Daily digest,
KillSec Ransomware Infrastructure Dismantled Amid Ongoing Cyber… (+5 more)
Ransomware
KillSec Ransomware Infrastructure Dismantled Amid Ongoing Cyber Threats
Europol's Operation KillSwitch led to the seizure of KillSec ransomware infrastructure and the provisional arrest of three suspects, including a 16-year-old identified as the main operator. The KillSec group is linked to around 1,000 attacks globally, with approximately 500 being successful. Concurrently, U.S. Authorities seized tools associated with the China-linked Flax Typhoon and disrupted a Chinese-language cybercrime ecosystem known as YAM store. In addition, various critical vulnerabilities, including CVE-2026-104286 and CVE-2026-21589, were reported as in the wild. Cyberespionage activities were noted, with Russia-aligned actors targeting organizations supporting Ukraine. The situation remains dynamic with ongoing investigations and emerging threats.
APT · 2 sources · score 79 · CVE-2026-0257, CVE-2026-104286, CVE-2026-111497, CVE-2026-21589, CVE-2026-46300
Breaches
Nintendo Switch 2 Hacked via Civilization 7 Exploit
Hackers have exploited a vulnerability in physical copies of Civilization 7 to gain unauthorized access to the Nintendo Switch 2. This exploit utilizes the game's chat feature to input code via a connected USB device, allowing hackers to manipulate the console. In response, 2K has reportedly begun recalling physical copies of the game due to security concerns, with some users experiencing order cancellations. The exploit, known as CivSwitch, does not allow for the playing of dumped Switch 2 games but enables access to save files and the ability to run homebrew applications. The situation is evolving rapidly, as AI-assisted coding tools are facilitating the development of new hacking methods. Nintendo is facing increasing challenges from modders and hackers as this exploit gains traction in the community.
Vulnerability · 2 sources · score 61 · CivSwitch
Amplifon Data Breach Exposes Personal and Health Information
Amplifon (USA), Inc. reported a security incident involving unauthorized access to personal data affecting approximately 1.33 million individuals. The breach occurred between January 18 and February 8, 2026, with suspicious activity detected on February 11, 2026. The investigation revealed that sensitive information, including names, Social Security numbers, dates of birth, and health records, may have been compromised. Amplifon announced the breach on November 6, 2026, and is currently notifying affected individuals. The company is offering 24 months of free credit monitoring and identity protection services to those impacted. Legal investigations are underway to determine the potential for a class action lawsuit against Amplifon. The exact method of the breach and whether it involved third-party services remain unclear.
Breach · 2 sources · score 52
Threat actors and malware
North Korean Hackers Target Binance, Stealing $6.3 Billion
On October 29, 2026, Binance suffered a significant cyberattack resulting in the theft of approximately $6.3 billion in cryptocurrency, attributed to the North Korean hacking group TraitorTrader. The attackers infiltrated Binance's systems by posing as recruiters and deploying malware on an employee's computer. Following the breach, the Federal Reserve and OCC contacted U.S. banks to assess potential cybersecurity vulnerabilities and suspicious activities related to the incident. The hack has raised concerns about the security of traditional banking infrastructures in light of the cryptocurrency sector's vulnerabilities. In response, major banks initiated internal assessments to bolster their defenses against similar attacks. TRM Labs reported that the coordinated response from the crypto industry was unprecedented, with Tether freezing over $2.67 billion in tokens shortly after the theft. The FBI has confirmed the involvement of North Korean state-sponsored actors in this incident.
APT · 3 sources · score 76 · Lazarus Group, TraitorTrader, TraderTraitor
Hyderabad Users Face Increased Risk from Mobile Cyber Attacks
Cybercriminals are targeting mobile phone users in Hyderabad through malicious applications and phishing attacks, leading to personal data theft and financial fraud. Police have reported an average of three cases of financial fraud each month involving newly downloaded apps. The Hyderabad Zonal Enforcement Directorate (ED) has identified malware, spyware, and phishing as the primary attack vectors. Phishing messages often claim urgent issues with bank accounts or parcels, tricking users into revealing sensitive information. Recent investigations revealed that an international gang used similar tactics to defraud individuals in the U.S. Cybercrime officials warn of zero-click attacks that can compromise devices without user interaction. Users are advised to verify app authenticity and be cautious when sharing personal information. Regular updates to mobile operating systems and applications are recommended to mitigate risks.
Phishing · 2 sources · score 55
Also worth knowing
AI Deepfake Technology Fuels Crime Against Korean Celebrities
AI deepfake technology has led to a surge in meme creation and criminal activities targeting Korean celebrities. Recent challenges have emerged, allowing users to easily create videos by compositing their images into existing footage. However, this ease of use has resulted in increased misuse, including the production of deepfake pornography and violations of portrait rights. Notably, several legal actions have been taken against individuals producing explicit deepfake content, with sentences ranging from two to three years in prison. The controversy highlights the thin line between harmless memes and harmful deepfake crimes, particularly affecting girl groups in the entertainment industry. As the technology becomes more accessible, the potential for abuse continues to grow, raising concerns about the protection of individuals' rights and reputations.
Disinfo & Influence · 2 sources · score 52
New on leak sites
32 victims listed on ransomware leak sites by 15 groups in the 24 hours before this issue. The most active:
Also moving
- APT groups: Lazarus Group, Lazarus, APT38, Arid Viper
- Malware: TraderTraitor, BV:Miner-T, ClickFix, Cobalt Strike, CosmicPulse
- CVEs: CVE-2026-109618, CVE-2026-109619, CVE-2026-123087, CVE-2026-98432, CVE-2017-7921
- Campaigns: Bring Kids Back UA
- Ransomware groups: C3RB3R
- Vulnerabilities: CivSwitch, CopyFail
Get the next one by email
The digest is free and arrives every morning. One click to leave.
A free account turns the digest into a personal watchlist: choose what you want to follow.