Chinese Actors Use Automated Tools to Steal Data from Global Organizations

Defenders should prioritize mitigating risks associated with the Shai-Hulud worm affecting the Tensorlake npm SDK. Additionally, attention is required for Cisco NX-OS vulnerabilities addressed by recent hardening releases. Global organizations must also defend against data exfiltration attempts utilizing automated scanning and XSS.

Threat level high

Today in 60 seconds

Critical·KEV·Ransomware·EPSS 100% Chinese Actors Use Automated Tools to Steal Data from Global Organizations Chinese government-linked actors use automated scanning and XSS to steal data from global organizations. Do this today Implement multifactor authentication for all services and sanitize web application inputs.
High·CVSS 10.0·4 outlets Cisco Issues Hardening Releases for Multiple NX-OS Vulnerabilities Cisco released hardening software updates for multiple internally discovered vulnerabilities in NX-OS and related platforms. Do this today Upgrade Cisco NX-OS to the fixed release specified in the advisory for the affected product line.
High·3 outlets Shai-Hulud Worm Compromises Tensorlake npm SDK A malicious version of the Tensorlake npm SDK was used to distribute the credential-stealing Shai-Hulud worm. Do this today Verify all installations of the Tensorlake SDK are using version 0.5.145 or later.

Actively Exploited 4

Chinese Actors Use Automated Tools to Steal Data from Global Organizations Critical·KEV·Ransomware·EPSS 100%·CISANewRead Chinese government-linked actors use automated scanning and XSS to steal data from global organizations.
Chinese government-linked cyber threat actors are combining automated scanning tools, botnets, and hands-on exploitation. They target organizations by exploiting vulnerabilities via cross-site scripting and password spraying on Microsoft Exchange servers.

Why it matters. These actors are exfiltrating emails and credentials from targeted organizations, including US critical infrastructure sectors.

Do this today Implement multifactor authentication for all services and sanitize web application inputs.

Affected
Microsoft Exchange servers, VPN software

CVE
CVE-2014-6278, CVE-2015-3306, CVE-2015-5477, +5 more

Read on CISA Post on X LinkedIn
```
{"coverage":0.387,"evidence":1,"freshness":0.612,"importance":1,"novelty":1,"quality":0.95,"total":0.864}
```
Atlassian Data Center: CVE-2026-21589 Unauthenticated File Read Critical·Exploited·PoC public·6 outlets·SecurityWeekNewRead Threat actors are exploiting a critical vulnerability in Atlassian Data Center products allowing unauthenticated file reads.
Threat actors have begun targeting CVE-2026-21589, a critical vulnerability in Atlassian's self-hosted Data Center products. This flaw allows unauthenticated attackers to read specific files from the web application root. Exploitation can lead to reading configuration files containing plaintext credentials when Jira is integrated with Crowd.

Why it matters. Successful exploitation can grant access to sensitive configuration files, potentially leading to unauthorized user creation and administrative group membership changes.

Do this today Update to the fixed versions or apply provided firewall/rewrite rules.

Affected
Atlassian Data Center products

CVE
CVE-2026-21589

Read on SecurityWeek Post on X LinkedIn

Also covered by The Register, Horizon3.ai
```
{"coverage":1,"evidence":0.9,"freshness":0.13,"importance":0.75,"novelty":1,"quality":0.9,"total":0.803}
```
Zammad CVE-2026-102489: Session Leak Enables RCE Critical·KEV·PoC public·Horizon3.aiNewRead A WebSocket error in Zammad leaks session cookies, enabling unauthenticated RCE via session hijacking.
CVE-2026-102489 allows an attacker to trigger an error via a WebSocket request to leak session cookies for active users. With a leaked admin session cookie, an attacker can achieve remote code execution by writing a malicious template and triggering a password reset.

Why it matters. Exploitation allows an attacker to execute code with the privileges of the zammad OS user. The vulnerability was reportedly used in a recent security incident involving the Dutch Institute for Vulnerability Disclosure.

Do this today Patch Zammad immediately.

Affected
Zammad

CVE
CVE-2026-102489

Read on Horizon3.ai Post on X LinkedIn

Also covered by GBHackers
```
{"coverage":0.613,"evidence":1,"freshness":0.297,"importance":0.75,"novelty":1,"quality":0.85,"total":0.782}
```
FBI Warns of Ongoing FortiBleed Attacks Targeting FortiGate VPN Admins Critical·Exploited·BleepingComputerNewRead The FBI warns that FortiBleed attacks continue, exploiting leaked credentials to lock out administrators on FortiGate devices.
The FBI reports ongoing FortiBleed attacks targeting exposed Fortinet FortiGate firewalls and SSL VPN gateways. Threat actors use leaked or reused credentials, credential stuffing, and password spraying to gain access. Attackers can then delete existing admin accounts or change passwords to deny victim access.

Why it matters. Successful exploitation can serve as an initial entry point for ransomware affiliates. Remediation requires more than patching, including restricting external access and enforcing MFA.

Do this today Enforce MFA and restrict external access to FortiGate SSL VPN portals.

Affected
Fortinet FortiGate firewalls, SSL VPN gateways

Read on BleepingComputer Post on X LinkedIn

Also covered by The Hacker News
```
{"coverage":0.613,"evidence":0.9,"freshness":0.314,"importance":0.75,"novelty":1,"quality":0.95,"total":0.768}
```

Vulnerabilities & Patches 4

Cisco Issues Hardening Releases for Multiple NX-OS Vulnerabilities High·CVSS 10.0·4 outlets·Cisco PSIRTNewRead Cisco released hardening software updates for multiple internally discovered vulnerabilities in NX-OS and related platforms.
Cisco conducted an internal security review resulting in hardening releases for multiple vulnerabilities across NX-OS, Cisco License On-Prem, and APIC. These vulnerabilities were discovered during internal testing and are not known to be actively exploited.

Why it matters. The vulnerabilities affect core networking and management infrastructure components, potentially allowing unauthorized code execution if unpatched.

Do this today Upgrade Cisco NX-OS to the fixed release specified in the advisory for the affected product line.

Affected
MDS 9000 Series, Nexus 3000 Series, Nexus 7000 Series, Nexus 9000 Series, UCS 6300/6400/6500/6600, UCS X-Series Direct Fabric Interconnect 9108 100G

CVE
CVE-2026-76453, CVE-2026-76455, CVE-2026-76456, +22 more

Read on Cisco PSIRT Post on X LinkedIn
```
{"coverage":0.898,"evidence":0.7,"freshness":0.351,"importance":0.75,"novelty":1,"quality":0.95,"total":0.765}
```
LMCache Flaw Allows Unauthenticated Remote Code Execution Medium·PoC public·The Hacker NewsNewRead LMCache has a critical vulnerability allowing unauthenticated remote code execution via unsafe Python pickle deserialization.
A critical flaw in LMCache, an open-source software for LLM acceleration, permits unauthenticated code execution. The vulnerability resides in the multiprocess mode, specifically exploiting unsafe Python pickle deserialization.

Why it matters. Exploitation allows an attacker to run arbitrary code on the cache server without authentication. A public proof-of-concept exploit is available.

Do this today Review network segmentation for LMCache deployments to restrict access to the ZeroMQ messaging library.

Affected
LMCache multi-process mode

CVE
CVE-2026-105192

Read on The Hacker News Post on X LinkedIn

Also covered by GBHackers
```
{"coverage":0.613,"evidence":0.5,"freshness":0.347,"importance":0.75,"novelty":1,"quality":0.8,"total":0.657}
```
Cisco NX-OS NX-API Remote Code Execution Vulnerability Medium·Cisco PSIRTNewRead Unauthenticated remote code execution with root privileges is possible via the NX-API feature in Cisco NX-OS.
Insufficient input validation in the NX-API feature of Cisco NX-OS Software allows an unauthenticated, remote attacker to execute arbitrary code with root privileges. Exploitation can also cause process crashes leading to a denial of service.

Why it matters. Successful exploitation grants root-level code execution on affected network infrastructure devices. No workarounds are available; patching is required for remediation.

Do this today Upgrade to a fixed software release as noted in the advisory.

Affected
Nexus 3000 Series Switches, Nexus 9000 Series Switches, UCS 6300 Series Fabric Interconnects

Read on Cisco PSIRT Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.65,"importance":0.75,"novelty":1,"quality":0.95,"total":0.543}
```
Nvidia DCGM Exporter Vulnerability Allows Resource Exhaustion Medium·The RegisterNewRead Unauthenticated attackers can crash GPU monitoring services via exposed DCGM Exporter endpoints.
A high-severity vulnerability (CVE-2026-47483) in the Nvidia DCGM Exporter allows unauthenticated attackers to exhaust server resources. This can crash GPU monitoring and potentially disrupt AI workloads. Additionally, exposed Node Exporter instances reveal detailed server configuration data.

Why it matters. Exposure of these monitoring endpoints provides attackers with reconnaissance data and the ability to cause service disruption without authentication.

Do this today Upgrade Nvidia DCGM Exporter to version 4.8.2 or later.

Affected
Nvidia DCGM Exporter, Prometheus Node Exporter

CVE
CVE-2026-47483

Read on The Register Post on X LinkedIn

Also covered by r/netsec
```
{"coverage":0.387,"evidence":0,"freshness":0.729,"importance":0.75,"novelty":1,"quality":0.85,"total":0.541}
```

Worth watching

Malware analysis Following The Payload John Hammond · 8 Oct
Walkthrough HackTheBox - Reactor IppSec · 3 Oct
Tool demo 🍍📟 Theme Hacking Techniques - WiFi Pineapple Pager Hak5 · 2 Oct
Conference talk DCSG1 - Where's our Hats: The founding of N0H4Ts - Pengfei Yu, Zara Teo DEFCONConference · 30 Sep

Malware & Ransomware 2

Shai-Hulud Worm Compromises Tensorlake npm SDK High·3 outlets·The RegisterNewRead A malicious version of the Tensorlake npm SDK was used to distribute the credential-stealing Shai-Hulud worm.
A malicious version, 0.5.144, of the tensorlake npm package was published containing the Shai-Hulud worm. This worm harvests credentials, exfiltrates secrets, and establishes persistence. The package was removed from npm and Tensorlake updated the version to 0.5.145.

Why it matters. The malicious SDK's installation script can execute on developer machines or build servers, potentially compromising the host before any AI code runs. The worm targets crypto wallets, cloud credentials, and GitHub Actions secrets.

Do this today Verify all installations of the Tensorlake SDK are using version 0.5.145 or later.

Affected
Tensorlake SDK

Read on The Register Post on X LinkedIn

Also covered by The Hacker News, GBHackers
```
{"coverage":0.774,"evidence":0,"freshness":0.515,"importance":1,"novelty":1,"quality":0.85,"total":0.653}
```
16 Malicious Firefox Extensions Steal Crypto Wallet Secrets High·The Hacker NewsNewRead Sixteen malicious Firefox extensions impersonate crypto wallets to steal recovery phrases and private keys.
Researchers found 16 malicious Firefox extensions designed to steal cryptocurrency wallet recovery phrases and private keys. These extensions disguise themselves as legitimate wallet portals or utilities. The stolen secrets are transmitted to attacker-controlled Cloudflare Workers.

Why it matters. Users installing these extensions risk exposing critical wallet credentials, leading to direct theft of cryptocurrency assets.

Do this today Review installed Firefox extensions for unauthorized wallet or utility functions.

Affected
Mozilla Firefox extensions

Read on The Hacker News Post on X LinkedIn

Also covered by GBHackers
```
{"coverage":0.613,"evidence":0,"freshness":0.575,"importance":0.75,"novelty":1,"quality":0.8,"total":0.555}
```

Threat Actors & Campaigns 4

Hackers Hijack Google Domains via ccTLD Registry Compromise High·5 outlets·BleepingComputerNewRead Compromised DNS operators allowed attackers to obtain unauthorized certificates for Google and ccTLDs.
Attackers compromised third-party DNS operators to modify authoritative DNS records. This allowed them to obtain unauthorized HTTPS certificates for several Google domains and ccTLDs in Ghana, American Samoa, and Sierra Leone. The certificates enabled impersonation of legitimate brands.

Why it matters. Impersonation using valid TLS certificates bypasses standard browser warnings, posing a risk of credential theft or content delivery from compromised domains.

Do this today Monitor CT logs across your entire domain portfolio, including parked domains.

Affected
.GH, .SL, and .AS ccTLDs

Read on BleepingComputer Post on X LinkedIn

Also covered by Ars Technica, The Register
```
{"coverage":1,"evidence":0,"freshness":0.198,"importance":0.75,"novelty":1,"quality":0.95,"total":0.59}
```
FBI Seizes Domains Used by Chinese Hackers Targeting Critical Infrastructure High·BleepingComputerNewRead FBI seized domains and tools used by Chinese state-sponsored actors to scan and breach critical infrastructure.
The FBI seized seven domains used by Chinese state-sponsored hackers, known as Flax Typhoon, to operate MicroScan and FishHub. These tools were used to scan for vulnerabilities and conduct spear-phishing attacks against critical infrastructure.

Why it matters. The activity demonstrates targeted, widespread efforts to compromise U.S. and foreign critical infrastructure networks. Reviewing the provided indicators is necessary to identify potential past or current intrusions.

Do this today Review indicators of compromise, patch vulnerable systems, disable unnecessary exposed services, and enforce multifactor authentication.

Read on BleepingComputer Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.802,"importance":0.75,"novelty":1,"quality":0.95,"total":0.558}
```
Coalition Seizes Tools Used by Integrity Tech in Flax Typhoon Campaign High·The RecordNewRead International agencies seized tools from Integrity Tech, linked to PRC cyber operations targeting critical infrastructure.
A coalition of nations took down digital tools and infrastructure belonging to Beijing-based Integrity Tech. These tools were used by threat actors in the Flax Typhoon campaign to conduct vulnerability scanning and intrusions. Seized tools included 'Microscan' for reconnaissance and 'FishHub' for phishing attacks.

Why it matters. The activity demonstrates state-backed efforts to gain long-term, secret access to critical infrastructure, including operational technology systems. Adversaries are targeting less monitored edge devices for persistent access.

Read on The Record Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.75,"importance":0.75,"novelty":1,"quality":0.95,"total":0.553}
```
FBI Warns of Chinese Actors Using Botnets for Data Theft High·GBHackersNewRead Chinese-linked actors use automated tools and botnets to steal sensitive data from various sectors globally.
The FBI and international agencies issued an advisory detailing operations by groups linked to the Chinese government. These actors utilize automated scanning tools, large-scale botnets, and hands-on exploitation techniques. They target critical infrastructure, government, and healthcare systems.

Why it matters. Defenders must assume the use of advanced, automated techniques for reconnaissance and data exfiltration. Focus on detecting lateral movement and unusual outbound communications.

Do this today Implement multifactor authentication for webmail, VPNs, and critical accounts.

Read on GBHackers Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.981,"importance":0.75,"novelty":1,"quality":0.65,"total":0.546}
```

Breaches & Incidents 1

Unauthorized Access Exposed 8.8M Records from Denmark's ID Register High·The RegisterNewRead Abuse of a private firm's access credentials exposed personal data for 8.8 million individuals from Denmark's ID register.
An unauthorized party exploited a private company's legitimate access to the Central Population Register. This activity occurred over a ten-day period in September, resulting in the exposure of personal data for approximately 8.8 million people. The affected company's access has been cut off, and authorities are investigating the breach.

Why it matters. The exposed CPR numbers could enable fraud and identity-related abuse. Organizations are advised not to rely on a CPR number alone for identity verification.

Affected
Denmark's Central Population Register (CPR)

Read on The Register Post on X LinkedIn

Also covered by CSO Online
```
{"coverage":0.613,"evidence":0,"freshness":0.16,"importance":1,"novelty":1,"quality":0.85,"total":0.593}
```

CVE spotlight

CVE	Affects	CVSS	EPSS	Status
CVE-2015-3306	ProFTPDProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the sit…	—	97%	Exploited (KEV)CISA due 11 Oct
CVE-2016-3081	Apache StrutsApache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when …	—	93%	Exploited (KEV)CISA due 11 Oct
CVE-2015-5477	ISC BINDISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.	—	91%	Exploited (KEV)CISA due 11 Oct
CVE-2021-3199	ONLYOFFICE DocsONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and…	—	8%	Exploited (KEV)CISA due 11 Oct
CVE-2023-22894	StrapiStrapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to disc…	—	2%	Exploited (KEV)CISA due 11 Oct
CVE-2026-102489	Zammad GmbH ZammadZammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability c…	—	1%	Exploited (KEV)CISA due 5 Oct (passed)

Quiz

Today's question

According to the report, what specific methods are Chinese cyber threat actors using to target global organizations?

On the radar tomorrow

KEV deadline Sun 11 OctCVE-2015-3306 · ProFTPD
KEV deadline Sun 11 OctCVE-2015-5477 · ISC BIND
Patch Tuesday in 4 daysTuesday 13 October
CTF starts Fri 18:00 UTCFortID CTF 2026
WatchingAnthropic rolls out program for ‘long-term commitment’ to secure critical infrastructure, open source software
WatchingRansomware recovery CEO charged over secret ransom payments

Also worth your time

Exploits

Teltonika_RutOS 00.07.06.21 - command injectionRemote
TigerGraph_Community_Edition 4.2.4 - arbitrary file writeWebApps
WordPress 7.0.2 - Path TravesalWebApps
Food-Ordering 1.0 - LFIWebApps
Ecava_ntegraXor IGX_16.0.701.10 - RCERemote

Community

Podcasts

180: ContiDarknet Diaries · 59:17
Soap Box: HD Moore talks OT security, frontier fearmongering and moreRisky Business · 34:01
SN 1099: An Alien Mind - From RSA Weakness to Agentic AttacksSecurity Now · 3:03:15
SANS Stormcast Thursday, October 8th, 2026: Atlassian Vulnerabilities; ccTLD Compormise; Outlook blocking .msixSANS Internet Storm Center · 6:58

That's today's brief.

The next brief lands at 06:30 IST.

Friday, 9 October 2026