Cybersecurity Newsfeed - 03/11/26

Cybersecurity Newsfeed

📅 03/11/26

🛡️ Vulnerabilities

• Over 1,000 GitLab Instances Vulnerable to RCE: Over 1,000 self-hosted GitLab instances remain exposed to critical remote code execution attacks targeting maximum-severity vulnerabilities. Attackers are actively targeting flaws like CVE-2026-97229, an integer overflow bug in GitLab’s CI/CD Regular Expression Compiler, which is currently listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog alongside CVE-2026-85706. More info

• Ivanti Connect Secure VPN Zero-Days Exploited: Ivanti released emergency security patches for Connect Secure VPN appliances addressing two actively exploited zero-day vulnerabilities (including CVE-2026-104935). CISA added these flaws to its KEV catalog after threat actors chained them with existing exploits to achieve unauthenticated root code execution, steal credentials, and alter system logs. More info

• Synology NAS Devices Targeted by C3RB3R Ransomware: Synology alerted NAS device owners to ongoing ransomware attacks deploying the C3RB3R payload, which encrypts files with a .L0CK3D extension. Attackers are exploiting unpatched 2024 vulnerabilities (including critical RCE flaw CVE-2024-10441 with a CVSS 9.8) on outdated DiskStation Manager (DSM) software builds. More info

🎯 Adversaries

• BITTER APT Targets South Asian Government and Engineering Sectors: FortiGuard Labs and security researchers uncovered a cyberespionage campaign by the BITTER APT group targeting South Asian government, energy, and engineering entities. The multi-stage infection chain leverages fake diplomatic LNK lure documents and custom PowerShell scripts to deploy PapRAT spyware for persistent data exfiltration and remote code execution. More info

  More info

• DarkBlinders Campaign Targets Israeli and Iraqi Kurdish Targets: Iran-aligned threat cluster DarkBlinders launched spear-phishing campaigns targeting high-profile Israeli targets and Iraqi Kurdish government cloud environments. The group exploited AppDomainManager injection, DLL sideloading, and spoofed government portals to deploy SHELBYLOADER malware and establish persistent access. More info

• Chinese Threat Actors Deploy ARTEX AI Framework: Chinese threat actors leveraged ARTEX, an open-source agentic AI penetration-testing framework, to execute automated, parallel attacks targeting over 200 international organizations across government, telecom, and technology sectors. More info

• SysGoRAT Malware Targets Government Linux Servers: Palo Alto Networks Unit 42 detected cyber espionage activity targeting government Linux servers using SysGoRAT malware alongside suspected AI-generated shell scripts containing inline conversational notes to harvest system credentials and establish persistent access. More info

• Fake Adobe Acrobat Pages Distribute ScreenConnect Installer: Threat actors are deploying fake Adobe Acrobat document-signing web pages to trick victims into executing genuine, digitally signed ScreenConnect remote management installers, granting attackers persistent remote access and elevated privileges on target endpoints. More info

🦠 Malware & Botnets

• XCPE Android TV Botnet Disrupted: International law enforcement agencies alongside Google disrupted the XCPE Android malware botnet involving over 1.3 million compromised Android TV set-top boxes across 206 models. The modular backdoor (x.cpe) operated with system-level privileges via MQTT protocols to execute commands, steal logs, and install payloads. Google permanently banned OEM manufacturer Videostrong for intentionally pre-installing the firmware backdoor for financial gain. More info

  More info

• VOLTA Infostealer Weaponizes LLMs for Victim Assessment: Cisco Talos uncovered VOLTA, a novel Windows infostealer leveraging Large Language Models (LLMs) such as Claude, Gemini, and Kimi to evaluate stolen victim data automatically. After harvesting credentials and personal files, VOLTA queries AI backends to rate target monetization value before delivering priority victim assessments to threat actors via Telegram. More info

• Deep Dive into Brazil’s Astaroth Banking Trojan Ecosystem: Security researchers analyzed the evolving Astaroth banking Trojan ecosystem targeting Brazil, detailing its abuse of GitHub steganography and WhatsApp Web for resilient Command-and-Control configuration hosting and lateral spreading. The malware employs geo-restricted JS downloaders and process hollowing techniques to harvest sensitive banking credentials from targeted browsers. More info

📈 Trends

• Mobile Carriers Retain Customer Metadata for Years: A privacy review highlighted that major mobile carriers retain customer call, text, and geolocation metadata for years, creating severe data breach and surveillance risks. Telecom security firm Cape demonstrated how core carrier retention windows leave long-term logs exposed, urging aggressive data minimization policies. More info

• Guardz Integrates Palo Alto Networks Prisma Browser: Guardz integrated Palo Alto Networks Prisma Browser for Business into its security suite to deliver enterprise-grade browser protection tailored for small businesses. The combined platform detects in-session web threats—including HTML smuggling and phishing—and correlates browser events directly with identity and endpoint telemetry. More info

💥 Breaches & Leaks

• Fintech Provider Abrigo (Sageworks) Taken Offline After Attack: Financial technology provider Abrigo initiated emergency maintenance on October 30 after detecting suspicious activity, taking its Sageworks banking application offline. Threat actors claim to have exfiltrated employee and account data, including names, email addresses, and phone numbers. Security researchers strongly advise affected financial institutions to rotate Sageworks API keys immediately. More info

• Chainalysis Confirms Security Breach via Autonomous Agentic AI: Blockchain analytics platform Chainalysis confirmed a security breach where attackers utilized autonomous agentic AI techniques to breach internal tools. The incident exposed customer names, emails, user IDs, and roles, though core investigation graphs, notes, and authentication secrets remained uncompromised. More info

• BTCPay Server Instances Targeted in Hot Wallet Crypto Thefts: BTCPay Server warned administrators to update their cryptocurrency payment processing software immediately due to unauthorized hot wallet thefts affecting outdated instances. Hosting providers suspended vulnerable instances running version 2.4.1 while maintainers investigate how attackers gained unauthorized administrative privileges. More info

📚 Others

• Guide on Reverse Engineering Android Applications with Apktool: A technical guide details using Apktool to reverse engineer Android applications by decompiling APK resources, modifying XML manifests and configurations, and recompiling and signing the modified binary for analysis. More info

---

⬅ Back to Archive