ThreatsDay: 59 Linux Kernel Bugs, Falcon Spyware, GSocket Backdoors + 17 More Stories

ThreatsDay Linux Kernel disclosed that a credential was leaked, exposing a trust relationship that could have been abused.

And a familiar account doesn't always mean a familiar person is using it.

Yet a surprising amount of this week's trouble starts right there.

AI is helping them build attacks faster, while also giving them new systems to target.

Criminal servers have been seized, and a few defenses are getting stronger.

The attackers have also been observed creating six meme coins on the NEAR blockchain network (FUK, OLCCL, MEILI, MMLI, DABI, and SINU) to launder a slice of the ill-gotten funds, passing through about $430,000 of the stolen cryptocurrency.

Anyone connected to ThreatsDay Linux Kernel through the compromised trust relationship is potentially affected, not just ThreatsDay Linux Kernel itself.

Attackers are using fake websites, stolen access, and trusted tools to get into places they shouldn't be.

Microsoft said it has observed multiple incidents in which threat actors deployed GSocket, an open-source remote access tool, on internet-facing Linux servers to maintain access after the original vulnerabilities were addressed, turning a single web application compromise into persistent access.

There's no patch for a leaked credential the way there is for a code flaw; the only fix is making sure it's actually dead, not just flagged as risky.

And researchers keep finding small coding mistakes that can cause much bigger problems.

Europol, along with global partners, has disrupted the criminal infrastructure behind GootLoader, CastleRAT, and StealC malware, seizing 235 servers and 257 domains as part of an ongoing effort called Operation Endgame.

The trust mechanism involved here is an OAuth or access token, which is what let access move between otherwise unrelated systems.

Since 2018, GootLoader has infected at least 25,000 computers globally, and has been used in ransomware attacks of at least 44 U.S. based victims, leading to about $28.8 million in losses.

As part of the operation, authorities have identified over 6 million victim credentials.

ThreatsDay Linux Kernel says the credential has been revoked, and no exploitation has been confirmed so far.

Some intruders are staying hidden even after security holes are fixed.

Other tactics used to make funds tracing more difficult include moving between blockchains through bridges and cross-chain swap services, swapping between assets on DEXs, hopping through lending vaults and liquid-staking services, and mixing bitcoin through coinjoins, and ETH and SOL through the Privacy Cash privacy pool.

If you have any integration or dependency involving ThreatsDay Linux Kernel, rotate any credentials shared with it as a precaution, even without confirmation you were directly affected.

Your own credential inventory is worth auditing for keys or tokens with broader access than they actually need -- the same blast-radius problem applies to anything your own organization leaks.

Still, plenty of things are going wrong in ways that shouldn't be this easy.