Russian EMERCOM Mobile App Compromised to Distribute False Alerts

Chinese-linked WARP PANDA Uses VMware ESXi Zero-Day CVE-2026-41709 to Evade Logging

CrowdStrike disclosed on 28 October 2026 that the China-associated group WARP PANDA exploited CVE-2026-41709, a zero-day logging flaw in VMware ESXi, during espionage operations against U.S. legal sector organizations. The vulnerability, rated 2.7 on CVSS 3.1, allows a malicious administrator to perform certain operations without generating log entries, thereby hindering incident reconstruction by defenders. Broadcom, which maintains the product, credited researcher Ian Barton for the report and released fixes in specific ESXi builds rather than simple version numbers. The flaw was added the same day to CISA’s catalog of exploited vulnerabilities, with a remediation deadline of 11 November 2026. CrowdStrike observed the activity spanning September 2025 to August 2026 and linked it to deployment of BRICKSTORM and SharpStorm malware inside victim vCenter environments, along with theft of cloud session tokens and unauthorized multi-factor authentication records. No alternative mitigations have been published, underscoring the risk of deprioritizing low-severity issues that primarily affect audit integrity.

North Korean WaterPlum Group Infects 30,000 Computers Across 100 Countries via Fake Coding Tests

The North Korean-linked group WaterPlum, also known as Contagious Interview, has infected at least 30,000 computers in more than 100 countries between December 2025 and July 2026. According to the Internet Crime Complaint Center (IC3), the operation moved at least $10.7 million in cryptocurrency to North Korea and compromised more than 7,000 wallets. Attackers pose as recruiters on social media and freelance platforms, luring software developers with nonexistent job offers that require downloading malicious files disguised as coding tests. The malware arsenal includes BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle, with the latter hiding inside blockchain-themed projects and abusing Visual Studio Code configurations. Developers are specifically targeted because they often store production keys, wallets, and credentials on the same machines used for testing third-party code. Japanese authorities have dismantled laptop farms connected to the scheme that helped maintain the attackers' operational cover.

US Offers $10 Million Reward for Iranian IRGC Cyber Commander Amir Yaryab

The United States has announced a reward of up to $10 million through the Rewards for Justice program for information leading to the identification or location of Amir Yaryab, leader of the Cyber Operations Command within Iran's Islamic Revolutionary Guard Corps (IRGC). Yaryab oversees units responsible for cyber operations targeting critical infrastructure across the United States, Europe, and the Middle East. Groups under his direction, including Shahid Hemmat and Shahid Shushtari, have conducted campaigns against defense, energy, telecommunications, finance, transportation, hotels, and airlines sectors. He is also linked to structures associated with the CyberAv3ngers group, known for attacks on industrial control systems and operational technology equipment. Previous operations attributed to IRGC-linked actors compromised internet-exposed Unitronics programmable logic controllers, affecting at least 75 devices between November 2023 and January 2024, including 34 in the US water and wastewater sector. The reward specifically targets individuals acting under foreign government direction in malicious cyber activities against US critical infrastructure.