A new BPFDoor backdoor variant and the AVERAT implant hide on telecom edge devices by posing as mail traffic. See how they work and how to hunt them.
Related Posts:
The post BPFDoor Backdoor and New AVERAT Implant Hide in SMTP Traffic on Telecom Edge Devices appeared first on Daily CyberSecurity.
Bitcoin’s Liquid Network, a sidechain built by Blockstream and used by dozens of exchanges to move funds faster and more privately than the main Bitcoin blockchain allows, got drained of roughly 4,000 of the 4,200 Bitcoin sitting in its federation wallet on September 6.
The attackers, who described themselves as white-hat hackers, have since returned 3,400 of those crypto coins, worth around $262.6 million, while keeping roughly 598 BTC, close to $47 million, for themselves.
Update: 3,400 BTC of the roughly 4,000 BTC withdrawn on September 6 has been returned to the @Liquid_BTC Federation wallet. The return followed confirmation from @Blockstream that the affected bridge nodes have been patched. Approximately 598 BTC remains outstanding, and…
— Samson Mow (@Excellion) September 7, 2026
The size of the initial theft makes this much more serious than another crypto hack. The attacker took nearly 95% of the wallet’s Bitcoin in a single transaction, leaving the fund behind Liquid’s L-BTC token with only about 197 BTC.
This wasn’t a partial breach. The attacker drained almost the entire collateral pool that should back every L-BTC token with an equal amount of real Bitcoin.
How the money actually left is the more technically interesting part. According to Bitrue’s breakdown of the exploit, the attackers didn’t steal a private key or compromise any authorization credentials at all. A software bug in Elements, the open-source code powering Liquid Network, apparently let more L-BTC exist than the system’s real Bitcoin reserves should have allowed, and that unbacked token was then redeemed for genuine BTC through SideSwap’s authorized peg-out mechanism. Liquid itself confirmed the specific access point directly, stating plainly that the funds moved through SideSwap’s authorization key, and that key itself was never compromised.
What happened next is where this stops looking like an ordinary crypto heist. Rather than demanding a ransom payment or threatening to dump the stolen coins, the attackers negotiated entirely in public, writing messages directly into Bitcoin transactions using the OP_RETURN field, a way to embed small amounts of arbitrary data on-chain.
The discussion between @Blockstream and the white-hat hacker (WHH) regarding the ~4000 BTC from @Liquid_BTC is happening in public. It seems to be their preference over email. As it's hard to follow the chain of messages in OP_RETURN, here's a summary with links.
— Samson Mow (@Excellion) September 7, 2026
11:30 AM PDT -… https://t.co/IEXyFpBITx
Their opening demand, relayed through Liquid’s own channels, was refreshingly blunt: fix the underlying vulnerability first, confirm every node is patched, and only then would they send the money back.
Blockstream appears to have met that condition. After the team confirmed that the affected bridge nodes had received the security patches, the attackers returned 3,400 BTC to the federation wallet. They first checked that they had the correct return address. They then kept the remaining 598 BTC, effectively rewarding themselves for the bug discovery. Former Blockstream executive Samson Mow provided updates during the incident but warned that the recovery is not over. The network remains paused while federation members complete more security work, resolve a chain split caused by the freeze, and restore confidence that L-BTC has full Bitcoin backing before they restart the network.
Whether “white hat” is the right label here is a genuinely contested question, and not just semantically. Security specialist Alena Vránová pushed back hard against the framing on social media, arguing that exploiting a vulnerability, draining $320 million, and demanding a fix before returning the money still meets the legal definition of extortion, potentially carrying felony charges and prison sentences up to 20 years in the US. Calling yourself ethical after the fact doesn’t retroactively make unauthorized access to someone else’s wallet legal, whatever bug you’re fixing on the way out.
If you attacked @Liquid_BTC fix it fast I'd reckon to avoid serious trouble.
— Alena V. (@AlenaSatoshi) September 7, 2026
If you exploit vuln, steal 4k BTC and demand a fix for ransom, that's EXTORTION.
This can mean felony charges and long prison time. In the U.S. up to 20 years, and computer-fraud charges can add more. https://t.co/aekesa5K0n
The incident also creates a long-term trust problem that a security patch cannot fix. Galoy founder Nicolas Burtey argued that, even if the funds return in full, the attack has already damaged trust in Liquid. Who will trust Liquid with their money after this? The federated system promises one-to-one Bitcoin backing for every L-BTC token, but this attack showed that guarantee can fail. Recovering most of the funds does not erase that failure.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Liquid Network)
“Free” movies and TV could cost you your privacy, bandwidth, and control of your home network.
We’ve warned about illegal streaming and modded Amazon Fire TV Sticks in the past. Now, researchers have found that certain SuperBox devices and apps could quietly enroll a household connection into a proxy network, allowing third parties to route traffic through it.
An earlier report identified CyberFlix TV, available through SuperBox’s custom app store, as containing Popanet proxy functionality that registers the device with a server controlled by the proxy operator.
Law enforcement agencies have warned that “foreign entities” are using residential proxies to conceal their identities and make their activity appear to come from someone else’s home network.
The FBI defines a residential proxy as follows:
“A residential proxy is an intermediary server between individuals and websites they visit to make their connections appear to originate elsewhere. Legitimate IP addresses assigned by an Internet Service Provider (ISP) to consumers’ Internet of Things (IoT) devices, such as TV streaming devices, digital picture frames, smartphones, tablets, and routers are used to route traffic. Once an internet-connected device is compromised, the device’s IP address can be used by threat actors to mask their online illegal activity, making the consumer appear responsible.”
Residential proxy networks rent out ordinary home IP addresses to customers. That makes their traffic appear as if it originates from a legitimate consumer connection rather than a data center, helping cybercriminals evade IP-based fraud controls and reputation systems.
Besides affecting connectivity, this can mean that a household’s public IP address becomes associated with activity it did not initiate, ranging from credential stuffing and account abuse to attempts to bypass enterprise security controls.
Plume’s more recent research warns that these proxy networks can also function as malware-delivery platforms. In other words, attackers may not only use a compromised streaming box as an exit node. They may use the proxy connection to reach the box itself and install additional malicious software.
The reported SuperBox configuration is especially troubling because it disables or weakens multiple Android safeguards. Researchers found exposed Android Debug Bridge (ADB) access, root-level privileges without authentication, and the removal of protections that would normally restrict untrusted app installation or prompt users to approve risky actions.
Many people assume that placing a streaming device behind a home router prevents outside access. Normally, network address translation and a firewall do make unsolicited inbound connections more difficult. But proxy-enabled devices can maintain an encrypted outbound connection to a remote server, creating a channel that the home router treats as legitimate traffic initiated from inside the network.
The safest option is not to connect devices or install apps that promise unauthorized access to free movies and TV. You could be bringing a proverbial Trojan horse into your home.
If you own a SuperBox device or have installed CyberFlix TV, disconnect the device from your network. A factory reset may not be enough to make it safe to use again, so you should replace it.
When a device’s business model depends on monetizing your connection, its security choices can put your IP address, bandwidth, privacy, and local network at risk.
Network segmentation can reduce exposure for ordinary Internet of Things (IoT) devices, but it is not a complete answer here. A product that intentionally establishes a persistent proxy channel and offers weak device-level protection should not be trusted on a household network, even on a separate guest network.
From reporting threats to removing them.
Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.
Introduction
The modern cyber threat landscape has seen a fundamental shift in how threat actors manage and deploy their infrastructure. Advanced persistent threats (APTs) have almost completely moved away from static command-and-control (C2) servers, opting instead to build complex, multi-layered botnets known as Operational Relay Box (ORB) networks.
Project ORBITAL (which stands for Operational Relay Box Intelligence, Tracking, & Analysis Lexicon) was established as a centralised intelligence matrix to track, analyse, and ultimately help defenders disrupt this highly evasive infrastructure.
To construct these networks, adversaries systematically compromise unpatched, end-of-life devices. By targeting legacy, unpatched Small Office/Home Office (SOHO) router and Internet-of-Things (IoT) devices attackers can create a sprawling, decentralised mesh of proxy nodes. By routing their operations through layers of compromised devices, adversaries mask their true origins, making malicious activity blend seamlessly with legitimate regional traffic.
Blogs by my colleagues at Team Cymru as well as Google offer detailed explanations as to why and how these ORBs have grown over many years and continue to expand.
Project Background
Project ORBITAL represents a centralised Open Source Intelligence (OSINT) collection driven by public reporting from advanced research teams across the cybersecurity and technology sectors. This initiative aggregates telemetry and findings from top-tier vendors including Cisco Talos, CrowdStrike, Google, GreyNoise Labs, Lumen Black Lotus Labs, Microsoft, SecurityScorecard, Sekoia, SentinelLabs, Sygnia, and Team Cymru. Furthermore, it incorporates critical alerts and intelligence shared publicly by United States government agencies, specifically the Federal Bureau of Investigation (FBI), the Cyber National Mission Force (CNMF), and the National Security Agency (NSA).
This repository builds on the methodology of my previous OSINT tracking initiatives. It is heavily inspired by the structure and community success of my earlier matrix projects, specifically the Ransomware Tool Matrix (RTM) (here), the Ransomware Vulnerability Matrix (RVM) (here), and the Russian APT Tool Matrix (RUTM) (here). By applying a similar, structured approach to mapping Operational Relay Box (ORB) networks, this project aims to provide defenders with a clear, actionable lexicon for hunting and tracking evasive edge-device botnets.
Graph Visualisation
Once Project ORBITAL was initially assembled, it was then possible to use a GitHub Action automation with NetworkX and PyVis to create a Graph Visualisation using the data collected. Once in this view, some interesting patterns could be observed.
Analysis of the extracted data uncovered that ASUS devices were the most targeted out of all of the targeted devices by ORBs from the public reports.
Another interesting point the graph highlighted is that the LapDogs ORB network had the highest number of reported targeted devices.
In most reported scenarios, a singular threat group used a dedicated ORB network. However, from extracting the details from the Google and SentinelLabs reports, an adversary like APT15, reportedly leverages both SPACEHOP and PurpleHaze ORB networks, alongside two other separate adversaries UNC2630 and UNC5174.
The overlap in ORB usage suggests these APTs aren't all building their own botnets from scratch. These overlaps likely indicate there are provisioning teams, such as specialised contractors, like Beijing Integrity Tech, who build and maintain these ORB networks and then lease access to the broader Chinese intelligence community in the Ministry of State Security (MSS) and People’s Liberation Army (PLA).
Panda-monium
Below is the list of well-known China-nexus APTs listed using CrowdStrike’s naming scheme and their Google or Microsoft aliases that are all mentioned in Project ORBITAL.
The most notable aspect about this list is that it contains APTs with wildly different mandates. VANGUARD PANDA (Volt Typhoon) is famous for pre-positioning within critical infrastructure with the potential disruptive attacks, while KEYHOLE PANDA (APT5) and JUDGMENT PANDA (APT31) are long-running cyber-espionage and IP theft operators. The fact that both the saboteurs and the spies have all adopted ORB networks goes to show that this tactic is not niche but instead is the baseline standard for Chinese APT operational security (OPSEC).
How to Access
You can find Project ORBITAL on my GitHub repository below:
Google announced that it helped take down NetNut, a 2 million strong malicious residential proxy network. The incident highlights the growing risks posed by residential proxy networks that quietly conscript consumer devices into services used by cybercriminals and nation-state actors alike.
The post Residential Proxy Risks: Understanding Google’s Latest Action Against 2 Million Strong NetNut appeared first on The Security Ledger with Paul F. Roberts.
Learn how to securely handle user documents in authentication and onboarding systems to protect data, ensure compliance, and prevent breaches.
The post Handling User Documents Securely in Authentication and Onboarding Systems appeared first on Security Boulevard.
As API and AI adoption grows across the Middle East, so do the expectations around how data is handled. For many organizations operating in this region, it’s not just about securing applications. It’s about doing it in a way that keeps data in-country and aligned with local requirements. Today, we’re introducing the Wallarm Middle East [...]
The post Introducing Wallarm Middle East Cloud: Built for Data Residency Compliance appeared first on Wallarm.
The post Introducing Wallarm Middle East Cloud: Built for Data Residency Compliance appeared first on Security Boulevard.
What happened A ransomware attack on Sandhills Medical Foundation, a Federally Qualified Community Health Center in McBee, South Carolina, is now the subject of a class action investigation, nearly a year after the incident was first discovered. Sandhills Medical discovered the ransomware attack on May 8, 2025. A forensic investigation determined that an unauthorized third […]
The post Sandhills Medical Foundation Ransomware Breach Draws Class Action Investigation Nearly a Year Later appeared first on CISO Whisperer.
The post Sandhills Medical Foundation Ransomware Breach Draws Class Action Investigation Nearly a Year Later appeared first on Security Boulevard.
What happened CTM360 researchers have uncovered a large-scale fraud operation using Telegram’s Mini App feature to run cryptocurrency scams, impersonate major brands, and distribute Android malware. The platform behind the operation, dubbed FEMITBOT based on a string found in API responses, uses Telegram bots and embedded Mini Apps to create convincing app-like experiences within the […]
The post Telegram Mini Apps Abused for Crypto Scams and Android Malware Delivery appeared first on CISO Whisperer.
The post Telegram Mini Apps Abused for Crypto Scams and Android Malware Delivery appeared first on Security Boulevard.
What happened Frost Bank, San Antonio’s largest bank, is facing two proposed class-action lawsuits following a cyberattack attributed to the Everest ransomware group that allegedly exposed the sensitive personal data of an estimated 109,000 customers. The bank has not publicly confirmed the scope of the breach or reported it to the Texas Attorney General’s Office, […]
The post Frost Bank Hit With Class-Action Lawsuits Over Data Breach Affecting More Than 100,000 Customers appeared first on CISO Whisperer.
The post Frost Bank Hit With Class-Action Lawsuits Over Data Breach Affecting More Than 100,000 Customers appeared first on Security Boulevard.
What happened A cybersecurity incident in late April 2026 targeted Sistemi Informativi, an Italian company wholly owned by IBM Italy that provides IT infrastructure management for public agencies and key private sector organizations. IBM confirmed the breach through an official statement, acknowledging it had identified and contained a cybersecurity incident and activated incident response protocols […]
The post Salt Typhoon Suspected in Breach of IBM Italy Subsidiary Managing Public Infrastructure appeared first on CISO Whisperer.
The post Salt Typhoon Suspected in Breach of IBM Italy Subsidiary Managing Public Infrastructure appeared first on Security Boulevard.
What happened Cyberthint analysts have documented a structural shift in how cyberattacks are conducted, with threat actors now using artificial intelligence to discover and exploit zero-day vulnerabilities in minutes rather than months. The firm identified this transition in late 2024, noting that AI is operating not just as a research assistant but as an active […]
The post Threat Actors Use AI to Automate Zero-Day Discovery and Exploitation at Machine Speed appeared first on CISO Whisperer.
The post Threat Actors Use AI to Automate Zero-Day Discovery and Exploitation at Machine Speed appeared first on Security Boulevard.
What happened A faulty Microsoft Defender antimalware signature update released around April 30, 2026, caused widespread false positive alerts by incorrectly flagging two legitimate DigiCert root certificates as high-severity malware. The detection, labeled Trojan:Win32/Cerdigent.A!dha, identified registry entries belonging to DigiCert Assured ID Root CA and DigiCert Trusted Root G4 as threats and automatically quarantined them […]
The post Microsoft Defender Mistakenly Flags DigiCert Root Certificates as Malware appeared first on CISO Whisperer.
The post Microsoft Defender Mistakenly Flags DigiCert Root Certificates as Malware appeared first on Security Boulevard.
PhantomRaven Wave 5: New Undocumented NPM Supply Chain Campaign Targets DeFi, Cloud, and AI Developers
The post PhantomRaven Wave 5: New Undocumented NPM Supply Chain Campaign Targets DeFi, Cloud, and AI Developers appeared first on Security Boulevard.
Small business owners should be sure to fix these three non-technical risks that require little cybersecurity expertise.
The post 3 easy-to-miss cybersecurity risks for small businesses appeared first on Security Boulevard.
The cyber threat outlooks from CIOs and CISOs at the NASCIO Midyear Conference in Philadelphia ranged from the good to the bad to the ugly — with AI front and center.
The post A Tale of Two States: The 2026 Cybersecurity Paradox appeared first on Security Boulevard.
Security leadership is often associated with emerging threats and advanced technologies, but much of the role comes down to disciplined execution, thoughtful decision-making, and balancing protection with business continuity. In CISO Diaries, we speak with leading CISOs around the world to understand what the role actually looks like beyond frameworks and incident headlines, how security […]
The post CISO Diaries: Victor-Andrei Nicolae on Practical Security, Patience, and AI-Driven Defense appeared first on CISO Whisperer.
The post CISO Diaries: Victor-Andrei Nicolae on Practical Security, Patience, and AI-Driven Defense appeared first on Security Boulevard.
What happened A supply chain attack campaign attributed to TeamPCP, dubbed Mini Shai-Hulud, has compromised packages across the PyPI, NPM, and PHP ecosystems over a two-day period, affecting over 1,800 developer repositories containing stolen credentials. The campaign was first identified on April 29 when malicious versions of four SAP NPM packages were caught delivering information-stealing […]
The post 1,800 Developers Hit in Mini Shai-Hulud Supply Chain Attack Across PyPI, NPM, and PHP appeared first on CISO Whisperer.
The post 1,800 Developers Hit in Mini Shai-Hulud Supply Chain Attack Across PyPI, NPM, and PHP appeared first on Security Boulevard.
Entrar