SysBlue Cyber Solutions

28/10/2026

Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns.

The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access.

"First identified in late 2023, Silent Train uses rotating chains of compromised SOHO, IoT, and enterprise infrastructure," Lumen Technologies Black Lotus Labs said in a report shared with The Hacker News. "It employs anti-forensic techniques, compartmentalized operations, and post-operation cleanup to minimize detection and attribution."

Volt Typhoon used the disrupted Silent Train network for four zero-day campaigns targeting enterprise management systems and strategic networks.

27/10/2026

CyberStrikeAI Uses 44 AI Agents to Automate Operations Against Japan Targets.

Cybersecurity researchers have disclosed details of three targeting organizations in Japan in which artificial intelligence (AI) was a key element, either in the driving seat or to assist a human operator.

TrendAI, which analyzed three exposed server environments used by threat actors to conduct the malicious cyber operations, described them as distinct from previously published attacks that have leveraged ARTEX, an AI pe*******on testing framework, to single out entities in South Korea and Japan.

TrendAI analyzes three cyber campaigns involving autonomous and AI-assisted attacks, including CyberStrikeAI activity targeting Japan.

20/10/2026

Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software.

The private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised, Mozilla and Google's Chrome Root Program confirms on October 20.

An intermediate CA signs the certificates that websites present, so anyone holding one of these keys could issue a certificate for any website that a browser would accept.

Eight eMudhra CA keys were compromised, prompting browser blocks and software fixes. Chrome found no rogue certificates in CT logs.

19/10/2026

Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor.

Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public.

According to a researcher who goes by the online alias boredhackerblog, the exploitation activity involves chaining four different vulnerabilities, collectively called Plex2Shell.

Attackers exploit four Plex Media Server flaws chained as Plex2Shell to deploy XMRig miners and reverse proxy software after PoC release.

18/10/2026

ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants.

ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants.

ConnectWise disabled seven application identities and suspended Cloud Backup after attackers compromised Microsoft 365 tenants.

17/10/2026

MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon

Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX.

The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by a user named "malfexteste8." It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of the package is 1.0.3.

The MALFEX-linked npm package imgdecode uses a Windows DLL to fetch and decrypt a GitHub payload before injecting it into dllhost.exe.

15/10/2026

ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More.

Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an actual feature. And somehow, it fits right in with this week's security stories.

The rest gets interesting in different ways. A small permission can lead to a big theft. A trusted login can hide the wrong person. Old bugs are finding new victims, familiar tools are being put to strange uses, and some flaws are so simple you wonder how nobody spotted them sooner.

This week's ThreatsDay covers ransomware attacks, critical security flaws, credential theft, new malware, and sneaky tricks attackers use to break in.

14/10/2026

Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability.

Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco said in an advisory on Wednesday.

The attacker sends an email with a crafted attachment through the gateway and, if it succeeds, could then run commands as root. The appliance filters an organization's email for spam, malware, and other threats, and only a gateway with the File Reputation service enabled and a Content Scanner Tools package older than version 25.3.0.5525 is vulnerable.

https://thehackernews.com/2026/10/cisco-warns-of-active-attacks.html?m=1

13/10/2026

Anthropic Warns Small AI Models Could Soon Form Self-Propagating IoT Botnets

Small artificial intelligence (AI) models may be months away from developing capabilities to self-replicate on IoT devices like smart ovens and off-brand Android TV boxes, according to a warning from Anthropic.

The frontier AI lab said small AI models could form autonomous, self-propagating worm botnets that are "challenging to shut down," since "there's no centralized point to shut off."

Anthropic warns small AI models could form IoT botnets; GLM-5.2 propagated Llama3.1-8B to eight nodes in four of five tests.

11/10/2026

P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands.

Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword.

"Compared with the variants we usually observe, P7 reduces its on-device footprint, adds on-device keychain and crypto-wallet theft, and adds two way C2 communication with the attacker's infrastructure," iVerify said in a new report published Thursday.

P7 DarkSword adds on-device keychain and crypto wallet data theft to the iOS exploit kit, alongside two-way C2 communication.