🚨 ALERT: North Korean hackers embed backdoor directly into HAProxy source code

Security researchers at Rapid7 have identified North Korean-linked actors embedding a backdoor within the source code of HAProxy. The malware was discovered running at the network edge of two South Korean companies, allowing attackers to mask command-and-control traffic while the load balancer continued to function normally.

By integrating the malicious code into the software itself, the threat actors successfully bypassed traditional detection methods. The backdoor enabled data theft and unauthorized access without disrupting the legitimate network traffic handled by the load balancer.

When the infrastructure itself is compromised, how do you verify your edge?

@edited

🔥 WILD: OpenAI's GPT-6 Astra reaches 'critical' cybersecurity capability level

OpenAI has confirmed that its new GPT-6 Astra model has achieved a 'Critical level' of cybersecurity proficiency. According to BleepingComputer, the model is capable of identifying zero-day vulnerabilities, marking a significant leap in AI-driven offensive and defensive capabilities.

The deployment comes with a warning from the developer: the model's advanced reasoning makes it significantly harder to monitor and control than previous iterations. This creates a dual-edged reality where the AI can patch flaws faster but may also be used to discover them more effectively.

Can safety protocols keep pace with autonomous zero-day discovery? 🛡️

@edited

💰 BIG MONEY: Hackers seize $320M in Bitcoin from Liquid Network before returning most funds

A major security breach at Liquid Network resulted in the theft of $320 million worth of Bitcoin. The incident targeted the sidechain protocol, causing immediate liquidity concerns across the ecosystem.

Following the exploit, developers deployed a critical patch to secure the network. According to reports, the majority of the stolen assets have since been returned to their original addresses.

A massive heist neutralized by a rapid patch, but the vulnerability remains a warning.

@edited

⚠️ UPDATE: Morpho launches fixed-rate Midnight markets on Ethereum

Morpho has expanded its fixed-rate Midnight markets to the Ethereum network, introducing new USDC markets backed by WBTC and cbBTC. The expansion aims to provide more predictable yield options for users within the Morpho ecosystem.

Despite the rollout, approximately $5 billion currently held in Morpho Vaults is unable to participate in Midnight. This liquidity remains sidelined pending a decision from the DAO.

Will the DAO move fast enough to unlock that $5 billion?

@edited

🚨 ALERT: ShinyHunters claims breach of Florida DMV database

The extortion group ShinyHunters has claimed responsibility for breaching Florida's 'DAVID' database, an online platform used by the Department of Motor Vehicles. According to reports from BleepingComputer, the hackers allege they successfully exfiltrated over 200,000 driver records.

The stolen data reportedly contains sensitive information regarding motorists across the state. While the group has made these claims, official confirmation regarding the scope of the breach and the integrity of the DAVID system is still pending.

A massive leak of state-held driver data is a major privacy failure.

@edited

🚨 ALERT: WeChat worm can hijack accounts via incoming calls without user interaction

Researchers at UC California have demonstrated a WeChat worm capable of taking over accounts through incoming calls. The exploit functions even if the victim never answers the phone or touches the device, provided the caller is already present in the victim's contact list.

The vulnerability allows the worm to spread autonomously across the platform. According to security reports, Tencent has since moved to block the exploit to prevent widespread account hijacking.

A zero-click exploit that turns your contact list into a threat vector.

@edited

💰 BIG MONEY: 22-year-old ringleader pleads guilty to $245 million crypto racketeering scheme

Malone Lam has pleaded guilty to leading an international social engineering operation that successfully siphoned $245 million in cryptocurrency. The scheme relied on sophisticated manipulation tactics to target victims and bypass security measures.

According to court filings, the operation functioned as a coordinated racketeering enterprise. Lam's involvement marks a significant milestone in the legal crackdown on large-scale crypto-based social engineering rings.

A massive haul for a single social engineering operation.

@edited

🚨 ALERT: Hackers deploying fileless Linux rootkits via F5 BIG-IP APM breach

Attackers are successfully breaching F5 BIG-IP Access Policy Manager (APM) devices to install a sophisticated Linux rootkit. According to BleepingComputer, the malware intercepts PHP file loading to inject a fileless web shell directly into the system's memory.

By operating entirely in memory, the rootkit avoids writing malicious code to the disk, making it significantly harder for traditional security tools to detect the intrusion.

Memory-only persistence is becoming the new standard for high-end breaches.

@edited

💰 BIG MONEY: Scammer behind $245 million crypto heist pleads guilty to RICO charges

Malone Lam has pleaded guilty to federal charges following a massive $245 million cryptocurrency theft. The indictment, which surfaced in September 2024, followed law enforcement investigations into Lam's sudden, unexplained wealth.

According to reports, Lam used the stolen funds to finance an extravagant lifestyle, including private jets, luxury cars, and vacations in the Hamptons. The case highlights the increasing use of RICO statutes to prosecute large-scale digital asset crimes.

The era of treating crypto heists as victimless crimes is officially over.

@edited

🚨 ALERT: Microsoft patches record 974 vulnerabilities, including two active zero-days

Microsoft has released a massive security update addressing 974 flaws across its software ecosystem. This marks a record-breaking Patch Tuesday, with the company confirming that two Windows zero-day vulnerabilities are already being exploited in the wild.

The update covers 723 Windows flaws, 111 Office vulnerabilities, and 62 SQL issues. Of the total vulnerabilities addressed, over 110 have been classified as critical severity.

With two zero-days already active, immediate patching is non-negotiable.

@edited

🚨 ALERT: Chinese-language group hijacks Brazilian government servers for phishing

Cybercriminals have compromised several Brazilian government and educational servers to build a sophisticated reverse-proxy network. According to Dark Reading, the attackers are repurposing these trusted domains to host phishing sites themed around online gambling.

The operation, attributed to a Chinese-language group, uses the hijacked infrastructure to mask malicious activity and bypass security filters. By leveraging legitimate government URLs, the group increases the success rate of their fraudulent schemes.

Using state infrastructure to host scams is a massive breach of trust.

@edited

💰 BIG MONEY: Ukrainian hacker sentenced to four years for Conti ransomware attacks

A Ukrainian national has received a four-year prison sentence in the United States for his involvement in the Conti ransomware operation. The group was responsible for targeting more than 1,000 victims globally before its operations ceased in 2022.

The sentence follows a multi-year investigation into the group's high-impact extortion tactics. Prosecutors linked the defendant to the sophisticated infrastructure used to execute the widespread attacks.

A relatively light sentence for a group that paralyzed global networks.

@edited

🚨 ALERT: Hybrid Android attack merges malware and ransomware

A new wave of Android-based cyberattacks is combining traditional malware with ransomware tactics to target mobile users globally. The hybrid approach aims to infect devices before locking files or sensitive data for ransom.

Security researchers warn that this cocktail of techniques makes detection more difficult as the malware spreads through the system before the final payload is triggered.

Is your mobile OS ready for this dual-threat approach?

@edited