Friday, September 25, 2026 · Daily editionBack issueBack issues · Search

SitRep

An independent cybersecurity briefing — what matters, with its sources.

You are reading a back issue. Go to the latest edition →

The situation

Bitget $351.6M Hot Wallet Heist

Bitget reports a $351.6M theft; suspend withdrawals, audit principals, and hunt for post-exploit indicators.

Composed by SitRep’s AI editors from 5 sources — SecurityWeek, Microsoft Secure, Mandiant Threat Intelligence, The Hacker News, Kaspersky Official Blog

Bitget Reports $351.6M Hot Wallet Theft

SecurityWeek reports a backend compromise at Bitget that led to a $351.6 million loss from hot and warm wallets spanning ETH, XRP, BNB, AVAX, USDT and USDC; withdrawals were suspended and some attacker-linked wallets frozen. Mandiant and SlowMist lead the investigation; private keys were not exposed. The incident underscores rapid post-exploit activity across centralized exchanges and the need for immediate containment, forensics, and interlinked asset monitoring.

Context

Cloud-principal abuse and backend compromises enable rapid theft across multi-chain wallets. Exposure extends to hot wallets, backend services, and transaction monitoring integrations; impact can cascade to custodial and exchange operations. Exposed patterns include attacker-operated wallet funds across multiple chains and ongoing investigations by major firms.

The move

5 things to do today

  1. Rotate and audit all cloud service principals and managed identities; enforce least privilege and log service-principal activity for anomalous multi-resource operations.
  2. Patch or mitigate CVE-2026-35273 in Oracle PeopleSoft; search logs for URL-encoded /PSEMHUB/ and web shell filenames x[.]jsp and u[.]jsp, and rotate affected credentials.
  3. Apply patches for CVE-2026-5430 (WSo2) and CVE-2026-71362 (Adobe Commerce) immediately; prioritize KEV-listed assets for remediation before Sept 27.
  4. Update Roundcube to 1.6.16 / 1.7.1+ and WordPress to 7.1.2+; hunt for exploitation indicators such as suspicious SQL queries against virtuser_query and unexpected PHP file uploads.
  5. Isolate backend wallet or transaction-processing services; preserve logs and memory captures; coordinate with legal/forensic partners if custodial services operate.

On the wire

P1Identity

STORM-3168 Uses Compromised Service Principals for Rapid Destructive Sequences

Microsoft Secure details Storm-3168 (JADEPUFFER) using compromised Azure service principals to enumerate and then execute a seven-minute destructive workflow across Storage, Key Vault, App Service, and SQL (300+ read ops, 100+ deletions). Immediately review service principal permissions, rotate affected principals, and deploy hunts for rapid multi-resource activity originating from service principals.

MICROSOFT SECURE · Storm-3168: Agentic Cloud Attacks From Compromised Principals

P0Breach

Bitget Backend Compromise Led to $351.6M Hot/warm Wallet Theft

SecurityWeek reports the compromise affected backend wallet infrastructure (private keys not exposed) and resulted in $351.6M stolen across ETH, XRP, BNB, AVAX, USDT and USDC; withdrawals were suspended and some attacker wallets frozen. For non-crypto orgs, treat this as a playbook: isolate compromised backend services, preserve logs for cross-chain transaction analysis, and coordinate external forensic partners.

SECURITYWEEK · North Korea Suspected in $351 Million Bitget Crypto Heist

P0Exploit

ShinyHunters Mass Exploitation of Oracle PeopleSoft CVE-2026-35273

Mandiant reports UNC6240 exploiting CVE-2026-35273, bypassing WAFs via URL-encoded /PSEMHUB/, deploying web shells x[.]jsp and u[.]jsp and using fileless post-exploit techniques. Patch PeopleSoft, disable EMHub where feasible, search web and WAF logs for URL-encoded /PSEMHUB/ and deployed shell filenames, and rotate credentials for affected accounts.

MANDIANT THREAT INTELLIGENCE · ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft

P1Patch Tuesday

CISA KEV Adds Critical WSO2 and Adobe Commerce Flaws with Active Exploitation

The Hacker News reports CVE-2026-5430 (WSo2 path traversal → RCE) and CVE-2026-71362 (Adobe Commerce improper authorization) were added to CISA KEV and exploited in the wild; agencies urged to patch by Sept 27. Prioritize all WSO2 API Manager/Control Plane/Universal Gateway instances and Adobe Commerce installs for immediate patching or compensating controls.

THE HACKER NEWS · WSO2 and Adobe Commerce Flaws Added to CISA KEV

P1Web

Active Exploitation: Roundcube CVE-2026-48842 and WordPress CVE-2026-87902

The Hacker News and Kaspersky report active exploitation of CVE-2026-48842 (Roundcube pre-auth SQLi; 523,000 instances exposed) and CVE-2026-87902 (WordPress core RCE; affected 4.7.0–7.1.1). Patch Roundcube to 1.6.16/1.7.1+ and WordPress to 7.1.2+, hunt for suspicious SQL queries against virtuser_query and unexpected PHP file uploads or execution.

THE HACKER NEWS · Roundcube Pre-Auth SQL Injection Flaw Actively Exploited

Indicators named in this edition

KindValueNote
CVECVE-2026-35273Oracle PeopleSoft EMHub exploit used by ShinyHunters/UNC6240
CVECVE-2026-87902Critical WordPress core RCE; affected versions 4.7.0–7.1.1; patched in 7.1.2+
CVECVE-2026-5430WSo2 path traversal enabling RCE added to CISA KEV
CVECVE-2026-71362Adobe Commerce improper authorization added to CISA KEV
CVECVE-2026-48842Roundcube pre-auth SQL injection via virtuser_query plugin
FILENAMEx[.]jspWeb shell filename observed in PeopleSoft exploitation
FILENAMEu[.]jspWeb shell filename observed in PeopleSoft exploitation
VERSIONWordPress 4.7.0–7.1.1Affected versions for CVE-2026-87902

Elsewhere in the edition

ShinyHunters Breach Exposes FBI Agents in Data Debacle

BBC reports current and former FBI agents fear for safety after a hack appears to expose the bureau’s workforce data, including names, addresses, badge numbers, and medical records. ShinyHunters threatens to publish the stolen data within days, seeks no money, and may enable phishing, doxxing, or violent-attacks against agents and families.

4 reports

Kiteworks Urges Six-Hour Shutdown Over Potential Zero-Day Attacks

Kiteworks urges a six-hour global shutdown after threat intelligence from federal authorities warned of a possible attack, though no breach is confirmed. Time-window guidance covers multiple zones, with Central Europe 4:00–10:00 and New York 10:00 p.m.–4:00 a.m. The advisory, precautionary rather than a breach response, notes all known vulnerabilities are fixed in version 9.5.1.

2 reports

Macfinger ClickFix Campaign Delivers macOS Information Stealer

SANS analyzes Macfinger ClickFix infections on 2026-09-24, finding a macOS information stealer not based on AMOS Stealer. It uses architecture-specific Mach-O binaries (arm64/x86_64), a loader script from 45.131., plist persistence, and C2 traffic via WebSocket plus HTTP POST to /api/t. Indicators include multiple hashes and file paths.

2 reports

Kosovar Owner of Rydox Marketplace Pleads Guilty in US Court

Kosovar Ardit Kutleshi, who created and ran the Rydox marketplace, pleaded guilty to identity theft and money laundering conspiracy. Rydox enabled sale of 321,372 cybercrime products and served about 18,000 users; more than 7,600 transactions occurred 2016–2024, with at least $232,000 in revenue. Domain and servers were seized in December 2024, along with roughly $225,000 in cryptocurrency. Sente…

2 reports

MacSync Mac Malware Uses iCloud Calendar Invites to Steal Data

Kaspersky uncovered MacSync, a Mac infostealer delivered via iCloud calendar events and fake apps. After execution, the loader reads calendar instructions to deploy MacSync, exfiltrating credentials, cryptocurrency wallets, and developer data. New variants add an Objective-C backdoor spoofing Finder and persistence; the campaign targets developers, crypto enthusiasts, and IT users. The malware em…

2 reports

Also reported

End of the Friday, September 25, 2026 edition.