The FBI raided 40 Texas homes over a North Korean scheme that used fake IT workers to target 70 US companies and generate $3 million. The Justice Department (DoJ) announced coordinated enforcement actions this week targeting North Korea’s long-running scheme to place fake IT workers inside American companies. Two US nationals were arrested, 14 people charged across two separate indictments, and the FBI searched more than 40 residences in Texas, seizing approximately 187 laptops and KVM switch devices. The Texas operation, called Operation Lonestar Roundup, ran between September 21 and 25. The seized devices are the same laptops American companies shipped to their newly hired remote employees, not knowing those IT workers were North Korean intelligence agents using stolen US identities. “Today the Department of Justice announced coordinated actions against the Democratic People’s Republic of North Korea (DPRK) government’s schemes to fund its regime through remote information technology (IT) work for U.S. companies.” states DoJ. “These actions include an indictment, two arrests, searches of multiple known or suspected “laptop farms” in Texas pursuant to “Operation Lonestar Roundup,” and the seizure of approximately 187 computer devices used by DPRK IT workers.” The scheme was simple. North Korean IT workers applied for remote jobs using stolen or fake identities. They used VPNs and proxy servers to make it look like they were working from the United States. American helpers received the laptops provided by employers and installed remote access software so the North Korean workers could use them. These helpers were paid for their role, while the money earned from the jobs was sent back to North Korea through accounts controlled by the regime. According to an indictment from the Northern District of Ohio, the scheme ran from 2019 to mid-2025 and targeted more than 70 US companies across 17 states. The companies operated in sectors including healthcare, communications, cybersecurity support, retail, and manufacturing. “In total, the scheme impacted more than 70 U.S. company employers and generated approximately $3 million in revenue for IT workers.” SoJ states.”The revenue is believed to have been sent to sanctioned entities controlled by the DPRK. Victim employers included companies in the health care, communications, cyber support, retail, and manufacturing sectors across Ohio, sixteen additional states, and the District of Columbia.” The North Korean IT workers earned about $3 million, which prosecutors believe was sent to North Korean entities subject to international sanctions. The authorities warn the scheme is evolving in response to better detection. “Increasingly, North Korean IT workers are turning to recruiting American facilitators to counter improved private sector detections and law enforcement actions.” states DoJ. “These workers are hiring facilitators to complete a wider variety of tasks, and in some cases subcontracting entire jobs to third-party foreign nationals. “ That’s not just using Americans as props. It’s actively outsourcing parts of the operation to people inside the US, which makes attribution harder and interception more complicated. Some IT workers are now subcontracting entire jobs to third-party foreign nationals. Others are hiring facilitators to handle a wider range of tasks beyond just managing the laptops. CrowdStrike, which helped the FBI investigate, tracks the group behind this operation as Famous Chollima and describes the laptop farm infrastructure as vital to overcoming the physical and legal barriers of operating from outside the US. “These laptop farms enabled FAMOUS CHOLLIMA operatives to pose as legitimate remote workers and siphon illicit wages back to their regime while maintaining persistent access to victim organizations. Working alongside the FBI, CrowdStrike’s threat intelligence into the adversary and their operations, and technical analysis helped make these disruptions possible.” states CrowdStrike. “This operation marks the beginning of a broader U.S. law enforcement effort to dismantle FAMOUS CHOLLIMA’s U.S. infrastructure. CrowdStrike’s Counter Adversary Operations team intends to remain an integral part of that effort.” The FBI’s separate public service announcement puts the operation in broader context: “thousands of North Korean state-controlled IT workers” are currently embedded at Western companies, posing what the agency calls a significant national security and intellectual property theft insider threat. North Korean IT workers have individually earned up to $300,000 per year under these schemes, and the collective revenue is measured in hundreds of millions annually, flowing directly to designated entities including the North Korean Ministry of Defense. This is the fifth round of enforcement actions announced since June 2025 under the DOJ’s DPRK RevGen Domestic Enabler Initiative (June 2025, November 2025, April 2026, and May 2026). The initiative targets people in the United States who help North Korean IT workers carry out these schemes. According to CrowdStrike, North Korean hackers were responsible for about half of all documented hands-on cyber intrusions over the past year. The regime is also targeting cryptocurrency exchanges and open-source software projects. In 2025 alone, North Korean attackers stole at least $2 billion in cryptocurrency. The DOJ released a list of email addresses used in these operations, including accounts like randyryang@gmail.com and dev.jerryyang@gmail.com, which companies can add to their screening indicators. The FBI’s public service announcement includes detailed mitigation guidance on spotting DPRK IT worker applications. The red flags are consistent: inconsistencies in work history, reluctance to appear on video, requests to redirect laptop deliveries, and payment accounts that route through intermediaries. “Threats posed by nation-states like North Korea are a stark reminder that our adversaries will go to great measures to exploit our nation’s economic strength to further and fuel their own nefarious agendas,” said U.S. Attorney David M. Toepfer for the Northern District of Ohio. “We are thankful to FBI Cleveland for their incredible work and persistence to put a stop to these bad actors. These charges serve as an urgent alert to all U.S. companies to remain vigilant in their hiring practices.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, IT workers)
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Fortinet Multiple Products and BeyondTrust Remote Support flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability This week, Palo Alto Netwoks researchers reported that PEERSTITCH malware exploited FortiManager to expose 500+ firewalls, evade detection inside FortiOS memory, and maintain stealthy access. The attackers exploited CVE-2025-61624, a path traversal flaw in the FortiOS auto-script engine, to deploy a new implant called PEERSTITCH. The flaw CVE-2026-102764 is an input validation vulnerability in internal components of BeyondTrust Remote Support. BeyondTrust Remote Support is a remote technical support tool that allows IT help desks and support teams to securely access and troubleshoot users’ computers and other devices over a network. From a cybersecurity perspective, the software is important because it can provide privileged access to systems and allow technicians to perform sensitive operations. The components do not properly validate the origin of incoming messages, potentially allowing an attacker to perform file operations on the appliance under certain conditions. “CISA is aware of critical authentication bypass vulnerability CVE-2026-102764 , affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Patches are available for supported versions (24.3.1 and later); organizations using older versions must upgrade first.” CISA warns. “Cyber threat actors are actively exploiting the vulnerability to gain initial access, then establishing persistence, escalating privileges, and moving laterally. “ According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaws by October 19, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers. According to e-commerce security firm Sansec, attacks leveraging the vulnerability, dubbed BlockStrap, have not yet been observed, but threat actors are expected to find a way to exploit it. The researchers based their assessment on identifying four potential attack paths involving CVE-2026-103849 in less than 24 hours. The flaw impacts September versions of Adobe Commerce and Magento Open Source through 2.4.9 and Adobe Commerce B2B through 1.5.3. The security firm warned that Adobe’s “priority 2” rating of this flaw does not reflect the danger and urgency in this case, despite the more complex attack path.
Unit 42 details the top initial access vectors adversaries use to breach organizations, led by edge exploits, credential abuse and phishing The post Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026 appeared first on Unit 42.
F5 addressed multiple vulnerabilities, including critical RCE flaws in NGINX that attackers could exploit without authentication. Security and application delivery firm F5 announced fixes for eleven security issues in NGINX. Among them, critical vulnerabilities tracked as CVE-2026-15176 and CVE-2026-93479 could be exploited without authentication via crafted HTTP requests. Under certain conditions beyond their control, an unauthenticated attacker could exploit the security flaws to trigger a buffer overflow leading to a restart. If ASLR is disabled or can be bypassed, the attacker could achieve RCE. The flaw CVE-2026-15176 (CVSS score of 9.2) is a heap-based buffer overflow vulnerability in NGINX Plus and NGINX Open Source that could allow an unauthenticated attacker to trigger a denial-of-service condition or potentially execute arbitrary code by sending crafted HTTP requests. The vulnerability occurs under specific configurations involving the alias directive and the $request_filename variable. Remote code execution may be possible if ASLR is disabled or bypassed. The flaw CVE-2026-93479 (CVSS score of 9.2) is a heap-based buffer overflow vulnerability in NGINX Plus and NGINX Open Source that could allow an unauthenticated attacker to trigger a denial-of-service condition or potentially execute arbitrary code through crafted HTTP requests. It affects specific configurations where regular-expression capture variables from the map directive are referenced before the map output variable, or where a non-cacheable variable is used in a string expression under certain conditions. Remote code execution may be possible if ASLR is disabled or bypassed. The third critical flaw fixed by the vendor, tracked as CVE-2026-97205 (CVSS score of 9.2), is a use-after-free vulnerability in NGINX ngx_http_core_module that, under certain configurations with asynchronous file I/O (AIO) enabled, may cause memory corruption or unexpected worker process termination when processing Server Side Includes (SSI) pages containing include virtual commands. A remote attacker could exploit the flaw to cause a denial-of-service (DoS) or potentially execute code, particularly when ASLR is disabled or can be bypassed. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, NGINX)
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Atlassian flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Atlassian flaw, tracked as CVE-2026-21589 (CVSS score of 9.3), to its Known Exploited Vulnerabilities (KEV) catalog. In early October, threat actors started exploiting CVE-2026-21589, a critical arbitrary file access flaw in Atlassian Data Center products. The vulnerability could allow attackers to access sensitive files under certain conditions. Affected products include Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, and Fisheye. “This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file’s exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents.” reads the advisory. “In some configurations, there may be some sensitive files that make this highly severe.” Previdian telemetry has detected 15 exploitation attempts from three IP addresses in Japan and the U.S.. “Exploitation has now started to hit our honeypot network” Previdian Founder Ryan Dewhurst wrote on LinkedIn. On October 6, watchTowr Labs published a technical analysis of CVE-2026-21589 after comparing vulnerable and patched Atlassian packages. Researchers found a path traversal flaw where double-colon (::) sequences can be treated as path separators, allowing attackers to read files from the application web root. “While semicolons (;) are very common in path traversal within Java applications, along with the everyday dots (.) and slashes (/), one item stood out: the matching of double colons (::).” reads the analysis. “This is uncommon syntax for this type of vulnerability, but grepping through the codebase we came across an all too familiar sight.” In one Crowd deployment with Jira, researchers were able to read crowd.properties, which exposed application credentials. They then used those credentials to create a user and add it to the jira-administrators group. Crowd IP allowlisting can block this attack path. Exploitation attempts against its honeypot network reportedly began two hours after watchTowr published additional technical details about the vulnerability. According to watchTowr, the problem is in Atlassian’s web-resource handling. It can turn a string such as ..::..::..::..::WEB-INF::web.xml into ../../../../WEB-INF/web.xml, allowing attackers to move through directories and access files they should not be able to read. Atlassian says all versions before the listed fixed versions are affected: ProductFixed versionsBitbucket Data Center9.4.26, 10.2.8, 10.5.1Confluence Data Center9.2.26, 10.2.19Jira Service Management Data Center5.12.40, 10.3.26, 11.3.12Jira Software Data Center9.12.40, 10.3.26, 11.3.12Bamboo Data Center10.2.24, 12.1.12Crowd Data Center6.3.7, 7.0.3, 7.1.7, 7.2.4Crucible4.9.15Fisheye4.9.15 watchTowr has released a free tool on GitHub to help check if a server is vulnerable. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaw by October 18, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
PEERSTITCH malware exploited FortiManager to expose 500+ firewalls, evade detection inside FortiOS memory, and maintain stealthy access. PEERSTITCH, a stealthy implant deployed during a prolonged intrusion, helped attackers maintain access to a telecom managed service provider after compromising its FortiManager appliance. Palo Alto Networks Unit 42 documented the operation, which began in September 2024 and exposed credentials and configurations for more than 500 downstream firewalls. “Unit 42 investigated a multi-stage network intrusion against a telecommunications organization that occurred in September 2024, which we are tracking as cluster CL-STA-0954 (aka UNC5820). The attackers behind CL-STA-0954 achieved an initial compromise by exploiting CVE-2024-47575 against a centralized FortiManager appliance.” reads the report published by Palo Alto Networks. “From that single appliance, our observations are that the attackers exfiltrated an archive containing running configurations, cryptographic material and database files containing information about more than 500 managed FortiGate firewalls. Those firewalls protected the target’s own infrastructure and the networks of its clients.” The initial access relied on CVE-2024-47575, known as FortiJump, which allowed an unauthenticated attacker to register a rogue virtual device with the central management platform over TCP port 541. Within minutes, the attackers extracted a configuration archive containing serial numbers, public IP addresses, routing tables, VPN credentials, and cryptographic trust material for every managed firewall. One compromised management system had effectively handed them the keys to hundreds of networks. The targeted 500 devices didn’t all belong to the same organization. They protected the managed service provider’s infrastructure and its clients’ networks. The attackers got running configurations and private keys for firewalls belonging to organizations that had no idea any of this was happening. Unit 42 was clear about the scope: the investigation covered only the provider’s own environment, not the downstream clients. Armed with decrypted credentials from the stolen configuration files, which stored passwords as reversible ciphertext, the attackers then established unauthorized SSL/VPN sessions into internal network management segments from external staging addresses. That’s the moment reconnaissance turned into active access. In the second stage, attackers exploited CVE-2025-61624, a path traversal flaw in the FortiOS auto-script engine, to deploy a new implant called PEERSTITCH. The implant is a 64-bit ARM64 binary written in C, but what it does is unusual. Unit 42’s researchers put it plainly: “PEERSTITCH leaves no persistent binary on disk, opens no listening ports and initiates no outbound network connections. Instead, it communicates through traffic generated by legitimate processes on the infected host, which makes the malware resistant to conventional endpoint and network detection.” the report continues. “The attackers also impersonated the FortiManager platform to pull from managed firewalls of other hosts in the targeted network.” Instead, it injects itself into two legitimate FortiOS daemons, the logging process and the VPN service, and creates a covert communication bridge between them using memory that’s already allocated to those running processes. When traffic passing through the logging daemon matches two specific markers, a port number embedded in data and a link-local IP address, it extracts a session token and writes it directly into the VPN daemon’s memory using Linux’s /proc filesystem. When the VPN daemon processes a subsequent session carrying that same tag, it takes an alternate execution path, bypassing FortiOS security checks entirely. PEERSTITCH is hard to detect because it leaves no persistent file on disk, opens no listening ports, and initiates no outbound network connections. The only way to detect it is by inspecting live process memory for anomalous read-write-execute (RWX) regions in the two targeted daemons or identifying NOP patches at specific offsets in their code. Fortinet’s Integrity Checker Tool cannot detect the implant because it scans files on disk, which remain untouched. The attackers also established a secondary command channel by abusing Apache’s built-in certificate management module on the firewalls. They embedded shell commands in the domain name field of certificate validation requests and configured Apache to retry them continuously, creating a persistent outbound reverse shell through a legitimate system process. Before running their malicious auto-scripts, the attackers killed the logging and syslog daemons to suppress any trace of what was about to happen. Crash logs were wiped. Rogue administrator accounts and script objects were automatically deleted shortly after execution. The malicious ACME configuration file was overwritten with innocent-looking text. The PEERSTITCH injector unlinked its own binary from disk after completing execution. “The cryptographic trust material governing the platform’s relationship with every managed device leaves with the attacker and remains valid until it is rotated. Defenders must treat edge management interfaces with the highest level of zero trust isolation.” Palo Alto Networks states. “They must also treat the credentials and certificates those interfaces hold as compromised the moment the platform is.” Patching FortiManager doesn’t reverse the data theft. The stolen cryptographic keys remain valid until the trust material on every managed device is individually rotated. A firmware update alone won’t invalidate them. The broader lesson goes beyond Fortinet: management platforms are high-value targets because compromising one can expose an entire network. As Unit 42 noted, “the management platform is the highest-value target on the network.” When that platform belongs to a managed service provider, a single breach can affect hundreds of downstream customers, turning a local compromise into a supply-chain security incident. “For organizations that manage infrastructure on behalf of others, the management platform is the highest-value target on the network. Compromising the management platform is not contained by the boundary of the organization that owns it.” the report concludes. “That compromise also does not end when the platform is patched.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, PEERSTITCH malware)
OpenAI has disclosed seven new incidents in which its artificial intelligence (AI) models exhibited misaligned behavior, including one case where its research model, after not having funds on an Ethereum test network, spent test cryptocurrency from a third-party's wallet without authorization to complete a coding task. The incident, the AI company said, involved an internal research model part
In the space of a month, a new category of AI model went from nonexistent to everywhere. TypeSafe AI released Jev on September 15 and called it a System One model, a nod to Kahneman's fast, intuitive thinking. OpenAI announced its own Decisions API at DevDay and opened a public beta on October 6. Cribl published cribl-decision, an open LoRA adapter you can run locally. Others, like Laya, are
A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH. The attack involves the exploitation of CVE-2025-61624 (CVSS score: 5.4), a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that could allow a
Confirm this action.
Leaving now will discard your changes.