Feed aggregator

Article URL: https://bitbanksoftware.blogspot.com/2026/11/how-to-read-codes-from-many-ir-remote.html

Comments URL: https://news.ycombinator.com/item?id=50457979

Points: 1

# Comments: 0

Article URL: https://www.jewishideas.org/article/going-out-limb-joha

Comments URL: https://news.ycombinator.com/item?id=50457978

Points: 1

# Comments: 0

Article URL: https://mail.openjdk.org/archives/list/amber-spec-observers@openjdk.org/thread/UYEK3PGOHN6R56AHJTSLPGAY363K666S/

Comments URL: https://news.ycombinator.com/item?id=50457968

Points: 1

# Comments: 0

Article URL: https://github.com/Baeta78/token-economy

Comments URL: https://news.ycombinator.com/item?id=50457964

Points: 1

# Comments: 0

Article URL: https://www.youtube.com/watch?v=-k-Dnw0F3kc

Comments URL: https://news.ycombinator.com/item?id=50457960

Points: 1

# Comments: 0

Article URL: https://www.youtube.com/watch?v=lYSjLv-usuc

Comments URL: https://news.ycombinator.com/item?id=50457955

Points: 1

# Comments: 0

Recently, I've been reading a bunch of books trying to disprove my own belief that AI trading bots won't eventually take away all the edge in the market and leave no opportunities behind. I've always disagreed with the Efficient Market Hypothesis, much like Edward Thorp.

In one of the books I read,(The Migration of Scarcity)

A weather forecast does not change the weather, Edrin. A market forecast is part of the weather.

A forecast in such a market does not describe a state that exists independently of it. It selects among states, each of which would make it true. Forecasting becomes coordination.

I guess if I had to put the thing that made me disagree with the theory into words, this would be it.

Comments URL: https://news.ycombinator.com/item?id=50457952

Points: 1

# Comments: 0

Article URL: https://singularityhub.com/2026/11/11/ai-models-can-tell-when-researchers-plant-concepts-in-their-neural-networks-is-it-self-reflection/

Comments URL: https://news.ycombinator.com/item?id=50457949

Points: 1

# Comments: 0

Article URL: https://github.com/getmoto/moto

Comments URL: https://news.ycombinator.com/item?id=50457947

Points: 2

# Comments: 0

In this article

1. When one RCE stops being just one RCE
2. Observed attack chains
3. How threat actors deploy and operate GSocket
4. How GSocket reconnects without a fixed C2 address
5. Mitigation and protection guidance
6. References
7. Learn More

Microsoft observed multiple incidents in which threat actors deployed GSocket, an open source remote access tool, on compromised Linux servers. Threat actors used Gsocket to maintain access even after the vulnerabilities used for initial compromise were remediated. This turned a single web application compromise into persistent access that outlasted the remediation of the original vulnerabilities. Defenders investigating affected hosts should look for evidence of GSocket deployment, persistence, privilege escalation, and outbound connections, rather than treating application patching alone as complete remediation.

Microsoft Defender for Endpoint telemetry shows this activity growing over recent months and concentrated on web applications and hosting environments. GSocket relays traffic through a shared public network, so there is no threat actor-owned IP address or domain to block.

When one RCE stops being just one RCE

Exploiting a web application vulnerability gives a threat actor command execution in the context of the web server process. That access lasts only while the vulnerability remains unpatched and the service keeps running. Patching the application or restarting the service can remove it.

To keep access, threat actors typically add a persistence mechanism, and each common option has drawbacks. SSH keys added to authorized_keys are easy for administrators to find during an audit. Reverse shells depend on threat actor-controlled servers that defenders can block or sinkhole. Custom implants require ongoing development and maintenance. The same trade-offs apply when initial access comes through remote access services or cloud shell sessions.

GSocket addresses these drawbacks, which helps explain why multiple unrelated threat actors have adopted it.

• Shared relay infrastructure. Traffic passes through the Global Socket Relay Network, a public relay service. The threat actor does not register or host any infrastructure, so there is no threat actor-owned IP address or domain to block. Organizations can still restrict access to the relay itself.
• Outbound-only connections. The compromised host and the operator both connect outbound to the relay, which bridges the two sessions. The host needs no inbound listener or public IP address, and network address translation does not prevent the connection. Inbound firewall rules do not see this traffic, although egress filtering and outbound monitoring can.
• Built-in evasion and persistence. The deployment script can rename the process, stage files in memory-backed directories, and install persistence that survives a reboot, without additional development by the threat actor.

The same relay model that supports legitimate remote administration also gives threat actors a way to maintain access without operating dedicated C2 infrastructure. Once GSocket runs on a compromised server, the server and the operator each connect outbound to the Global Socket Relay Network, which pairs the two sessions over an end-to-end encrypted channel.

Figure 1: After code execution on an internet-facing application, GSocket is deployed and both ends connect outward to the relay.

Because GSocket runs independently of the exploited application, patching the vulnerability does not remove the relay client or its persistence.

Microsoft Defender for Endpoint telemetry shows that this activity is not limited to a single compromise. From March through August 2026, devices with GSocket-related detections increased 356.2%, although the increase was not consistent month to month.

Figure 2: Growth in GSocket-related detections from March to August, measured against the March baseline.

Web applications and hosting accounted for 87.1% of attributable Microsoft Defender for Endpoint incidents in the analysed telemetry. Within that group, PHP web applications and cPanel hosting represented 63.9% of incidents and Apache represented 24.3% (Figure 3).

Figure 3: Distribution of GSocket-related incidents by application category. PHP web applications and Apache account for most incidents within the web applications and hosting group.

Education and research accounted for the largest share of affected organizations (30.7%), followed by technology and telecommunications (22.9%).

Figure 4: Distribution of affected organizations by sector.

These figures reflect the share of affected organizations and do not indicate that threat actors selected these sectors deliberately. Exposure is the more likely factor: academic institutions often run large, decentralized web estates maintained outside central IT, which are harder to inventory and patch.

Observed attack chains

The RCE-based intrusions in this analysis followed a similar sequence after initial access. Threat actors compromised an internet-facing application, profiled the host, transferred and concealed the relay tooling, and used the resulting channel for command and control. Some intrusions also included persistence and privilege escalation. Figure 5 combines these behaviours into a generalized attack chain. Not every stage occurred in every intrusion.

Figure 5: Generalized GSocket attack chain observed across RCE-based intrusions, mapped to MITRE ATT&CK. How threat actors deploy and operate GSocket

Initial access and deployment: Threat actors exploited internet-facing web applications and used curl to download and execute a remote script. The script profiled the host, selected a GSocket client matching the system architecture, staged it in writable or memory-backed paths such as /dev/shm, and established encrypted outbound command and control through the Global Socket Relay Network.

Figure 6: Encoded RCE command executed through a vulnerable PHP application.

Defense evasion and persistence: Threat actors disguised GSocket with kernel-thread-like process names, persisted through cron, systemd, shell profiles, watchdogs, and redundant copies, then removed staging files and other deployment indicators.

Figure 7: Kernel thread names used to disguise the GSocket process. Figure 8: Persistence entries created during GSocket deployment.

Privilege escalation: After gaining execution as the web-service account, in few observed incidents, threat actors attempted to exploit CVE-2026-43284, one of the recent Linux kernel vulnerabilities also known as Dirty Frag, to elevate privileges to root.

How GSocket reconnects without a fixed C2 address

GSocket identifies endpoints by a shared secret instead of an IP address or hostname. During installation, the deployment script typically generates a random secret and writes it to standard output. The threat actor can choose to read the secret from the console, redirect it to a temporary file and retrieve the file before is deleted, or have it delivered through a supported notification channel, such as Telegram (configured with GS_TG_TOKEN and GS_TG_CHATID), Discord, or a webhook. With this secret, the operator can reconnect later from any compatible GSocket client, without knowing the victim’s IP address, hostname, or network location.

A traditional reverse shell connects to a threat actor-controlled IP address written into the payload. GSocket instead derives its connection identifier and authentication material from the shared secret. The compromised host and the operator each connect outbound to the Global Socket Relay Network (GSRN), which matches them and brokers an end-to-end encrypted session. Neither endpoint needs a public IP address, an inbound listener, or a permissive inbound firewall rule.

As a result, blocking an IP address or domain is unlikely to cut off access. The connection relies on a shared relay service, outbound traffic that is commonly permitted, and a secret that does not need to be hardcoded in the payload. Anyone with the shared secret can reconnect through the relay without knowing the compromised host’s IP address or hostname.

Mitigation and protection guidance

For an affected Linux server, remediation should address both the initial compromise and the GSocket deployment.

1. Patch and harden internet-facing applications. Keep web applications, CMS platforms, plugins, and application servers current. Remove unused components and restrict file-upload and administrative paths.
   • Remediate the host as well as the vulnerability. Do not treat application patching as complete remediation. Investigate and remove the GSocket client, associated persistence, and staged files, then verify that outbound connections to the relay infrastructure have stopped
2. Patch and harden internet-facing applications. Keep web applications, CMS platforms, plugins, and application servers current. Remove unused components and restrict file-upload and administrative paths.
3. Constrain outbound traffic. Apply deny-by-default egress rules, allow only required destinations, and monitor connections to relay infrastructure.
4. Harden the host runtime. Mount temporary and memory-backed directories as non-executable where feasible, and alert on execution from hidden or world-writable paths.
5. Audit persistence surfaces. Review cron entries, systemd units with plausible service names, and shell startup files. Persistence is often layered across several mechanisms, so stopping the running process alone does not remove access.
6. Prioritize local privilege-escalation patching on internet-facing servers. In the analyzed activity, threat actors attempted to exploit CVE-2026-43284 to escalate from the web-service account to root. Separately, Microsoft FORGE Lab recently documented 59 Linux kernel bug reports, including eight vulnerabilities for which researchers demonstrated local root privilege-escalation exploits in controlled environments.
7. Enable Microsoft Defender for Endpoint on Linux. Keep real-time and cloud-delivered protection enabled, with behavior monitoring for anomalous child processes of web services and masqueraded process identities.

Microsoft Defender detections

Microsoft Defender for Endpoint provides visibility into activity associated with GSocket-related Linux intrusions, including suspicious shell execution, payload delivery, persistence, defense evasion, and remote communication. The alerts below were observed in the analyzed telemetry. An individual alert does not establish the initial access method or confirm that every stage of an intrusion succeeded.

TacticObserved activityExample alerts observed in analyzed telemetryInitial access, ExecutionShells and commands launched from web servers and application runtimes– Possible Web Server compromise activity
– Suspicious shell execution from PHP application
– Suspicious shell execution from web server application
– Suspicious shell execution from a scripting application runtime
– Suspicious remote command execution via Java Web application
– Suspicious remote command execution through Node web applicationExecutionGSocket and gs-netcat tooling launched on the host– ‘GsNetcat’ hacktool was prevented
– ‘GsNetcat’ hacktool was blocked and was active
– An active ‘GsNetcat’ hacktool was blocked
– An active ‘GsNetcat’ hacktool process was detected while executing and terminatedExecution, Payload deliveryShell commands and scripts used to retrieve, prepare, and launch payloads– Suspicious shell command execution
– Suspicious piped command launched
– Suspicious script launched
– Executable permission added to file or directory
– Suspicious file dropped and launched
– Suspicious file or content ingressPersistenceCron jobs and Linux services created for recurring execution and continued access– Suspicious cron job creation
– Suspicious Linux service createdDefense evasionHidden file execution, obfuscation, timestomping and removal of binaries or history traces.– Hidden file executed
– Suspicious file or information obfuscation detected
– Suspicious deletion of launched process binary
– Attempt to clear command history
– Suspicious timestamp modificationDiscoveryReconnaissance and collection of local system information– Reconnaissance activity
– Suspicious process collected data from local systemCommand and controlReverse-shell behavior and communication with GSocket domains– Possible reverse shell
– Suspicious communication with a remote target Microsoft Security Copilot

Security Copilot customers can use the standalone experience to create their own prompts or run prebuilt promptbooks to automate incident response or investigation tasks related to this threat:

• Incident investigation: correlate web-service process ancestry, relay client deployment, persistence changes, and outbound activity into a single timeline for the affected host.
• Threat actor profile: summarize observed GSocket tradecraft and related tooling seen in the environment.
• Device summary: assess the affected Linux host, its exposed application, and follow-on activity after initial execution.

Advanced hunting queries

Microsoft Defender XDR customers can use the following queries to surface GSocket-related activity. The queries use public Advanced Hunting tables populated by Microsoft Defender for Endpoint and cover deployment patterns observed in the analyzed intrusions.

Matches should be investigated in context with process ancestry, execution context, persistence changes, and related network activity.

GSocket process activity

Looks for GSocket tooling by name or command line.

DeviceProcessEvents | where Timestamp > ago(7d) | where FileName has_any ("gs-netcat", "gsocket") or ProcessCommandLine has_any ("gsocket.io", "gs-netcat", "gsnetcat") | project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName | order by Timestamp desc

Installer download activity

Looks for the download-and-execute pattern used to fetch GSocket.

DeviceProcessEvents | where Timestamp > ago(7d) | where ProcessCommandLine has "gsocket.io" or ProcessCommandLine has "gsgg.b-cdn.net" | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName | order by Timestamp desc

Connections to observed distribution hosts

These are tool distribution endpoints, not threat actor-owned command and control.

DeviceNetworkEvents | where Timestamp > ago(7d) | where RemoteUrl has_any ("gsocket.io", "gsgg.b-cdn.net") | project Timestamp, DeviceName, ActionType, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessAccountName | order by Timestamp desc

Known file hashes

Matches the SHA-256 hashes published in the indicators of compromise section.

let badSHA256 = dynamic([ "d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa", "f95c4d029e6784e3849b4d1e2e2ae1a661187236ef7c5d487c71158a290a03b5", "55d141bb2f62c527c3fea3413b8429fed7d52633d0b123b5e611bfa42165229f", "12450bafc7a4398040e1ad3a16dbf4dbc79b6a8f83ef306c4f0f73f59886f06c" ]); DeviceFileEvents | where Timestamp > ago(7d) | where SHA256 in~ (badSHA256) | project Timestamp, DeviceName, ActionType, FileName, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine | order by Timestamp desc

Staging and persistence artifacts

Useful when hashes are missing or a different build is used.

DeviceFileEvents | where Timestamp > ago(7d) | where FolderPath startswith "/dev/shm/.gs-" or FileName in~ ("systemd-remount-d", ".gsn_ora", "defunct", "defunct.service") | project Timestamp, DeviceName, ActionType, FileName, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine | order by Timestamp desc MITRE ATT&CK techniques observed

The following techniques were observed across the analyzed intrusions. Not every technique occurred in every intrusion, and some outcomes, such as persistence across reboot and successful relay session establishment, were not confirmed in every case.

Initial access

• T1190 Exploit Public-Facing Application | Internet-facing web applications were exploited to gain command execution in the web service context. Follow-on commands were launched as children of web server and application runtime processes, consistent with exploitation of an exposed application.

Execution

• T1059.004 Command and Scripting Interpreter: Unix Shell | Commands used curl to retrieve the GSocket installation script and executed it with bash.
  Additional bash invocations launched the renamed payload.

Execution, Persistence

• T1053.003 Scheduled Task/Job: Cron | Cron entries were created in the same detection window as GSocket deployment script activity, consistent with persistence.

Persistence

• T1543.002 Create or Modify System Process: Systemd Service | Activity launched a bash command invoking the renamed /usr/bin/defunct payload and referenced defunct.service and a multi-user.target.wants link.

Defense evasion

• T1036 Masquerading | A GsNetcat binary executed as systemd-remount-d, a system service-like filename. In a separate execution context, bash used exec -a to present /usr/bin/defunct with the argument-zero name [kaluad].
• T1564.001 Hide Artifacts: Hidden Files and Directories | gs-netcat payloads were staged under the dot-prefixed /dev/shm/.gs-0 directory. A GsNetcat-detected file was also observed at /tmp/.gsn_ora.
• T1222.002 File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification | chmod changed permissions on the renamed payload, including chmod 700 /usr/bin/defunct.
• T1070.006 Indicator Removal: Timestomp | touch commands applied older timestamps to /usr/bin/defunct and defunct.service. Timestamp copy operations targeted the system service-like payload name.
• T1070.004 Indicator Removal: File Deletion | rm removed the staged /dev/shm/.gs-0/gs-netcat file, and a separate rmdir command removed the staging directory.

Command and control

• T1105 Ingress Tool Transfer | curl downloaded gs-netcat payloads from GSocket distribution endpoints into /dev/shm/.gs-0.
• T1090.002 Proxy: External Proxy | GSocket clients were launched with options that establish outbound sessions to the Global Socket Relay Network, a shared public relay that brokers the connection between the compromised host and the operator. The relay is third-party infrastructure and is not owned by the threat actor.

Indicators of compromise

The indicators below were observed in the analyzed telemetry. They represent specific observations from these intrusions rather than a complete inventory of GSocket tooling or infrastructure.

IndicatorTypeDescriptiongsocket[.]ioDomainScript and installer retrievalcdn[.]gsocket[.]ioDomainClient binary distributiongsgg[.]b-cdn[.]netDomainClient binary distributionhxxps://gsocket[.]io/yURLScript retrieval in download-and-execute commandshxxps://gsocket[.]io/install.shURLInstaller retrieval target; successful retrieval not establishedhxxps://gsgg[.]b-cdn[.]net/bin/gs-netcat_mini-linux-x86_64URLDownload source associated with the x86-64 file belowhxxps://cdn[.]gsocket[.]io/bin/gs-netcat_mini-linux-aarch64URLDownload source associated with the AArch64 file below/dev/shm/.gs-0/gs-netcat_mini-linux-x86_64FilepathIdentified as HackTool:Linux/GsNetcat.A!MTB; hidden staging directoryd94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfaSHA256SHA-256 for /dev/shm/.gs-0/gs-netcat_mini-linux-x86_64; Identified as HackTool:Linux/GsNetcat.A!MTB; hidden staging directory/dev/shm/.gs-0/gs-netcat_mini-linux-aarch64FilepathIdentified as HackTool:Linux/GsNetcat.A!MTB; AArch64 payloadf95c4d029e6784e3849b4d1e2e2ae1a661187236ef7c5d487c71158a290a03b5SHA256SHA-256 for /dev/shm/.gs-0/gs-netcat_mini-linux-aarch64; Identified as HackTool:Linux/GsNetcat.A!MTB; AArch64 payload/tmp/systemd-remount-dFilepathIdentified as HackTool:Linux/GsNetcat!rfn at both paths; service-like filename/usr/bin/systemd-remount-dFilepathIdentified as HackTool:Linux/GsNetcat!rfn at both paths; service-like filename55d141bb2f62c527c3fea3413b8429fed7d52633d0b123b5e611bfa42165229fSHA256SHA-256 for /tmp/systemd-remount-d, /usr/bin/systemd-remount-d; Identified as HackTool:Linux/GsNetcat!rfn at both paths; service-like filename/tmp/.gsn_oraFilepathHidden file identified as HackTool:Linux/GsNetcat.A!MTB12450bafc7a4398040e1ad3a16dbf4dbc79b6a8f83ef306c4f0f73f59886f06cSHA256SHA-256 for /tmp/.gsn_ora; Hidden file identified as HackTool:Linux/GsNetcat.A!MTB References

1. The Hacker’s Choice. “GSocket.” GitHub. https://github.com/hackerschoice/gsocket
2. Microsoft Defender Security Blog: Cookie-controlled PHP webshells: A stealthy tradecraft in Linux hosting environments
   https://www.microsoft.com/en-us/security/blog/2026/04/02/cookie-controlled-php-webshells-tradecraft-linux-hosting-environments/
3. Elastic Security Labs: Betting on Bots
   https://www.elastic.co/security-labs/threat-command/betting-on-bots
4. SANS Internet Storm Center: GSocket Backdoor Delivered Through Bash Script
   https://isc.sans.edu/diary/32816
5. Sansec: Found defunct.dat on Your Site? You’ve Got a Problem https://sansec.io/research/gsocket

Learn More

For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog.

To get notified about new publications and to join discussions on social media, follow us on LinkedIn, X (formerly Twitter), and Bluesky.

To hear stories and insights from the Microsoft Threat Intelligence community about the ever-evolving threat landscape, listen to the Microsoft Threat Intelligence podcast.

Review our documentation to learn more about our real-time protection capabilities and see how to enable them within your organization.  

• Learn more about securing Copilot Studio agents with Microsoft Defender 
• Evaluate your AI readiness with our latest Zero Trust for AI workshop.
• Microsoft 365 Copilot AI security documentation
• How Microsoft discovers and mitigates evolving attacks against AI guardrails
• Prompt injection protection in Microsoft Defender for Office 365 – official documentation of the prompt injection protection in Microsoft Defender for Office 365.
• How Microsoft discovers and mitigates evolving attacks against AI guardrails | Microsoft Security Blog
• Manipulating AI memory for profit: The rise of AI Recommendation Poisoning | Microsoft Security Blog – a related example of an AI-era technique observed in email traffic
• Defending the inbox against prompt injection attacks | Microsoft Defender for Office 365 Blog – feature announcement introducing prompt injection protection in Microsoft Defender for Office 365.
• Learn how Microsoft is reimagining the SOC for the agentic era with ISOC in Microsoft Defender

The post The global socket: how threat actors are weaponizing GSocket for stealthy C2 appeared first on Microsoft Security Blog.

.kadence-column487333_a006eb-8f > .kt-inside-inner-col{padding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;}.kadence-column487333_a006eb-8f > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column487333_a006eb-8f > .kt-inside-inner-col{flex-direction:column;}.kadence-column487333_a006eb-8f > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column487333_a006eb-8f > .kt-inside-inner-col{background-color:rgba(255, 229, 229, 0.83);}.kadence-column487333_a006eb-8f > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column487333_a006eb-8f{position:relative;}@media all and (max-width: 1024px){.kadence-column487333_a006eb-8f > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}@media all and (max-width: 767px){.kadence-column487333_a006eb-8f > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}In this article

• Vanderbilt is bringing campus systems back online after a cyberattack
• BYOD claims it stole sensitive data, but Vanderbilt has not confirmed those claims
• Students and staff should follow official guidance and watch for suspicious messages
• Eligible students can get Malwarebytes for free through our Student Protection Program

Vanderbilt University is bringing systems back online after a cybersecurity incident claimed by the BYOD ransomware group.

Vanderbilt University is a private research university in Nashville, Tennessee. Founded in 1873, it now serves more than 13,800 undergraduate, graduate, and professional students across 12 schools and colleges, with programs ranging from engineering and education to law, medicine, and nursing. Its combination of teaching and research means its systems support not only everyday campus activities but also valuable academic research.

According to Bleeping Computer, BYOD claims it encrypted Vanderbilt’s databases and obtained more than one million Social Security numbers, along with names, email addresses, telephone numbers, student and employee records, and research data. It also claims control of a domain controller (a server that manages network access) and possession of backups.

How the attackers gained access remains undisclosed. Vanderbilt’s November 10 evening incident update states that the following systems and applications are available:

• Campus Wi-Fi
• Okta: Continue to use multifactor authentication (MFA)
• Vanderbilt email (Outlook): Vanderbilt email is available on Vanderbilt and personal devices
• CampusPrint
• Brightspace
• Zoom
• YES (Your Enrollment Services): All course registration is proceeding as scheduled

Other Vanderbilt systems and applications remained restricted. The university says fully restoring normal operations could take several weeks.

The university has not confirmed the number of affected people. BYOD claims it obtained more than one million Social Security numbers, but that is not a verified count of affected students or other people. The university says it is still determining what data, if any, was accessed.

How to stay safe

BYOD has threatened to release the data it claims to have stolen.

Students and staff should follow Vanderbilt’s latest IT guidance and be alert to messages asking them to restore access, disclose passwords, or approve unexpected login requests.

We have a guide for people who discover their data was included in a data breach: Involved in a data breach? Here’s what you need to know.

How Malwarebytes can help

Protection for personal devices can help reduce the risk of follow-on malware and scams, but it cannot undo the theft of information from a university’s systems.

Vanderbilt students can get free Premium Security for two years on up to three devices through our Malwarebytes Student Protection Program. This can help protect against malware and scams, including those that could follow any release of stolen data.

Malwarebytes Scam Guard is a free tool that can help you assess whether a message is a scam and suggest what to do next.

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

The investigatory powers commissioner talks to Computer Weekly about the challenges of overseeing the UK’s surveillance capabilities, candour and the impact of artificial intelligence

The cybercrime group Qilin has emerged as the world’s most active ransomware affiliate program, claiming at least 365 victim organizations in the past three months alone. But even top Russian hackers make operational security mistakes, and the administrator of Qilin has made a few key missteps over the last decade that all point to a 36-year-old man living in St. Petersburg, Russia.

Operating since September 2022, the Russia-based ransomware group Qilin is the currently the most industrious ransomware-as-a-service gang, according to a report (PDF) this month by the cybersecurity firm NCC Group (KrebsOnSecurity profiled the administrator of the second most active ransomware group — The Gentlemen — in June).

The Qilin ransomware administrator “Haise” advertising his affiliate program on the cybercrime forum RAMP. Image: Ke-la.com.

Qilin attracts affiliates to hack into companies and deploy ransomware by offering them at least 80 percent of any extortion amount paid by victims. Its members practice the “double extortion” model, stealing sensitive data before encrypting systems and threatening to publish the files online. Unlike most ransomware partnerships based out of Russia, Qilin is happy to team with English-speaking affiliates, and its leader has shared on Telegram that they’ve worked with ransomware groups like Scattered Spider and RansomHub.

The head of Qilin goes by the handle “Haise,” but they weren’t always known by this nickname. It is not uncommon for cybercriminals to change their handle periodically as an operational security (opsec) measure. Doing so is generally a smart move, because it helps to sever one’s ties to older identities that may not have been as careful on basic opsec, such as separating their real life identity from their cybercrime activities. But even those cautious criminals will sometimes have to reference their past monikers when applying for membership at a new forum. And forums eventually get hacked or seized. That is precisely what happened with Haise.

The cyber intelligence platform Intel 471 records that in June 2022, Haise applied for membership to RAMP, a closely-guarded Russian cybercrime forum that was created as a haven for ransomware affiliate programs. Intel 471 has indexed direct messages from RAMP (the forum was seized by the FBI in January 2026), and those missives show the RAMP administrator approved Haise’s application, referring to this user as Haise and by their Telegram username: Alexbigboss44.

Searching Intel 471 for Alexbigboss44 reveals this was the Telegram account name shared by the user Rjun on the Russian cybercrime forums Exploit and XSS two years earlier in 2020. The cyber intelligence platform Flashpoint finds Alexbigboss44 is a prolific participant in cybercriminal forums and Telegram channels, primarily focused on the illicit trade of traffic, logs, and corporate access [full disclosure: Flashpoint is an advertiser on this blog].

The Qilin administrator once used the nickname “Rjun” on several forums, and shared their Telegram handle as “Alexbigboss44.” Image: Ke-la.com.

Flashpoint says this user was engaged in high-volume acquisition of Facebook logs and Google Ads accounts to facilitate fraudulent advertising and gambling schemes, and that they functioned as a broker and operator — managing a network of traffickers and purchasing compromised data to fuel their operations.

The link between the Qilin administrator Haise and the much older Rjun and Alexbigboss44 accounts was shared privately earlier this month by IntelHawk, which describes itself as an AI-based platform capable of de-anonymizing threat actors based on historical usernames, stylometry and other signals.

IntelHawk founder and chief technology officer Leo Bogod said an analysis of these identities shows a progression from novice arbitrageur and credit card fraudster in 2018–2019 to a more experienced participant and organizer of complex cybercrime-related activities in 2020–2023, with increasing attention to malware, botnets, and payment infrastructure.

Where does this connection between these threat actor identities lead? Intel 471 finds that by the time Alexbigboss44 was applying for membership to RAMP, Rjun was already a longtime member of several other Russian crime forums, including Darkmarket, Verified, and Zloy. Intel 471 says Rjun signed up at all of these sites with the email address mail-30a@mail.ru.

The identity threat protection firm Spycloud found the email address mail-30a@mail.ru at one time used the password “Rjun132” [Spycloud is also an advertiser on this blog]. A search for that email at the breach tracking service Constella Intelligence shows that it appeared in records maintained by gosuslugi.ru, the official digital platform for state and municipal services in the Russian Federation.

Gosuslugi was breached in late 2025, reportedly exposing more than 20 million records with full names, birth dates, and mobile numbers. According to the leaked Gosuslugi records (via Constella), the address mail-30a@mail.ru belongs to 36-year-old Aleksey Mikhailovich Yakovtsev from St. Petersburg, Russia.

Flashpoint finds Haise has long used a Telegram account with the user ID 118329521, recording more than 5,000 messages from this user since 2018. Records from Russia’s education watchdog Rosobrnadzor reveal that Mr. Yakovtsev went to grade school in Murmansk and that he holds a master’s degree in computing and information systems.

A search on this Telegram ID in Constella shows it is linked to the Russian phone number +79602347275. Pivoting on that phone number in Constella reveals it is connected to the email addresses aleksey1990yakov@mail.ru and rjun123321@mail.ru. IntelHawk finds that +79602347275 belongs to Yakovtsev’s biological sister, and that Aleksey often used his sister’s email address when registering at different websites.

That phone number appears on several airline flight records at Russian travel agencies that have experienced a data breach in recent years, and those records show Aleksey Yakovtsev, born August 18, 1990, flew between St. Petersburg and Murmansk at least three times between 2013 and 2014.

More recent flight records show that while Mr. Yakovtsev has not traveled by plane outside of Russia, he does fly frequently between Saint Petersburg and Sochi. Often called the “Russian Riviera,” Sochi is Russia’s largest resort city, situated along the coast of the Black Sea and about 1,200 miles south of Saint Petersburg by plane.

Attempts to reach Mr. Yakovtsev via email and phone were unsuccessful.

Further reading: Gang Exposed, an anonymous Twitter/X account that has a history of successfully deanonymizing suspected ransomware actors, reached similar conclusions about Haise’s real-life identity, crediting IntelHawk’s platform for helping to connect the dots.

The Qilin ransomware admin Haise’s now-deleted Telegram account, advertising the affiliate program in July 2024. Image: justpaste.it/iosba.

One reader sounds a warning about all our devices that are connected to the internet, following a series of cyber-attacks on supermarket fridges

Well done to Alex Pearce for unplugging his fridge from the internet (Hot fridges, a fake nuclear alert and a $6bn heist: are we in the foothills of a hacking epidemic?, 8 November). My only question is why he didn’t do it a few weeks earlier, when the first round of hacked fridges were headline news for several days.

Your article notes that there are millions of devices connected to the internet. This sea of domestic and industrial controllers, known as the “internet of things” in marketing literature and the “internet of shit” by engineers, all have several things in common: their firmware is almost never upgraded, software security features are a fig leaf and the vast majority can run without an internet connection.

Continue reading...

Article URL: https://cadreen.com/training

Comments URL: https://news.ycombinator.com/item?id=50455917

Points: 1

# Comments: 0

Article URL: https://www.upi.com/Top_News/World-News/2026/11/11/North-Korea-revised-constitution-reunification-Naenara/2891794386175/

Comments URL: https://news.ycombinator.com/item?id=50455907

Points: 1

# Comments: 0

Article URL: https://www.reuters.com/legal/litigation/meta-tiktok-join-google-push-back-indonesias-planned-ai-copyright-law-revisions-2026-11-11/

Comments URL: https://news.ycombinator.com/item?id=50455906

Points: 1

# Comments: 0

Article URL: https://lwn.net/Articles/1106901/

Comments URL: https://news.ycombinator.com/item?id=50455903

Points: 1

# Comments: 0