NEWS

Weekly Recap: Binance Heist, Linux DDoS Botnet, Device-Code Phishing, Android Spyware

This week: FBI ties a $6.43B Binance theft to North Korea, a Telnet-spreading Linux DDoS botnet, device-code phishing, trojanized extensions, and a long CVE list.

Dylan H.

News Desk

November 2, 2026
3 min read
Weekly Recap: Binance Heist, Linux DDoS Botnet, Device-Code Phishing, Android Spyware

Threat of the Week

Binance theft attributed to North Korea. The FBI linked the theft of more than $6 billion in virtual assets to the TraderTraitor group. The $6.43B haul spans 11 blockchains, 82% of it on Ethereum and Bitcoin. About $2.85B has been frozen by Tether, Circle, Ripple, Arbitrum, and Optimism.

Top News

  • Volt Typhoon "Silent Train": The Chinese state-linked group uses rotating chains of compromised SOHO, IoT, and enterprise devices as a relay network for zero-day attacks.
  • Polymarket trading halt: Trading paused after hackers compromised third-party DebugBear. About $2.7M was drained from 33 deposit wallets.
  • ChatGPT shared-link flaw: Parameter Labs found a now-patched bug where a shared link ran attacker JavaScript in the victim's signed-in session.
  • Trojanized Claude Code extension: Two versions on the Cursor Marketplace installed a persistent SSH backdoor. Cursor said up to 5,000 users were affected.
  • Amadey botnet disruption: Australia's Signals Directorate cut its access to 180,000 computers.
  • Virtualine seizure: The DoJ seized a domain tied to the bulletproof hosting provider.
  • Keystone breach: The hardware wallet maker lost 25,964 customer records and plans to destroy 18,835 devices using the old key.
  • Trezor warning: A suspected hardware theft implant was flagged in Trezor Safe 5 units sold by reseller CryptoBilis.
  • uCreator Android spyware: Targets apps such as GCash, WeChat, and WhatsApp, and can clone WeChat accounts.
  • Gheist campaign: Stolen GitHub tokens were used to plant a "sync-check" workflow that dumps repository secrets. Wiz recovered over 13,500 branches from 850+ accounts.

Trending CVEs

Notable vendors and products in this week's list:

  • Wasmtime: CVE-2026-115889, CVE-2026-115893
  • Juniper Session Smart Router: CVE-2026-103401 through CVE-2026-103409
  • Drupal: CVE-2026-114573, CVE-2026-9082, CVE-2026-118539
  • Veeam: CVE-2026-107239, CVE-2026-107238
  • Telerik UI for ASP.NET AJAX: CVE-2026-18672, CVE-2026-19219
  • Okta Access Gateway: CVE-2026-115547
  • TeamViewer: CVE-2026-111585
  • Langflow: CVE-2026-93680, CVE-2026-110186 (see our Langflow coverage)
  • Also: ASUS (14 CVEs), Apache Camel (6), Google Chrome, Linux kernel, a TightVNC pre-auth RCE, Mozilla Firefox, Apache Tomcat and Kafka, Canonical LXD, and WatchGuard

Other Notable Items

  • MadApe: A Microsoft device-code phishing kit first seen by Group-IB on January 7, 2026
  • Searchjacked: 319 Chrome extensions with 13.4M reported installs hijacked searches
  • Kairos: A Go-based Linux DDoS botnet spreading over Telnet using default root credentials with an empty password
  • CyberDakait: Seven Android trojan families targeting Indian banks; at least 17,960 devices compromised and about 7.6M SMS messages intercepted
  • Aur0ra ransomware (Gold Ogre): Sophos reports heavy use of AI tools in intrusions
  • Hugging Face: Malicious models abuse trust_remote_code to run cryptominers and backdoors on GPU hosts
  • Emergency alert systems: Both Ukraine's and Russia's were hit, sending false alerts
  • UltraViewer scam: Victims are steered to trojanized installers that deliver DarkKometa and njRAT

Takeaways

Disable Telnet and default credentials on exposed devices, restrict OAuth device-code flows, audit browser and IDE extensions, and rotate any GitHub tokens that could have leaked.

Sources