Find what you’re looking for
Browse everything
6,838 results in Threat Reports
Inside Silent Train: How Volt Typhoon Built an Ephemeral Network That Rebuilds Itself in Under Two Minutes
Since late 2023, China-backed threat actor Volt Typhoon has operated a covert, rapidly rotating infrastructure campaign dubbed 'Silent Train' by Lumen Technologies' Black Lotus Labs. The operation chains compromised SOHO routers, IoT devices, and enterprise edge appliances into ephemeral relay networks that are assembled and dismantled in under two minutes, with individual sessions averaging roughly four hours. The group exploited zero-days in Versa Director, Cisco Catalyst SD-WAN, N-Able N-Central, and VeloCloud Orchestrator, and abused devices from Fortinet, Cisco, Ivanti, F5, Palo Alto Networks, and others to maintain persistent, stealthy access across telecom, defense, government, energy, water, transportation, and emergency-services sectors across the United States. Silent Train illustrates a decisive evolution in nation-state tradecraft: attackers no longer maintain static botnets that can be seized or sinkholed. By rebuilding relay chains continuously and targeting centralized management and control-plane platforms, Volt Typhoon can pre-position inside critical infrastructure indefinitely—raising the urgency for network visibility, zero-trust segmentation, and encrypted east-west traffic controls that can detect anomalies even when the underlying infrastructure changes daily.
41,000 DHS Employees Exposed: How Hacktivists Turned an Okta SSO Into a National Security Leak
In late October 2026, a hacktivist group calling itself the Department of Peace exfiltrated a database containing personal and organizational records on more than 41,000 Department of Homeland Security employees and contractors, subsequently sharing it with transparency nonprofit Distributed Denial of Secrets. The attackers claimed to have obtained the dataset by compromising an Okta single sign-on service used internally by DHS, though Okta denied any evidence of system compromise. The leaked data exposed names, email addresses, phone numbers, and internal organizational structures across DHS components including CISA and ICE, with records dating back several years. The incident follows a pattern of prior DHS breaches in 2014 and 2018 and a 2025 GitHub credential exposure affecting CISA systems. This breach underscores the persistent vulnerability of identity and access management infrastructure at federal agencies. Hacktivist-motivated intrusions leveraging SSO credential theft are accelerating, and the exposure of government organizational charts, contact details, and operational personnel represents a compounding national security and counterintelligence risk that aligns with growing regulatory pressure around zero-trust adoption in federal environments.
Virtualine Seized: Inside the Bulletproof Host That Powered Ransomware, Stealers, and Sextortion in 2026
In 2026, U.S. authorities obtained a court order to seize the primary domain of Virtualine, a Russian-speaking bulletproof hosting provider operating under aliases including Secury, Massgod, Spamhouse, Lanedo, and Omegatech. Virtualine served as critical criminal infrastructure for ransomware groups—including Coinbase Cartel, DragonForce, INC, The Gentlemen, and Qilin—as well as sextortion operations, CSAM distributors, cryptocurrency mixers, stealers such as StealC, and loaders including Matanbuchu. Despite receiving repeated takedown notices from law enforcement agencies in Germany, Canada, and Australia, Virtualine continued hosting illicit customers. The domain seizure disrupted customer access but did not eliminate the underlying server infrastructure or erase blockchain-traceable payment records linking operators to their criminal clientele. This incident underscores a persistent structural problem: bulletproof hosting providers function as the connective tissue of the cybercriminal ecosystem, enabling ransomware-as-a-service, infostealer distribution, and financial crime to coexist on shared, abuse-resistant infrastructure. As law enforcement actions grow more frequent, threat actors rapidly migrate to backup providers, making network-layer visibility, egress control, and east-west segmentation more critical than ever for enterprise defenders.
GMO's Onamae Desktop Cloud Ransomware Attack: How a Pre-Staged Payload Held 26,739 Cloud Servers Hostage
In October 2026, GMO Internet Group's Onamae Desktop Cloud virtual private server platform was compromised by a threat actor who gained unauthorized access on October 20, potentially affecting up to 26,739 customer servers. The attacker exfiltrated company and customer data—including MetaTrader 4/5 trading credentials—and demanded an ¥8 billion ($50 million) ransom, which GMO refused to pay. The attacker subsequently published stolen data online and threatened to detonate a pre-planted ransomware payload, prompting GMO to urge customers to physically disconnect and shut down their systems. GMO partnered with Trend Micro for incident response and offered ¥5,000 per affected customer as interim compensation. This incident highlights an accelerating extortion playbook in which threat actors pre-position ransomware payloads inside cloud-hosted infrastructure before issuing demands, weaponizing the fear of detonation as leverage. As VPS and desktop-cloud services grow in adoption across Asia-Pacific financial and retail sectors, the risk of supply-chain-style detonation attacks on shared cloud infrastructure is now an urgent board-level concern.
Node2Shell (CVE-2026-111497): CISA Confirms Active Exploitation of Critical Brotli RCE Flaw
In October 2026, CISA added CVE-2026-111497 — a critical remote code execution vulnerability in Google's Brotli compression library, dubbed Node2Shell — to its Known Exploited Vulnerabilities catalog after confirming active in-the-wild exploitation. The flaw stems from an out-of-bounds write in the Brotli decoder, enabling unauthenticated remote attackers to corrupt decoder state memory, disclose sensitive data, cause denial-of-service, or achieve full remote code execution via a maliciously crafted compressed stream. Affected surfaces include Node.js runtimes, HTTP servers, clients, and .NET applications, prompting emergency patches from Microsoft. Federal agencies were mandated to remediate by November 10, 2026. The Node2Shell campaign underscores a persistent and accelerating trend: attackers weaponizing widely deployed open-source compression and runtime libraries to gain initial footholds at scale. As Brotli is embedded across cloud-native workloads, container images, and API gateways, the blast radius of unpatched deployments is exceptionally broad, heightening urgency for organizations operating hybrid and multicloud environments.
CVE-2026-101767: Oracle EBS Under Active Siege — What Security Teams Must Do Now
On October 27, 2026, threat actors began actively scanning the internet for Oracle E-Business Suite (EBS) systems vulnerable to CVE-2026-101767, a critical unauthenticated SQL injection flaw in EBS's Thin Client Framework servlet that chains to remote code execution. Oracle released patches on October 20, 2026, as part of its quarterly Critical Patch Update, but over 670 internet-exposed EBS instances remain visible on Shadowserver, predominantly in the United States. Threat intelligence firm Defused confirmed exploit attempts against honeypot decoys within days of the patch release, indicating rapid weaponization. The flaw requires no authentication and can be exploited in low-complexity attacks, making unpatched EBS deployments a high-value, low-effort target for ransomware-adjacent extortion groups. This incident follows a pattern of serial Oracle EBS exploitation: the Clop extortion gang abused CVE-2025-61882 since August 2025, compromising organizations including Logitech, GlobalLogic, and Harvard University, while ShinyHunters exploited a PeopleSoft zero-day (CVE-2026-35273) in June 2026 to exfiltrate data from Nissan, Nottingham University, and others. Oracle application stacks have now become a recurring high-priority attack surface for data-theft and extortion campaigns targeting Fortune 100, government, and healthcare environments.
16 Actively Exploited CVEs in One Month: How InfraTrust's October 2026 Report Exposes the Edge Infrastructure Crisis
Between September 18 and October 14, 2026, InfraTrust's October Pulse report documented 133 security advisories across 18 vendors covering 2,813 vulnerabilities in critical network infrastructure. Sixteen advisories included actively exploited flaws added to CISA's Known Exploited Vulnerabilities catalog, targeting edge devices including Citrix NetScaler, Ivanti Connect Secure, Check Point Security Management Server, Cisco SD-WAN, Arista VeloCloud, FortiMail, F5 BIG-IP APM, and PAN-OS. Attackers leveraged unauthenticated remote code execution, authentication bypass, and path traversal flaws to gain initial access and pivot into enterprise networks. The PHP2Shell vulnerabilities further compounded risk by exposing management interfaces of firewalls, VPN appliances, and application delivery controllers to unauthenticated RCE. This wave of infrastructure exploitation reflects a maturing initial-access-broker ecosystem where edge appliances serve as primary entry points. With threat actors including nation-state groups systematically targeting network management planes, organizations face compounding risk from unpatched vendor firmware cycles that delay PHP2Shell and Linux kernel fixes beyond enterprise control.
Volt Typhoon's Silent Train: How China's APT Is Using Zero-Days to Pre-Position Inside U.S. Critical Infrastructure
Chinese state-sponsored threat actor Volt Typhoon has been operating a covert relay infrastructure called 'Silent Train' for at least three years, exploiting at least four zero-day vulnerabilities—including CVE-2026-16812 in VeloCloud Orchestrator, CVE-2026-20127 in Cisco Catalyst SD-WAN, CVE-2025-8875/8876 in N-able N-central, and CVE-2024-39717 in Versa Director—to target telecommunications firms, government agencies, defense contractors, utilities, and critical infrastructure providers primarily across California, Texas, and Hawaii. The framework chains compromised SOHO routers and IoT devices as ephemeral relays, with operators erasing all tooling within eight hours of session completion to evade forensic detection while maintaining persistent access to high-value enterprise systems for one to three months. Silent Train represents a significant evolution beyond Volt Typhoon's disrupted KV-Botnet infrastructure, demonstrating the group's adaptive capacity and sustained intent to pre-position within U.S. critical infrastructure ahead of potential geopolitical conflict. The campaign's hybrid use of disposable relays and retained enterprise footholds signals a maturing operational playbook that poses escalating risk to any organization managing edge networking, SD-WAN, or centralized IT management platforms.
Operation Omegaline: How the Virtualine Bulletproof Hosting Takedown Exposes the Ransomware Supply Chain
In October 2026, a coordinated international law enforcement operation led by the FBI, with support from Germany's Polizei Hessen, the Netherlands' Politie Midden-Nederland, and the UK's National Crime Agency, seized the primary domain of Virtualine—a bulletproof hosting provider operating since at least 2022 under aliases including Secury, Massgod, and Omegatech. Virtualine knowingly hosted ransomware operators, infostealer infrastructure, phishing platforms, Russian-language cybercrime forums, and illicit markets, accepting direct Bitcoin payments to launder criminal proceeds. Dutch authorities seized dozens of physical servers in Limburg, taking hundreds of virtual servers offline and recovering data tied to over 3,000 customers. Blockchain intelligence firms Chainalysis and TRM Labs confirmed financial links to ransomware groups, the StealC infostealer, and a Russian drug marketplace that alone accounted for 44% of Virtualine's inflows. This takedown underscores a hardening global posture against bulletproof hosting infrastructure—the connective tissue of ransomware, infostealer, and cybercrime-as-a-service ecosystems. With law enforcement increasingly using blockchain tracing and private-sector intelligence partnerships to dismantle hosting providers rather than just end-point actors, enterprises must recognize that criminal infrastructure takedowns expose customer data and enable follow-on investigations targeting the broader cybercrime supply chain.
Unauthenticated Endpoint Puts Millions of Intelbras Surveillance Cameras at Risk of Denial-of-Service
In 2024–2025, Kaspersky researchers discovered a denial-of-service vulnerability (CAN-2026-2035970, CVSS 4.0 score 5.1) in Intelbras IP camera firmware affecting models including the iM3B-C, iMX C, iM4 C, iM5 SC, iME 360 C, and iM7+ FC. The flaw resided in an unauthenticated firmware upgrade endpoint (/firmwareUpgrade_service/Demo) that accepted any HTTP POST request—regardless of payload validity—and forced the device into a reboot cycle, rendering it offline indefinitely when requests were repeated. With over 4 million downloads of the companion Mibo Smart app across Latin America, the attack surface was substantial. Intelbras patched the issue in firmware R.260804 following responsible disclosure. This incident underscores the persistent risk of unauthenticated management endpoints in IoT and embedded devices deployed at scale. As surveillance infrastructure becomes more deeply integrated into enterprise and critical-facility security postures, availability-disrupting vulnerabilities in these devices carry operational consequences far beyond a simple device reboot, including blind spots in physical security and compliance gaps under frameworks requiring continuous monitoring.
AI-Powered APT Chains PHP2Shell and Linux Kernel Exploit to Root 25 Servers Including U.S. Government Systems
On October 25, 2026, a suspected China-nexus APT actor exploited a chained vulnerability set—PHP2Shell (CVE-2026-109618 and CVE-2026-109619) and the Fragnesia Linux kernel privilege escalation flaw (CVE-2026-46300)—to root 25 servers across the U.S., Japan, Taiwan, and South Korea. Three compromised systems belonged to a U.S. government-affiliated organization. Attackers used AI-assisted tooling including Anthropic's Claude Code, FOFA reconnaissance, and LLM-augmented offensive scripting to automate target identification, exploitation, and Active Directory credential extraction. Persistent reverse SSH tunnels and dormant web shells remain active across 22 additional rooted firewalls, and the full scope of credential compromise is still undetermined. This incident exemplifies a new generation of AI-accelerated espionage operations where nation-state actors leverage large language models to compress exploit development timelines, automate reconnaissance at scale, and chain zero-day-class vulnerabilities against management interfaces—dramatically lowering the barrier to high-impact government network penetration.
Volt Typhoon's Silent Train: How a Covert Relay Network Powered Four Zero-Day Campaigns Against U.S. Critical Infrastructure
Beginning in late 2023 and accelerating through 2026, the China-state-sponsored threat group Volt Typhoon operated a covert relay network called Silent Train to execute four confirmed zero-day exploitation campaigns against critical U.S. infrastructure. The group systematically targeted endpoint management platforms, SD-WAN orchestrators, and network control-plane technologies—including CVE-2026-20127 in Cisco Catalyst SD-WAN Controller and CVE-2026-16812 in Arista VeloCloud Orchestrator—routing malicious traffic through rotating chains of compromised SOHO, IoT, and enterprise devices across 27 device classes. Victims spanned telecommunications, defense contractors, satellite services, energy, transportation, and emergency services, with operations concentrated in Hawaii, California, and Texas. Silent Train represents a structural evolution in nation-state tradecraft: ephemeral multi-hop relay infrastructure that self-destructs after each session, making attribution and disruption exceptionally difficult. As geopolitical tensions in the Indo-Pacific intensify, this campaign signals that critical infrastructure operators must treat control-plane technologies and management platforms as primary attack surfaces requiring zero trust segmentation and continuous east-west traffic inspection.