SecurityAffairs

Ads or Surveillance? Researchers Flag Suspicious Targeting of Starlink Users

Wed, 28 Oct 2026 14:37:21 +0000

Discover-Tech allegedly targeted Starlink users with digital ads to track their locations, according to sources cited in a new Reuters report.

Digital defense firm TrendAI found that an Israeli ad tech company was heavily targeting users of satellite internet service Starlink, probably to spy on them. That’s according to six people familiar with the matter, speaking to Reuters. Raphael Satter reported it on October 27 in a Reuters story, and the claims rest on sources, not on a published attribution.

“Researchers at TrendAI, a unit of Tokyo-based cybersecurity company Trend Micro, ‌concluded the Israeli company Discover-Tech was one of the biggest sources of digital ads shown to users of SpaceX’s Starlink service and that the ads were likely being used to geolocate or otherwise surveil them, according to the six people.” Reuters states.

TrendAI concluded that the company Discover-Tech was one of the biggest sources of digital ads shown to users of SpaceX’s Starlink. They believe the ads were likely used to geolocate users or otherwise surveil them.

“TrendAI™ Research observed large-scale use of advertising infrastructure for geolocation tracking, advertising technology surveillance, and intelligence gathering. Data from these activities is valuable for precise targeting of key individuals in sensitive locations, including active conflict zones.” reads the report published TrendAI. “SHADOW-EARTH-79 is also the number one bidder in 105 individual countries in Starlink traffic that we observed. It accounts for approximately 13% of all winning bid events in Starlink traffic, five times higher than average (approximately 3%) bids for other bidders, and the highest of any high-volume buyer. Starlink is widely used in conflict zones where terrestrial networks are degraded.”

SpaceX didn’t respond to requests for comment, and Discover-Tech and its chief executive didn’t respond over the past two weeks.

Starlink users make attractive targets. Governments around the world are trying to get a grip on satellite internet terminals, which route data through SpaceX satellites and not through nationally regulated telecom firms. That lets them sidestep local internet restrictions, work in hostile areas or coordinate action across battlefields. Ukraine’s military relies on Starlink for frontline communications and for directing drone strikes.

The findings come from advertising data collected by TrendAI. The data shows that Discover-Tech became one of the biggest bidders for ads shown to Starlink users worldwide. It was the top bidder in more than 100 countries, including several where Starlink is banned or restricted. Advertisers bid in online auctions to buy space for ads in browsers and apps.

“In Starlink IP space traffic that we observed, SHADOW-EARTH-79 is the second-largest winning bidder by raw volume. However, examining the statistics and saturation of the group’s ad impression buying strategy reveals an obvious skew towards buying ad impressions on Starlink addresses, compared with its overall footprint.” continues the report.

TrendAI published its report on October 15 but didn’t name Discover-Tech. Instead, it identified “an ad tech entity” called Shadow-Earth-79. Six sources say that’s TrendAI’s codename for Discover-Tech.

TrendAI didn’t directly explain why it left out the company’s name. It said its naming policy helps prevent mistakes and avoids labels that could confuse security teams, lead them to focus on the wrong risks or prompt the wrong response.

Starlink users are valuable targets for surveillance. Governments want more control over satellite internet services, which send data through SpaceX satellites rather than local telecom networks. Starlink lets users get around local internet restrictions, stay connected in dangerous areas and communicate on the battlefield.

Ukraine’s military uses Starlink for frontline communications and to help direct drone strikes.

Finding ways to track Starlink users has turned into a cottage industry. In May, the Israeli newspaper Haaretz and the website Intelligence Online separately reported that Israeli-owned businesses were pitching clients on ways to identify and track them. Haaretz said exploiting ad data appeared to play a key role.

On the same day as TrendAI’s report, the Canadian cyber watchdog Citizen Lab and the New York ad tech firm Confiant named Discover-Tech. Both said it abused the ad bidding process, which can leak data about internet users back to the bidder. Over time, a bidder can collect that data, collate it and merge it with other information to de-anonymize users and follow them around the web. In some cases it can also set them up for targeting with surveillance software.

Citizen Lab and Confiant said the ads appeared inside dozens of sensitive networks belonging to media organizations, governments and tech firms. Google, Comcast and other companies said they removed Discover-Tech from their ad platforms. At least one big US tech company and one international organization recently started internal inquiries into whether Discover-Tech’s ads targeted their employees, according to one of the six people and a seventh person familiar with the matter.

TrendAI’s report pointed to suspicious bidding patterns that suggested “targeting and tracking infrastructure” and not a commercial advertising operation.

“Overall, the design of this “customer-facing” front-end makes us believe that the system is more likely designed as a “surveillance” and “intelligence gathering” platform, rather than simply a platform for advertisement management.” the report concludes. “The collected evidence indicates with moderate-to-high confidence that SHADOW-EARTH-79’s advertising presence functions as targeting and tracking infrastructure rather than a commercial advertising operation. The anomalous bidding behavior, heavy dominance in sanctioned and conflict states, and pronounced over-bidding for Starlink address space establish intent to reach specific audiences in sensitive geographies.”

It noted an obvious skew toward Starlink-aimed ads. It also found that Shadow-Earth-79 was the top ad buyer in Syria, Libya, Yemen and South Sudan, and the second biggest in Afghanistan. Few Western brands are chasing shoppers in Libya at the moment, and the report says demand for legitimate Western advertising in sanctioned or active-conflict states is effectively zero.

The entity also won an implausibly dominant share of bids in several other countries, including Hungary, Israel, Egypt, Azerbaijan and Venezuela. The researchers were convinced Discover-Tech was behind it and discussed naming it in the report, according to the six sources. They dropped the idea after TrendAI executives raised legal concerns, five of those sources said.

It wouldn’t be the first time. Earlier this year, Reuters reported that Palo Alto stripped explicit references to China from a report on a global cyberespionage campaign, even though its researchers were confident Beijing was behind the hacking. Reuters said the report was watered down over fears that naming China would cause problems for Palo Alto’s operations there, which were already under scrutiny after a Beijing directive told domestic companies not to use its products. Palo Alto said the lack of attribution had nothing to do with China’s procurement rules and called any suggestion otherwise speculative and false.

Executives fear that exposing surveillance operations could draw retribution, and industry experts tell Reuters the sector has a habit of staying quiet.

“Self-censorship is common in the cybersecurity industry, especially when executives fear that exposing surveillance operations could draw retribution, industry experts say.” Reuters concludes.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Starlink)

Hive and Nefilim Ransomware Affiliate Gets 70 Months In Jail

Wed, 28 Oct 2026 20:19:06 +0000

Artem Stryzhak gets 70 months in prison for Hive and Nefilim ransomware attacks, while the FBI offers $11 million for his alleged co-conspirator.

A federal court in Brooklyn has sentenced Artem Stryzhak, a Ukrainian national, to 70 months in prison for using ransomware to extort millions of dollars from victims. The U.S. Attorney’s Office for the Eastern District of New York announced it in a press release, and it also says an $11 million reward remains for a co-conspirator who’s still at large.

“Earlier today, in federal court in Brooklyn, Artem Stryzhak, a Ukrainian national, was sentenced by United States District Judge Pamela K. Chen to 70 months in prison for using ransomware to extort millions of dollars from victims.” reads the DoJ’s press release. “The defendant pled guilty in December 2025 to conspiracy to commit fraud, extortion, and related activity in connection with computers. “

In December, Artem Aleksandrovych Stryzhak pleaded guilty in the U.S. for Nefilim ransomware attacks. The Ukrainian citizen was arrested in Spain in 2024 and extradited to the US in April 2025. He pleaded guilty to conspiracy to commit computer fraud, extortion, and related activity

Nefilim ransomware was used to encrypt networks worldwide, including in the Eastern District of New York, causing millions in losses from ransom payments and system damage. Attackers employed a customized ransomware executable in each attack, generating unique decryption keys and tailored ransom notes for victims. In June 2021, Nefilim administrators granted Artem Stryzhak access to the ransomware code in exchange for 20% of his ransom proceeds, which he deployed via his account on the administrators’ online platform.

Stryzhak and co-conspirators researched victims using online databases to collect information on their net worth, size, and contacts. After gaining network access, they stole data to pressure companies into ransom payments. Nefilim notes warned that stolen data would be posted on publicly accessible “Corporate Leaks” sites maintained by the administrators if victims did not comply.

Volodymyr Tymoshchuk, Stryzhak’s co-defendant and Nefilim admin, is a serial ransomware cybercriminal who is still at large.

According to court documents, his first role was with Nefilim. Starting around June 2021, he joined the ongoing Nefilim conspiracy as an affiliate and got access to the ransomware. In exchange, he agreed with one of the group’s administrators, Volodymyr Tymoshchuk, to pay the administrators 20 percent of the ransom proceeds. Even crime has licensing fees.

One of those attacks came in June 2021, when Stryzhak stole data from a company in the oil and gas transportation industry. About a week later, he created email addresses that went into a ransom note sent to the victim. He kept deploying Nefilim ransomware through at least October 2021.

Separately, he also joined the Hive ransomware group as one of its earliest affiliates. From June 2021 to January 2023, Hive’s conspirators attacked about 1,500 victims worldwide, including government entities, hospitals and businesses. The attacks caused major disruption to daily operations around the world and affected responses to the COVID-19 pandemic. One hospital had to give up digital technology to treat its patients and couldn’t take in new ones right after the attack.

As a Hive affiliate, Stryzhak and his co-conspirators hit seven victims, including law firms, a dentist’s office and a healthcare provider, during the pandemic. Those victims couldn’t get to their encrypted data. The FBI, as part of a months-long effort to disrupt Hive, gave a decryption key to one of Stryzhak’s victims, so that victim recovered its data without paying a ransom.

U.S. Attorney Joseph Nocella, Jr. thanked the FBI’s New York Field Office, the Justice Department’s Office of International Affairs and its Computer Crime and Intellectual Property Section, and Spanish law enforcement for helping to capture him.

“Ransomware attacks like those committed by the defendant wreak enormous havoc—harming victim companies that pay millions in remediation and ransoms, preventing hospitals and other critical facilities from accessing data, and putting sensitive information in the hands of bad actors,” stated United States Attorney Nocella. “Today’s sentence reflects that cybercriminals cannot hide from law enforcement and will face significant punishment for their criminal conduct. We remain determined to capture Volodymyr Tymoshchuk, a serial ransomware developer and Stryzhak’s co-conspirator.”

The State Department’s Transnational Organized Crime Rewards Program is offering up to $11 million for information that leads to the arrest, conviction or location of Tymoshchuk.

Anyone with information can call the FBI at +1-917-242-1407 or email [email protected], contact a local field office if in the United States, or reach the nearest U.S. Embassy if overseas.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Virtualine Domain Seized, but Allegedly Abusive Website Remains Online

Thu, 29 Oct 2026 08:45:21 +0000

The FBI seized Virtualine, a hosting service accused of supporting criminal sites, ignoring abuse reports and helping launder money from illegal activities

The FBI seized the website of Virtualine, a hosting service that sold its services to criminals. The seized domain is virtualine.net, and the government says the site was used to commit and facilitate prolific criminal activity. That includes the advertisement of sexually explicit images of minors, the intentional disclosure of nonconsensual intimate images of adults and minors, and international money laundering. A court authorized the seizure.

“Theophani K. Stamos, First Assistant U.S. Attorney for the Eastern District of Virginia, and Darren B. Cox, Assistant Director in Charge of the FBI Washington Field Office, announced today the seizure of the website virtualine.net after it was used to commit and facilitate prolific criminal activity, including the advertisement of sexually explicit images of minors, the intentional disclosure of nonconsensual intimate visual depictions of adults and minors, and international money laundering designed to conceal and promote criminal conduct.” The Justice Department has the details in a press release.

Virtualine, also known as Secury, Massgod, Spamhouse, Lanedo and Omegatech, offers “bulletproof” hosting. It sells hosting, servers and domain names to customers who want a provider that ignores abuse complaints. It promotes its services on cybercrime forums.

Court records include examples of those ads. In September 2024, Virtualine told an Exploit.in user that it allowed illegal activities such as phishing, payment card fraud, email spam and port scanning, but banned child sexual abuse material and terrorism-related content. In June 2025, it boasted on HackForums that it ignored more abuse than three therapists combined.

In March 2026, Virtualine promoted an “additional protection plan” for customers, offered after the company received an official request from law enforcement. Under the plan, it would move the customer’s criminal infrastructure to another shell company unaffiliated with Virtualine, and then reactivate the server. It was a game of musical shell companies.

“In March 2026, Virtualine advertised its “additional protection plan,” which it offered to its customers after “receiv[ing] an official request from law enforcement agencies.” Under this plan, Virtualine would move the customer’s criminal infrastructure to “another shell company not affiliated with Virtualine, after which the server is reactivated.”” continues the press release.”As Virtualine advertised to users on the platform HackForums in June 2025, “Virtualine ignored more abuse than your last three therapists.””

Despite saying it bans child content, the government says Virtualine knowingly hosted a website that carried it. Court records call that site Vendor 1. It’s a criminal online forum where users post and sell access to nude, sexually suggestive or sexually explicit images and videos of minors and adults, and it also promotes a hack-for-hire service in which people pay hackers to get into victims’ online accounts without consent and take explicit images and videos.

In January 2026, about a month after assigning Vendor 1 an IP address, Virtualine began receiving reports of child sexual abuse images and videos on the server. The reports came from police in Germany, Canada and Australia, the US National Center for Missing and Exploited Children (NCMEC), and a victim’s lawyer. According to the government, Virtualine continued hosting Vendor 1 despite those warnings.

The government also says Virtualine helped Vendor 1 build a new website. It allowed users to upload illegal material and download it after paying.

The site accepted several payment methods, including an option called “BTC [NO-AML].” It used bitcoin addresses outside a hosted payment service, allowing customers to pay directly and avoid that service’s checks for illegal funds.

Authorities say some payments came directly from criminal groups. They accuse Virtualine of accepting the money and moving it through further transactions to hide its source.

The FBI’s Washington Field Office led the investigation, with significant help from Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland, the U.K.’s National Crime Agency, and private partners OverRIPE and Lumen. The Justice Department’s Office of International Affairs also assisted. Assistant U.S. Attorneys Laura D. Withers and Stefanie A. Schwartz represent the government.

A domain seizure doesn’t end the problem, and the government says so in plain terms. The new website Virtualine built with Vendor 1 has already drawn at least one abuse complaint about sexually explicit images of children, and the release adds: Virtualine hosts this new website to this day.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Virtualine)

ENGIE Data Breach Exposes Customer Details and Energy Contracts

Thu, 29 Oct 2026 08:53:37 +0000

ENGIE says attackers accessed French customers’ contact and energy contract data through a partner sales tool. Banking data was not affected.

French multinational energy company ENGIE warned customers in France that attackers accessed personal information through a sales tool used by some business partners. The exposed data includes contact details and energy contract information that could help fraudsters impersonate the supplier.

The company says its internal IT systems weren’t compromised and banking information wasn’t affected. It has blocked the attackers’ access, notified the relevant authorities and contacted affected customers, according to a spokesperson who spoke to BleepingComputer.

According to notification emails sent to affected customers, the incident involved a tool used by partners to sell the company’s electricity and natural gas offers.

The notification confirms that attackers gained unauthorized access to personal information stored in the sales tool.

“We are informing you that an act of cyber-malice recently affected a tool used by some of our partners to market energy offers. As part of this incident, unauthorized access to your personal data was identified.” reads the notification.

The compromised information includes customers’ names, postal addresses, email addresses, telephone numbers, customer IDs, contract numbers and energy supply identifiers.

The company hasn’t disclosed the partner or platform involved. It also hasn’t revealed how many customers were affected, when the intrusion began, or when it was discovered.

For electricity customers, these include the delivery point identifier (PDL). For gas customers, they include the metering and estimation point (PCE).

ENGIE says financial information wasn’t affected and that its investigation indicates the exposure was limited to contact details and certain contract information.

That reduces one category of risk but doesn’t eliminate financial fraud. Attackers can use accurate customer information to persuade victims to disclose additional data or make payments.

Anyway, the exposed data could support impersonation scams. The company warned customers to watch for attempts to obtain further information or induce payments. A contract number, however, doesn’t prove that a caller is legitimate. It may simply show that the person has access to an exposed record.

Customers should verify unexpected requests through trusted channels, even when the sender knows their personal details.

ENGIE hasn’t attributed the attack to a specific group, and at this time no ransomware group has claimed responsibility for the attack.

Experts recommend visiting ENGIE’s official website or app directly instead of signing in through links received by email.

Customers should also be cautious with unexpected calls and messages. If someone requests a payment, password or additional personal information, they should end the exchange and verify the request using independently obtained official contact details.

Customers should never share SMS verification codes, passwords or banking details with someone who contacts them unexpectedly.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, data breach)

Election Website Security: 42% of US County Sites Still Lack .gov Domains

Thu, 29 Oct 2026 09:21:41 +0000

US election websites show improved security, but weak email protection, non-.gov domains and third-party tracking still expose voters to risks.

Millions of Americans will use websites to check their registration, find polling places or track ballots before the November 3 election. However, a new study finds that many county election websites still have security weaknesses involving domain names, email authentication, encrypted connections and third-party tracking.

Mysterium VPN’s 2026 County Election Website Security Census examines 2,081 county election websites across the United States.

“42% of county election websites aren’t on .gov (869 of 2,081 identified). That’s down from 57% in 2024.” states the report. “Weighted by population, it’s 28% because the big counties moved first.”

That’s an improvement from 57% in the company’s 2024 census. However, the findings reveal persistent weaknesses that could expose voters to impersonation, misleading websites and unnecessary data collection.

These findings concern public information websites and their contact domains. They do not establish that voting machines, ballot-counting systems or election results have been compromised.

The researchers started with 3,144 US counties and county equivalents but identified county-run election information pages for 2,081. Of these, 869 used domains outside .gov.

Only verified US government organizations can register a .gov domain, making it a useful way for voters to identify official government websites. The study found that larger counties had made more progress: when weighted by population, 28% of residents lived in counties whose election pages used non-.gov domains.

Texas accounted for 169 non-.gov sites, including 134 using the older co.<county>.tx.us structure. Arizona and Nebraska had no identified non-.gov county election sites.

The FBI and CISA previously warned that criminals were using fake election websites to spread false information and collect personal data. Moving to .gov and redirecting older addresses can reduce confusion, although the domain alone cannot guarantee that every aspect of a website is secure.

Election offices communicate with voters about registration, identification requirements and missing ballots. Weak email authentication can make it easier for attackers to impersonate these offices.

Of 1,977 readable election pages, 965 displayed a contact address. After excluding consumer email services, researchers examined 942 county-controlled domains.

“Of the 1,977 election pages whose content we could read, 965 display a contact address. Twenty-three of those are at consumer providers like Gmail. As in 2024, we set them aside, because Gmail’s security policy is Gmail’s, not the county’s.” states the report. “That leaves 942 county-controlled election email domains.”

The study reported that 23% had no DMARC record, while 28% used p=none, a monitoring-only policy that does not request quarantine or rejection of unauthenticated messages. Another 30% requested quarantine and 19% rejection.

Together, the first two groups account for roughly 51% of domains without an enforced DMARC policy. The report’s underlying counts total 941 rather than the stated 942, a discrepancy that requires clarification.

The share of domains without DMARC fell from 41% in 2024 to 23% in 2026. SPF, another email authentication mechanism, was present on 98% of checked domains.

Smaller counties performed worse. Among the third of counties with the fewest residents, 34% of election contact domains lacked DMARC, compared with 12% among the largest counties.

Non-.gov domains also showed weaker protection: 32% lacked DMARC, compared with 16% of .gov domains. These findings indicate an association, not proof that adopting .gov automatically improves email security.

DMARC enforcement can reduce certain forms of domain spoofing, but it cannot prevent every impersonation attempt, lookalike domain or attack involving compromised accounts.

The researchers found 28 websites with consistent HTTPS failures among the 2,081 tested. Fifteen lacked a working HTTPS service, seven presented certificates for the wrong domain, and others had expired or untrusted certificates or failed to establish a secure connection.

Another 178 websites would serve election pages over unencrypted HTTP if visitors requested them that way. Only 34% sent an HSTS header, which instructs compatible browsers to insist on encrypted connections. Sixty-three certificates were due to expire within 30 days of Election Day.

A separate test examined third-party connections when election pages loaded in a clean browser, without clicks or scrolling.

Of 1,930 measured pages, 84% contacted at least one company identified as a tracker by Disconnect or DuckDuckGo. The median page contacted six third-party domains. Google Analytics or Tag Manager appeared on 60% of websites, while Meta Pixel appeared on 3%.

Mysterium suggests that some tracking results from default settings in website platforms rather than deliberate decisions by election officials. The presence of third-party code does not, by itself, establish unlawful tracking or prove exactly what information was collected.

Still, counties should review whether these connections are necessary on pages designed to provide basic voting information.

The study examined recognizable election-related domain names across several extensions, including .gov, .com, .org, .net, .us and .vote.

Researchers identified 2,074 matching names that resolved to an address. Of these, 121 were registered outside government control. Thirty-eight hosted unrelated websites, eight were offered for sale, 73 displayed basic server or hosting pages, and two served gambling or spam content.

The researchers also found 73 counties with a working .gov version of the name used by their non-.gov election website, suggesting that some had secured the official address without completing the migration.

A separate test generated 14,456 single-character misspellings of 77 state and large-county election domains. Researchers found 245 registered variants and identified 26 that served parked, placeholder or unrelated pages after excluding potentially coincidental matches.

The study does not establish that these registrations were malicious or identify their owners. However, a voter who mistypes an address or guesses the wrong domain ending could reach a third-party website instead of an official source.

Across the seven states that decided the 2024 presidential election, 43% of identified county election websites were outside .gov, down from 55% in 2024.

In these states, 26% of election contact domains lacked DMARC, compared with 39% two years earlier. However, 55% still lacked an enforced policy.

The nine states whose 2026 Senate races were rated toss-up or lean in mid-October showed similar concerns: 53% of identified county election sites were outside .gov, while 44% of election contact domains lacked enforced DMARC.

These figures measure website and email configurations. They are not evidence that an election has been compromised.

Mysterium recommends that eligible government organizations complete the move to .gov, redirect old addresses, enforce email authentication policies and configure HTTP-to-HTTPS redirects and HSTS.

Counties should inventory legitimate email senders before tightening DMARC policies to avoid disrupting valid communications. They should also review advertising pixels and unnecessary third-party connections, monitor certificate expiration dates and consider registering defensive versions of their domains.

For voters, the report recommends starting with the state election office listed on USA.gov and following its link to the relevant county website. Voters should avoid trusting unsolicited messages or plausible-looking search results without checking the destination.

If an election-office email comes from an unexpected address, voters should verify it using an independently obtained official telephone number. An unusual address is a reason to check, not proof of fraud, since the study found that some legitimate offices still use consumer email services.

The researchers combined Census Bureau county data with official websites recorded in Wikidata and checked them against CISA’s .gov registry. They tested displayed contact addresses, email authentication records, certificates, redirects, tracking requests and lookalike domains.

The study identified 2,081 election pages, compared with 2,913 in the 2024 manual survey. Automated discovery favored larger counties with better-structured websites, leaving smaller counties underrepresented even though some had weaker protections.

The comparisons indicate progress but are not a perfectly matched before-and-after assessment. Different tests also used different sample sizes, and the tracking analysis measured a single page load from one location.

The observations reflect October 17, 2026, rather than continuous monitoring. The findings provide a useful snapshot of public-facing election website security, but individual results should be rechecked before drawing conclusions about a specific county.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Election Website)

Volt Typhoon Used Silent Train to Hide Zero-Day Attacks

Thu, 29 Oct 2026 10:34:54 +0000

Volt Typhoon used disposable relay chains to hide zero-day attacks on critical systems. Lumen linked Silent Train to at least four zero-days.

Lumen’s Black Lotus Labs has spent three years tracking a covert network it calls Silent Train, which it ties to Volt Typhoon, the China-linked APT group. The cybersecurity firm says the network hid exploitation of software flaws the vendors didn’t know about yet. Black Lotus sent hundreds of victim notifications along the way, and the investigations that followed revealed the exploitation of at least four confirmed zero-days and one likely.

“Volt Typhoon’s Silent Train is a covert network designed to gain and maintain access to the technologies businesses rely on to manage devices, networks and critical operations.” reads the report published by Lumen. “Black Lotus Labs® tracked how the group used rapidly changing chains of compromised infrastructure to conceal its activity while exploiting previously unknown vulnerabilities in centralized management platforms.”

Silent Train first showed up in November 2023, shortly before the first takedown of the KV-botnet, Volt Typhoon’s earlier network of hijacked routers. Activity rose after the second disruption. The group dropped persistent infrastructure and moved to disposable chains of compromised devices that it could rebuild whenever it wanted.

Each session began on a rented server outside the United States. It then passed through another server and compromised small-office routers, home devices and IoT equipment in other countries. Finally, the traffic passed through a compromised device in the U.S., close to the target. This helped the attackers make their activity look like normal local traffic and bypass location-based blocks and IP reputation filters. On average, the chains passed through about four devices before reaching a U.S. IP address. Some used as many as six.

Lumen identified more than 27 types of devices used in the network, including TP-Link routers and Fortinet appliances. Some of these devices had no known vulnerabilities, suggesting that Volt Typhoon may have used previously unknown exploits to compromise them and create relay points.

“We observed more than 27 device classes exploited and used in Silent Train operations, ranging from SOHO and IoT devices like TP-Link routers and Netgear Orbi devices to enterprise platforms like Fortinet appliances and CyberPanel servers.” the report continues. “Some relay device types lack known vulnerabilities, suggesting Volt Typhoon leveraged undisclosed zero-day exploits to set up a single relay in a four-to-six hop chain and indicating a willingness to commit significant resources to protecting future access capabilities.”

The attackers exploited exposed web interfaces and installed only the tools needed to connect the devices through SSH. These included temporary SSH services, keys, configuration files and tools already available on the systems. At the end of each session, they removed all traces of their activity and dismantled the relay chain. Sessions lasted about four hours on average, although some lasted only minutes. The attackers could also build a new chain in less than two minutes, suggesting that they had partly automated the process.

The group worked with strict discipline. New device types arrived about one per quarter, and about one per month during the 2023 and 2024 build-out, always tested outside the U.S. first. Roles never changed: Intelbras modems served only as overseas relays, Netgear Orbi devices only as the U.S. hops facing victims, and the server providers stayed separated by layer too.

By early 2025, enterprise platforms like Fortinet, Cisco, PRTG, Mirth Connect and CyberPanel joined as final hops. They stayed up one to three months and supported several intrusions. The group also added reverse tunnels using the open-source proxies Chisel and FRP, and the old and new methods ran in parallel.

Volt Typhoon used Silent Train only during key stages of its attacks, including exploiting vulnerabilities, stealing credentials and data, and maintaining access to compromised systems. Each session targeted between one and five victims, often just one organization. The activity was carried out by human operators, mainly from Monday to Friday, between 9 a.m. and 10 p.m. China Standard Time. The group also paused operations for several weeks around Chinese New Year.

The group targeted tools used to manage endpoints and networks, as well as SD-WAN systems and other control platforms. These systems can manage hundreds or thousands of devices, allowing attackers to reach many systems without moving through the network in the usual way. This approach also helped them leave fewer traces. After the attacks, investigators found webshells running in memory, stolen credentials, misuse of built-in features such as remote file transfers, and deleted logs.

The four confirmed zero-day campaigns hit Versa Director in 2024, N-able N-central through CVE-2025-8875 and CVE-2025-8876, Cisco Catalyst SD-WAN through CVE-2026-20127, and VeloCloud Orchestrator through CVE-2026-16812. The Cisco bug is a CVSS 10.0 flaw, and the group kept exploiting it well after Cisco disclosed it in February 2026. In the Versa case, the group used an in-memory JAR webshell to limit forensic evidence and reach downstream customers.

The likely fifth is Quest KACE. The campaign hit more than 30 victims and faded after Quest’s October 2025 security updates.

“The campaign affected more than 30 victims, followed vendor remediation timelines and declined after Quest’s October 2025 security updates.” the report states. “Despite limited forensic evidence, the available data supports a moderate-confidence assessment that Volt Typhoon exploited a zero-day vulnerability.”

The actor stayed on the KACE server and used its admin features to take credentials.

Victims include telecoms, government agencies, defense contractors, satellite and emergency communications, universities with ROTC programs, managed service and IT firms, and critical infrastructure such as water, energy, transportation, maritime, rail and aviation. What they share is access to bigger networks or customers. Hawaii, California and Texas were the top locations for several years. Lumen can’t say why, but the pattern fits pre-positioning for a crisis in the Indo-Pacific.

“For enterprise leaders, the lesson is clear: systems with broad administrative reach can become high-value gateways to the entire organization and its customers. Reducing internet exposure, accelerating patching, strengthening access controls and preserving security telemetry are essential to detecting threats earlier and limiting their impact.” Lumen concludes.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, China)

U.S. CISA adds Linux Kernel and Broadcom VMWare ESX flaws to its Known Exploited Vulnerabilities catalog

Thu, 29 Oct 2026 16:05:56 +0000

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Linux Kernel and Broadcom VMWare ESX flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Linux Kernel and Broadcom VMWare ESX vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

Below are the flaws added to the catalog:

CVE-2026-41709 (CVSS score of 7.6) Broadcom VMWare ESX Insufficient Logging Vulnerability
CVE-2026-46300 (CVSS score of 2.7) Linux Kernel Missing Initialization of a Variable Vulnerability

In July, Broadcom released patches to address five vulnerabilities affecting VMware ESXi, vCenter, Workstation, and Fusion, including CVE-2026-41709. The vulnerability in VMware ESX is caused by insufficient logging. A malicious user with administrator privileges could perform certain operations on the affected system without those actions being recorded in the logs.

This could allow an attacker to hide specific activities and make it harder for security teams to detect suspicious behavior, investigate incidents, and determine what happened. The flaw does not itself grant administrator privileges; the attacker must already have them.

According to CrowdStrike’s 2026 Legal Threat Landscape Report, which said the China-linked threat actor Warp Panda (aka Armory Castle, UNC5221, Clay Typhoon and VerdantBamboo) exploited CVE-2026-41709 as a zero-day in early 2026 to reduce the visibility of its activities in audit logs.

Warp Panda targets internet-facing edge devices by exploiting zero-day vulnerabilities and deploying custom malware to maintain persistent, covert access. The group also attempts to evade detection by bypassing audit logging, stealing cloud session tokens and registering unauthorized multi-factor authentication (MFA) devices.

The second flaw added to the catalog is CVE-2026-46300, also known as Fragnesia, could let local attackers gain root access through page cache corruption.

The flaw affects the XFRM ESP-in-TCP subsystem and could allow local attackers to gain full root access by corrupting the kernel page cache.

Security experts warn that the issue is dangerous because attackers with low privileges can modify read-only files in memory and take complete control of vulnerable systems. The vulnerability was discovered by William Bowling of the V12 security team, while Wiz published a detailed technical analysis.

“The vulnerability allows unprivileged local attackers to modify read-only file contents in the kernel page cache.” reads the report published by Wiz. “Attackers can then achieve root privileges through deterministic page-cache corruption.”

Fragnesia shares similarities with earlier Linux privilege escalation flaws, such as Dirty Frag and Copy Fail. According to researchers, the bug can reliably provide root access on major Linux distributions without requiring race conditions or complicated timing attacks.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix CVE-2026-41709 by November 11, 2026, while CVE-2026-46300, must be fixed by October 31, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

CVE-2026-41709

484,142 Exposed Cloud Buckets Contain 18 Billion Files

Thu, 29 Oct 2026 18:43:01 +0000

42 publicly listable cloud buckets containing 18 billion files, including exposed credentials, database dumps and backups.

The Ransomnews research team counted 484,142 publicly listable cloud storage buckets in October 2026, holding 18.05 billion files. They built the count from the search engines that index open cloud storage and published it as the Ransomnews Cloud Exposure Index, written by Mantas Sasnauskas.

“No file was opened for this index. Every number below comes from bucket names, file extensions, file counts and last-modified timestamps. That is a deliberate limit. It keeps the research on the right side of the line, and it turns out to be enough to see where the sensitive material concentrates.” Ransomnews states. “We are calling it the Ransomnews Cloud Exposure Index, and we will rerun it quarterly so the numbers can be compared over time.”

The researchers used bucket names, file types, file counts and last-modified dates to collect their data. They did not open any files, allowing them to identify where sensitive information might be stored without accessing the content. They plan to repeat the research every three months to track changes over time.

Amazon S3 accounts for 72% of the exposed buckets, roughly in line with its share of the market. This does not mean S3 has weaker security than other providers. Azure Blob, however, appears 2.5 to 3.6 times more often than expected among buckets named for backups, data exports and payroll records. The researchers also found 321,058 files related to credentials and keys. Of the exposed .env files, 67% were last modified in 2026.

Below is the split by provider, from a snapshot taken on October 7:

Provider	Open buckets	Share
Amazon S3	347,984	71.9%
Azure Blob	68,532	14.2%
Google Cloud Storage	53,131	11.0%
DigitalOcean Spaces	11,069	2.3%
Alibaba OSS	3,426	0.7%
Total	484,142	100%

A lot of these buckets are public on purpose, holding website assets, CDN mirrors, open datasets and podcast archives. So the index isn’t 484,142 breaches. It’s the pool where breaches hide, and the rest of the report narrows it down to the stores that should never have been listable.

“Azure, by a wide margin relative to its size. Azure Blob holds 14.2% of open buckets, but 37% of the 1,459 buckets with “backup” in the name, 42% of the 399 named for exports, and 51% of the 505 carrying HR or payroll terms.” continues the report. “Buckets named for logs, customers and databases sit at 35% to 36%, all around two and a half times Azure’s baseline.”

The skew only shows up for operational data. Buckets named “dev” sit at Azure’s baseline of 15 percent, and “test” and “staging” fall below it, at 9 and 7 percent. The authors suspect Azure storage accounts more often hold line-of-business data such as backups, exports and HR systems that enterprises run on Microsoft, while S3 and Google Cloud carry more application assets. They call it a hypothesis the counts suggest and don’t prove, and it’s the first thing they want to test next time.

By sector, retail and e-commerce names lead with 5,666 buckets, mostly storefront assets. The more worrying number is that names tied to regulated sectors (finance, healthcare, education, government, legal and HR) appear on 10,891 unique open buckets. Those are the places where a stray file most likely holds personal, health or financial records, and where regulators expect to hear about it.

Sector (by bucket name)	Open buckets	Files in them
Retail and e-commerce	5,666	269.9M
Finance and insurance	3,508	58.0M
Healthcare	2,709	47.9M
Media and entertainment	2,696	136.2M
Education	2,393	60.6M
Gaming	2,296	79.0M
Travel and hospitality	1,714	118.7M
Real estate	1,137	60.7M
Government and public sector	1,000	36.2M
Legal	978	11.3M
Crypto	630	11.9M
HR and payroll	505	8.4M

Healthcare-related names appear in 2,709 buckets containing 47.9 million files. The researchers identified them using terms such as “hospital” (135 buckets), “patient” (135), “clinic” (277) and “dental” (331). HR and payroll is the smallest sector, with 505 buckets, 259 of which are hosted on Azure.

These figures are based on names, not proof of ownership. The search matches parts of words, so “store” can refer to object storage as well as shops. A single bucket can also appear in two sectors.

The exposed buckets also list about 4.7 million database and dump files, 15,130 mailbox archives, and tens of millions of spreadsheets and documents. Credential files are particularly concerning because they can turn a cloud misconfiguration into a real intrusion.

File type	What it is	Files listed
.pem	Certificates and private keys	113,285
.env	App secrets and API keys	80,495
.p12	Certificate bundles with keys	33,268
.keystore	Java and Android keystores	27,229
.ppk	PuTTY SSH private keys	24,302
.pfx	Windows certificate bundles	23,352
.ovpn	OpenVPN client configs	15,079
.jks	Java keystores	2,421
.htpasswd	Web server password files	695
.tfstate	Terraform infrastructure state	475
.kdbx	KeePass password vaults	457

Each of these exists to grant access. A .env file is where developers keep database passwords and API keys. A .tfstate file is Terraform’s record of a whole cloud setup, often with secrets in plain text, and a .kdbx vault is encrypted but now open to anyone who wants to guess passwords offline. Some .pem files are public certificates and some files are test fixtures, so the counts are a ceiling on live secrets and not a measure of them. It’s still a big ceiling.

Database files make up most of the sensitive material by volume:

File type	What it usually holds	Files listed
.sqlite	Embedded app databases	2,561,807
.bak	Database and server backups	752,055
.sql	Database dumps	687,446
.sqlite3	Embedded app databases	488,176
.dump	Database dumps	176,603
.mdb / .accdb	Microsoft Access databases	36,467
.dmp	Memory and crash dumps	12,809
.pst / .ost / .mbox	Mailbox archives	15,130
.eml	Saved emails	4,549,665
.csv	Data exports and records	at least 69,580,112
.xlsx / .xls	Spreadsheets	42,544,997
.docx	Word documents	24,936,788
.pdf	Documents, invoices, scans	at least 106,191,393
.log	Application and server logs	at least 61,310,809

The exposed buckets contain thousands of virtual disk images, including VMware, Hyper-V and QEMU files. A single disk image can contain an entire server, including credentials.

Some exposures involve active systems. Of 80,495 .env files, 67% were last modified in 2026. Certificates and SQLite databases include both recent and older files. Backups appear older, with 89% of the 752,055 .bak files last modified before 2025. Almost all PuTTY key files date from 2024.

Recent leaks need urgent attention, while long-standing exposures point to poor security management. The problem is ongoing: at least 113.6 million files were added to publicly listable buckets in the seven days before September 9. Over the previous 30 days, these included more than 21,000 SQL dumps, nearly 21,000 backup files, 4,477 .pem files and 1,298 .env files.

Public .env files can expose database passwords that ransomware affiliates and initial access brokers look for. Similar credentials appear in stolen-data logs, but in this case, attackers do not need to infect a device. They only need to search for exposed files.

Cloud providers already offer settings to prevent public access. Organizations should enable S3 Block Public Access, disable anonymous access to Azure Blob storage, and enable public access prevention in Google Cloud. These controls should apply at account or organization level to prevent new storage buckets from becoming public.

Organizations should also scan their storage for sensitive files such as .env, .sql, .bak, .pem, .ppk, .tfstate and .kdbx. Terraform state files and virtual disk images should be treated as secrets, stored privately, encrypted and monitored. Backups should never be publicly accessible, and recovery procedures must be tested.

One exposed bucket may be a mistake, but many often indicate a wider process failure. Organizations need to fix the underlying security controls, not just individual buckets.

The research has some limitations. The team queried search engines on October 25, while the bucket list was current to October 7 and the newest indexed file dated September 9. File-level data may therefore be about a month old. Counts are also capped at one million per query, so researchers split larger categories into date ranges and added the results.

Some limits apply. The team queried the search engines on October 25. The bucket list was current to October 7 and the newest indexed file was dated September 9, so file-level figures lag by about a month. The index caps any single count at one million, so larger types were split into date windows and summed.

A last-modified date shows when a file was written, not when it was exposed, and a listed file isn’t proof that its contents can be read. No bucket is named in the report. Exposures with a known owner in regulated sectors are going through responsible disclosure, with national CERTs copied where the owner is public sector or doesn’t respond.

“Rotate any secret that has ever sat in a public bucket. Closing the bucket does not un-leak the key. Assume anything that was listable was copied.” conlcudes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Cloud Buckets)

US Probes Suspected Hack Behind Military Base Freezer Failures

Thu, 29 Oct 2026 21:58:38 +0000

The Pentagon treats August freezer failures at US military bases as a suspected hack and is working with French investigators after a supermarket attack.

The Pentagon is investigating freezer failures that spoiled food at US military bases in August as a suspected cyberattack, according to four officials who spoke to Reuters. One official said US investigators are also in contact with French authorities about a similar attack on commercial freezers that disrupted supermarkets in France earlier this month. This is the first time Reuters has reported that the US incident is being treated as a suspected cyberattack.

“The Pentagon is treating the spate of mysterious freezer malfunctions that spoiled food at military bases across the United States in August as a suspected hack, according to four officials familiar ‌with the matter.” Reuters reports.

“One of the officials said the military investigators were in touch with their French counterparts about a similar cyberattack on commercial freezers that disrupted supermarkets there earlier this month.”

It is still unclear who is behind the attacks. Reuters could not determine how far the investigation has progressed or whether investigators have identified the cause or those responsible. The Pentagon said a unit of US Cyber Command is working closely with other government agencies and law enforcement. The Army’s Criminal Investigation Division confirmed that its Cyber Field Office is involved and is working with French law enforcement to investigate the freezer outages in Europe.

The incidents hit commissaries, the on-base stores where military personnel buy food. At least six were affected in late August, according to Reuters’ review of the bases’ Facebook posts and website updates. Stars and Stripes named Fort Irwin, F.E. Warren, Naval Station Newport, Columbus and Travis among the confirmed stores, and some outlets count up to 14 sites in 11 states, though not all are confirmed.

Source: Signal and Silence Blog

In at least one case the freezers didn’t just stop. Their temperatures were cranked up overnight, which left mounds of wilted or melted food in the morning. Fort Huachuca in Arizona said on August 26 that its freezer went into defrost mode and heated up all the food, adding that trust us when we say it was spoiled.

The Pentagon wasn’t the first to speak. A recently created blog called Signal and Silence reported the freezer failures and the possibility of sabotage on August 28, while Stars and Stripes reported the involvement of military investigators and Britain’s Daily Telegraph reported the contacts with the French. The French Embassy in Washington had no comment. Frozen food is the one asset where damage takes hours and evidence takes the form of puddles.

The French attack is the clearest example. Hackers took control of the cooling units in more than 350 stores and raised the temperatures. Frozen food aisles were emptied, and some units got so hot they caught fire. One supermarket owner said the total cost could reach tens of millions of euros.

The same thing happened in Arizona: attackers made the units hotter instead of just turning them off.

Reuters could not tell which brand was used at the US bases, and Danfoss, which is the manufacturer targeted in French supermarket attacks, did not reply. A public research report on Danfoss controllers came out before the incidents, but nothing shows a link to the bases.

There is a history of attacks on refrigeration systems. Danfoss reports that hackers targeted supermarkets in Russia and Israel in 2022 by exploiting outdated cooling controllers. In December 2025, US prosecutors accused a Ukrainian woman of belonging to a hacking group that disrupted refrigeration at a meat plant in 2024, ruining more than 2,000 pounds of meat.

Earlier this year, the Global Food Safety Initiative urged food safety experts and IT leaders to work together to protect refrigeration systems.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Military Base Freezer)

Binance Investigates Suspicious Crypto Transfers Worth Up to $5.8 Billion

Thu, 29 Oct 2026 22:53:27 +0000

Binance probes suspicious crypto transfers worth up to $5.8 billion as Tether and Circle freeze $1.79 billion in stablecoins linked to the activity.

Binance is investigating a potential security incident after billions of dollars in cryptocurrency moved from wallets linked to the exchange on October 29. The transfers raised concerns about a possible hack, while Tether and Circle moved to freeze stablecoins linked to the suspicious activity. The full scope of the incident remains unclear, and the reported outflows shouldn’t automatically be treated as confirmed losses.

According to The Block, blockchain analyst Spreek identified approximately $3.55 billion in incoming transfers to an initially unidentified wallet.

“Onchain data flagged by analyst Spreek shows about $3.55 billion in incoming transfers to the unlabeled wallet, with nearly $900 million subsequently moved across other wallets.” The Block reports. “Conor Grogan, a senior director and product leader at Coinbase, says the amount is up to $5.8 billion.”

Coinbase executive Conor Grogan estimated that the total value of the movements could reach $5.8 billion.

I think the number is potentially up to $5.8B. Tether has blacklisted a large portion of this. https://t.co/ANz2DiXc8S pic.twitter.com/BfscU7ENSo
— Conor (@jconorgrogan) October 29, 2026

These figures come from blockchain tracking and different estimates, so they don’t necessarily represent the amount stolen.

‼️ BREAKING: The Binance hack has grown to about $5.6B drained across Ethereum, Bitcoin and Tron, on-chain trackers say.

If confirmed, it would be the biggest crypto heist on record.

Tether and Circle have frozen about $1.8B in stablecoins, and Circle says it acted "in… https://t.co/UzgOxw9jLE pic.twitter.com/9fBEaaZrWj
— International Cyber Digest (@IntCyberDigest) October 29, 2026

Binance acknowledged the reports and said its security team was investigating. The company had not publicly confirmed a breach in the initial reports, making it important to distinguish between suspicious transactions and a verified compromise.

“We are aware of reports of a potential security issue and we are actively investigating.” He wrote in a post on X. “Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information. Users should remain cautious of scams and should not trust unofficial links, messages, or requests for account information.”

We are aware of reports of a potential security issue and we are actively investigating.
Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information. Users should…
— Yi He (@heyibinance) October 29, 2026

This statement, reported by The Block, reflects the company’s position at the time. Binance also urged users to be cautious of unofficial messages and links, a relevant warning whenever a major security incident attracts public attention.

Blockchain records showed large transfers from Binance-linked hot wallets to a wallet that wasn’t previously identified as belonging to the exchange. Hot wallets hold cryptocurrency in systems connected to the internet, allowing exchanges to process withdrawals and other transactions quickly. Their online availability also makes their security controls particularly important.

The transfers involved Ethereum, stablecoins and other cryptocurrencies. Some funds were later moved to additional wallets, making it harder to track all the transactions.

Investigators must determine who initiated the transfers, whether they were authorized and whether an attacker gained control of the wallets. They also need to establish whether the funds belonged to customers or Binance itself.

Large transfers alone don’t prove a hack. However, unusual movements involving large amounts of cryptocurrency require immediate investigation.

One of the most significant developments was the response from the companies behind two major stablecoins, USDT and USDC. According to The Block and Forbes, Tether and Circle froze approximately $1.79 billion in stablecoins associated with the suspicious transfers in the initial reports.

The figures subsequently changed as the investigation developed. Tether CEO Paolo Ardoino later said the company had frozen more than $1.567 billion in USDT linked to a potential Binance exchange hack. These amounts reflect reported actions at different points in time and shouldn’t be combined without checking whether they refer to distinct assets and addresses.

Tether froze more than 1.567B USDT related to a potential Binance exchange hack.

Protecting the industry and our partners is our main priority.

Stay safe everyone.
— Paolo Ardoino 🤖 (@paoloardoino) October 29, 2026

The freezes demonstrate an important feature of centralized stablecoins: their issuers can restrict transfers from addresses they control through their token contracts. This can help contain suspected theft, but it doesn’t provide the same control over assets such as Ether or Bitcoin. Nor does freezing a balance guarantee that every transferred asset can be recovered.

The incident also highlights a practical tension in crypto security. Stablecoins offer the convenience of blockchain transfers, but their centralized issuers retain powers that can make a difference during an investigation.

Binance maintained that customer funds were safe, while co-founder Changpeng Zhao, widely known as CZ, said the activity appeared to be a hack. Zhao no longer manages Binance’s platform, but said he expected customers’ funds to be fully covered.

The company said its user funds were “completely safe.”

“Our teams are aware of reports of a potential security issue and are actively investigating. User funds are completely safe. Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information.” the company states. “Users should remain cautious of scams and should not trust unofficial links, messages, or requests for account information.”

That assurance is important, but it doesn’t replace a technical explanation of how the transfers occurred or independent confirmation of the final impact.

A security investigation must establish more than whether an exchange can cover a potential loss. It should determine how the activity was authorized, whether credentials or signing mechanisms were compromised, which systems were involved and whether the attacker retained any access.

For customers, the immediate priority is to avoid becoming a secondary victim. Attackers often exploit uncertainty around a major incident to distribute fake announcements, impersonate support staff and direct users to fraudulent websites. Users should rely on official Binance communication channels, avoid unexpected links and never disclose passwords, authentication codes or wallet recovery phrases in response to unsolicited messages.

Security teams should also watch for phishing emails that use the incident to demand urgent account verification. Attackers may exploit the situation to launch a separate scam.

The key lesson is that blockchain transparency does not guarantee operational security. Public ledgers show transactions, but they don’t reveal who authorized them, how attackers may have gained access or whether an exchange’s internal security controls failed.

As the investigation continues, it’s important to distinguish between reported transfers, confirmed theft and funds that can be recovered. The figures may change as analysts trace more wallets and stablecoin issuers take further action.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Binance)