Weekly recap: OpenSSH SSHole probed, Zyxel zero-day hits switches
Twenty OpenSSH attempts came from 13 IPs, and a Zyxel flaw was used on nearly 1,000 switches.
Stories per day · 30 days
7 RSS
Relateddebian7ubuntu4rce3spearphishing3espionage2gorbag2package-manager2russia2supply-chain2ukraine2central-asia1cwpdoor1energy1gamaredon1india1kazakhstan1lazarus1linux1
92 stories, newest first · one card per story
Stories tagged #apt
Debian and Ubuntu APT Vulnerability Allows Root Code Execution (CVE-2026-109518)
CVE-2026-109518 in APT lets on-path attackers install malicious packages with root privileges via HTTP redirects and retry mishandling.
Debian and Ubuntu APT flaw allows package swap
The flaw in APT lets MitM attackers swap verified packages and run code as root when retries are enabled.
Debian APT flaw lets attackers hijack updates and run code as root
CVE-2026-109518 in APT allows network attackers to replace verified packages and execute code as root on Debian releases.
Debian apt security update for CVE-2026-109518
Max Justicz found vulnerability allowing man-in-the-middle attackers to execute arbitrary code as root after HTTP redirects.
APT mishandles hard links allowing remote code execution
A remote on-path attacker can trick APT into installing an unverified package and achieve root-level remote code execution.
Debian apt security update fixes man-in-the-middle code execution
Max Justicz discovered a vulnerability in apt allowing man-in-the-middle attackers to execute arbitrary code as root by merging package downloads; fixed in version 3.0.4.
Gorbag APT group targets Ukrainian organizations with self-deleting malware
Gorbag APT uses BeautyStealer that erases itself after collecting credentials from Ukrainian law enforcement, city councils and defense entities.
Russia-aligned Gorbag APT targets Ukrainian entities
Gorbag harvests intelligence from Ukrainian law enforcement and frontline administrations using spearphishing since February 2025.
ESET maps APT activity from April through September 2026
China-, Iran-, North Korea- and Russia-aligned groups hit governments, semiconductors, drones, crypto firms and Ukraine.
Rapid7: high-severity flaws exploited within three days in Q3
The Gentlemen and Qilin led claimed ransomware incidents, the US accounted for 60% of attacks, and AI was operational in 8%.
4
SideCopy Hackers Target Indian Organizations With ReverseRAT Malware to Steal Data
SideCopy is spear-phishing Indian organizations with malicious shortcuts to deploy in-memory ReverseRAT for data theft.
3
Silent Lynx: Kazakhstan-Linked Hackers Target Russian Refinery and Government
Kazakhstan-linked Silent Lynx spies on Russia's Orsk refinery and regional governments using spear-phishing and lightweight malware.
8
UK and Allies Warn of Cyber Threat from China’s Integrity Technology Group
Allies warn Integrity Technology Group enables China-backed intrusions, email theft, and related hacking tools.
5
US Disrupts Chinese State-Sponsored Hacking Tools
The US seized domains for Chinese state-sponsored tools MicroScan and FishHub used against critical infrastructure.
5
Russian Spies Give 'MatchBoil' Malware a Stealthy Facelift
Cyber-espionage actor UAC-0099 has upgraded its MatchBoil dropper with stealthier capabilities for ongoing campaigns against Ukrainian organizations.
Russia-Aligned UAC-0099 Evolves MATCHBOIL Malware
ESET documents two years of UAC-0099 upgrades to its MATCHBOIL downloader used in espionage against Ukrainian government, energy and transport sectors.
China-linked malicious actors called out by UK and international partners for targeting sensitive data globally
UK and partners attribute global data theft to China-linked Integrity Technology Group and Flax Typhoon-related activity.
8
Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data
Joint advisory says Integrity Technology Group-enabled Chinese actors steal data from critical infrastructure using botnets and hands-on hacking.
UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing
Cisco Talos says UAT-11985 phished Taiwan researchers with AI-assisted event lures and real-time Google AitM.
Iranian Hackers Use Fake Dubai Airports Coding Test to Target Iraqi Critical Infrastructure
Unit 42 attributes Blinder Tunnel campaign to Iranian actors CL-STA-1178, targeting an Iraqi engineer via fake Dubai Airports coding test.
Researchers find Chinese hacking campaigns targeting AI firms, Asian governments
Chinese state-backed groups phished AI researchers and used the Antino backdoor against Asian governments, hitting about 350 endpoints.
Warlock Ransomware Hits Large Spanish, Portuguese Orgs
Warlock ransomware is hitting large Spanish and Portuguese organizations; the Chinese actor blends cybercrime and APT behavior.
2
China-Nexus Hackers Compromise 350 Systems Across Asia With New Antino Backdoor
Cisco Talos attributes UAT-11587 (China-nexus) to compromising ~350 endpoints in eight Asian countries using the Antino backdoor with Microsoft Graph-based C2.