You are reading a back issue. Go to the latest edition →

The situation

Bitget Reports $351.6M Hot Wallet Theft

Bitget reports a $351.6M theft; suspend withdrawals, audit principals, and hunt for post-exploit indicators.

Composed by SitRep’s AI editors from 5 sources — SecurityWeek, Microsoft Secure, Mandiant Threat Intelligence, The Hacker News, Kaspersky Official Blog

SecurityWeek reports a backend compromise at Bitget that led to a $351.6 million loss from hot and warm wallets spanning ETH, XRP, BNB, AVAX, USDT and USDC; withdrawals were suspended and some attacker-linked wallets frozen. Mandiant and SlowMist lead the investigation; private keys were not exposed. The incident underscores rapid post-exploit activity across centralized exchanges and the need for immediate containment, forensics, and interlinked asset monitoring.

Context

Cloud-principal abuse and backend compromises enable rapid theft across multi-chain wallets. Exposure extends to hot wallets, backend services, and transaction monitoring integrations; impact can cascade to custodial and exchange operations. Exposed patterns include attacker-operated wallet funds across multiple chains and ongoing investigations by major firms.

Analysis

SitRep’s judgement from the cited reporting, not reported fact. Written by AI.

Through-line: attackers leverage rapid automated cloud-principal abuse and backend compromises to turn limited access into large-scale loss; defenders must patch, constrain credentials, and hunt for post-exploit indicators immediately to blunt impact.

Microsoft Secure · Mandiant Threat Intelligence · SecurityWeek

Contrarian view

SitRep’s judgement from the cited reporting, not reported fact. Written by AI.

Crypto Theft Is Not Financial-sector Only

Crypto heists reveal technology and identity weaknesses across cloud services and backend ecosystems; the impact extends beyond finance to any organization relying on cloud-native infrastructure.

SecurityWeek · Microsoft Secure · Mandiant Threat Intelligence

Anyone with the link reads the whole edition, free. The link says nothing about you.

Email it

The move

5 things to do today

Rotate and audit all cloud service principals and managed identities; enforce least privilege and log service-principal activity for anomalous multi-resource operations.
Patch or mitigate CVE-2026-35273 in Oracle PeopleSoft; search logs for URL-encoded /PSEMHUB/ and web shell filenames x[.]jsp and u[.]jsp, and rotate affected credentials.
Apply patches for CVE-2026-5430 (WSo2) and CVE-2026-71362 (Adobe Commerce) immediately; prioritize KEV-listed assets for remediation before Sept 27.
Update Roundcube to 1.6.16 / 1.7.1+ and WordPress to 7.1.2+; hunt for exploitation indicators such as suspicious SQL queries against virtuser_query and unexpected PHP file uploads.
Isolate backend wallet or transaction-processing services; preserve logs and memory captures; coordinate with legal/forensic partners if custodial services operate.

On the wire

2critical
3elevated
0moderate
0low

P1Identity

STORM-3168 Uses Compromised Service Principals for Rapid Destructive Sequences

Microsoft Secure details Storm-3168 (JADEPUFFER) using compromised Azure service principals to enumerate and then execute a seven-minute destructive workflow across Storage, Key Vault, App Service, and SQL (300+ read ops, 100+ deletions). Immediately review service principal permissions, rotate affected principals, and deploy hunts for rapid multi-resource activity originating from service principals.

MICROSOFT SECURE · Storm-3168: Agentic Cloud Attacks From Compromised Principals

Copy link to “STORM-3168 Uses Compromised Service Principals for Rapid Destructive Sequences”

P0Breach

Bitget Backend Compromise Led to $351.6M Hot/warm Wallet Theft

SecurityWeek reports the compromise affected backend wallet infrastructure (private keys not exposed) and resulted in $351.6M stolen across ETH, XRP, BNB, AVAX, USDT and USDC; withdrawals were suspended and some attacker wallets frozen. For non-crypto orgs, treat this as a playbook: isolate compromised backend services, preserve logs for cross-chain transaction analysis, and coordinate external forensic partners.

SECURITYWEEK · North Korea Suspected in $351 Million Bitget Crypto Heist

Copy link to “Bitget Backend Compromise Led to $351.6M Hot/warm Wallet Theft”

P0Exploit

ShinyHunters Mass Exploitation of Oracle PeopleSoft CVE-2026-35273

Mandiant reports UNC6240 exploiting CVE-2026-35273, bypassing WAFs via URL-encoded /PSEMHUB/, deploying web shells x[.]jsp and u[.]jsp and using fileless post-exploit techniques. Patch PeopleSoft, disable EMHub where feasible, search web and WAF logs for URL-encoded /PSEMHUB/ and deployed shell filenames, and rotate credentials for affected accounts.

MANDIANT THREAT INTELLIGENCE · ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft

Copy link to “ShinyHunters Mass Exploitation of Oracle PeopleSoft CVE-2026-35273”

P1Patch Tuesday

CISA KEV Adds Critical WSO2 and Adobe Commerce Flaws with Active Exploitation

The Hacker News reports CVE-2026-5430 (WSo2 path traversal → RCE) and CVE-2026-71362 (Adobe Commerce improper authorization) were added to CISA KEV and exploited in the wild; agencies urged to patch by Sept 27. Prioritize all WSO2 API Manager/Control Plane/Universal Gateway instances and Adobe Commerce installs for immediate patching or compensating controls.

THE HACKER NEWS · WSO2 and Adobe Commerce Flaws Added to CISA KEV

Copy link to “CISA KEV Adds Critical WSO2 and Adobe Commerce Flaws with Active Exploitation”

P1Web

Active Exploitation: Roundcube CVE-2026-48842 and WordPress CVE-2026-87902

The Hacker News and Kaspersky report active exploitation of CVE-2026-48842 (Roundcube pre-auth SQLi; 523,000 instances exposed) and CVE-2026-87902 (WordPress core RCE; affected 4.7.0–7.1.1). Patch Roundcube to 1.6.16/1.7.1+ and WordPress to 7.1.2+, hunt for suspicious SQL queries against virtuser_query and unexpected PHP file uploads or execution.

Previously in SitRep Sep 24: Patch or Mitigate CVE-2026-48842 in Roundcube Immediately

THE HACKER NEWS · Roundcube Pre-Auth SQL Injection Flaw Actively Exploited

Copy link to “Active Exploitation: Roundcube CVE-2026-48842 and WordPress CVE-2026-87902”

Indicators named in this edition

Vulnerabilities named CVE-2026-35273 · CVE-2026-87902 · CVE-2026-5430 · CVE-2026-71362 · CVE-2026-48842

Kind	Value	Note
FILE PATH	x[.]jsp	Web shell filename observed in PeopleSoft exploitation
FILE PATH	u[.]jsp	Web shell filename observed in PeopleSoft exploitation

Known exploited

Added 25 Sept3 vulnerabilities added to CISA’s catalogue of flaws exploited in the wild

CVE	Vendor and product	Added	Due
CVE-2026-65660	Microsoft SharePoint	25 Sept	28 Sept
CVE-2026-67279	MikroTik RouterOS	25 Sept	28 Sept
CVE-2026-87902	WordPress Core	25 Sept	28 Sept

Source: CISA KEV catalogue, version 2026.10.21 (released 21 Oct 2026; read by SitRep 23 Oct 2026).

Due dates are CISA’s deadlines for US federal civilian agencies (BOD 22-01).

The full catalogue at cisa.gov

Elsewhere in the edition

ShinyHunters Breach Exposes FBI Agents in Data Debacle

BBC reports current and former FBI agents fear for safety after a hack appears to expose the bureau’s workforce data, including names, addresses, badge numbers, and medical records. ShinyHunters threatens to publish the stolen data within days, seeks no money, and may enable phishing, doxxing, or violent-attacks against agents and families.

4 reports

NEWSAPI CYBER INSIGHTSShinyHunters Breach Exposes FBI Agents in Data Debacle
NEWSAPI CYBER INSIGHTSInside the FBI Hack: Agents Fearful After Data Breach
NEWSAPI CYBER INSIGHTSFBI’s Elite Hacking Team Exposed in Breach by ShinyHunters
NEWSAPI CYBER INSIGHTSFBI Data Breach Exposes Agents' Medical and Fitness Records

Kiteworks Urges Six-Hour Shutdown Over Potential Zero-Day Attacks

Kiteworks urges a six-hour global shutdown after threat intelligence from federal authorities warned of a possible attack, though no breach is confirmed. Time-window guidance covers multiple zones, with Central Europe 4:00–10:00 and New York 10:00 p.m.–4:00 a.m. The advisory, precautionary rather than a breach response, notes all known vulnerabilities are fixed in version 9.5.1.

2 reports

BLEEPINGCOMPUTERKiteworks Urges Six-Hour Shutdown Over Potential Zero-Day Attacks
NEWSAPI CYBER INSIGHTSKiteworks Urges Server Shutdown Amid Imminent Cyberattack Threat

Macfinger ClickFix Campaign Delivers macOS Information Stealer

SANS analyzes Macfinger ClickFix infections on 2026-09-24, finding a macOS information stealer not based on AMOS Stealer. It uses architecture-specific Mach-O binaries (arm64/x86_64), a loader script from 45.131., plist persistence, and C2 traffic via WebSocket plus HTTP POST to /api/t. Indicators include multiple hashes and file paths.

2 reports

SANS INTERNET STORM CENTERMacfinger ClickFix Campaign Delivers macOS Information Stealer
SANS INTERNET STORM CENTERA Close Look at Macfinger ClickFix Malware Campaign

Kosovar Owner of Rydox Marketplace Pleads Guilty in US Court

Kosovar Ardit Kutleshi, who created and ran the Rydox marketplace, pleaded guilty to identity theft and money laundering conspiracy. Rydox enabled sale of 321,372 cybercrime products and served about 18,000 users; more than 7,600 transactions occurred 2016–2024, with at least $232,000 in revenue. Domain and servers were seized in December 2024, along with roughly $225,000 in cryptocurrency.

2 reports

SECURITYWEEKKosovar Owner of Rydox Marketplace Pleads Guilty in US Court
BLEEPINGCOMPUTERRydox Marketplace Admin Pleads Guilty, Faces 22 Years

OpenAI to Release GPT-6 Cyber and Deployment Gateway

OpenAI plans to release its cybersecurity-focused model GPT-6 Cyber, plus a new product to help users deploy it, per Fortune, citing unnamed sources. The story appears on pymnts[.]com dated 2026-09-25, with Fortune reporting on Sept.

2 reports

NEWSAPI CYBER INSIGHTSOpenAI to Release GPT-6 Cyber and Deployment Gateway
NEWSAPI CYBER INSIGHTSOpenAI to Preview GPT-6 Cyber at Dev Day, Plans Daybreak Product

US Cybersecurity Agency Releases Election Security Plan Ahead Of Midterms

The Epoch Times, via Kimberly Hayek, reports the nation’s cybersecurity agency released its election infrastructure security plan ahead of the November midterms, with the story also appearing on Zero Hedge.

2 reports

NEWSAPI CYBER INSIGHTSUS Cybersecurity Agency Releases Election Security Plan Ahead Of Midterms
NEWSAPI CYBER INSIGHTSFederal Cyber Agency Unveils Midterm Plan Ahead of Election

MacSync Mac Malware Uses iCloud Calendar Invites to Steal Data

Kaspersky uncovered MacSync, a Mac infostealer delivered via iCloud calendar events and fake apps. After execution, the loader reads calendar instructions to deploy MacSync, exfiltrating credentials, cryptocurrency wallets, and developer data. New variants add an Objective-C backdoor spoofing Finder and persistence; the campaign targets developers, crypto enthusiasts, and IT users.

2 reports

NEWSAPI CYBER INSIGHTSMacSync Mac Malware Uses iCloud Calendar Invites to Steal Data
HELP NET SECURITYMacSync Info-Stealing Malware Hides Commands in iCloud Calendar

Also reported

UNIT 42Unit 42 Debunks Three Consulting Myths About Security Tools and GRC
BLEEPINGCOMPUTERShinyHunters Exploits Grav Core Path Traversal on Clop Site
BLEEPINGCOMPUTERElementor WordPress Flaw Lets Attackers Create Admin Accounts
BLEEPINGCOMPUTERAnthropic Offers Up to $250 Claude Code Credits for Cloud Sessions
SECURITYWEEKClop Leak Site Takeover and Docker Botnet Seize AI Keys
BLEEPINGCOMPUTEROpenAI Preps $500 ChatGPT Pro Max Plan With Faster Codex
BLEEPINGCOMPUTERSOC 2 Must Adapt for AI Agents to Avoid Irrelevance
THE HACKER NEWSCompromised GitHub Actions Resumed Mini Shai-Hulud Malware
THE HACKER NEWSPamStealer macOS Malware Adds Live C2 Decryption and Persistence
BLEEPINGCOMPUTERMicrosoft to Deprecate Windows Deployment Services in Windows Server

End of the Friday, September 25, 2026 edition.

Read the whole paper free, by email each morning. Get the brief →

Colophon

SitRep · Vol. 1, No. 8

Publisher: Published and funded by its independent maintainer. No advertising or sponsors.
Editors: Curator, Writer, Editor and IOC Sanitizer — four AI agents.
AI disclosure: Each edition is selected, written, edited and sanitized by four AI agents (Curator, Writer, Editor, IOC Sanitizer). The maintainer builds and oversees the pipeline; editions are not reviewed by a person before they are published.
Corrections: brief@sitrepit.com or the contact page.