Today’s Topics:
- Ivanti Releases More Patches After Zero-Day Chain Compromises VPN Appliances
- FBI Ties Record $6.3 Billion Binance Heist to North Korean Hackers
- How can Netizen help?
Ivanti Releases More Patches After Zero-Day Chain Compromises VPN Appliances
Ivanti has released another round of security updates for its Connect Secure VPN appliances after two additional zero-day vulnerabilities were linked to attacks discovered in early October. The flaws, tracked as CVE-2026-111357 and CVE-2026-118527, were exploited alongside CVE-2026-104935, an authentication bypass patched on October 13. Ivanti issued fixes for the remaining vulnerabilities on October 29, confirming that attackers had used the three flaws together against a limited number of customers.
The exploit chain allowed attackers to execute commands with root privileges on appliances running the latest firmware available at the time of compromise. CVE-2026-111357 is a high-severity privilege escalation vulnerability rated 8.8 on the CVSS scale, and CVE-2026-118527 allows authenticated attackers to upload files to a predictable location. Combined with the authentication bypass, these weaknesses gave attackers a path from unauthenticated access to complete control of an affected VPN appliance.
Security researchers at Volexity identified the activity during an investigation involving a previously unknown threat actor tracked as UTA0576. Once inside the compromised appliance, the attackers extracted credentials, collected Active Directory information, and searched for sensitive data, including Windows LAPS passwords and BitLocker recovery keys. The group also conducted network reconnaissance and password spraying. Rather than installing a traditional backdoor or web shell, the attackers repeatedly exploited the vulnerabilities to execute commands and manipulated system logs to conceal their activity.
CISA added both newly disclosed vulnerabilities to its Known Exploited Vulnerabilities catalog on October 30. Organizations that installed Ivanti’s initial October patches still need to apply the newer updates to address the remaining flaws. Fixed releases include Connect Secure 25.1.1.3 and 22.8R2.6.
FBI Ties Record $6.3 Billion Binance Heist to North Korean Hackers
The FBI has attributed a record-breaking $6.3 billion cryptocurrency theft from Binance to North Korean state-sponsored hackers associated with TraderTraitor, a group linked to several major cryptocurrency attacks. The theft occurred on October 29, with attackers draining assets from Binance’s internet-connected wallets across multiple blockchains. In an October 31 alert, the FBI confirmed North Korea’s involvement and identified the operation as part of the country’s ongoing cryptocurrency theft activities.
Binance initially reported that the intrusion may have involved a compromised DevOps engineer’s laptop, potentially allowing attackers to access a service container and submit unauthorized withdrawal transactions. The company has since identified additional points of compromise, indicating a more extensive intrusion than initially suspected. Blockchain analysis from Elliptic also suggests the attackers manipulated legitimate transaction authorization mechanisms rather than simply stealing private keys. On Ethereum, the attackers abused EIP-7702 account delegation to redirect control of a Binance wallet to a malicious smart contract, which was then used to transfer substantial amounts of cryptocurrency.
Following the theft, investigators observed the attackers converting stolen assets into Ethereum and transferring funds across blockchain networks. The FBI warned that TraderTraitor would likely continue laundering the proceeds through decentralized finance platforms and instant cryptocurrency swapping services. Working with the U.S. Secret Service and IRS Criminal Investigation, the agency published hundreds of cryptocurrency addresses associated with the operation and urged financial service providers to block transactions connected to the stolen funds.
Binance temporarily suspended withdrawals following the attack and committed to covering customer losses using corporate reserves and security funds. By October 31, the exchange reported replacing approximately $6 billion of the stolen assets, with efforts continuing to recover or replace the remaining funds. Blockchain investigators and industry partners have also worked to identify and freeze assets associated with the theft.
How Can Netizen Help?
Founded in 2013, Netizen is an award-winning technology firm that develops and leverages cutting-edge solutions to create a more secure, integrated, and automated digital environment for government, defense, and commercial clients worldwide. Our innovative solutions transform complex cybersecurity and technology challenges into strategic advantages by delivering mission-critical capabilities that safeguard and optimize clients’ digital infrastructure. One example of this is our popular “CISO-as-a-Service” offering that enables organizations of any size to access executive level cybersecurity expertise at a fraction of the cost of hiring internally.
Netizen also operates a state-of-the-art 24x7x365 Security Operations Center (SOC) that delivers comprehensive cybersecurity monitoring solutions for defense, government, and commercial clients. Our service portfolio includes cybersecurity assessments and advisory, hosted SIEM and EDR/XDR solutions, software assurance, penetration testing, cybersecurity engineering, and compliance audit support. We specialize in serving organizations that operate within some of the world’s most highly sensitive and tightly regulated environments where unwavering security, strict compliance, technical excellence, and operational maturity are non-negotiable requirements. Our proven track record in these domains positions us as the premier trusted partner for organizations where technology reliability and security cannot be compromised.
Netizen holds ISO 27001, ISO 9001, ISO 20000-1, and CMMI Level III SVC registrations demonstrating the maturity of our operations. We are a proud Service-Disabled Veteran-Owned Small Business (SDVOSB) certified by U.S. Small Business Administration (SBA) that has been named multiple times to the Inc. 5000 and Vet 100 lists of the most successful and fastest-growing private companies in the nation. Netizen has also been named a national “Best Workplace” by Inc. Magazine, a multiple awardee of the U.S. Department of Labor HIRE Vets Platinum Medallion for veteran hiring and retention, the Lehigh Valley Business of the Year and Veteran-Owned Business of the Year, and the recipient of dozens of other awards and accolades for innovation, community support, working environment, and growth.
Looking for expert guidance to secure, automate, and streamline your IT infrastructure and operations? Start the conversation today.
Leave a Reply