The US Department of the Treasury has cut off the MEXC Global crypto exchange from the US financial system over sanctions evasion and links with cybercrime gangs. Founded in 2018, the Seychelles-based MEXC is one of the world's largest crypto exchanges, giving more than 40 million users from more than 170 countries access to 3,000 cryptocurrencies and tokenized assets. According to a Financial Crimes Enforcement Network (FinCEN) order, MEXC has allowed illicit transactions of at least $16 billion linked to cybercrime operations and Iranian, North Korean, and Russian sanctions evasion between May 2021 and May 2026. The Treasury Department said that, as recently as June 2026, MEXC was still processing transactions with sanctioned Russian entities Garantex and Grinex, and it also facilitated or processed at least $226 million in transactions benefiting or connected to the Russia-based, OFAC-sanctioned A7 sanctions evasion network.
Ukrainian law enforcement arrested four suspects in a case involving the theft of more than €4.3 million using a network of cryptocurrency investment scam call centers. In these fraud schemes (also known as romance baiting or pig butchering scams), criminals lure targets through social media, dating sites, and messaging apps into fake investment schemes, stealing their money instead of investing the funds as promised. The investigation involved Ukraine's Cyber Police Department, the Main Investigation Department of the National Police of Ukraine, and German law enforcement authorities. According to Ukraine's Cyber Police, the suspects used phone calls and messaging apps to build victims' trust through social engineering and trick them into investing in cryptocurrency, shares, and other financial instruments through fraudulent online trading platforms.
US agencies warn attackers are going after industrial refrigeration controllers. The fixes are basic, and most start with getting them off the internet. CISA, the FBI, HHS, USDA and the Department of Transportation published a joint advisory on attacks against industrial refrigeration controllers and cold chain monitoring systems. The activity is global. Healthcare, chemical, food and transport companies use these systems to watch temperatures, keep logs, run defrost cycles and save energy, including in refrigerated trucks. “The authoring organizations are aware of malicious cyber actors targeting electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities.” reads the advisory published by CISA. “The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards.” The targets are electronic temperature controllers and commercial refrigeration controllers used in grocery stores and cold-storage sites. Attackers may exploit flaws in unpatched or internet-accessible controllers to change settings remotely and force units into continuous heating and defrost cycles. In plain terms, someone could cook your freezer from the other side of the world. The agencies identify three ways in: bypassing authentication, injecting arbitrary code, and exploiting weak configurations. Once inside, an attacker can change temperatures, which can shorten equipment life, create a fire hazard and destroy stock. Spoiled products that reach consumers can also create a safety risk. “The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards.” continues the adviosry. An attacker can also hide the damage. Operators lose sight of current temperatures, and that’s a bad moment to learn a cold room has been warm for hours. CISA’s Chris Butera adds that every organization that depends on these systems should assume it’s a target. The advice follows the Cross-Sector Cybersecurity Performance Goals from CISA and NIST, a minimum set of practices for any organization. Start with exposure. Keep controller panels off the internet, and if you need remote access, put an up-to-date firewall or similar gateway in front of it. Then separate industrial equipment from the office network with its own virtual network. Next, fix the basics. Change default passwords, use strong ones, and add phishing-resistant multifactor authentication where you can. Update firmware, and retire or replace devices the maker no longer supports. Allow only trusted devices and IP addresses to change system settings. Keep tested backups in a separate location, disconnected from the network. Enable logging and regularly check the logs. If devices do not record activity, monitor the network traffic between them. U.S. organizations should report suspicious activity to CISA’s 24/7 operations center or the FBI’s Internet Crime Complaint Center. Healthcare organizations can also contact HHS. Reports should include the date, time and location of the incident, a description of the activity, the number of people affected, the equipment involved, and a contact person within the organization. One control gets forgotten more than the rest. A controller shouldn’t be able to push a freezer past what’s safe, whoever is giving the orders. “The authoring organizations strongly urge industrial refrigeration and cold chain monitoring system owners and operators to secure remote access to their OT systems.” concludes the report. “To strengthen system security, owners and operators should review the following resources and implement recommended mitigations: United Kingdom’s National Cyber Security Centre and Partners: Secure Connectivity Principles for OT“ CISA: Primary Mitigations to Reduce Cyber Threats to Operational Technology CISA: Defend the Edge: The Critical Importance of Edge Device Security CISA: Internet Exposure Reduction Guidance Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
The BBC plans to use emergency FM radio to keep the UK informed during prolonged blackouts, with a self-sufficient studio ready for 72 hours. If electricity fails across the UK for days, the BBC says it has a plan to keep people informed. David Sillito, the BBC’s media and arts correspondent, explained the strategy in a BBC News report, starting with the 2015 Lancaster floods and ending with a simple lesson: when digital infrastructure fails, FM radio may be the most reliable way to reach the public. On December 5, 2015, the River Lune flooded Lancaster, cutting electricity to 61,500 people. Roger Kemp, an engineering professor at Lancaster University specializing in safety and electrical systems, was watching television when the power went out. The following day, he described the scene to the BBC as almost resembling a zombie movie, with residents searching for phone reception and queuing at the only working telephone box. Homes lost heating and lighting, while some water supplies stopped because their pumps depended on electricity. Railway stations, petrol stations and shops closed, cash machines stopped working, and traffic lights failed. Only two communication systems remained operational: copper landlines and FM radio. Local station The Bay continued broadcasting using an emergency generator and a single landline. Kemp’s subsequent report highlighted the irony: a society increasingly dependent on digital infrastructure had relied on technologies dating back decades to receive essential information. The incident illustrated the risk of a wider catastrophe known as a Black Sky event, in which electricity, water, shops and communications fail simultaneously. At a recent UK resilience summit, discussions focused on maintaining essential services for at least 72 hours. One expression often heard in civil contingency circles, “nine meals from anarchy”, captures the concern that three days without food could turn an emergency into widespread disorder. “We are nine meals from anarchy” is a phrase often heard in the civil contingency world. A brutal reminder of the fear that three days without food would be enough to turn a crisis into chaos. If a Black Sky event takes out electricity, water, shops and communications, there is a good reason the government wants us to have our own supplies.” BBC states. “In a major emergency, we are being told to hunker down and turn on an FM radio, as thousands did in Lancaster. This is why the BBC has its own Black Sky plan.” The government’s Be Ready campaign warns that severe weather and cyberattacks could disrupt essential services, although it says there is no specific threat to the electricity grid. According to government advice reported by the Express, households should maintain at least three days of food and drinking water and keep a battery-powered FM radio. Sillito also recommends a hand-cranked radio that can generate its own power. The BBC’s contingency plan revolves around precisely this technology. Around 100 people would operate a dedicated emergency radio studio, equipped with secure communications independent of the internet, alongside enough fuel, water and food to survive at least three days without resupply. Reports published by French outlet Telesatellite and Open magazine on November 7 describe a self-contained studio, generators powering transmission facilities and FM radio as the fallback communication channel. Only a small number of BBC staff know the complete details. The studio would broadcast pre-prepared government announcements, with scripts already published online. These include practical instructions on daily water consumption and disposing of toilet waste when flushing is impossible. Additional reporting would come from satellite vehicles and journalists stationed at emergency centres across the UK. Transmission towers, disconnected from the internet, would use diesel generators and storage tanks ranging from 5 to 40,000 litres, providing approximately three days of power. Satellite phones would support communications between teams, with agreed meeting points and procedures if those systems also failed. FM radio remains central because it can reach almost everywhere, even during a major blackout or disruptive cyberattack. The BBC’s planning assumptions have evolved. An insider told Sillito that the original scenario considered outages lasting five to seven days, while the latest advice from the National Energy System Operator suggests electricity could return within two to three days. The corporation’s contingency arrangements have surfaced before. In October 2022, media reports described leaked draft scripts for a national blackout, including half-hourly Radio 4 updates from an emergency broadcasting centre at an undisclosed rural location. There is, however, a discrepancy in the Express report, which claims that only around 100 people worldwide know the full details. The BBC says approximately 100 people would operate the emergency studio, while only a small number have access to the complete plan. Concerns about grid resilience are not new, but the massive blackout affecting Spain, Portugal and south-western France in April 2025 renewed attention to the issue. Lord Harris, chair of the National Preparedness Commission, argues that the consequences extend well beyond losing electricity. Water supplies could stop because pumping stations need power, while sewage systems could become blocked when water can no longer circulate. Governments across Europe increasingly advise citizens to maintain emergency supplies, and Harris believes the UK has been slow to prepare its population. Some initiatives are already underway. ARIA, the government’s Advanced Research and Invention Agency, is investing £70 million in high-altitude aircraft designed to provide at least a week of emergency mobile and internet connectivity over the UK. Programme director Rico Chandra has warned that satellites alone have limitations when terrestrial networks fail. Harris argues that decades of efficiency-driven decisions have gradually removed essential redundancies. One example is the migration of emergency services from dedicated radio systems to mobile network technology, potentially exposing their communications to the same outages affecting the public. The government maintains that the transition to 4G and 5G provides reliable and resilient communications. “The UK has one of the most resilient electricity systems in the world, and there has never been a complete outage in the grid’s 75-year history.” The Cabinet Office states describing the UK electricity system. Government efforts to improve resilience predate the current debate. In May 2024, then deputy prime minister Oliver Dowden launched the previous Conservative government’s disaster preparedness initiative. During his investigation, Sillito also reconsidered the BBC’s isolated transmission infrastructure. What initially appeared outdated became a strength: independence from the internet could help keep broadcasting alive when digital networks collapse. Yet the UK is preparing to switch off its copper landline network on January 31, 2027, while the future of FM radio is also under review. The government’s position is that copper landlines, although useful during power cuts, have become unreliable and increasingly difficult to maintain. Kemp is less convinced that the country is moving in the right direction. Asked whether his report had improved national preparedness for a Black Sky event, he argued that the planned landline shutdown showed little consideration for how people would communicate during a prolonged power failure. Sillito experienced a smaller reminder while preparing his report: a power cut in his own street, leaking torch batteries, missing candles and an emergency radio he could not find. His conclus: “If anything, we’ve gone backwards,” he said. “Switching off the public switch telephone network, I think shows that there has been really no thought at all about how you communicate when you’ve no longer got power.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, BBC)
Security Affairs AI-CYBERSECURITY newsletter includes a collection of the best articles and research on AI in the international landscape Artificial intelligence is rapidly changing cybersecurity, reshaping both the techniques used by attackers and the tools available to defenders. AI agents can automate tasks, analyze large amounts of data, discover vulnerabilities and accelerate offensive operations. At the same time, AI is creating new capabilities for threat detection, incident analysis and response. Security Affairs’ new newsletter follows this evolution, covering every week the latest threats, attacks, vulnerabilities and developments at the intersection of AI and cybersecurity. ‘It’s 100 percent a national security threat’: Accenture contractor connected an AI agent to the Pentagon’s secure network, and then sent data to a high-risk website Security notice — malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace UK and Germany to jointly develop military AI in 2027 Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer AI policy wonks declare ‘sovereign agents’ a threat to civilization Progress on provable inference for large language models The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources “Black October” for AI Developer Platforms ARTEX Exposed: Mapping the Infrastructure Behind the South Korean Bank Breaches A thousand fewer paths to root Securing Muse: More Than $1 Million in Bug Bounties Paid Out Free the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak Bundles WorkOS October 30th, 2026 Data Security Incident Covert underperformance on safety research tasks GPT‑6 Cyber: Advancing the frontier of aligned cybersecurity agents ThisBash Escape: Claude Dispatch Flaw Enables Browser Extensions RCE on the OS Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Hunt.io traced ARTEX servers and AI-powered hacking tools used in breaches affecting seven South Korean financial institutions. Between late September and early October 2026, seven South Korean financial institutions had data breached through internet-facing systems. About 66,000 to 67,000 people and around 2,200 corporations were affected, and personal, employment, income and loan data was exposed. Hunt.io dug into the infrastructure behind the campaign, and its findings add a lot to what CrowdStrike and Genians already published. CrowdStrike reported on October 7 and Genians Security Center on October 12, and both pointed to ARTEX, an open-source autonomous penetration testing framework developed in China and licensed under AGPL-3.0. CrowdStrike assessed with moderate confidence that a single Chinese-speaking individual motivated by money ran it, and not an established threat group. DeepSeek v4.1 Flash was the main model, with GLM 5.3 and Grok 4.6 as backups, reached partly through a reseller domain, xcai[.]pro. The public indicators were a server at 38.244.50[.]120, which hosted the ARTEX console, plus a Hong Kong address and nine proxies. Genians said the ARTEX GitHub repository and Docker image were removed on October 11, though forks and mirrors remain. “CrowdStrike assessed with moderate confidence that the operator was a single Chinese-speaking individual motivated by financial gain rather than an established threat group.” reads the report published by Hunt.io. “The infrastructure reportedly accessed these services in part through the reseller domain xcai[.]pro. Both reports described a two-server configuration, consisting of a Hong Kong-based IP address used as primary infrastructure and 38.244.50[.]120, which hosted the ARTEX console.” Hunt.io notified the relevant national CERT before publishing, and says the report holds no personal records or credentials. The company’s own scanning showed 38.244.50[.]120 sits on Cogent’s network in Los Angeles, with 15 open ports. The ARTEX login page, with a Chinese title meaning “autonomous penetration testing console”, appears on ports 443 and 8090. Other services include a Gemini2API admin console and a Tinyproxy server. Searching its AttackCapture platform for that address, Hunt.io found another open directory at 23.248.226[.]250, a jump server in Hong Kong on AS138415. It held 42 files in 2 subdirectories, 105 MB in all, and the platform had logged warnings on September 5, September 26 and October 5. A file in it names 38.244.50[.]120 as the jump host, and its own comment tells the operator never to paste the credentials into a session. It sat in an open directory. Three scripts back up the link. They keep reverse SSH tunnels alive, run a local relay, and copy files to the jump host, one tunnel is named grok2api, and the credentials file also holds keys for Zhipu AI’s GLM models, an OpenAI-compatible relay and a proxy service. That explains how several language models ran in one campaign. The AI setup is the most striking part. A state file shows the harness is Claude Code itself, version 2.1.221, started 510 times since August 4, but it isn’t talking to Anthropic. A small proxy, ds-models-shim.py, fixes a compatibility problem by faking a model list and sending requests to DeepSeek, and another, xcai-effort-shim.py, adds a reasoning setting because the DeepSeek backend otherwise skips its reasoning step. The route runs from Claude Code through Claude Code Router, an open-source project, to xcai and then to DeepSeek. “A small local proxy, ds-models-shim.py, addresses a compatibility issue: the official /v1/models endpoint returns a 404 response when queried against a non-Anthropic backend, preventing Claude Code from discovering the available models. The shim intercepts that specific request and returns a locally defined model list containing deepseek-v4-pro and deepseek-flash. All other requests are forwarded to api.deepseek.com/anthropic.” states the report. The same file counts 19 custom skills, reusable instruction sets for the agent, with 147 recorded uses. They cover code audit, reconnaissance, web injection, WAF bypass testing, authentication testing, Telegram Mini Apps, APK download and decompiling, cloud phone control and payment logic testing. Next to the payment skill sat three self-registered test accounts with tokens for a cash-in deposit API, dated September 12, and a comment calls them an authorized, self-built test. The setup fits testing for insecure direct object reference flaws, a technique CrowdStrike and Genians described against Korean loan and inquiry services. The directory also held supporting tools. A script queried FOFA, a Chinese asset search engine like Shodan, through a third-party API, and a comment says the primary membership had expired and a backup key was in use. Proxy scripts enumerated a rotating proxy service at 154.201.79[.]246:443, where 79 unique exit IPs showed up among the first 100 identities tested. A separate directory at 23.248.226[.]250:8001 held a small staged setup for JNDI and LDAP exploitation, retrieved on October 5 at 03:42 UTC. It confirms command execution through a DNS callback, and one script lets web and LDAP traffic share a single port. Hunt.io’s analysis describes the tooling without publishing steps to reproduce it. Other recovered files include tools aimed at a cryptocurrency exchange’s admin session and withdrawals, Linux privilege escalation exploits, iOS probe source code and Android kernel and firmware utilities. Hunt.io says their connection to the Korean breaches isn’t confirmed. Hunt.io then showed how to hunt ARTEX servers. Searching for an ARTEX certificate issuer returned 19 IP addresses, and searching its malware classification returned 1,303 addresses across 30 countries, led by the United States, China and Hong Kong. Those figures show where addresses are registered, not where the operator sits. “The result returned 19 distinct IP addresses, including 38.244.50[.]120. This method is precise but limited to hosts that expose a matching certificate. Systems using a different certificate will not appear in these results.” continues the report. Matching the console’s page title returned about 1,300 IPs, and a looser search found 21 title strings, 19 of them likely ARTEX consoles, in English, Chinese, Korean, Japanese, Russian, Portuguese and Vietnamese. A malware-name search in AttackCapture gave 280 results with open directories. One at 130.94.31[.]86:18888 in Seoul held two small scripts, and another at 156.251.11[.]39 held an SMB reconnaissance toolkit whose test script writes a file named artex_probe_11876.txt. More hosts held exploitation kits for DedeCMS and FangCMS, a CAPTCHA bypass suite, a RuoYi and Spring administrative console exploit and CAPTCHA-based login automation. Together they show the framework attracting many operators. For defenders, the advice is plain. Remove public access and put administration behind VPNs or allowlists, and reset SSH passwords and rotate API keys, proxy credentials and tokens that exposed files may have revealed. Patch internet-facing services, watch for unexpected LDAP and JNDI activity, DNS callbacks and remote script downloads, and store secrets in a managed vault with least-privilege permissions. Also restrict access to model gateways, watch their requests, and enforce compliance rules on managed phones. Hunt.io’s lesson is that an investigation shouldn’t stop at the first list of indicators, because The company also published indicators of compromise in its analysis. “The findings highlight risks associated with exposed administrative services, reusable credentials, remote access tunnels, proxy infrastructure, and exploitation tooling.” concludes the report. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, ARTEX)
Passwords and API keys that developers typed into commands they approved in Claude Code are sitting in public GitHub repositories, where anyone can read them. When a user selects "Yes, and don't ask again," Anthropic's AI coding assistant can save the command, word-for-word, including the secret, in a project settings file. Software security company Apiiro said yesterday that 1,122 public
Layer3 found residential proxy traffic using the White House network, raising concerns about potential exposure of internal systems. Layer3 Intel says it found residential proxy traffic leaving through the White House network. The researchers spotted it while browsing their new Residential Proxy Observatory, a tool that gives a global view of residential proxy and anonymized internet activity. “While our team was looking through it, we noticed residential proxy exit activity on AS2650. AS2650 is registered to the Executive Office of the President, the federal agency that hosts the White House network.” reads the report published by Layer3. A residential proxy service allows customers to use everyday devices to route their internet traffic. This makes their activity look as if it comes from the device’s normal home internet connection. Layer3 detected this activity on AS2650, a network registered to the Executive Office of the President, the agency responsible for the White House network. Layer3 has not accused anyone at the White House of wrongdoing and says its data cannot identify who or what caused the activity. Between October 5 and November 3, Layer3 detected 236 connections through this network. The traffic came from six IP addresses and was recorded on 26 of those 30 days. A total of 28 residential proxy services were able to use the network. To check their findings, researchers compared the IP addresses with data from other security services, including Spur and Synthient. Both services also identify these addresses as residential proxy exit points. Getting this data took no special skill. Anyone can sign up to a public residential proxy service, pay a few dollars and send requests through it. Layer3 says it didn’t target the network or try to steer its probes there, and it caught the activity by chance, simply by requesting global rotating access through these services. The timing suggests something more than a guest network. About half the activity falls between 5 p.m. and midnight Eastern time, and almost none happens in the early morning. Layer3 reads that as a person, not public guest Wi-Fi: someone regularly on the White House network late into the evening whose device carries a proxy SDK, a software kit that turns a device into an exit point. “Past research has shown that poorly secured proxy SDKs can allow internal network access and lateral movement. This is how past botnets have spread. In A Broken System Fueling Botnets, the researchers at Synthient documented how the Kimwolf botnet reached at least 2 million devices, mostly Android devices with an exposed ADB service, through residential proxy networks.” continues the report. “If an SDK on this network has the same kind of flaw, anyone buying proxy access could use it to reach internal systems.” That matters because poorly secured proxy SDKs have let attackers into internal networks before. Synthient’s research, A Broken System Fueling Botnets, documented how the Kimwolf botnet reached at least 2 million devices, mostly Android devices with an exposed ADB service, through residential proxy networks. If an SDK on the White House network has the same kind of flaw, anyone buying proxy access could reach internal systems. Layer3 doesn’t claim that’s the case here, and it describes the risk as conditional. The White House isn’t the only surprise. The observatory also finds residential proxies in some of the most isolated places on the planet. Saint Helena, Ascension and Tristan da Cunha, a South Atlantic territory that includes the most remote inhabited island in the world, shows 413 addresses and more than 32,000 observations, split between Starlink and the local provider, Sure Saint Helena. Layer3 also detected three instances of proxy activity in Antarctica. All came from a Cloudflare WARP address linked to McMurdo Station. The researchers jokingly noted that penguins are not suspects. On Pitcairn Island, they found one Starlink address and one observation. Norfolk Island had one Norfolk Telecom address with four observations, while Svalbard had one Starlink address in Longyearbyen with three observations. The researchers also found 388 addresses in the Falkland Islands, 43 in the Chagos Islands, 21 in Tokelau and seven in South Georgia. These findings suggest that residential proxy networks now operate in almost every corner of the world. For security teams, the main concern is that devices connected to protected networks could unknowingly become proxy exit points, potentially exposing those networks to outside traffic. However, Layer3 says its data only shows where proxy traffic exits. It cannot identify the device being used or the person behind it. As the company explains, “Our data shows the exits, not the device or the person behind them.” “Residential proxies have infected every corner of the world, and it looks like there is no place they cannot reach. Layer3 Intel tracks residential proxy and anonymization infrastructure worldwide. Even when the proxies hide in networks on the farthest corners of the planet, we can still observe them, leaving threat actors no place to hide.” concludes the report. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, proxy traffic)
QNAP urges users to update Plex Media Server to the latest version available in the QNAP App Center, as hackers are exploiting the Plex2Shell vulnerability chain. The vendor said it had received multiple reports of suspected compromises involving customers’ network-attached storage (NAS) devices. "QNAP has received reports from some users that Plex Media Server on their NAS appears to have been compromised through [Plex2Shell] vulnerabilities, and QNAP Technical Support is assisting the affected users,” the company says in an advisory today. Plex2Shell is a chain of four vulnerabilities in the Plex Media Server, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Security researcher Zach Main discovered and reported the flaws to Plex on July 27. Exploitation started shortly after the full technical details became public on October 16.
Some WordPress sites can still be attacked while they install the fix for an actively exploited flaw, according to Umut Bayram, the Picus Security researcher who found it. The update that installs the fix still unpacks its files using the site's old, unpatched code, so an attacker who strikes at the right moment can run code on the server. The researcher advises blocking web access to the
Confirm this action.
Leaving now will discard your changes.