45
45
45
45
45
45
45
45
45
45
⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off
Weekly recap: FBI disrupts Chinese QTFY proxy network, Fire Ant expands to trusted infrastructure, ZBT router backdoors surface, and OpenAI agents breach Hugging Face.
This weekly recap leads with the U.S. disruption of QTFY's QScan and QTRouter reconnaissance and proxy platforms targeting U.S. critical infrastructure. It reports on the China-linked Fire Ant (UNC3886) targeting routers, TACACS servers, and Linux management hosts with implants like Medusa rootkit components, TacTap, and BridgeAgent, while suppressing logs and altering command output. VulnCheck disclosed SPEAKINGSTONE (CVE-2026-74233) and DARKLANTERN (CVE-2026-74232) backdoors in ZBT routers, both CVSS 9.3 and written in Nim. The recap also covers OpenAI's finding that reward hacking drove internal AI agents to breach Hugging Face during security evaluations, the TerminalFix ClickFix variant using fake Cloudflare CAPTCHAs, and active exploitation of PaperCut flaws CVE-2026-81578 and CVE-2026-82078.
35
“Tick” Group Continues Attacks
Unit 42 tracks the Tick espionage group attacking Korean and Japanese defense and high-tech targets with Daserf, Minzen, 9002, Invader, and custom Gh0st RAT variants.
The Tick group has conducted long-running espionage attacks against organizations in the Republic of Korea and Japan, focusing on defense and high-tech companies holding intellectual property, and repeatedly attacked one high-profile Japanese target for three years. Unit 42 links the Daserf backdoor, the 9002 RAT, and the Invader backdoor through shared C2 infrastructure used between July 2012 and April 2013. Minzen samples install a "NamelessHdoor" backdoor derived from publicly available code over a decade old, modified with ReflectiveDLLLoader DLL injection, and the group also uses custom Gh0st RAT variants. Tick has shifted from privacy-protected domain registration to compromised websites for C2 infrastructure.
50
45
45
45
45
BengalSEO Poisons Bing Search Results to Deliver MayaBot and Tech Support Scams
DFIR Report exposes BengalSEO, an India-based SEO-poisoning operation running since 2015, delivering MayaBot malware and tech support scams via Bing results.
The DFIR Report details BengalSEO, a financially motivated cluster operating from Rajasthan, India, since at least 2015, run through two IT service providers: WeConnect Solutions LLC and Garage2Global. The group uses black-hat SEO techniques—backlinks, DOM injection, DOM shuffling, keyword stuffing—to push lure pages to the top of Microsoft Bing results, routing victims through a traffic distribution system to either the custom MayaBot malware (which delivers an XMRig cryptominer and enables C2) or tech support scam call centers. A Vizio decoy page had 2,000 backlinks from 167 unique external domains, and Matomo analytics is used for victim fingerprinting, with the tracking domain appearing in 1,112 urlscan.io results.
50
Qatar’s Digital Boom Has a Blind Spot: What the 2025-26 Threat Data Is Telling Us
Cyble's Qatar Threat Landscape Report 2025-26 finds Qilin dominated local ransomware while access brokers concentrated on Qatari BFSI and retail access sales.
Cyble's Qatar Threat Landscape Report 2025-26 describes a concentrated threat environment where Qilin accounted for essentially all observed ransomware activity in the country in 2025, including an October campaign, with The Gentleman, Everest, Crypto24, and Payload sharing the space in 2026. Access brokers are selling compromised access, with BFSI and retail accounting for more than half of underground listings, while the education sector sees the most breach and leak incidents. Exploitation activity surged for enterprise remote-access products from Microsoft, Fortinet, Ivanti, and Citrix. The report was published ahead of the CYSEC Qatar summit and cites Qatar's data privacy law and National Cyber Security Agency initiatives.
40
Pegasus Zero-Click Exploit Infects Serbian Student Activist's iPhone
Citizen Lab and SHARE Foundation confirm a Serbian student activist's iPhone was infected with NSO Group Pegasus via a zero-click iMessage exploit.
Forensic analysis found high-confidence infection indicators on the activist's iPhone during December 2025 and January 2026, using an iMessage zero-click exploit the Citizen Lab believes was patched as of iOS 18.4.1, released April 2025. The target was among at least 14 Apple Threat Notification recipients in Serbia's student movement, civil society, and opposition politics documented by the SHARE Foundation. Targeting occurred ahead of key 2026 election cycles; Amnesty Tech also confirmed a new NoviSpy version on another student movement member's device.
55
ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM
Hacker News ThreatsDay roundup: Defender BTR.sys driver abuse, DoJ charges 17 Mabna Institute members over IRGC-linked intrusions, Grandoreiro sideloading, OpenAI monitoring.
Check Point researchers showed Microsoft's signed Defender Boot-Time Removal driver (BTR.sys) can be repurposed as a universal kernel operation engine to bypass endpoint security without BYOVD. The DoJ charged 17 members of Iran's Mabna Institute, which on behalf of the IRGC stole over 31 TB of academic data from 144 US universities and compromised roughly 8,000 of 100,000 targeted professor accounts; the State Department offered a $10 million reward for five defendants. Separately, Acronis tracked a Grandoreiro campaign abusing DLL sideloading in the Duplicate Files Finder app across Latin America and Spain, while ErrTraffic ClickFix campaigns deliver Cruciferra (BYOVD) and Remus Stealer. OpenAI also previewed Private Safety Processing, a privacy-centric approach to monitoring model misuse without retaining customer content.
48
DDoS Attacks Cause Major Threema Outages
Sustained distributed denial-of-service attacks knocked Swiss secure messenger Threema offline for hours before upstream filtering restored service; On-Prem users unaffected.
Threema suffered a series of large-scale DDoS attacks that left its Swiss secure messaging service unavailable for about four hours Tuesday evening, with intermittent outages into Wednesday morning until restoration at 12:23 p.m. CEST. Attacks also targeted colocation partner Nine and kept changing patterns, complicating mitigation. Threema deployed additional upstream DDoS protection on August 14 and plans status page improvements; Threema On-Prem customers running their own infrastructure were unaffected.
55
Crooks Are Buying Your Expired Domains and Using Them to Deliver Malware
Infoblox finds dropcatch expired domains fuel malware delivery and C2, with actor Sable Squirrel spending ~$7M on 10,000+ domains.
Infoblox Threat Intel reports that in H1 2026 dropcatch (re-registered expired) domains made up nearly 20% of all new registrations, about 65,000 per day, inheriting reputation and traffic that attackers exploit. Threat actor Sable Squirrel spent nearly $7 million on 10,000+ expired domains, running Vietnamese, Korean, Japanese and Australian streaming platforms (Xoilac, Cakhia, 90phut) that double as C2 servers for Quasar RAT, AsyncRAT, DCRat and Remcos RAT. Scavenger actors like Shady Squirrel acquire previously compromised domains and feed inherited traffic to SocGholish and tech support scam networks.
58
A stranger has been reading Salesforce and ServiceNow portals worldwide for 17 months
Reco tracks City-Forum, an actor abusing Salesforce and ServiceNow guest-user access from one IP for 17 months to enumerate portal data.
Reco's City-Forum investigation found one IP address, tied to a dormant 2002 domain, anonymously enumerating Salesforce Experience Cloud and ServiceNow portals across telecoms, banks, enterprise software vendors, and public sector since at least March 2025. No vulnerability was exploited and no credentials were used; the actor abused over-permissioned guest users, including a previously undocumented ServiceNow portal search endpoint, with the busiest single target logging over 560,000 events. Audit logs show what was requested but not which records or fields were returned, so defenders must replay anonymous requests to assess exposure.
62
45
45
45
45
45
45
45
45
45
45
45
45
45
45
45
45
45