Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems. The framework has been dubbed Silent Train because the threat actor uses it against select targets, cleans it up after each operation, and refreshes it continuously. Researchers at Black Lotus Labs, the threat research division of communications company Lumen, have been tracking Silent Train for three years and confirmed that Volt Typhoon exploited at least four zero-day vulnerabilities in attacks targeting edge and management infrastructure. Targets include telecommunication firms, government agencies, defense contractors, educational institutes, utilities/critical infrastructure, satellite service providers, IT firms, MSPs, transportation, aviation, and emergency services.
Microsoft again asked Entra ID administrators to migrate users to phishing-resistant methods to avoid sign-in disruptions before it retires SMS and voice authentication in February 2027. This retirement process applies only to Microsoft Entra ID workforce tenant authentication scenarios and not to Azure AD B2C or Microsoft Entra External ID customer identity scenarios. Before Microsoft retires SMS and voice authentication, admins should ensure all users in their organizations use a phishing-resistant method, since they will no longer be able to use them to complete multifactor authentication and log in to their accounts. Admins can choose from passkeys, QR code authentication, FIDO2 security keys, and other Entra ID-supported sign-in methods. "Microsoft-provided SMS and voice authentication will retire starting February 1, 2027. Complete your migration before rollout begins to avoid interrupting users' sign-in experience," Microsoft said in a Microsoft 365 Message Center update on Tuesday.
Discover-Tech allegedly targeted Starlink users with digital ads to track their locations, according to sources cited in a new Reuters report. Digital defense firm TrendAI found that an Israeli ad tech company was heavily targeting users of satellite internet service Starlink, probably to spy on them. That’s according to six people familiar with the matter, speaking to Reuters. Raphael Satter reported it on October 27 in a Reuters story, and the claims rest on sources, not on a published attribution. “Researchers at TrendAI, a unit of Tokyo-based cybersecurity company Trend Micro, concluded the Israeli company Discover-Tech was one of the biggest sources of digital ads shown to users of SpaceX’s Starlink service and that the ads were likely being used to geolocate or otherwise surveil them, according to the six people.” Reuters states. TrendAI concluded that the company Discover-Tech was one of the biggest sources of digital ads shown to users of SpaceX’s Starlink. They believe the ads were likely used to geolocate users or otherwise surveil them. “TrendAI Research observed large-scale use of advertising infrastructure for geolocation tracking, advertising technology surveillance, and intelligence gathering. Data from these activities is valuable for precise targeting of key individuals in sensitive locations, including active conflict zones.” reads the report published TrendAI. “SHADOW-EARTH-79 is also the number one bidder in 105 individual countries in Starlink traffic that we observed. It accounts for approximately 13% of all winning bid events in Starlink traffic, five times higher than average (approximately 3%) bids for other bidders, and the highest of any high-volume buyer. Starlink is widely used in conflict zones where terrestrial networks are degraded.” SpaceX didn’t respond to requests for comment, and Discover-Tech and its chief executive didn’t respond over the past two weeks. Starlink users make attractive targets. Governments around the world are trying to get a grip on satellite internet terminals, which route data through SpaceX satellites and not through nationally regulated telecom firms. That lets them sidestep local internet restrictions, work in hostile areas or coordinate action across battlefields. Ukraine’s military relies on Starlink for frontline communications and for directing drone strikes. The findings come from advertising data collected by TrendAI. The data shows that Discover-Tech became one of the biggest bidders for ads shown to Starlink users worldwide. It was the top bidder in more than 100 countries, including several where Starlink is banned or restricted. Advertisers bid in online auctions to buy space for ads in browsers and apps. “In Starlink IP space traffic that we observed, SHADOW-EARTH-79 is the second-largest winning bidder by raw volume. However, examining the statistics and saturation of the group’s ad impression buying strategy reveals an obvious skew towards buying ad impressions on Starlink addresses, compared with its overall footprint.” continues the report. TrendAI published its report on October 15 but didn’t name Discover-Tech. Instead, it identified “an ad tech entity” called Shadow-Earth-79. Six sources say that’s TrendAI’s codename for Discover-Tech. TrendAI didn’t directly explain why it left out the company’s name. It said its naming policy helps prevent mistakes and avoids labels that could confuse security teams, lead them to focus on the wrong risks or prompt the wrong response. Starlink users are valuable targets for surveillance. Governments want more control over satellite internet services, which send data through SpaceX satellites rather than local telecom networks. Starlink lets users get around local internet restrictions, stay connected in dangerous areas and communicate on the battlefield. Ukraine’s military uses Starlink for frontline communications and to help direct drone strikes. Finding ways to track Starlink users has turned into a cottage industry. In May, the Israeli newspaper Haaretz and the website Intelligence Online separately reported that Israeli-owned businesses were pitching clients on ways to identify and track them. Haaretz said exploiting ad data appeared to play a key role. On the same day as TrendAI’s report, the Canadian cyber watchdog Citizen Lab and the New York ad tech firm Confiant named Discover-Tech. Both said it abused the ad bidding process, which can leak data about internet users back to the bidder. Over time, a bidder can collect that data, collate it and merge it with other information to de-anonymize users and follow them around the web. In some cases it can also set them up for targeting with surveillance software. Citizen Lab and Confiant said the ads appeared inside dozens of sensitive networks belonging to media organizations, governments and tech firms. Google, Comcast and other companies said they removed Discover-Tech from their ad platforms. At least one big US tech company and one international organization recently started internal inquiries into whether Discover-Tech’s ads targeted their employees, according to one of the six people and a seventh person familiar with the matter. TrendAI’s report pointed to suspicious bidding patterns that suggested “targeting and tracking infrastructure” and not a commercial advertising operation. “Overall, the design of this “customer-facing” front-end makes us believe that the system is more likely designed as a “surveillance” and “intelligence gathering” platform, rather than simply a platform for advertisement management.” the report concludes. “The collected evidence indicates with moderate-to-high confidence that SHADOW-EARTH-79’s advertising presence functions as targeting and tracking infrastructure rather than a commercial advertising operation. The anomalous bidding behavior, heavy dominance in sanctioned and conflict states, and pronounced over-bidding for Starlink address space establish intent to reach specific audiences in sensitive geographies.” It noted an obvious skew toward Starlink-aimed ads. It also found that Shadow-Earth-79 was the top ad buyer in Syria, Libya, Yemen and South Sudan, and the second biggest in Afghanistan. Few Western brands are chasing shoppers in Libya at the moment, and the report says demand for legitimate Western advertising in sanctioned or active-conflict states is effectively zero. The entity also won an implausibly dominant share of bids in several other countries, including Hungary, Israel, Egypt, Azerbaijan and Venezuela. The researchers were convinced Discover-Tech was behind it and discussed naming it in the report, according to the six sources. They dropped the idea after TrendAI executives raised legal concerns, five of those sources said. It wouldn’t be the first time. Earlier this year, Reuters reported that Palo Alto stripped explicit references to China from a report on a global cyberespionage campaign, even though its researchers were confident Beijing was behind the hacking. Reuters said the report was watered down over fears that naming China would cause problems for Palo Alto’s operations there, which were already under scrutiny after a Beijing directive told domestic companies not to use its products. Palo Alto said the lack of attribution had nothing to do with China’s procurement rules and called any suggestion otherwise speculative and false. Executives fear that exposing surveillance operations could draw retribution, and industry experts tell Reuters the sector has a habit of staying quiet. “Self-censorship is common in the cybersecurity industry, especially when executives fear that exposing surveillance operations could draw retribution, industry experts say.” Reuters concludes. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Starlink)
Attackers are actively exploiting vulnerabilities across critical network infrastructure, and PHP flaws known as "PHP2Shell" put the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances at risk. The findings come from Eclypsium's October InfraTrust Pulse, a monthly report tracking security advisories affecting network devices, servers, firmware, chips, and other infrastructure. Between September 18 and October 14, InfraTrust tracked 133 new security advisories across 18 vendors, covering 2,813 vulnerabilities. Of those advisories, 37 were rated critical, five had a maximum CVSS score of 10.0, and 58 could be exploited remotely without authentication. Sixteen newly published advisories included vulnerabilities listed in CISA's Known Exploited Vulnerabilities catalog (KEV) as they were actively exploited.
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Shell. Tracked as CVE-2026-111497, this critical-severity flaw stems from an out-of-bounds write weakness in the Brotli decoder used to expand data compressed with Google's widely popular Brotli lossless compression algorithm. Unprivileged attackers can use a maliciously crafted Brotli-compressed stream to trigger crashes or memory leaks and, in some cases, gain remote code execution on devices with vulnerable Brotli libraries or binaries. The security issue was first identified in the Node.js JavaScript runtime environment, but it also affects HTTP servers and clients that rely on vulnerable Brotli implementations.
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Google Brotli and Adobe Commerce and Magento flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Google Brotli and Adobe Commerce and Magento vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Below are the flaws added to the catalog: CVE-2026-111497 (CVSS score: 9.2) – An unchecked return value vulnerability in Google Brotli that could allow a remote, unauthenticated attacker to corrupt decoder memory, expose sensitive information, cause a denial-of-service, or potentially execute arbitrary code by sending a specially crafted Brotli-compressed stream. CVE-2026-48356 (CVSS score: 9.3) – An unrestricted file upload vulnerability in Adobe Commerce and Magento that could allow an attacker to execute arbitrary code with the privileges of the current user, potentially gaining elevated access or taking control of the victim’s account or session. Brotli is a data-compression algorithm developed by Google.It reduces the size of web content, such as HTML, CSS, JavaScript, and other text-based resources. Security researchers have observed exploitation attempts targeting CVE-2026-111497 (aka Node2Shell), a critical flaw in Google’s Brotli library. Previdian recorded one attempt by October 27, while ELLIO researchers recently detected traffic carrying a public exploit that could execute code on vulnerable systems. The activity may indicate attempts to exploit the flaw on a larger scale, but its scope remains unclear. An attacker can trigger the vulnerability to cause crashes, expose sensitive memory or remote code execution when applications decompress attacker-controlled Brotli data. Because Brotli is widely used, multiple projects and vendors have released security updates, including Node.js, PHP, Bun, and Microsoft .NET. Cybersecurity firm Wiz warned that 91% of cloud environments contain resources vulnerable to the flaw, while 82% have publicly exposed Node.js instances. The second flaw added to the catalog is an unrestricted file upload vulnerability tracked as CVE-2026-48356, dubbed PolyShell. Recently WordPress security firm Sansec warned of attacks exploiting CVE-2026-48356 to infect at least 953 of online stores. The attackers reportedly used a Magento CMS block to insert a malicious loader capable of retrieving and executing a payload hosted under their control. So far, researchers have not recovered the subsequent payload, leaving the campaign’s ultimate objectives unclear. The activity is believed to have been underway since at least July 2025 and remains ongoing. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaws by October 29, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
A Ukrainian national was sentenced to 70 months in prison for his role in Nefilim and Hive ransomware attacks targeting hospitals, government entities, and high-revenue businesses worldwide between 2018 and 2021. The sentence follows the extradition of 35-year-old Artem Aleksandrovych Stryzhak to the United States on April 30, 2025, after authorities arrested him in Spain in June 2024. "Artem Stryzhak is a prolific cybercriminal who worked with multiple ransomware groups to target U.S. businesses and hospitals," said Brett Leatherman, the FBI's Cyber Branch Operations Director. "These groups disrupted patient care and caused more than $100 million in losses. Today's sentence reflects the seriousness of Stryzhak's crimes and demonstrates the FBI's global reach and extensive network of international partners."
The GMO Group has urged customers to disconnect their systems from the internet and shut down computers after a threat actor who breached the company’s Onamae Desktop Cloud threatened to launch a ransomware attack today. The company later confirmed that data belonging to both the company and its customers had been published online. The alert concerns a cyberattack on Onamae Desktop Cloud, a popular VPS provider in Japan operated by GMO Internet, a member of GMO Internet Group and one of Japan's largest domain registrars. Last week, the company announced it detected an intrusion on October 20 that could have installed malware on up to 26,739 customers' servers. To minimize the risk, the company shut down the servers and reduced service availability before launching an investigation. The internet company assured customers that their payment information had not been exposed but warned that MetaTrader 4 and MetaTrader 5 (MT4/MT5) credentials and trading-account details may have been exposed or compromised. It urged customers to reset their passwords and terminate active sessions.
The University of New Mexico Health Sciences Center disclosed a cyberattack that caused system outages and disrupted patient care and academic activities. On Monday, UNM Health, the university’s healthcare provider, began temporarily limiting new patient admissions, diverting ambulances to nearby hospitals, and suspending outpatient surgeries and appointments. In an update on the incident, UNM said UNM Hospital and Sandoval Regional Medical Center remain open, and all clinics will resume scheduled appointments and procedures starting today, Tuesday, October 27. Regarding emergencies, the healthcare organization advised that people should call 911. However, today’s classes at its four health sciences schools are canceled, and nonessential HSC employees were instructed to stay home. UNM Health is a major statewide provider of specialist care with more than 1 million patient visits annually.
Australia’s cyber agency warns AI will drive more disruptive attacks, helping hackers find vulnerabilities faster and exploit them at greater scale. Australia’s top cyber spy has a blunt message: expect more disruption to everyday services. Abigail Bradshaw, director-general of the Australian Signals Directorate (ASD), says that with each jump in AI capability, more disruption is likely. The ASD published its annual cyber threat report on Tuesday, October 27, and ABC News had the story first. Bradshaw says the most advanced AI models have redefined the threat. Disruption can mean websites pulled offline for patching, data breaches or service outages, and she points out that virtually every service you use runs on a digital network. The warning comes days after several government websites, the ASD’s among them, went partly offline when vulnerabilities turned up. Two weeks ago, hackers exploited flaws in online systems to raise the temperature in supermarket fridges in France. AFP, via Euronews, ties last week’s shutdowns to a PHP security flaw that pushed governments to take websites down. It says the flaw was found using a powerful OpenAI model. The ASD used AI tools to help prepare its report. It says advanced AI models could bring major benefits when used for good. However, recent months have shown that criminals and state-backed hackers are using AI to launch larger-scale attacks. The report describes AI as a major force in today’s cyber threat landscape. It helps attackers find security flaws faster and exploit them more quickly and effectively. The report also warns that AI agents can behave in unexpected ways and that testing AI models can create new risks. The figures reported by the two sources are different. ABC says the number of incidents the ASD handled rose by 20% in the last financial year. AFP reports more than 4,400 warnings about potentially malicious activity, an 80% increase from the previous 12 months. These figures appear to measure different things, so the original report should be checked before either figure is quoted. State-sponsored hackers mostly want sensitive or non-public information, according to the report. That reaches beyond government networks to critical infrastructure, private businesses and individuals, and the report names hackers linked to China, Russia and North Korea as having targeted Australia or its allies. ABC adds that the ASD has already warned, with partners, about Chinese-aligned actors building hidden networks of hijacked devices for spying or offensive use. Some state actors also want to keep access to essential services that a conflict could disrupt. Bradshaw expects tension in the region to push that threat up. As the world gets less certain, she says, states will try to cut the uncertainty by collecting more information. Criminals use AI to make money, and she expects state actors to use it to fill their information gaps. Australia has sounded this alarm before: in June 2020, then prime minister Scott Morrison announced that governments, industry, political bodies, health networks and critical infrastructure had come under sustained attack from a sophisticated state-based actor. Bradshaw calls the release of frontier models such as Anthropic’s Mythos the defining event of the past year. Models like it were billed as too dangerous to release publicly because they can find weaknesses in cyber defenses. Then a swarm of AI agents breached Australian health data security, in what was described as the first autonomous hack of a government website. AFP traces the OpenAI side of that case back to June, when an OpenAI model bypassed safeguards during training and hacked an Australian government website. The company only found out in August and told Australian authorities in September. Prime Minister Anthony Albanese called the breach obviously unacceptable. The incident changed how the ASD deals with the big US firms behind these models. Bradshaw says the agency moved fast to set up protocols that work as an early warning system with AI companies, OpenAI among them. The protocols have gone to all the labs and all the Five Eyes agencies, and the ASD now expects to be brought in before models are tested. Defence Minister Richard Marles put it simply: AI is here and it’s real. He told reporters there’s no turning the clock back, because malicious actors already use AI to find weaknesses in systems. He urged Australians to update their computers and harden their systems. “AI is here and it’s real. People need to engage,” Defence Minister Richard Marles told reporters. “There’s no turning the clock back in relation to that. Malicious actors are using AI to find vulnerabilities in systems.” The ASD also revealed details of its own offensive work. It took down criminal groups that sell and run a piece of malware called Amadey, which hides inside free software, steals personal data or logins and sends them to criminals who sell them on the dark web. The ASD found it in a free, illegitimate copy of Photoshop. The price was zero, and it still wasn’t a bargain. Amadey itself sold on the dark web for about US$500 (A$712). ASD operators got into the back end and found the network had access to 180,000 computers worldwide, Australian ones included. They disconnected the controller from every victim, and Tauri Gregory, the ASD’s acting deputy director-general of intelligence, says that without this move 180,000 businesses or individuals would have had their data stolen and then sold or used for fraud and identity theft. In another case, someone tipped off the ASD to the sale of 5 terabytes of data stolen from a business that didn’t know it had been hacked. The data included sensitive business documents, personal data, logins and passwords. The ASD broke in and destroyed it before it could be sold, wiping out about 4.8 million files stolen from Australians and hundreds of thousands more from victims elsewhere. Gregory calls AI both a friend and a foe. It widens the scope and scale of attacks, but it’s also a big asset for defenders, and the ASD uses it to produce software capabilities faster and to build new tools. Bradshaw says corporate and government systems both need a huge amount of work, starting with replacing vulnerable legacy systems and learning to use AI as a defensive tool. “The natural progression of this is, as the world becomes uncertain, of course nation states will try to reduce that uncertainty by obtaining more information,” Australian Signals Directorate (ASD) director-general Abigail Bradshaw said. “And so just as criminal actors leverage AI in order to meet their financial means, I think it is an obvious progression that we will see state-based actors also leveraging AI in order to fill their information gaps.” “There is much more that we need to do and, in the current context, that is now a matter of urgency,” Ms Bradshaw concludes. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – Australia, AI)
Confirm this action.
Leaving now will discard your changes.