Malware | Breaking Cybersecurity News | The Hacker News

Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX . The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41 , Kaspersky said in a technical report published this week. The primary objective behind deploying the malware is to undermine Microsoft Windows startup defenses, along with third-party security solutions, while maintaining long-term, covert access to compromised devices. Notably, BlackX is assessed to be an updated version of BlackLotus , a notorious bootkit that was first observed being advertised on cybercrime forums in late 2022, before its existence was officially confirmed by ESET in March 2023. BlackLotus is designed to exploit a now-patched Secure Boot bypass vulnerability tracked as CVE-2022-21894 (CVSS score: 4.4...

Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is an "Autonomous Red Team Kill Chain Framework" referred to as Phantom. The threat actor is assessed to be Russian-speaking and functions both as an intrusion and data-extortion operator, as well as an infrastructure provider supporting different partners across the ransomware ecosystem. "The operators exploited edge and remote-access systems at scale, including FortiClient EMS, SimpleHelp, cPanel, and VPN gateways," SOCRadar said . "They used AI-managed knowledge bases to track victims, stolen credentials, and campaign progress." A notable aspect that defines the campaign is its "AI-executed, human-approved operating structure" in which a human operator provides a victim-specific prompt and reviews every step, while the intrusions themselves are e...

The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year. According to ESET , the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2025, via a spear-phishing email bearing a malware-laced attachment that led to the deployment of the MATCHWOK backdoor through a downloader called MATCHBOIL. The activity ultimately culminated with the threat actor handing off access to Sandworm, which then conducted a data-wiping attack on September 17, 2025, more than two months after it obtained a foothold. What makes the attack stand out is UAC-0099's use of a previously undocumented backdoor called MythicRatatoskr that communicates with a command-and-control (C2) server hosted inside the Yggdrasil mesh network. The backdoor was deployed a day after MATCHWOK was executed. There are indications that development on the bac...

Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium , as it emerges that weaponizing the flaws may be harder than previously thought. The attacks aim to exploit CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), which can result in unauthenticated remote code execution (RCE) via specially crafted HTTP requests. The vulnerabilities have been patched in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. "However, analysis of the sample revealed that it is an updated and significantly expanded version of the Mirai-derived botnet variant identified in early 2026," Sophos said . "The sample displays downloader and network disruption functionality." ⚡ WARNING — PHP Warns of Another Unpatched RCE Flaw CVE-2026-115560 Specifically, it resolves a hard-coded, encrypted command-and-control (C2) address, establishes a TCP connec...

This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs , compromised eMudhra certificates , a Node.js RCE flaw , a hacked LiteLLM release, and hundreds of hijacked Tor relays . That's a lot to deal with in just a few days. And the week isn't even over yet. But those big headlines are only half the story. Stolen passwords, exposed databases, broken login checks, and trusted tools being turned against their users are causing trouble too. Some attacks are clever. Others work because someone left a simple security gap open. This ThreatsDay, we're digging into the stories that didn't make as much noise but still deserve attention. Some are strange, some are serious, and a few might surprise you. Here's everything else you shouldn't miss this week. The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out.

LiteLLM on Wednesday disclosed that threat actors compromised "multiple independent security controls" to push a malicious version of the Python package containing a credential stealer and a backdoor. On October 21, 2026, LiteLLM's release pipeline was compromised to push 1.107.0 to the Docker Hub registry and the Python Package Index (PyPI) repository. The incident took place around 4:00 a.m. PST. The following compromised versions were published - LiteLLM v1.107.0 (PyPI) v1.107.0, latest, main-latest, and main-stable (Docker) v1.107.0, latest, main-latest, and main-stable (GHCR) Users who downloaded an unpinned version of LiteLLM between 11:39 a.m. and 1:23 p.m. UTC via pip or used the Docker image v1.107.0, latest, main-latest, or main-stable between 11:46 a.m. and 2:20 p.m. UTC are impacted. The poisoned version incorporated code to harvest credentials and keys, and run arbitrary code from a remote server every hour, turning it into a remote acce...

The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep , Socket , StepSecurity , and Upwind . The compromise affects LiteLLM 1.107.0, distributed through PyPI wheels and Docker images. The Python package has since been quarantined on Python Package Index (PyPI), and the malicious Docker images have been removed. Oliver Jensen, director of security at LiteLLM, said an investigation into the incident is ongoing, and that it's still working to trace the original attack vector by which the threat actor published the malicious release. "We have identified that the malicious actions were taken through three engineers' GitHub accounts, appearing to be by way of stolen GitHub CLI OAuth tokens," Jensen said . "The threat actor used one user's account to trigger the project-releaser run, and another user's account to approve it. A...

Google on Tuesday said it's rolling out improved safeguards in its Chrome browser to secure users against ClickFix attacks when Enhanced Protection is enabled. ClickFix is a popular social engineering technique in which bad actors trick users into copying and pasting malicious code directly into their computer's operating system, thereby bypassing conventional security controls. As part of these attacks, unsuspecting users who land on legitimate-but-compromised sites or click on malicious ads are redirected to phishing landing pages that display fake Cloudflare or Google reCAPTCHA verification or other non-existent errors and instruct users to copy and paste a command on the Windows Run dialog (or the Mac Terminal app) to address it. The moment a user presses the Enter key after pasting the command, it triggers a multi-stage infection chain that leads to the deployment of malware, such as information stealers or remote access trojans. In an attempt to blend in with re...

Cybersecurity researchers have disclosed details of a previously undocumented China-aligned threat cluster known as Bronze Sandcastle that has been observed targeting organizations in Asia and Africa since mid-2025. "The most distinctive technical marker for Bronze Sandcastle is its consistent use of Sandboxie DLL sideloading," Sophos security researcher Gabor Szappanos said in a post published Tuesday. Between August 2025 and August 2026, attacks mounted by the threat actor have resulted in victims in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea. Evidence indicates that Bronze Sandcastle is most active in the UTC+8 time zone.  DLL sideloading is a popular adversarial technique that exploits the way Windows loads DLL files, allowing an attacker to trick a legitimate program into loading a malicious DLL . When an application is launched, it needs to load various DLLs in order to function correctly. If the application does not provide the f...

Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords, a researcher found. Exit relays are the last hop in a Tor circuit, where traffic leaves the network for its destination. Only a password login to an SSH server made through Tor between October 1 and 5, after accepting the interception server's host key, could have been captured. The Tor Project began flagging relays on October 4, and by October 5, none remained in the consensus, the list of relays that Tor clients use. At the peak on October 4, the relays carrying the attacker's exit policy made up 7.46% of Tor's exit capacity, measured by consensus weight, according to an  analysis of public Tor directory data  posted to the tor-relays mailing list. The researcher, who publishes as kaba,  scanned  all of Tor's roughly 3,000 exits on October 2 and found 333 redirecting SSH to the same 12 interception servers...

Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites. TeamUpdraft is the developer behind UpdraftPlus, a popular WordPress backup plugin with over four million active installations. The vendor also offers UpdraftCentral, a remote management service that's used for managing multiple sites remotely. A client component of UpdraftCentral is shipped within every copy of UpdraftPlus.  "Over the weekend of 17-18 October we identified unauthorized access to the teamupdraft.com website," TeamUpdraft said in a statement. "Our team responded straight away and worked through the night to contain it – we closed the access route, signed out every account and replaced the keys and credentials that could have been affected." As a result of the incident, threat actors are believed to have accessed its ...

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities ( KEV ) catalog, including four vulnerabilities impacting Plex Media Server that's collectively called Plex2Shell . The vulnerabilities are listed below - CVE-2026-96652 (CVSS score: 5.3) - Plex Media Server Server-Side Request Forgery (SSRF) vulnerability CVE-2026-96654 (CVSS score: 6.9) - Plex Media Server improper neutralization of encoded URI schemes in a web page Vulnerability CVE-2026-96655 (CVSS score: 5.3) - Plex Media Server Server-Side Request Forgery (SSRF) vulnerability CVE-2026-96656 (CVSS score: 8.6) - Plex Media Server external control of file name or path Vulnerability According to security researcher Zach Main, who discovered and reported the vulnerabilities, a remote attacker could chain the four vulnerabilities to achieve unauthenticated remote code execution. The issues were addressed in Plex Media ...

A Belarus-aligned hacktivist group spent nearly two years within the network of a Russian healthcare organization. According to a report published by Russian cybersecurity firm Solar, the activity has been attributed to a threat cluster dubbed Partisan Zmiy , which is also known as the Cyber Partisans . Known to be active since at least 2020, the group has a track record of striking industrial enterprises and government agencies in Russia and Belarus with a backdoor called Vasilek that uses Telegram for command-and-control (C2) and data exfiltration. Some of the attacks have also leveraged phishing lures to deliver an installer that simultaneously deploys the legitimate FortiClient VPN program on the system as well as an open-source program known as DNSCat2 that allows attackers to gain control of the infected host. A notable aspect of the threat actor is their ability to stage destructive attacks with a wiper referred to as Pryanik, alongside taking steps to systematical...

The Russia-linked state-sponsored threat actor tracked as APT28 (aka BlueDelta, Fancy Bear, and Forest Blizzard) has been attributed to attacks targeting two member states of the North Atlantic Treaty Organization (NATO). The Symantec Threat Hunter Team, which is tracking the activity cluster under the moniker Swallowtail , involved the use of a backdoor called HOOKEDGE and a previously undocumented loader that is designed to decrypt and run an encrypted payload in memory by using a cryptographic key that's supplied at runtime. Targets of the activity included a law enforcement agency, a naval shipbuilder, and a manufacturer of military aircraft engines – entities that hold information that could be of use to a foreign intelligence agency, the Broadcom-owned threat intelligence unit said. "During one attack against the naval shipbuilder, operators returned to a compromised host repeatedly over the course of a week in what appeared to be hands-on-keyboard activity,...

An attacker used a contributor's GitHub account to replace the download archives on five existing releases of OVHcloud's command-line tool on Monday, October 19. The account had been hijacked, and the new files were a build designed to steal secrets stored on the disk of any machine that runs it, the cloud provider says. They were live on GitHub for up to 94 minutes, from 12:47 to 14:21 UTC, and reached only people who installed or updated the OVHcloud CLI during that window, via a path that checks for no hash, on macOS, Linux x86_64 or arm64, or Windows x86_64. OVHcloud deleted the swapped archives and published a clean  v0.16.0  that evening as an immutable release, whose files GitHub will not let anyone change. The source code, the release tag, and the company's build pipeline were not touched: the bad build was a plain go build of a later commit, uploaded straight onto releases published between April and September. Who Was Exposed On v0.15.0, the attac...

Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks. The high-severity vulnerability, tracked as CVE-2026-110936 (CVSS v4 score: 8.4), could allow an attacker to place a specially-crafted DLL in a directory the application searches, resulting in execution of malicious code with the same privileges as the affected service. "The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path," Siemens said in an advisory. "This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application." The issue has been patched in version 4.0.9.8. Huntress Labs researcher Jose Oregon has been credited with discovering and reporting the shortcoming. In a separate alert, Siemens said attackers have abused a genuine ...

Cybersecurity researchers have disclosed details of a ClickFix delivery platform called ROMULUS that's being used to distribute malware such as Legion Loader. According to Forescout Research - Vedere Labs, ROMULUS is akin to a malware delivery service that employs ClickFix-style lures on bogus landing pages to trick unsuspecting users into running malicious commands and infecting their own machines. "ROMULUS may be a privately operated panel, a commercial cybercriminal delivery service, an affiliate framework, or software that has been copied between operators," security researcher Sai Molige said in an analysis. The cybersecurity company said it identified six IP addresses running ROMULUS -

Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public. According to a researcher who goes by the online alias boredhackerblog , the exploitation activity involves chaining four different vulnerabilities, collectively called Plex2Shell . The vulnerabilities are below - CVE-2026-96652 (CVSS score: 5.3) - An unauthenticated server-side request forgery (SSRF) stemming via the "/player/timeline" endpoint by taking advantage of the fact that the "protocol" parameter is inserted into a programmatically-constructed player URL with no validation, allowing an attacker to force the Plex server to POST to a destination of their choice. CVE-2026-96654 (CVSS score: 6.9) - An improper neutralization of URL values included in the "searchOne" endpoint that could allow an attacker to call other plugins' functions and...

Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, Rank Math said in a  security notice  published on October 16. Any site that installed and activated one of those copies should be treated as compromised, and the malware can recreate its hidden backdoor whenever someone visits the site. Rank Math has removed the affected files and released a clean version, 3.0.124. Installing it replaces the plugin but does not remove files, administrator accounts, or scheduled tasks the malware may already have placed elsewhere on the server, Wordfence said in an  advisory  on October 17. Who Is Affected The version number does not show whether a copy is affected. Rank Math's  changelog  dates 3.0.123 to October 7, more than a week before the window opened, and the notice limits the inciden...

The worst problems don't always come with a warning. Sometimes they arrive through a service everyone trusts, a device someone bought, or a system nobody thought to check. By the time something looks wrong, the damage may already be done. This week had plenty of that. Trusted connections became a problem. Hardware wasn't as safe as it looked. Old bugs found new victims, and some systems were left so exposed that breaking in barely required any effort. Even AI agents crossed lines they weren't supposed to. Some attacks were clever. Others were painfully simple. The full recap shows just how much can go wrong, and how little it sometimes takes. ⚡ Threat of the Week ConnectWise Suspends Cloud Backup Following Unauthorized Access — ConnectWise disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenant...