ThreatsDay Roundup: North Korea Launders $6.43B Binance Haul, GSocket Backdoors Surge 356%, Europol Seizes 235 Servers
This week's cybersecurity landscape features a complex North Korean laundering operation moving billions across 16 blockchains and 65,000 transactions while creating meme coins on NEAR. Microsoft reported a 356% spike in GSocket detections on Linux servers, allowing persistent access after initial vulnerabilities are patched. Europol dismantled infrastructure tied to GootLoader, CastleRAT, and StealC, seizing 235 servers and identifying over 6 million stolen credentials. Palo Alto Networks detailed the Falcon browser spyware framework used against government entities in the Middle East and Southeast Asia to steal passwords, cookies, and emails. Microsoft also disclosed 59 Linux kernel bugs, including eight with working root exploits such as CVE-2026-64563. Additional campaigns include Silent Lynx AI-assisted espionage in Central Asia, the new Citrus ransomware group abusing contractor accounts, and BluePhishing attacks targeting Microsoft Entra agents.
The Hacker NewsNov 12, 2026Translated from English