Victims
- Binance
- Organizations
- MicrosoftEuropolEllipticPalo Alto Networks Unit 42
- Countries
- North Korea
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-64563 | Linux kernel: rhashtable: clear stale iter->p on table restart rhashtable_walk_start_check() has two restart paths when… | 7.8 | <1% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | battle.net | , password managers, cryptocurrency wallets, Steam, Roblox, Battle.net, EA Desktop, and Minecraft; then exfiltrating the loot as s |
From the original article
12 min read at thehackernews.com
A search result isn't always safe. An access request isn't always harmless. And a familiar account doesn't always mean a familiar person is using it.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.