Ledger Reseller Devices Tied to $71.5M Crypto Drain

Ledger investigates backdoored wallets from CryptoBilis reseller as $71.5M sits in flagged addresses

Ledger is investigating reports of lost funds from users in Southeast Asia who bought devices from CryptoBilis, a reseller listed for Indonesia, Malaysia, and the Philippines. Ledger asked CryptoBilis to pause sales and shipments, and advised recent buyers not to set up devices or to move assets to a new Ledger signer with a new seed. Ledger said the drained funds appear limited to devices sold through CryptoBilis and that it has no indication its own infrastructure was compromised. Arkham Intelligence showed about $71.5 million in flagged addresses, including $29.4 million in ether and $17.5 million in bitcoin. Former Mt. Gox chief Mark Karpelès posted photos of a Ledger he bought in Malaysia with a hidden board and LTE module. CryptoBilis had not issued a public statement.

Ledger’s Crypto Wallets Reportedly Backdoored, $71 Million in Crypto Already Moved →

Topics: Crypto security

Dutch intelligence: Coathanger malware survives firmware patches, hit 20,000 edge devices

Dutch intelligence agencies MIVD and AIVD published a joint advisory on October 7 warning that Chinese state-sponsored attacks on routers, firewalls, and VPN gateways will increase significantly. The advisory disclosed Coathanger, a remote access Trojan built for Fortinet FortiGate appliances, found during a 2024 investigation into a Chinese intrusion at a Dutch Ministry of Defence research network. Coathanger exploited CVE-2022-42475, a pre-authentication RCE in FortiOS with a CVSS score of 9.3, then deployed a payload that hooks system calls and injects itself into the reboot process. A device patched, rebooted, or firmware-upgraded after compromise remains infected. The NCSC found at least 14,000 devices compromised during the zero-day window and at least 20,000 total, belonging to government agencies, international organizations, and defense contractors. China’s foreign ministry rejected the accusations.

Dutch Intelligence: Chinese Malware Survives Firmware Patches, Compromised 20,000 Edge Devices →

Topics: State-sponsored hackingMalware & infostealers

FBI and six allies name Beijing’s Integrity Technology Group in email theft campaign

On October 8, 2026, the FBI and cybersecurity agencies from six allied nations issued joint advisory AA26-281A identifying Beijing-based Integrity Technology Group as the commercial entity enabling a sustained email theft campaign. Co-signers include CISA, the NSA, the UK’s NCSC, Australia’s ASD, Canada’s Cyber Centre, Japan’s NPA and NCIR, New Zealand’s NCSC, and Spain’s CNI. The campaign ran since at least mid-January 2021, with indicators dating to 2016. Victims included government organizations, law enforcement, healthcare systems, and religious institutions in Southeast Asia, plus US critical infrastructure, law enforcement, education, and religious organizations, with targets in Africa and North America. Actors built a custom web application giving third parties access to stolen email. Eight CVEs were exploited, five added to CISA’s KEV catalog concurrently. Integrity Tech was sanctioned by the US Treasury in January 2025, the UK in December 2025, and the EU in March 2026.

Beijing Firm Integrity Technology Group Hacked Government Email, Built Third-Party Portal →

Topics: State-sponsored hacking

Leaked Silent Ransom Group chats reveal fake IT agents and $200M in claimed settlements

A leaked archive of internal chats from the Silent Ransom Group, also tracked as Luna Moth and Chatty Spider, shows the Russia-linked crew recruiting agents to pose as IT staff inside US law firms. In early October, an unidentified source posted thousands of messages spanning August 2025 to September 2026 to a purpose-built .onion site; Recorded Future News reviewed the archive, dubbed the Luna Moth Files. Chainalysis matched crypto addresses to known SRG extortions, including a $10 million payment in mid-2026. SRG skips encryption, talking its way into large law firms by phone and phishing, using legitimate remote management software. About 50 organizations appear in the chats, most law firms. The gang’s own figures total roughly $200 million in settlements, unverified. By September the group discussed relaunching as Sleepless Threat.

Leaked Chats Show a Russian Extortion Gang Sending Fake IT →

Topics: RansomwarePhishing

Cyberattack on two Seoul megachurches may have exposed 850,000 members

Suspected cyberattacks on two Seoul megachurches may have exposed the personal data of hundreds of thousands of members. Oasis Security found attack records and account information related to Yoido Full Gospel Church and SaRang Church on an overseas server. Initial analysis indicated data connected to 850,000 Yoido members could be compromised, including names and birth dates, with some records containing phone numbers, addresses, and national identification numbers. The file contained 2,629 changes to resident registration numbers, 3,964 to phone numbers, and 7,202 to addresses. Senior Pastor Lee Young-hoon apologized and said the church worked with authorities. The SaRang breach reportedly involves files of about 89,000 congregants and 286 staff members, with attack logs suggesting data was taken in August. Both churches are investigating and neither has determined how attackers got in.

Cyberattack on Korean megachurches may have exposed 850K members →

Topics: South Korea data breaches and enforcement

ARTEX AI and Claude agents used to attack South Korean banks

A Chinese-speaking hacker used the ARTEX AI penetration testing suite and Claude agents to attack multiple South Korean banks, including Shinhan Bank, KB Kookmin Bank, and Hana Bank, exposing clients’ personal data and credit card information and causing system outages in some cases. The South Korean government responded with an emergency meeting and calls for immediate security measures for critical IT systems. CrowdStrike confirmed the use of ARTEX AI, until recently an open-source agentic penetration testing suite developed in China. Researchers found open directories containing Claude Code session histories, ARTEX configuration files, and Claude memory files. The ARTEX instance used DeepSeek v4.1-flash as its primary LLM backend, supplemented with GLM-5.3 and Grok 4.6. CrowdStrike says the attacker may be a 26-year-old Chinese national, though the personal details are not reliable enough to confirm identity. After confirming real-world use, the developer made ARTEX closed-source, but derivatives remain available.

ARTEX AI, Claude agents used in cyberattacks on South Korean banks →

Topics: Autonomous AI agent cyberattacks in the wildClaude Code

FBI arrests Cypfer co-founder Edward Dubrovsky in ShinyHunters probe

The FBI arrested Edward Dubrovsky, a Canadian cybersecurity executive and co-founder of Canadian ransomware negotiation firm Cypfer, in connection with its ShinyHunters investigation. Dubrovsky is now associated with another Canadian security firm, CyberSteward. The New York Times reported on October 9 that the FBI had arrested a suspect in Pennsylvania; cybersecurity journalist Brian Krebs later identified the suspect as Dubrovsky. The FBI has not publicly released his name in a formal announcement, and the exact charges and his alleged role were not immediately clear. Court records show the case was filed in the Eastern District of Pennsylvania on October 8 and terminated there on October 9 after Dubrovsky was committed to the Eastern District of Texas. The arrest follows the detention in Jordan on September 29 of suspected ShinyHunters member Saif al-Din Khader, known online as Rey.

FBI Arrests Ransomware Negotiation Firm Co-Founder in ShinyHunters Probe →

Topics: ShinyHuntersCybercrime arrests

XRP Ledger bug could have minted coins beyond fixed supply

A vulnerability disclosure report published on XRPL.org on Friday said an integer overflow in the XRP Ledger’s payment engine could have let one cheap, rigged transaction mint coins beyond the network’s fixed supply. When one payment consumed many offers from the XRP Ledger’s built-in order book, the engine summed the XRP owed using 64-bit math with no overflow check; if the total grew too large it would wrap around to a tiny number, paying offer owners in full while charging the buyer almost nothing. The bug likely dates to 2015. Exploiting it would have required a few hundred accounts posting absurdly priced offers, one payment sweeping through them, and a few hundred dollars’ worth of XRP in refundable reserves plus fees. Researcher Cayden Liao reported the bug on September 22nd. RippleX reproduced it before rating it critical. An emergency release of xrpld followed on September 25th. The report said there was no evidence of exploitation on any public network.

XRP Bug Could Have Let Hackers Print Billions in Crypto Out of Thin Air →

Topics: Crypto security

Hacked security cameras used to track troops and military targets

Internet-connected security cameras and webcams are being hacked and turned into military intelligence tools, allowing countries including Israel, Iran, Russia, and Ukraine to monitor troop movements, track targets, and assess attacks. An estimated 1.2 billion internet-connected cameras operate worldwide, many inadequately secured. A poultry farmer in northern Israel found the language settings on a camera overlooking his chicken coop had changed to Arabic during the US-Israeli military campaign against Iran earlier this year. The Israel National Cyber Directorate determined hackers had compromised the Chinese-made device; its position gave a view of Israeli security activity near the Lebanese border. During the June 2025 Israel-Iran war, the directorate urged homeowners and businesses to secure their cameras, identifying weak passwords, outdated software, and direct internet exposure as common weaknesses. Directorate chief Yossi Karadi said Iran had infiltrated parking and road cameras during the conflict to monitor prominent Israelis.

Hackers use security cameras to track troops, military targets in Israel, Ukraine - report →

Topics: State-sponsored hackingSmart devices privacy

Spoofed store discount ads on Facebook and TikTok can steal card details in real time

Group-IB attributes a scam campaign it calls Milk Dragon to a group that has run for at least a year, creating lookalike e-commerce sites for familiar brands and retailers. The ads offer deep discounts on major brands including Legos and Calvin Klein and are placed in Facebook and TikTok groups and pages focused on bargains, where deal hunters are likely to click. Shoppers who click through can land on spoofed stores carrying malware called BytePress, which sends checkout-form entries back to attackers. Some fake storefronts use AI-generated product listings to appear more credible. Submitting the purchase is not necessary for theft: BytePress can stream keystrokes in real time, so card details and other personal information may be exposed before the form is sent. Once submitted, details pass through attacker-controlled systems to a legitimate website, letting attackers intercept one-time password prompts.

Spoofed store discount ads on Facebook and TikTok can steal card details in real time, report warns →

Topics: PhishingMalware & infostealers

Canadian YouTuber builds ALPR camera to track police vehicles

Canadian software engineer and YouTuber Anthony Sistilli built an automatic license plate recognition camera designed to track police vehicles. In a video posted to his channel on October 7, Sistilli said two police officers came to his doorstep on September 20 to ask about the device and his intentions for the project. Sistilli pointed to the irony of the officers’ concerns, saying they mirror the privacy concerns of ordinary citizens wary of expanded blanket surveillance from mass ALPR installation. Flock Safety, a US public safety technology company, has scaled its centralized national surveillance network to more than 120,000 cameras across 49 states, capturing billions of vehicle scans monthly. Further detail on the device’s construction and the officers’ questions remains in the source.

Canadian YouTuber builds ‘Flock-like’ camera to exclusively track police vehicles →

Topics: License plate readers (ALPR)Flock Safety