GoSerpent backdoor: Southeast Asia data theft chain
The GoSerpent backdoor campaign targeted government and diplomatic entities in Southeast Asia, combining stealthy remote access with staged credential dumping and file exfiltration.
Category: Beveiligingsnieuws
BitLocker extortion through printers: what changed
Two recent incidents in Latin America show a new extortion pattern: attackers encrypt disks with BitLocker and trigger ransom notes via office printers. The cases also reveal recurring misuse of RDP, MSSQL misconfigurations, and RMM tools.
GenieLocker ransomware: custom-made for multiple systems
GenieLocker ransomware has been active since March 2026 and targets victims across multiple sectors. It runs on Windows, Linux and ESXi and uses a custom encryption mechanism.
Focus: OctLurk and SilkLurk backdoors (Central Asia)
In Central Asia, since January 2025, two new backdoors have been observed: OctLurk and SilkLurk. The attackers use customized loaders, heavy obfuscation, and additional functionality via plug-ins and LurkProxy.
Rapid7 PoC Released for SmartConsole Auth Bypass
Rapid7 has published a Python PoC to test for CVE-2026-16232. This SmartConsole auth bypass lets attackers obtain an admin login token if the setup allows unauthenticated access.
Ruflo MCP flaw: unauthenticated remote command execution
A critical Ruflo MCP flaw (CVE-2026-59726) lets attackers run commands without authentication. The impact includes API key theft and poisoning of persistent AI memory.
SilverFox uses BYOVD and DLL sideloading
A cybercriminal group, Silver Fox, targeted a Japanese organization in the industrial manufacturing sector. With BYOVD and DLL sideloading, ValleyRAT is delivered for long-term remote access.
Cisco FMC zero-day: static credentials exposed
CISA added a Cisco FMC zero-day to its KEV catalog after reports of active exploitation. The flaw involves static credentials that could let attackers access sensitive data.
INC ransomware: SonicWall SMA 1000 vulnerabilities
Resecurity reports that INC ransomware has been claiming victims faster since the beginning of August 2026 via SonicWall SMA 1000. The chain appears to be driven by zero-days that, among other things, abuse MFA seeds and credentials.
Cyberattack on Economic Beneficiaries Register
Liechtenstein reports that a cyberattack accessed the economic beneficiaries register, impacting around 31,000 people. Authorities say they took immediate steps and saw no signs of data tampering.