Weekly roundup: TraderTraitor $6.43B Binance theft, Volt Typhoon Silent Train, Cursor extension backdoor and dozens of CVEs
This weekly roundup covers many incidents. The FBI attributed the theft of $6.43B in virtual assets from Binance across 11 blockchains to the North Korean group TraderTraitor, with $2.85B frozen on-chain. Volt Typhoon was reported to use a rotating relay network of compromised SOHO, IoT and enterprise devices, codenamed Silent Train, including in zero-day attacks, to pre-position access in critical infrastructure. A tampered Claude Code extension on the Cursor Marketplace installed an SSH backdoor (up to 5,000 users), and Polymarket lost about $2.7M after third-party DebugBear was compromised. The roundup also lists a long set of patched vulnerabilities across Wasmtime, Chrome, Firefox, Linux kernel, Veeam, Juniper, WatchGuard, Apache and others.
Exploit público
Há código de exploração publicado no Exploit-DB para CVE-2026-9082. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.
-
Drupal Core 10.5.5 - Error-Based SQL Injection
This script targets Drupal Core 10.5.5 running on PostgreSQL, abusing the JSON:API module's filter handling, where user-supplied array keys end up inside the SQL query. An unauthenticated remote attacker who can reach a site with JSON:API exposed could trigger database errors that leak data, such as the database version, in the error message. It is a short proof of concept that only demonstrates information disclosure through error-based injection, with no further exploitation. It was tested only in a local Docker setup and is not verified by Exploit-DB, but it appears to match the listed CVE.
Detalhes técnicos
- Cursor/Claude Code: two extension versions were altered to plant a persistent SSH backdoor with a reverse shell. Cursor rotated keys, rebuilt the marketplace and took the server offline. How the publisher account under Anthropic's name was obtained remains unanswered.
- Polymarket/DebugBear: DNS records were hijacked via the domain registrar and crypto-draining JavaScript drained about $2.7M from 33 deposit wallets in under an hour.
- Gheist: a campaign using stolen GitHub tokens plants a "sync-check" workflow that prints repository secrets into logs, downloads them through the API and deletes the run. Wiz recovered over 13,500 branches from more than 850 accounts.
- Keystone: an attacker exploited a flaw in a third-party monitoring tool to escalate privileges and take customer records and a device-authenticity key. Keystone will destroy 18,835 devices carrying the old key. Trezor warned of a suspected hardware implant in Trezor Safe 5 units sold by reseller CryptoBilis.
- Mobile and fraud: the uCreator Android spyware clones WeChat accounts using on-device virtualization. CyberDakait runs seven Android banking trojan families in India (17,960 devices, about 7.6M SMS intercepted). MadApe is a Microsoft device-code phishing kit. A phishing lure poses as an Anthropic AI event.
- Other malware: the Kairos Go-based Linux DDoS bot spreads via Telnet default credentials. XWorm is delivered to Colombian organizations. Aur0ra ransomware (Gold Ogre) uses AI models, with guardrails bypassed by posing as red team work. Malicious Hugging Face repositories abuse trust_remote_code for cryptomining and backdoors. A tech-support scam trojanizes UltraViewer and UltraMailer to deliver DarkKometa and njRAT. Microsoft observed Teams-based help desk impersonation leading to Quick Assist access and AD CS abuse.
- Other items: Virtualine, a bulletproof hosting provider, was seized. The Australian Signals Directorate disrupted Amadey. The Searchjacked campaign involved 319 Chrome extensions (13.4M installs). Russia's and Ukraine's emergency alert systems were hit.
Remediação
- Patch the listed products, prioritizing those marked urgent or exploited.
- Move funds from Trezor devices bought from CryptoBilis since March 2026 to a new wallet with a new seed.
- Audit installed IDE extensions and GitHub tokens and workflows, and disable default Telnet credentials.
- Restrict Quick Assist and device-code authentication flows, and train users on help desk impersonation.
Linha do tempo
-
Weekly roundup: TraderTraitor $6.43B Binance theft, Volt Typhoon Silent Train, Cursor extension backdoor and dozens of CVEs
ler a análise desta fonte ocultar
This weekly roundup covers many incidents. The FBI attributed the theft of $6.43B in virtual assets from Binance across 11 blockchains to the North Korean group TraderTraitor, with $2.85B frozen on-chain. Volt Typhoon was reported to use a rotating relay network of compromised SOHO, IoT and enterprise devices, codenamed Silent Train, including in zero-day attacks, to pre-position access in critical infrastructure. A tampered Claude Code extension on the Cursor Marketplace installed an SSH backdoor (up to 5,000 users), and Polymarket lost about $2.7M after third-party DebugBear was compromised. The roundup also lists a long set of patched vulnerabilities across Wasmtime, Chrome, Firefox, Linux kernel, Veeam, Juniper, WatchGuard, Apache and others.
Technical Details
- Cursor/Claude Code: two extension versions were altered to plant a persistent SSH backdoor with a reverse shell. Cursor rotated keys, rebuilt the marketplace and took the server offline. How the publisher account under Anthropic's name was obtained remains unanswered.
- Polymarket/DebugBear: DNS records were hijacked via the domain registrar and crypto-draining JavaScript drained about $2.7M from 33 deposit wallets in under an hour.
- Gheist: a campaign using stolen GitHub tokens plants a "sync-check" workflow that prints repository secrets into logs, downloads them through the API and deletes the run. Wiz recovered over 13,500 branches from more than 850 accounts.
- Keystone: an attacker exploited a flaw in a third-party monitoring tool to escalate privileges and take customer records and a device-authenticity key. Keystone will destroy 18,835 devices carrying the old key. Trezor warned of a suspected hardware implant in Trezor Safe 5 units sold by reseller CryptoBilis.
- Mobile and fraud: the uCreator Android spyware clones WeChat accounts using on-device virtualization. CyberDakait runs seven Android banking trojan families in India (17,960 devices, about 7.6M SMS intercepted). MadApe is a Microsoft device-code phishing kit. A phishing lure poses as an Anthropic AI event.
- Other malware: the Kairos Go-based Linux DDoS bot spreads via Telnet default credentials. XWorm is delivered to Colombian organizations. Aur0ra ransomware (Gold Ogre) uses AI models, with guardrails bypassed by posing as red team work. Malicious Hugging Face repositories abuse trust_remote_code for cryptomining and backdoors. A tech-support scam trojanizes UltraViewer and UltraMailer to deliver DarkKometa and njRAT. Microsoft observed Teams-based help desk impersonation leading to Quick Assist access and AD CS abuse.
- Other items: Virtualine, a bulletproof hosting provider, was seized. The Australian Signals Directorate disrupted Amadey. The Searchjacked campaign involved 319 Chrome extensions (13.4M installs). Russia's and Ukraine's emergency alert systems were hit.
Remediation
- Patch the listed products, prioritizing those marked urgent or exploited.
- Move funds from Trezor devices bought from CryptoBilis since March 2026 to a new wallet with a new seed.
- Audit installed IDE extensions and GitHub tokens and workflows, and disable default Telnet credentials.
- Restrict Quick Assist and device-code authentication flows, and train users on help desk impersonation.