ThreatsDay: 59 Linux Kernel Bugs, Falcon Spyware, GSocket Backdoors + 17 More Stories

Cybersecurity threats have intensified this week with North Korea laundering $6.43 billion from Binance, Microsoft discovering 59 Linux kernel bugs, and Europol seizing 235 servers in a major takedown. Attackers are increasingly using AI tools to automate attacks and bypass security measures, while researchers uncover critical vulnerabilities in widely used systems.

The North Korean threat actors linked to the record-breaking theft from Binance have employed a highly complex and automated method to launder the illicit proceeds. "Since the theft it has used more than 20,000 wallets on 16 blockchains, at least 36 services and at least 65,000 transactions," Dr. Tom Robinson, Elliptic's founder and chief scientist, said. "Around $3.0 billion remains in addresses linked to the theft, mostly as ETH and BTC."

Persistent Linux Vulnerabilities

Microsoft has reported a surge in GSocket deployments on internet-facing Linux servers, maintaining access after original vulnerabilities were addressed. Devices with GSocket-related detections increased 356.2% from March through August 2026, with most associated with PHP web applications, cPanel hosts, and Apache. The majority of targets are in education and research, followed by technology and communications, manufacturing, and government entities.

Separately, Microsoft's scan of Linux kernel subsystems unearthed 26,502 raw findings, forming the basis for 59 public upstream reports and 33 assigned CVEs. This includes working root privilege-escalation exploits for eight of those CVEs, such as CVE-2026-64563, which "enabled a stable local privilege escalation on Linux -- and affected Android with SELinux enforcing -- without requiring special kernel configurations or user namespaces."

Global Law Enforcement Action

Europol, along with global partners, has disrupted criminal infrastructure behind GootLoader, CastleRAT, and StealC malware, seizing 235 servers and 257 domains. "The operation targeted 'cybercrime-as-a-service' models, where these tools enabled further crimes like ransomware attacks and data theft," Europol said. Authorities have identified over 6 million victim credentials that were being sold for use in other cyber-attacks.

North Korean spokesperson Kim Yo Jong denied the country's role in the Binance attack, calling it an "absurd" effort to "damage the international image of the DPRK." Despite these denials, cybersecurity researchers continue to trace the complex money laundering operations that have moved billions through multiple blockchains and services.

Browser Espionage and AI Threats

A command and control framework called Falcon has been compromising victims' browsers by running malicious JavaScript on government web applications. "An actor leveraged Falcon to compromise visitors of webmail portals and government web applications by placing malicious JavaScript directly within these sites," Palo Alto Networks Unit 42 reported. The framework has targeted government entities in one Middle Eastern country and four Southeast Asian countries between March and May 2026.

Meanwhile, an exposed Silent Lynx server has uncovered cyber espionage operations targeting Central Asian governments and critical infrastructure. "The directory held the group's tooling alongside data from active intrusions into government and critical infrastructure organisations across the region, and the AI agent the operator relied on to run them," CloudSEK said. The operation appears to be focused on regional intelligence gathering rather than financial motives.

Proofpoint has disclosed details of BluePhishing, described as "the next evolution of OAuth consent abuse," enabling bad actors to leverage agent identities for initial access. "By exploiting gaps in visibility and governance around emerging AI agent adoption, attackers can abuse one-time consent links to create agent identities in target tenants, obtain access tokens, and operate with the privileges assigned to those agents."