Threat actors are exploiting the four-flaw chain to hack the Plex Media Server application on QNAP NAS devices.
The post Plex2Shell Exploited Against QNAP NAS Users appeared first on SecurityWeek.
Read more of this story at Slashdot.
An unreleased OpenAI cyber model found and exploited 948 distinct Linux kernel privilege escalation bugs for about $1.2 million.
The post AI Agents Got Root on Linux via 948 Kernel Flaws in OpenAI Research appeared first on SecurityWeek.
Several staffers at the White House are using computers or mobile devices equipped with residential proxy services that render their internet address available for others to rent, security experts warned today. One of the proxy services is a Russian company whose founder’s web hosting business was ground zero for cyberattacks against election systems in Arizona and Illinois in 2016.
The security firm Layer3 Intel said it detected multiple residential proxy nodes beaconing out from the internet address network reserved for the Executive Office of the President (AS2650). Layer3 said the proxy activity was relatively persistent between October 5 to November 3, and that a review of the proxies available from AS2650 showed they exited from the White House network 236 times during that period.
The proxy tracking company Synthient said on Twitter/X that the activity it saw coming from AS2650 was related to multiple Windows 11 installations of a service called Infatica, a proxy program that is often integrated into “free” mobile and desktop applications. Infatica’s founder Vladimir Fomenko is a Russian man whose hosting firm King Servers was home to six of the eight internet addresses used by Russia’s state security services to compromise databases for election systems in Arizona and Illinois in 2016.
Synthient’s depiction of the outgoing proxy traffic from the dedicated White House network (AS2650). Click to enlarge.
There are dozens of residential proxy providers with varying degrees of legitimacy, many of them based in China or Russia. But at a minimum, they all make it simple for customers to rent someone else’s internet address as a way to anonymize their web traffic or spoof their true location. From a website’s perspective, the traffic from a proxy network user appears to originate from the rented IP address, not from the proxy service customer.
Layer3 Intel said the proxy exit nodes at the White House came from six internet addresses, on 26 of the 30 days, and that most of the activity happens in the evening, between 5 p.m. and midnight.
Incredibly, Infatica was not the only proxy service that reportedly has been reselling access to White House internet addresses: Layer3 Intel said it found 28 separate residential proxy services were able to exit through this network.
“This is public access,” the Layer3 Intel team wrote. “Anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it. We did not selectively target this network or try to make our probes exit from it. We caught this by chance, simply by requesting global rotating access through these services.”
The White House did not immediately respond to a request for comment.
As detailed in several stories here over the past year, residential proxy services are a major source of unwanted and often malicious traffic, including account takeover and other cybercrime activity, advertising fraud, and mass content scraping for AI projects.
They can also introduce serious security risks. In late 2025, it was discovered that cybercriminals were mass exploiting a widespread vulnerability in these services that allowed them to probe each proxy endpoint’s local network for vulnerable systems to infect with malware. In January 2026, dozens of proxy services were forced to patch their networks after Synthient Founder Ben Brundage showed how cybercriminals were abusing a vulnerability in these residential proxy services to seize control over devices inside the local networks of unsuspecting users.
“Some of these resellers sell bandwidth for as low as 60 cents a Gigabyte, that means for less than a dollar you can gain access into some of the most confidential and trusted networks,” Brundage told KrebsOnSecurity. “The reseller ecosystem further enables this with any criminal able to buy access while skipping KYC [Know Your Customer] processes.”
All too often, these proxy services are beaconing out from employee devices brought into the workplace. App developers can embed software development kits (SDKs) provided by the residential proxy networks to monetize their software, allowing them to receive a small amount of money on each installation.
As risky as residential proxies can be for unsuspecting end users, they are all too commonly found on government and corporate networks. In a webinar in January 2026, the proxy tracking service Spur found residential proxies in nearly 300 government owned and operated networks, 318 utility companies, 166 healthcare companies or hospitals, and 141 companies in banking and finance. In a blog post earlier this year, the security firm Infoblox said it discovered that fully 65% of its customer base was querying one or more residential proxy related domains.
Read more of this story at Slashdot.
Google said today it worked with industry partners to dismantle a botnet made up of more than 1.3 million Android TV set-top boxes that ship with malicious software which secretly rents the user’s Internet connection out to strangers and conducts advertising fraud. Experts involved in the takedown say the action is likely to sever the botnet’s access to more than 10 million additional compromised systems, including other Internet of Things (IoT) products such as Android-based healthcare devices and karaoke machines.
A report from the Google Threat Intelligence Group (GTIG) said Google has severed ties with Videostrong Technology Co., a TV box manufacturer in China that GTIG and other industry experts concluded was responsible for including malware that enrolled more than 1.3 million set-top boxes in a botnet dubbed “XCPE” (named after one of the malware’s core code components).
The global distribution of XCPE botnet infections. Image: Google Threat Intelligence Group.
The report said the XCPE botnet loaded the user’s device with software that makes their Internet address available for resale by multiple “residential proxy” services, which allow customers to rent Internet addresses as a way to anonymize their web traffic or spoof their true location. As detailed in several stories here over the past year, residential proxy services are a major source of unwanted and often malicious traffic, including account takeover activity, advertising fraud, and mass content scraping for AI projects.
“Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices,” the GTIG post reads, noting that Google took legal action to take down the domains and servers Videostrong used to control the botnet and install additional malware. “A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust, and represents a serious risk to those users. Without users’ knowledge or consent, infected devices were offered as a distribution mechanism for a wide array of criminal actors.”
The report notes that while TV boxes made up the the majority of the botnet, the same XCPE malware was found in other Android-based IoT products, including telehealth devices, karaoke machines, and even digital signage systems.
Google said it requires all Android device makers to pass compatibility and security tests to ensure their products don’t harm users, but that Videostrong nevertheless found a way to load their malicious software immediately after a user boots up one of these devices for the first time (Google says it has since addressed that weakness).
The GTIG report calls out a number of residential proxy providers whose software development kits were routinely downloaded by devices infected by the XCPE botnet. Those include AppSalt, also known as Honeygain, which was developed by the Vilnius, Lithuania-based Oxylabs. In October 2026, Oxylabs and Honeygain were reorganized as independent platforms under an umbrella entity called Source, which received $130 million in funding from private equity firm Warburg Pincus that reportedly valued the business at $3.6 billion.
Another provider linked to the botnet was NetNut, a once sprawling residential proxy company operated by the publicly-traded Israeli company Alarum Technologies. In July 2026, the FBI worked with industry partners to seize hundreds of domains associated with NetNut, saying the company was responsible for operating a separate botnet called Popa that enslaved TV boxes as residential proxies. Other proxy providers named in the GTIG report include EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb and GaGaNode.
Google’s announcement credits a number of industry partners, including Synthient, a startup that tracks proxy providers. In January 2026, Synthient published research into the rapid spread of the Kimwolf botnet, which at the time was hammering networks worldwide with record-smashing DDoS attacks. Synthient documented how Kimwolf infected millions of Android set-top boxes virtually overnight, using a widespread vulnerability in these residential proxy services to compromise other Android-based devices inside the local networks of unsuspecting TV box users.
Synthient’s research caused dozens of residential proxy providers to patch their networks, which helped to fragment the Kimwolf botnet into much smaller pieces that made its incessant and disruptive DDoS attacks far easier for network operators to manage. It also attracted the attention of the Motion Picture Association (MPA), a trade group representing the major Hollywood studios, which partnered with Synthient to purchase and tear apart a number of popular Android TV set-top boxes — including some that were being infected by Kimwolf and other IoT botnets.
In a report published today, Synthient examined a popular, pre-infected TV box sold under the brand MECOOL by a publicly traded company in China called Skyworth Technology, concluding that MECOOL also bundled the malware from Videostrong Technology Co. and likewise installed AppSalt/Honeygain and other proxy components.
The MECOOL storefront and marketing. Image: Synthient.com.
Synthient founder Ben Brundage told KrebsOnSecurity that Videostrong’s malware also distributed software for the proxy service Grass. In our November 2025 story, “Is Your Android TV Streaming Box Part of a Botnet?” we quoted a researcher from Censys who found the popular Superbox TV streaming device bundled Grass’s residential proxy software. We also quoted the Grass founder, who denied any affiliation with the TV box maker.
That November 2025 story noted that Superbox and similar Android TV set-top boxes gain new customers primarily by engaging influencers on Tiktok and other social networks who praise the product’s ability to offer hundreds of (pirated) pay TV streaming services for a one-time fee.
Likewise, Synthient’s report observes that the MECOOL set-top boxes exploded in popularity after the product was mentioned in 2023 by the Youtube channel Linus Tech Tips, which has an audience of nearly 17 million subscribers [Linus Tech Tips said in a statement shared with Synthient that it has since updated the video to explicitly frame the product as a scam and have removed all associated affiliate links].
The popular Youtube channel Linus Tech Tips discussing MECOOL TV streaming boxes.
The GTIG report estimates the XCPE botnet takedown should sever access to at least 10 million additional compromised devices, noting that the various proxy and ad fraud affiliates of Videostrong “each have diversified distribution channels for their modules beyond XCPE.”
Synthient’s Brundage echoed that conclusion, calling the 1.3 million number “highly conservative.”
“The scale of affected devices is likely way higher,” he said. “This is probably the largest operation against backdoored TV boxes that we’ve seen.”
Update, Nov. 5, 11:07 a.m. ET: In a statement shared post-publication, Oxylabs said that while its system is built so that a device can’t be used as a proxy exit node unless they receive a signal that it has consented, the developer faked these signals.
“We have been conducting regular audits of the applications provided by our partners,” the statement reads. “However, following this incident, we will improve the application and application’s build fingerprinting logic to better detect cases where the SDK is running on an unapproved build of an originally authorized application.”
The statement said Oxylabs has no record of any company called Videostrong Technology Co., but it did find between is suppliers the domain “com.abc[.]nexus,” mentioned in the GTIG report as an external malware loader.
“As soon as we saw that, we suspended the relationship and sent them a formal legal inquiry,” the statement reads. “This supplier accounts for less than 1% of our IP address pool. We had a signed contract with them, they assured our QA team that users had given consent, and we saw the consent flow ourselves.”
Further reading:
Plume Security Labs white paper on the XCPE botnet (PDF)
Black Lotus Labs writeup on LinkedIn
TrendAI’s analysis
Synthient’s list of affected devices, broken down by model number
Read more of this story at Slashdot.
A China state-backed threat group is using ARTEX, the automated agentic AI penetration testing framework, to achieve remarkable speed, scale and success in a campaign that already compromised about 140 sensitive targets in 11 days, according to CrowdStrike.
The threat group, which CrowdStrike tracks as Vapor Panda, targeted more than 200 organizations in at least 14 countries since Oct. 17, the security company said in a threat report Thursday. Targets and confirmed victims include foreign ministries, a European country’s presidency and prime minister’s office, defense and intelligence agencies; 19 U.S.-based organizations in the pharmaceutical, semiconductor, defense, nuclear and financial sectors; and telecom providers in the United States, Belgium and the Philippines.
CrowdStrike told CyberScoop about 70% of Vapor Panda’s targets were confirmed compromised or had evidence indicating moderate confidence of a successful intrusion.
Vapor Panda’s use of ARTEX, paired with DeepSeek, allowed it to accomplish more tasks with shocking speed — requests occurring as often as every 10 seconds — and pursue multiple attack paths concurrently.
“This is the first time that we’re seeing an agentic adversary nation-state threat actor at this scale, and I think that this is probably, unfortunately, something we’ll see more of,” Adam Meyers, senior vice president of counter adversary operations at CrowdStrike, told CyberScoop.
Hands-on-keyboard activity tracked by CrowdStrike for the past 15 years typically involved up to 40 commands per hour. “Now, with ARTEX, we could see it exceed 1,500 commands an hour,” Meyers said.
“If you diversify that across 200 targets, it costs them very little to run a mass-exploitation campaign and drop a websell,” he added. “They can hit more targets in a faster period of time.”
Vapor Panda’s broad-access campaign, which remains active, has targeted think tanks and government agencies spanning defense, justice, finance and diplomacy.
“I would characterize it as a diverse operational mission that tends to focus on sectors and geographies that Beijing considers economically or politically important,” Meyers said.
The active campaign attributed to Vapor Panda is separate from the ARTEX activity Microsoft Threat Intelligence attributed to Storm-0940 earlier this month, including a supply-chain attack targeting ConnectWise customers.
Adversarial use of AI is relatively new, yet also quickly becoming the new normal, Meyers said. “We’re scrambling because we’re seeing so many of these agentic adversaries.”
Agentic AI use for malicious purposes is growing month-over-month at a rate of almost threefold. CrowdStrike observed roughly 45 agentic adversary attacks in September and it’s already at 126 for October, and climbing.
Adversarial use of agentic AI isn’t an intractable problem, but rather another reminder that organizations need visibility into their endpoints, identities and cross-domain capabilities, Meyers said.
These attacks aren’t showcasing anything new, “it’s just doing it at a speed and scale that we’re unaccustomed to,” he said. “It’s not hopeless, but you’ve got to take action. You can’t put your head in the sand.”
The post China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days appeared first on CyberScoop.
A defense contractor with top secret security clearance pleaded guilty to aiding North Korea’s remote worker scheme by allowing co-conspirators to use his identity to apply for jobs, including positions with national security implications, the Justice Department said Wednesday.
John Allen Kurrle Jr. participated in a short-lived but prolific conspiracy that spanned at least 88 job applications at U.S.-based companies, resulting in nine job offers, according to court records.
The 62-year-old allowed co-conspirators to use his identity and government clearance for prospective sensitive work, often with U.S. government contractors. The nine job offers Kurrle’s co-conspirators received between June and October 2025 had annual salary ranges of $120,000 to $190,000.
The scheme had a limited success rate. The longest and most lucrative job a co-conspirator landed under Kurrle’s identity lasted about three weeks, netting a total pay of $4,800.
His identity was also used to gain employment as a software engineer at a Ventura, California-based company to work on a generative AI project for a component of the U.S. military. The company sent a laptop to Kurrle’s residence in Gainesville, Virginia, where he received and hosted laptops shipped by multiple victim companies, enabling co-conspirators to remotely access the devices from outside the United States.
Yet, during a video call to verify employment eligibility, the company noticed that the person who appeared on the video call did not match Kurrle’s age or physical characteristics, according to court records. The unnamed company terminated the employment of Kurrle’s co-conspirator before he did any work on the military contract and Kurrle shipped the laptop back to the company.
The company paid Kurrle’s co-conspirator almost $2,200 for 32 hours of onboarding, which Kurrle is now ordered to pay in restitution along with the $4,800 received from the other company.
Kurrle also, as part of his plea agreement, admitted to using the identity of a third person, without their consent, to apply for some remote work positions. He doesn’t dispute that the scheme likely benefitted North Korea, but claims he wasn’t aware of the connections to North Korea during the duration of his involvement in the conspiracy.
Michael Barnhart, nation state investigator at DTEX, said researchers previously identified Kurrle as a facilitator for North Korea’s remote worker scheme. Yet, until recently, he wasn’t sure if Kurrle was a victim or impersonated.
The case underscores North Korea’s efforts to gain access to roles with a strategic intelligence requirement, as it focuses on contractor roles because those present the path of least resistance.
Kurrle joins a growing list of people who have been charged or jailed for supporting the North Korea regime’s scheme that generates hundreds of millions of dollars annually for the country’s military and organizations involved in its weapons programs.
Authorities have been cracking down on the malicious insider activity by seizing cryptocurrency linked to the theft, and targeting U.S.-based facilitators who provided forged or stolen identities and hosted laptop farms for North Korean operatives.
Some of that money is also funneling through a web of front companies and intermediaries, including sanctioned entities, that partly fund Russia’s war effort against Ukraine, DTEX said in a report in July. This includes manufacturing weapons and supplying them to Russia’s military, according to the security firm.
The countermeasures are stacking up, but the scheme is widespread and has infiltrated an undetermined number of businesses, including hundreds of Fortune 500 companies.
Federal judges previously sentenced other people to prison for their involvement in the scheme, including Matthew Issac Knoot and Erick Ntekereze Prince; Keija Wang and Zhenxing Wang; Audricus Phagnasay, Jason Salazar and Alexander Paul Travis; Oleksandr Didenko and Christina Chapman.
Kurrle pleaded guilty to conspiracy to commit wire fraud and faces up to 20 years in prison upon sentencing, which is currently scheduled for Jan. 28, 2027.
The post Defense contractor pleads guilty to aiding North Korean remote worker scheme appeared first on CyberScoop.
Tracked as CVE-2026-97229, the bug allows unauthenticated attackers to execute arbitrary code on the server.
The post Max-Severity GitLab Vulnerability Exploited Against Alpine Linux appeared first on SecurityWeek.
A company working on behalf of the Department of Homeland Security sought to cut off online access to information on more than 41,000 employees that hacktivists said they obtained from a database breached at DHS.
A search tool for the database, named Icepick, went offline for a spell before coming online again Thursday under a different registrar.
Icelandic hosting company FlokiNET said Thursday that it received a request from DHS contractor ZeroFox to remove the data, which it refused.
“By mid-morning, icepi.cx no longer resolved. Its registrar, CentralNic, had placed the domain on serverHold,” FlokiNET said in a blog post. “Our refusal kept nothing online. The request that decided the outcome to take the site down was not the one sent to us. A registrar reached the opposite conclusion the same morning, published nothing, and a global audience lost access to the site. In the meantime the site is online again under a domain from a different registrar.”
CentralNic and ZeroFox did not immediately respond to requests for comment Thursday.
DHS said late Wednesday that it was working to protect its employees against any breach.
“DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively,” a spokesperson said. “We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available.”
The social media site Bluesky was also blocking links to the archive because it shared people’s contact information without their permission, although a company official said changes were coming because the wording had identified it as a malicious link.
FlokiNET said it refused the ZeroFox request that mislabeled the archive as part of a doxxing campaign.
“Doxxing publishes private details about private people so that others can find them at home. Icepick publishes work identities of government employees,” it wrote. “Who they work for. What their role is. How they can be reached in that role. The information describes people in the exercise of public authority, not in their private lives. Federal officers carrying out an enforcement programme are not private individuals while they are carrying it out.”
“The public has a legitimate interest in knowing who is doing that work, under whose authority, and in which office,” it continued. “Journalists cannot report on an agency whose personnel are structurally unknowable.”
ZeroFox said that regardless of that, the data made it possible to locate people whose information was in the database.
“The request does not depend on who the listed individuals are or what their duties are,” ZeroFox wrote to FlokiNET. “It rests on two facts: the data was stolen, and it is personal data that identifies and locates real people.”
The post Leaked DHS employee archive, Icepick, faces challenges to stay online appeared first on CyberScoop.
The Chrome 156 update fixes 52 bugs, while Firefox 159 was rolled out with 167 security patches.
The post Chrome and Firefox Updates Patch Over 200 Vulnerabilities appeared first on SecurityWeek.
The Office of the National Cyber Director has rolled out its second regional cyber pilot program, this one focused on rural hospitals.
National Cyber Director Sean Cairncross visited South Carolina on Monday to debut the six-month program, Project Lifeline 250, which connects industry with rural hospitals. The concept is similar to the first pilot program in Texas that connected industry with the water sector.
“Project Lifeline 250 connects the world-leading American industry with rural hospitals and uses the greatest American tools and capabilities to defend hospital networks; deploy physical back up devices after an initial incident to ensure an impacted hospital can still provide critical care; and identify high-risk and legacy devices and replace them,” Cairncross said in a statement.
The health care sector had a record year for breaches last year, with 804 large breaches reported to the Health and Human Services Department’s Office for Civil Rights that affected more than 140 million people. The FBI identified the sector as the top target for ransomware and other hackers in 2025.
Rural hospitals, like the water sector, lack resources compared to other kinds of critical infrastructure.
Besides industry and the ONCD, the effort is a project that draws in the South Carolina Critical Infrastructure Cybersecurity program, the South Carolina Law Enforcement Division and local governments in the state.
“Cyber threats are a rising challenge to our nation’s security, and we must remain vigilant to protect the systems our communities depend on,” said South Carolina Gov. Henry McMaster. “Project Lifeline 250 is another important step toward ensuring South Carolina’s rural hospitals have the resources they need to defend against cyberattacks and continue providing critical care.”
Some of the same companies involved in providing free services in the Texas pilot are involved in the South Carolina pilot, too, along with some new participants. Among the participating firms: Abnormal AI, Cisco, Cyera, Microsoft, Rilian Partners, Trellix and Zscaler.
“The stakes for critical infrastructure are getting higher and higher,” said Yotam Segev, cofounder and CEO of Cyera. “There’s real urgency in bringing cyber expertise from some of the world’s largest and most complex enterprises to rural hospitals through Project Lifeline 250. When a hospital knows where its patient data lives and who can reach it, it can reduce the leverage behind ransomware. Every community should have that clarity, no matter the size of the hospital or its IT team.”
Members of Congress also have introduced legislation designed to aid rural hospital cybersecurity.
The ONCD hasn’t said what will happen at the end of the six-month pilots. And so far it has only partnered, or publicly discussed partnering with, GOP-led states.
The post National cyber director rolls out latest pilot in South Carolina, this time for rural hospitals appeared first on CyberScoop.
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
The post This is Fine: What NetScaler Zero-Days Tell Us About the New Normal appeared first on SecurityWeek.
Login