Executive summary

In 2025, several threat actors exploited CVE-2025-53770 and CVE-2025-53771 (ToolShell vulnerabilities) in on-premises Microsoft SharePoint to achieve remote code execution through crafted HTTP requests. One of the threat actors deployed ransomware on the target’s systems after successful exploitation. Microsoft attributed this ransomware-related ToolShell activity to Storm-2603, distinguishing it from other actors whose observed activity was primarily focused on credential theft, espionage, and data exfiltration.

In December, our retrospective analysis identified activity consistent with Storm-2603’s TTPs. This activity involved the attacker using the IIS worker process as an in-memory bridge to the customer’s infrastructure, keeping the access and control layer entirely within w3wp.exe without writing anything to disk. Although subsequent post-exploitation activity generated disk artifacts, the bridge used to maintain access remained memory-resident.

Let’s look in more detail at this attack.

Intrusion timeline: Strategic latency and exploitation

The intrusion analyzed in this report occurred in two stages, with a temporal gap between initial access and subsequent exploitation activity. The attack timeline was as follows:

• Dec 20 – Vulnerability fingerprinting: A single HTTP request targeted a SharePoint administrative endpoint associated with the ToolPane component to determine whether the host was vulnerable to CVE-2025-53770.
• Dec 21-23 – Tactical latency: A three-day period of silence followed the initial probe, separating the vulnerability fingerprinting from subsequent malicious activity and potentially reducing the likelihood of immediate detection.
• Dec 24 – High-intensity re-engagement: On Christmas Eve, when security staffing at many companies is reduced, the full RCE chain was executed through the IIS worker process (w3wp.exe) on the same endpoint as the initial probe.
• Dec 26 – Incident discovery: The three-day gap initially prevented the December 20 probe from being correlated with subsequent malicious activity, marking the event as low priority. Retrospective analysis established that the probe was the initial phase of the subsequent intrusion.

Initial access validation phase

Vulnerability fingerprinting

A vulnerability fingerprinting request on December 20 marked the first observed interaction with the target. The request originated from infrastructure associated with ONYPHE, an internet-scale attack surface discovery and management platform for identifying exposed assets, vulnerabilities, and cyberthreats. Unlike widely used tools such as Shodan and Censys, which merely provide a list of internet-facing assets correlated with the open-source data about known vulnerabilities, ONYPHE actually checks if the target system is vulnerable.

The request characteristics were consistent with ONYPHE’s vulnerability checks, which use active, non-intrusive probes to identify internet-exposed systems vulnerable to specific CVEs. For ToolShell, ONYPHE adopted the approach used by Niels Hofmans (hazcod). Namely, it attempts to inject a harmless marker into the target server to find out if it is vulnerable.

This phase served as a validation step against the SharePoint execution surface exposed over HTTP:

• The target processed structured requests through the ASP.NET pipeline without rejection.
• The request path reached application logic capable of handling serialized input.
• No defensive controls interrupted or altered the execution flow at the application boundary.

Approximately 12 minutes later, a second inbound connection originated from infrastructure associated with Pfcloud UG, a provider operating under a bulletproof hosting (BPH) model. Given the timing and the IP’s documented history of scanning and abusive activity, the connection may represent follow-on reconnaissance against the newly identified target. No exploitation was attempted at this stage.

Active exploitation: Santa took your data and left a backdoor

The main malicious activity occurred on December 24. The actor targeted the same SharePoint host with a crafted request from 45.91.94.204 (45.91.92.0/22, ASN 63473, HostHatch, LLC). This resulted in a webshell execution within the IIS worker process (w3wp.exe). The payload was not written to disk; rather, it was loaded directly into the ASP.NET runtime and used during subsequent request processing. The implant remained resident for the lifetime of the affected application domain. This runtime state was lost when the application pool was recycled or IIS was restarted.

Attack originated from an SPN node

The IP address 45.91.94.204 is a Safing Privacy Network (SPN) node. SPN routes each connection through a multilayer VPN path with multiple relay nodes that can obscure the originating IP.

SPN promotes itself as a network that offers strong privacy protection for internet traffic. Its infrastructure resembles Tor’s in many ways, but with some differences. It features the following capabilities:

• Speed: Near-VPN performance for high-speed data transfer.
• Layer 3 support: Supports multiple protocols like TCP, UDP, ICMP (unlike Tor, which only supports TCP).
• App-routing: Direct tunneling without a browser.
• Multi-identity: Simultaneous exit nodes to bypass IP rate limits.
• Fixed-size packets and padding make it harder to analyze its traffic.

It is less common than Tor, and frequently bypasses standard Tor blocklists.

Webshell architecture

The webshell the attackers injected into the w3wp.exe runtime is a multi-module in-memory framework, where execution is orchestrated through the main component (G.cs) and extended via multiple functional units across namespaces.

The implementation follows a modular C# project structure in which each capability is isolated into its own compilation unit and invoked dynamically at runtime.

“G.cs” pipeline control and C2

Pipeline control

The main webshell component is G.cs. It orchestrates the implant’s execution context, lifecycle, C2 and session management.

To ensure persistence within the runtime, G.cs performs the following actions:

• Registers a custom VirtualPathProvider using the non-public RegisterVirtualPassProviderInternal method from the ASP.NET HostingEnvironment class so that ASP.NET uses it for virtual-path processing. The provider is automatically added to the chain of registered virtual path providers.
  
• Delegates the provider’s .NET Remoting lifetime policy to the previous provider in the chain, preserving the existing lifetime behavior.
  

Additionally, to evade defenses and enable the VirtualPathProvider to be registered even if the application in whose AppDomain the webshell is running is precompiled, the module implements the trust control subversion (T1553) technique:

• Uses reflection to check if the application is precompiled.
• Extracts pointers for internal state fields for the BuildManager class, which manages application compilation, and modifies them at runtime.
  
• Uses reflection once again to force runtime injection.

G.cs uses the GetCacheKey() function as the interception point for the virtual path processing flow. It processes incoming requests to the SharePoint server and checks their headers to filter out requests from the attacker.

The specific User-Agent in the request headers triggers the webshell execution. If the request doesn’t match this condition, the implant remains dormant, making its traffic harder to recognize.

Command and control layer (in-memory transport)

The same core module (G.cs) implements the communication layer.

Instead of relying on external frameworks or standard beacons, it uses a custom binary protocol with XOR-based obfuscation to exchange data with the C2. These communications blend into normal application traffic. The module uses the GetCacheKey() hook to intercept standard HTTP requests. When a specific User-Agent is detected in the request headers, the module parses it, extracts the payload, and establishes a TCP connection to a target host inside the target’s network if needed.

G.cs establishes a full-duplex proxy tunnel to support interactive control. It stores active target sockets in memory to pair concurrent HTTP read and write channels.

TCP connections from the C2 server to arbitrary hosts inside the target network are supported for pivoting and lateral movement. The traffic is proxied through the SharePoint host.

As can be seen in the screenshots, the attackers used the suo5 tool to implement traffic proxying. Its authors promote it as a stable forward-proxying tool for scenarios where outbound internet connections are prohibited.

To increase its performance, G.cs manipulates ThreadPool by raising its limits for concurrent operations and maximum timeout.

“Prog.cs”: Execution entry point and task dispatcher

Prog.cs is the entry point that receives command-line arguments and passes them to uk/London.cs. The latter acts as the orchestrator, handling command parsing and privilege escalation (via named pipe impersonation). We’ll review it in more detail later. If the “suo5” command is provided, London.cs triggers G.cs to hook into the ASP.NET runtime as a memory shell. Once active, G.cs independently processes incoming web traffic inside the web server memory.

Host interaction modules

The following modules provide direct system interaction capabilities, each implemented as a separate unit. London.cs triggers these modules when it receives a corresponding command from Prog.cs.

“FileDownloader.cs”

The FileDownloader.cs module downloads arbitrary files from external URLs provided by the C2. It stores the downloaded files in the Program Data directory without any user interaction.

“LoggedOnUsers.cs”

This module enumerates logged-on users and identifies their session types (interactive, service, remote). The results are stored in memory. The attackers can retrieve them using the proxy and tunneling capabilities provided by G.cs.

“ProcessList.cs”

This module lists running processes with full paths to the corresponding executables on the disk. The results are stored in memory and the attackers can retrieve them via G.cs.

“NetworkInfo.cs”

This module extracts information about existing network connections, including protocols, local and remote IPs and ports, and connection state. It also enumerates network interfaces and headers. The results are stored in memory and can be retrieved by the attackers via G.cs.

“MSI.cs”

This module silently installs and executes MSI packages previously downloaded by FileDownloader.cs.

“User.cs”

This module creates administrative accounts using the native SAM RPC subsystem (SAMRPCNative namespace) rather than standard command-line tooling. This may indicate an attempt to evade detection and provide the attackers with privileged stealthy access to target systems that persists after the webshell has finished its work.

SAMRPCNative

The SAMRPCNative namespace implements a low-level C# P/Invoke wrapper for the native Windows samlib.dll library, comprising three types: SAMStructs.cs, SAMMethods.cs, and SAMEnums.cs.

“SAMEnums.cs”

Implements structured bitwise lists and constant flags mapping numeric codes to their security meaning in SAM, and translates system status return codes.

“SAMStructs.cs”

Defines native data structures required for P/Invoke memory alignment and for marshalling. It securely formats and aligns data structures.

“SAMMethods.cs”

Contains external API declarations (P/Invoke) imported from samlib.dll to perform actions such as connecting to the SAM server, creating users and opening domains.

This layer is crucial for the attackers because it enables account operations.

Privilege escalation

The uk namespace contains offensive primitives for privilege escalation. To elevate privileges to SYSTEM, it uses a local token impersonation technique via the Encrypting File System Remote Protocol (EFSRPC) interface adopted from the EfsPotato tool.

This functionality is implemented in the uk/London class. It creates a malicious named pipe while the EfsrTiny class (a tiny version of the EfsPotato tool) connects to the LSASS.exe RPC server. Then it’s London.RpcThread function calls the EfsRpcEncryptFileSrv function from EfsrTiny with a crafted \\localhost path. This tricks LSASS.exe into connecting back to the attacker’s named pipe. Finally, the London.Exp function uses ImpersonateNamedPipeClient to coerce and impersonate the LSASS.exe token and spawn a new process via CreateProcessAsUser with SYSTEM privileges. As the webshell resides in the IIS worker process, it has the necessary SeImpersonatePrivilege to perform this technique.

The uk namespace also implements a minimal MSRPC client layer by explicitly defining structures such as RPC_CLIENT_INTERFACE and MIDL_STUB_DESC, thereby spoofing an interface stub. This enables direct interaction with the Windows RPC runtime (Rpcrt4.dll) without relying on MIDL-generated stubs or higher-level RPC abstractions. This provides direct control over binding and marshaling that goes beyond the constraints of standard client APIs.

Post-exploitation activity

Shortly after the webshell injection, the infected worker process spawned msiexec.exe to install a remote MSI payload hosted in Supabase cloud storage. The payload was Velociraptor, an open-source digital forensics and incident response tool – namely version 0.73.4.0 vulnerable to CVE-2025-6264 – that the attackers abused for command execution on the target network.

In October 2025, Cisco Talos reported Velociraptor being leveraged by threat actors as a post-compromise execution framework and attributed this activity to Storm-2603. This tool enables arbitrary command execution, and can be used for various purposes. In our case, it was used for persistence, discovery, data collection and payload execution.

The threat actor used Velociraptor to deploy multiple independent tunneling mechanisms, including Zoho Assist-Unattended Support for unauthorized remote access, VS Code CLI tunneling, Cloudflare Tunnel, and a lightweight reverse proxy utility. By doing so, they attempted to maintain access even if some of their tools were detected and deleted. At this stage, they also no longer depended on the IIS worker process lifecycle and ToolShell vulnerability.

EDR-killing attempts

Once the threat actor had access to the target system, they were able to upload a vulnerable driver that is used by many attackers to terminate EDR solutions. We were able to detect the main driver at C:\programdata\rsndispot.sys (054a32d6033b1744dca7f49b2e466ea2). In addition, the adversary used a malicious DLL (2d9ebf9c042f596f435865b40edad928) in a sideloading attack. This DLL was identified as Warlock ransomware’s AV killer. It was possibly intended to kill security solutions using the vulnerable rsndispot.sys driver.

Ransomware deployment attempt

The attackers made attempts to launch ransomware on the compromised system. However, the Proactive Defense Module in Kaspersky Endpoint Security blocked the ransomware process, effectively preventing this activity. The malware DLL we obtained was identified as Warlock ransomware.

What defenders really need to look for

ToolPane deserialization and CLR artifacts

When the attackers tried to access ToolPane, both the dynamically compiled App_Web_toolpane.aspx assembly and the Microsoft.GeneratedCode helper assembly were present within the same application domain.

Both assemblies are used in legitimate scenarios. App_Web_* assemblies are generated during normal ASP.NET page compilation, while Microsoft.GeneratedCode is typically produced by the XmlSerializer during legitimate serialization workflows. However, a request to the ToolPane endpoint that results in immediate loading of Microsoft.GeneratedCode within the same execution window indicates that the runtime is processing serialized data supplied through the request.

Detecting deserialization exploitation

First, it is highly recommended to read this article (in Russian) on how deserialization exploit attempts in the CLR should be detected, with examples of YARA rules and monitoring recommendations. A summary of the main idea of the detection logic is provided below.

Deserialization vulnerabilities should be treated as a distinct class of exploitation events. In the CLR, deserialization is not merely the conversion of bytes into values – it is the reconstruction of an object graph from an incoming stream. Serialization and deserialization are performed by formatters. One of the most widely used formatters is BinaryFormatter. It uses the NRBF format, which defines the stream as a sequence of records describing classes, arrays, primitives, and references between objects. The shape of the resulting graph is determined by the data supplied to the deserializer. This means that the input stream defines not only the values but also the specific types, relationships, and lifecycle points that the runtime must materialize.

Microsoft states explicitly that BinaryFormatter is unsafe and cannot be made safe; beginning with .NET 9, the in-box implementation is effectively removed from ordinary use. However, Microsoft continues to use it in its products, including SharePoint, because it is powerful and easy to use. To fix BinaryFormatter-related issues, architectural changes are needed. Similar warnings also apply to related unsafe mechanisms, including LosFormatter (used in the vulnerable page).

The primary risk of unsafe deserialization is that the CLR may resolve unexpected types, instantiate objects outside normal constructor invariants, and invoke special lifecycle mechanisms such as ISerializable, IObjectReference, IDeserializationCallback, and methods marked [OnDeserialized]. In other words, the attacker-controlled data can force the runtime to construct a graph containing types with executable side effects.

A practical detection strategy should therefore focus on graph-construction artifacts. CLR loader events identify the relevant assemblies and application domains. Memory and metadata inspection then reveal the type names and generated serializer structures associated with the suspected gadget chain. In ToolShell-like scenarios, unsafe deserialization usually produces helper assemblies (evidence in loader events) with metadata containing fully qualified type names, gadget class names, and string representations of the constructed generic types (just scan via YARA for it). In our case, the artifacts to look for include Microsoft.GeneratedCode, App_Web_toolpane.aspx* (evidence of deserialization in loader events) as well as strings identifying ObjectDataProvider, ExpandedWrapper, and LosFormatter (evidence that the input stream was deserialized into dangerous objects). Note that these indicators are not significant in isolation; their value lies in the fact that they show the runtime has already received data requiring helper code generation to reconstruct a dangerous object graph.

Gadget objects that exploit vulnerabilities like those associated with ToolShell are conveniently represented in corpus-style tooling such as ysoserial.net/YSoNet, which aggregate known gadget chains for unsafe .NET deserialization. For defensive purposes, the value of these projects lies not in their offensive capability but in the catalog of types and structures that can be searched for in streams, memory, and helper assemblies. The presence of any of them in memory or in a helper assembly should be treated as a strong indicator of exploitation.

To simplify deserialization exploit detection, we created a tool named CLRDeserializationExploitFinder. It can detect ToolShell exploitation attempts, as well as other gadget chains covered by ysoserial.net.

Detecting a VPP-based webshell/runtime implant

A mechanism based on VirtualPathProvider should be treated as a separate class of runtime implant (no files involved). In ASP.NET, HostingEnvironment.RegisterVirtualPathProvider registers a new virtual-path provider (VPP) in the application’s compilation system. Once registered, the application can serve virtual paths during dynamic compilation as though they were ordinary on-disk pages. Dynamic compilation does not require the payload to exist as a file in the filesystem. It operates entirely within the trust boundary of the application itself. During the compilation process, temporary files may be generated, but they cannot be treated as reliable forensic artifacts. Because VPPs can also be used for legitimate purposes, the defensive model should begin with an inventory of the legitimate VirtualPathProvider implementations. In all other cases, the registration or use of a new VPP should be considered anomalous.

To see how the dynamic generation of virtual pages using ASP.NET, IIS, and the CLR works, and to learn how to detect such activity, use our project VirtualPathProvider Lab.

The most useful telemetry source for this technique is the Microsoft-Windows-IIS-Configuration ETW provider. To detect virtual paths, events 25 and 47 are of primary value. Event 25 records the mapping of ConfigPath to PhysicalPath, and event 47 records the mapping of the configuration path to a directory. In the case of a VPP-backed path, these events create an inconsistency: IIS and ASP.NET behave as if the path has a physical representation, while the corresponding file does not exist on disk. In the example provided by VirtualPathProvider Lab, this appears as a mapping of the virtual resource googlecheck.aspx to a physical path where no real file is present. This discrepancy between configuration resolution and filesystem reality is the primary indicator of virtual content.

The second indicator is more negative than positive. For disk-backed files, IIS normally creates a FileChangeNotificationMonitor chain, as reflected in events 17, 18, 19, and 21. For virtual paths served by a custom VirtualPathProvider, this chain is absent or does not match the normal profile of an ordinary file because there is no physical object or corresponding on-disk change lifecycle. Consequently, the presence of positive events 25 and 47 combined with the absence of the expected events 17, 18, 19, and 21 for the same path forms a reliable detection pattern: the path exists for IIS as a configuration-resolved resource, yet it is not backed by the filesystem and is not accompanied by normal file-change monitoring.

To sum up, the hunting target here is the discrepancy between how IIS/ASP.NET resolves a resource and what is actually present on the disk and in the change-monitoring chain. For known applications, such cases can be filtered through an allowlist of legitimate VirtualPathProvider implementations. Anything else should be treated as a potential runtime implant and examined using ETW, filesystem verification, and memory inspection of the w3wp.exe process.

Attribution

Microsoft tracks Storm-2603 as a standalone threat actor with no known links to other groups. While they are careful about assessing the actor’s motivation, they mention that it has previously deployed Warlock and LockBit ransomware following active exploitation of on-premises SharePoint vulnerabilities. In the analyzed incident, we observed similar SharePoint exploitation activities, as well as an EDR killer associated with Warlock ransomware and unsuccessful Warlock launch attempts.

Other documented intrusions have identified Storm-2603 as leveraging known flaws within perimeter mail gateways to achieve initial access, subsequently staging the Velociraptor framework with elevated privileges and establishing persistent encrypted tunnels via commercial remote management software to orchestrate secondary lateral movement. This aligns with the post-exploitation behavior we observed in our case. Together with the ToolShell exploitation scenario, this allows us to attribute this case to Storm-2603 with moderate confidence.

Conclusion

From the incident analyzed in this article, the main defensive lesson is that exploiting an internet-facing SharePoint server can enable fileless code execution directly inside the application trust boundary. Storm-2603 did not require a conventional dropper, persistent service, or exposed C2 endpoint; instead, it deployed a webshell inside w3wp.exe, from which tunneling, privilege escalation, credential access, and lateral movement could be orchestrated. Detection therefore needs to move beyond file-based webshell hunting toward runtime behavior, such as anomalous w3wp.exe activity, unexpected outbound connections, RPC coercion, token impersonation, and the introduction of remote-management or DFIR tooling after application compromise.

To correctly attribute malicious activity and develop appropriate response measures, defenders should reconstruct execution chains and temporal relationships across application, host, and identity layers. They should also preserve memory and IIS telemetry, and correlate low-signal reconnaissance with subsequent privileged activity rather than evaluating events in isolation. A confirmed SharePoint exploit with code execution should trigger host-level containment, persistence hunting, credential and exposed MachineKey rotation, and TTP-driven investigation rather than remediation limited to the initial exploit or known IOCs.

Kaspersky products detect the threats mentioned in this article as:

• Trojan.MSIL.Agent.gen
• Trojan.Win64.DLLhijack.cdp

Indicator of compromise

Indicator of compromise	Description
45.91.94[.]204	SPN node
0xFD91321BF7FF7245DDA9B7B5D791ACE8	vskp2 – webshell implant
hxxps://vdfccjpnedujhrzscjtq[.]supabase[.]co/storage/v1/object/public/image/v4[.]msi	Vulnerable Velociraptor package
0x3A55D8F8F29716C694671834D8C6CB29	C:\ProgramFiles\Velociraptor\Velociraptor.exe
hxxps://auth[.]qgtxtebl[.]workers[.]dev/	Velociraptor server URL
199.232.210[.]172	C2 traffic relay
0x991EC6E04413F2D4D29341C17A8A54D5	Abused legitimate VS Code
0x3D553B9061C03F891CE97D7D2E64DDEE	VS Code Insiders for tunneling
91.224.92[.]121	Bulletproof-hosted C2 server
49.51.132[.]100	SPN node
hxxps://github[.]com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64[.]msi	Abused legitimate tunneling tool
0x2C32E44A013CBFC5A323EFB7694701D2	Abused tunneling tool executable
hxxps://files[.]catbox[.]moe/8f7vex[.]msi	Abused Zoho Assist Unattended Agent download URL
0x112A86ECA3CB5A0B5E20AB744CC5AF93	7z.exe renamed for sideloading
0xA930F81E3FB0A226EC5904D9043A17B8	C:\ProgramFiles(x86)\ZohoMeeting\UnAttended\ZohoMeeting.7z
204.76.203[.]219	Bulletproof-hosted C2 server
0x054a32d6033b1744dca7f49b2e466ea2	Vulnerable driver

Microsoft Authenticator's Android backup switch is coming in January. Existing recovery settings may not carry over automatically.

The post Microsoft Authenticator’s Android Backup Switch Is Coming in January — Google One Takes Over appeared first on TechRepublic.

On October 29, Binance lost control of about $6.34 billion in digital assets in a matter of hours. The attackers did not break in on that day, though. They had been working their way inside since June. The Binance hack was a slow campaign aimed at a handful of engineers, and it used a tampered download, a fake job interview and the exchange's own internal AI tool to reach the systems that sign transactions. Binance CEO Richard Teng called it "one of the most sophisticated attacks the digital asset industry has ever seen." He said the company takes full responsibility and that no user will bear the loss.

Why the Binance Hack Targeted Engineers, Not Systems

According to the post-mortem Binance released on Tuesday, the attackers went after people with access to wallet infrastructure. In June, Wallet DevOps Engineer A searched for a popular AI coding tool and downloaded a tampered Homebrew installation. Binance's security team spotted the anomaly, replaced the device and rotated his credentials. But the damage was done in another way: Engineer A's role, and his colleagues on the wallet infrastructure team, were now known to the attacker. In September, the attackers moved to social engineering. Software Engineer B, whose profile on a legitimate job-hunting platform mentioned his Binance experience, was approached by someone posing as a project director. A first-round video interview followed with a supposed HR representative, who shared personal photos and videos on social media to build trust. Binance said this was more advanced than social engineering it had seen before. In the second round, held on a popular chat app, Engineer B was told to download an "assignment" onto his work computer. It contained malicious code that ran during setup, swapped a legitimate development tool for a malicious version, and connected to an attacker-controlled server. The zero-day malware was not detected by endpoint security tools at the time. On October 20, the attackers used Engineer B's compromised computer and an internal AI tool to gain control over Engineer A and another wallet engineer, Engineer C. They then found that Engineer A had a container deployment permission token on his machine.

How the Binance Hack Unfolded on October 29

Between 17:15 and 19:56 UTC, the attacker logged onto Engineer C's computer, used Engineer A's stolen credentials, deployed a container and triggered a malicious script. That gave them unauthorized access to an internal wallet signing service, which they used to send transactions outside the normal withdrawal process. Between 20:05 and 20:09 UTC, five Binance hot wallets sent 233.46 million XRP to an attacker-controlled address. Hot wallets on Solana and Optimism sent about 970,500 SOL and 44.2 million OP. Binance then received an internal alert about large transfers, and another hot wallet sent 18,270 BTC.

Why Binance Couldn't Stop It Faster

Binance suspended withdrawals, but that did not end the outflows. The attacker had used the signing service to exploit Ethereum's EIP-7702 authorization mechanism. By submitting 50 signing transactions, they gave an attacker-controlled smart contract partial execution rights over a Binance hot wallet. Those authorizations lived on-chain and worked independently of Binance's withdrawal systems. And because the wallet used Multi-Party Computation, there was no single private key that could instantly revoke them. Binance had to build a special procedure to do it. The final unauthorized transfer of 2,961.9 ETH was confirmed at 23:56 UTC. At 00:10 UTC on October 30, Binance cleared the malicious delegation.

Who Is Behind It

Over the weekend, the FBI and other U.S. agencies blamed the theft on TraderTraitor, a North Korea state-sponsored group that has spent years attacking cryptocurrency platforms. Binance said it had detected and stopped 57 suspected North Korea-linked threats in 2026 alone, many using fake job interviews and malicious developer tools. On Tuesday, Kim Yo-jong rejected the U.S. findings, calling them a "grave political provocation" in a statement carried by the Korean Central News Agency. Observers noted the statement ended by saying Pyongyang had matters to "reconsider," without directly threatening retaliation. South Korea's Unification Ministry called her personal response unprecedented. An official said it suggested the North was taking the allegations seriously and was "increasingly conscious of its international standing."

Where Users Stand

Binance says it has set aside more than 100% of the funds needed to cover the loss. As of October 31, 98% of impacted token assets had been replenished, and Binance is buying the remaining, less liquid assets. About $2.85 billion has been frozen or intercepted with help from law enforcement, token issuers and blockchain intelligence firms. Withdrawals have broadly resumed. The exchange says it has rebuilt the affected wallet system and AI tool, replaced devices, revoked credentials tied to the affected engineers and brought in independent security firms. The investigation is ongoing.

Binance explains how North Korean hackers used fake job interviews, malicious developer tools and an internal AI tool…

The FBI attributed the $6.3 billion Binance crypto heist to North Korean state hackers, sparking denials from Pyongyang amid ongoing asset recovery efforts.

Related Posts:

• Cloudflare DDoS Report Shows 18.2 Million Network Attacks in Q3 2026
• Chinese Hackers Deploy Chrome Zero-Day Exploit Chain
• NCSC Warns of Physical Disruptions from Cyberattacks on OT Systems

The post North Korea Binance Heist: Pyongyang Denies $6.3B Hack appeared first on Daily CyberSecurity.

Arista fixed critical Arista security vulnerabilities CVE-2026-111497 and CVE-2026-98432 that allow unauthenticated remote code execution. Update now.

Related Posts:

• Ubuntu Kernel Fixes for CVE-2026-98432 (CVSS 9.8) Land in Proposed Pocket
• cPGuard Supply Chain Attack Pushes Backdoor Through Update Channel
• TeamViewer Client Vulnerability Enables Remote Code Execution

The post Arista Security Vulnerabilities Risk Remote Code Execution appeared first on Daily CyberSecurity.

The FBI blames North Korea for stealing $6 billion from Binance and urges crypto firms to block transactions linked to the stolen funds.

The FBI has named North Korea as the party behind the theft of more than $6 billion in virtual assets from the crypto exchange Binance, on or about October 29, 2026. The bureau published its findings in a public alert. The FBI specifically blames the North Korea-linked APT “TraderTraitor,” also tracked as Lazarus Group and APT38.

Binance hasn’t named a culprit, but the blockchain analysis firm TRM has. It was the first to attribute the attack to TraderTraitor, and Chainalysis also said it’s highly confident in that finding.

“The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as “TraderTraitor.”” reads the FBI’s statement.

“The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.”

Attackers used access from an engineer’s laptop to reach a service container and send unauthorized withdrawal requests. Binance says it has found no evidence that attackers stole any wallet private keys.

The FBI, along with the U.S. Secret Service (USSS) and IRS Criminal Investigation (IRS-CI), has spotted TraderTraitor actors turning the stolen assets mostly into Ethereum (ETH). The agencies expect the next step to be more laundering, by swapping the funds through DeFi and instant swap services as the actors prepare them for later stages. Instant swap services are aptly named.

The alert is aimed at private companies as well as law enforcement agencies. The FBI, USSS and IRS-CI are asking several types of businesses to help stop the money laundering. These include THORNode operators, who support the THORChain network, RPC node operators, who provide apps with access to blockchains, instant crypto exchanges, DeFi platforms, blockchain analytics companies and other crypto service providers.

The request is clear: these companies should block any transactions involving the wallet addresses used by TraderTraitor, including funds that can be traced back to them. According to the FBI, these addresses have received stolen funds and are controlled by North Korean attackers or are closely linked to them. The full list of addresses is included in the alert.

If you run any of these services, the first job is to check your blocklists against that list. The second is to look at transaction flows that touch those addresses indirectly, since the FBI says to block anything “derived from” them, not just direct transfers. Blockchain analytics firms are named for a reason, because tracing derived funds is their work.

The FBI says it’s committed to protecting the virtual asset community by identifying, mitigating and disrupting North Korea’s illicit cybercrime and virtual asset theft.

“The FBI maintains its commitment to protecting the virtual asset community by identifying, mitigating, and disrupting North Korea’s illicit cybercrime and virtual asset theft activities.” concludes the report. “If you have any information to provide, please contact your local FBI field office or FBI’s Internet Crime Complaint Center at ic3.gov.”

TRM says the attacker moved about $6.36 billion out of Binance wallets on ten blockchains on October 29, most of it in roughly 20 minutes starting at 20:05 UTC. That makes it the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025.

“On October 29, 2026, an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC. That makes this the largest crypto theft on record, about four times the USD 1.5 billion Bybit hack of February 2025. Binance has confirmed a security incident and suspended withdrawals on several networks.” TRM said. “TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence. TRM is tracking the funds and alerting partners through the Beacon Network.”

Freezing the money only went partway. Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, and Arbitrum’s Security Council froze 8,426 ETH and 74.6 million ARB, for roughly $2.7 billion in all. But the attacker raced the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave. It now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer’s reach.

The early freeze numbers were messy too, Tether and Circle froze approximately $1.79 billion in stablecoins associated with the suspicious transfers in the initial reports. Those amounts describe different moments, and you shouldn’t add them without checking whether they cover distinct assets. A freeze works on tokens that have an issuer to call, and Ether and Bitcoin don’t.

Below is the link to my interview regarding the Binance case for Italian state television.

https://www.youtube.com/watch?v=DtvhBA9TdPo

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Binance)

FBI links 628 crypto wallet addresses to North Korea’s TraderTraitor after the $6.3 billion Binance hack, asking services to block transfers involving stolen funds.

Binance links a $6.3 billion crypto theft to a compromised DevOps laptop, with North Korean hackers blamed by blockchain analysts.

Binance was investigating suspicious transfers that early estimates put at up to $5.8 billion. A day later, multiple media outlets reported that the largest cryptocurrency exchange had linked the theft of about $6.3 billion to a DevOps engineer’s compromised laptop. Billions had moved out of wallets linked to the exchange.

According to The Block, blockchain analyst Spreek identified approximately $3.55 billion in incoming transfers to an initially unidentified wallet.

“Onchain data flagged by analyst Spreek shows about $3.55 billion in incoming transfers to the unlabeled wallet, with nearly $900 million subsequently moved across other wallets.” The Block reports. “Conor Grogan, a senior director and product leader at Coinbase, says the amount is up to $5.8 billion.”

Coinbase executive Conor Grogan initially estimated that the total value of the movements could reach $5.8 billion.

Those figures came from blockchain tracking and differing estimates, so they didn’t necessarily show the amount stolen.

Binance pointed out that customer funds were safe, while co-founder Changpeng Zhao, widely known as CZ, said the activity appeared to be a hack. Zhao no longer manages Binance’s platform, but said he expected customers’ funds to be fully covered.

The company said its user funds were “completely safe.”

“Our teams are aware of reports of a potential security issue and are actively investigating. User funds are completely safe. Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information.” the company states. “Users should remain cautious of scams and should not trust unofficial links, messages, or requests for account information.”

That assurance is important, but it doesn’t replace a technical explanation of how the transfers occurred or independent confirmation of the final impact.

“Our initial investigation suggests this security incident may have started with a compromised DevOps engineer’s laptop. That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions.” Binance Co-CEO Richard Teng explained.

“To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single “one-click” action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual.”

I want to speak to you directly about what happened.

Bottom line – your money is safe, and we're covering every loss.

Our initial investigation suggests this security incident may have started with a compromised DevOps engineer's laptop. That gave an attacker access to a…

— Richard Teng (@_RichardTeng) October 30, 2026

Attackers used access from an engineer’s laptop to reach a service container and send unauthorized withdrawal requests. Binance says it has found no evidence that attackers stole any wallet private keys.

Binance also said it had found “additional points of breach” and was still investigating. Co-CEO Richard Teng said the investigation had not identified anyone responsible. After the attack, Binance suspended deposits and withdrawals to carry out security checks, cancelled the permissions linked to the affected address, and began working with blockchain analysis firms and law enforcement to track the stolen funds.

Binance says it will cover all losses using its SAFU fund and its own money, and that customer funds are safe. The company also plans to publish an updated Proof of Reserves once it has completed the recovery work. This commitment does not replace a detailed technical explanation or independent confirmation of the full impact of the attack.

Binance hasn’t named a culprit, but the blockchain analysis firm TRM has. It attributes the attack to TraderTraitor, a North Korean state-backed unit also tracked as Lazarus Group and APT38, and Chainalysis says it’s highly confident in that finding.

Our investigators observed funds stolen by DPRK in last month's Bitget exploit commingling with funds stolen from Binance.

We have a high degree of confidence that DPRK is responsible for the $6.4 billion hack of Binance. https://t.co/xj9dQYcbKr

— Chainalysis (@chainalysis) October 30, 2026

TRM says the attacker moved about $6.36 billion out of Binance wallets on ten blockchains on October 29, most of it in roughly 20 minutes starting at 20:05 UTC. That makes it the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025.

“On October 29, 2026, an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC. That makes this the largest crypto theft on record, about four times the USD 1.5 billion Bybit hack of February 2025. Binance has confirmed a security incident and suspended withdrawals on several networks.” TRM said. “TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence. TRM is tracking the funds and alerting partners through the Beacon Network.”

Freezing the money only went partway. Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, and Arbitrum’s Security Council froze 8,426 ETH and 74.6 million ARB, for roughly $2.7 billion in all. But the attacker raced the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave. It now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer’s reach.

The early freeze numbers were messy too, Tether and Circle froze approximately $1.79 billion in stablecoins associated with the suspicious transfers in the initial reports. Those amounts describe different moments, and you shouldn’t add them without checking whether they cover distinct assets. A freeze works on tokens that have an issuer to call, and Ether and Bitcoin don’t.

Hot wallets help explain how this type of theft can happen. They store cryptocurrency in systems connected to the internet, allowing exchanges to process withdrawals quickly. But this also makes strong security controls essential. Investigators still need to determine who initiated the transfers, whether they were authorized, whether attackers gained control of the wallets, and whose funds were stolen.

Binance co-founder Changpeng Zhao, who no longer runs the company, said the activity looked like a hack and expected customers to be fully compensated. Large transfers alone do not prove a cyberattack, but the findings that emerged later provided strong evidence of a breach.

Customers also need to be careful. Attackers often exploit the confusion after a major incident by spreading fake announcements, pretending to be support staff, and directing users to fraudulent websites. Use only Binance’s official channels, avoid unexpected links, and never share passwords, authentication codes, or wallet recovery phrases in response to unsolicited messages. Security teams should also watch for phishing emails that use the incident to pressure employees into verifying their accounts.

The lesson goes beyond Binance. A public blockchain records every transaction, but it cannot show who authorized it or how attackers gained access. Blockchain transparency does not guarantee operational security.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Binance)

The Binance hack investigation reveals a $6.3B breach tied to TraderTraitor, prompting massive stablecoin freezes and an infrastructure overhaul.

Related Posts:

• Polymarket Supply Chain Attack Drains Trader Wallets
• Binance Hot Wallet Breach Prompts Multibillion-Dollar Inquiry
• NetamLoader Hides in Windows Update Folder in Suspected Supply Chain Attack on Asian Government

The post Binance Hack Investigation Traces Historic $6.3B Breach appeared first on Daily CyberSecurity.

Binance probes a DevOps engineer’s hacked laptop after a $6.3 billion theft linked by researchers to North Korean hackers, and promises to cover all customer losses.

The Microsoft Authenticator AuthMask flaw allowed rogue Android apps to impersonate trusted software and hijack enterprise tokens and passkeys.

Related Posts:

• Intelbras Camera Vulnerability Lets Attackers Knock Mibo Cameras Offline
• Body-Parser Flaw CVE-2026-111181 Lets One Request Crash Express Servers, PoC Public
• Unauthenticated File Read Leaks Master Key in LiteLLM Enterprise Proxy, CVSS 10.0

The post Microsoft Authenticator AuthMask Flaw Leaks Tokens appeared first on Daily CyberSecurity.

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Arista VeloCloud Orchestrator flaw to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical Arista VeloCloud Orchestrator flaw, tracked as CVE-2026-114625 (CVSS score of 9.4), to its Known Exploited Vulnerabilities (KEV) catalog.

VeloCloud Orchestrator (VCO) is the central management system for VMware SD-WAN, a technology that helps companies securely connect offices, data centers, cloud services, and remote sites over wide-area networks.

It is now associated with Arista Networks, which acquired VMware’s SD-WAN business. The orchestrator gives network administrators a central place to configure, monitor, and manage the network.

The flaw is a SQL Injection issue that affects on-premises VeloCloud Orchestrator (VCO). It allows an authenticated user to gain operator privileges and impersonate a local superuser operator account. This could give a remote attacker access to internal functions that should not be remotely available, potentially compromising the system and the data it manages. Hosted VCO versions, including Dedicated, were also affected but have already been patched.

“VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.” reads the advisory. “On an affected system, any authenticated user can gain operator privileges and masquerade as a local “superuser operator” user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible.”

VeloCloud Orchestrator (VCO) is vulnerable by default. An attacker needs access to its web interface and a valid account. Even an account with the lowest permission level, Enterprise Read Only, is enough. No configuration change can prevent this exposure.

Administrators should check web access logs for unusual requests, encoded text, attempts to access internal services, or an unusually high number of requests. They should also block these IP addresses linked to attacks:

• 74.82.197.86
• 38.54.50.151

If an attack is suspected, administrators should save web, application, system and database logs, along with relevant file timestamps, before starting recovery, if possible.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaw by October 26, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

Fortinet security updates for FortiOS, FortiManager and FortiAnalyzer fix critical AI-found flaws. Advisories follow November 10. Patch now.

Related Posts:

• cPanel Patches PHP2Shell Flaws and WP Toolkit Bug Affecting Shared Hosting Servers
• QNAP Warns PHP2Shell Flaws Hit QTS and QuTS hero, Urges Users to Take NAS Offline
• Portainer Fixes Two Critical Flaws Letting Standard Users Take Over Docker Hosts

The post Fortinet Urges Fast Upgrades as AI-Found Flaws Hit FortiOS, FortiManager and FortiAnalyzer appeared first on Daily CyberSecurity.

A China-linked operator ran an AI-driven hacking campaign from one server, hitting ministries in Vietnam, Taiwan, Indonesia, and India.

Related Posts:

• APT41 Deploys BlackX UEFI Bootkit Against Central Asian Diplomatic Agencies
• APT28 Uses Hookedge Backdoor to Spy on Naval Shipbuilder and Defense Firms in Two NATO Countries
• Lazarus Operation FlashHole Abuses CrossWeb EX and GitHub to Spy on South Korean Firms

The post China-Linked Operator Used AI Agents to Breach 48 Government and Corporate Targets Across Asia appeared first on Daily CyberSecurity.

Purpose and Scope This report summarizes the quantity of new ransomware samples collected, the number of compromised systems, and statistics on targeted businesses during the month of September 2026, as well as major Korean & global ransomware issues. The analysis is based on data collected through ATIP (AhnLab Threat Intelligence Platform) and AhnLab Smart Defense, […]

Every federal bankruptcy court in the United States has lost access to the system it uses to send out bankruptcy notices. A BAE Systems cyberattack has disrupted the Bankruptcy Noticing Center (BNC), the platform that produces and transmits notices for all federal bankruptcy courts across the country.

The Administrative Office of the U.S. Courts confirmed the incident in a statement on Thursday afternoon. BAE Systems, a British multinational, operates BNC systems and websites on behalf of the Federal Judiciary. The Cybersecurity and Infrastructure Security Agency (CISA), which typically handles cyberattacks on federal agencies, referred questions to the U.S. Courts.

What the BAE Systems Cyberattack Has Taken Offline

According to the U.S. Courts, BAE Systems IT and websites that support BNC operations have been impacted by a cybersecurity incident. As a result, all access to the BNC systems and websites that BAE operates for the judiciary is currently unavailable. That includes:

• bnc.uscourts.gov
• bankruptcynotices.uscourts.gov
• notices.uscourts.gov
• the National Creditor Registration Service

The incident has also halted the BNC’s production and distribution of bankruptcy notices for the courts.

The Administrative Office said it has been in contact with the affected courts and is coordinating with BAE Systems. BAE is investigating the incident and working to restore operations. No timeline for recovery has been shared, and the nature of the attack has not been disclosed.

A Government Contractor Target, Again

The BNC disruption is the latest in a series of incidents where an attack on a government contractor or third-party vendor has spilled over into public services.

Last week, a contact center for the Federal Motor Carrier Safety Administration (FMCSA), a Department of Transportation safety agency, was temporarily taken offline after a government contractor was targeted by a cyberattack, according to two people with knowledge of the situation who were granted anonymity because they were not authorized to speak on the record.

The contact center is run by support provider Senture. The FMCSA first reported technical difficulties on social media on October 6. It remains unclear when that attack began or whether it is ongoing.

Courts Have Been Hit Through Vendors Before

In September 2026, the Kentucky Administrative Office of the Courts (AOC) confirmed that Kentucky Appellate Court data was compromised in a breach traced to a third-party vendor.

West Publishing Corporation, operating as Thomson Reuters Court Management Solutions (Thomson Reuters CMS), told the AOC that the incident originated in file systems tied to its C-Track case management platform. C-Track is used by the Kentucky Supreme Court and the Kentucky Court of Appeals to manage case records.

According to Thomson Reuters CMS, an unauthorized third party accessed and obtained court data from C-Track systems across several states, not just Kentucky. In Kentucky’s case, exposure was limited to appellate court data stored within the C-Track infrastructure.

Trial-level records that were never part of an appeal were not affected, since Kentucky does not use third-party vendors for trial court e-filing. The AOC said its appellate courts continued to operate normally throughout the incident.

Why the BAE Systems Cyberattack Matters

Taken together, the three incidents show a common thread. Courts and federal agencies increasingly depend on outside contractors to run critical systems, and when those contractors are hit, the impact lands directly on public services.

In the BNC case, a single compromised contractor has stopped a core function for every federal bankruptcy court at once. How quickly BAE Systems can restore the platform, and whether any data was accessed, remain the key open questions.

site-verification-ok

Attackers infected 333 Tor exit nodes with Ebury malware to hijack SSH logins and steal passwords. See how a researcher exposed them.

Related Posts:

• Aoki Infostealer Harvests API Keys and Tokens From AI Coding Assistants
• CL-UNK-1211 Deploys SysGoRAT Malware and AI Scripts Against Government Linux Servers
• Qilin, Inc and Settra Ransomware Gangs Exploit PAN-OS Flaw CVE-2026-0257 for VPN Access

The post 333 Tor Exit Nodes Hijacked by Ebury Malware for SSH Attacks appeared first on Daily CyberSecurity.

Purpose and Scope APT cases disclosed in September 2026 demonstrate that attacks have evolved to exploit the developer ecosystem, cloud services, and network management infrastructure as trust layers. Legitimate software installers, GitHub repositories, Microsoft 365, OneDrive, Telegram, Nostr, routers, and authentication servers were all included in the attack chain. Key Trends Supply chain attacks have […]

A fake Web3 accelerator used malicious npm packages to drop stealers on macOS and Windows and reroute AI coding agent traffic to its servers.

Related Posts:

• Ledger Supply Chain Attack Hits Europe via Tampered Wallets
• AI Agent Attack Turns One Exposed Endpoint Into a Full Server Takeover in Under 24 Hours
• Warden Stealer Rust Infostealer Targets AI Coding Agent Tokens and Browser Data

The post Malicious npm Packages From Fake Web3 Accelerator Apex Deliver Stealers and Hijack AI Coding Agents appeared first on Daily CyberSecurity.