Malware incidents
Malware incidents, most recently reported first.
Malware on Quantum Systems servers prompts German military to halt drone operations
Impact: Temporary suspension of the German armed forces’ operations of the manufacturer’s drones
German drone manufacturer Quantum Systems detected a cyber-attack on its internal servers in late October 2026. Update files containing malware had been planted on the servers, reportedly in an attempt to affect drone operations through updates. The company began a joint investigation with the authorities, and the German armed forces temporarily suspended operations of the manufacturer’s drones as a precaution.
Related reports: 12 · last report →Malicious drone update temporarily grounds German military drones
↳ Knock-on damage from the Quantum Systems incident · View original incidentImpact: Temporary suspension of Quantum Systems drone operations
Quantum Systems detected a cyber-attack in late October, and a malicious update was distributed through its QBase update server. The German Armed Forces suspended operations of the company's drones as a precaution. Flights of the affected drones subsequently resumed.
Related reports: 10 · last report →Hijacked GitHub accounts used to run data-stealing code in 1,806 repositories
Impact: 4,837 accounts abused, 61,764 repositories scanned, and data-stealing code executed in at least 1,806 repositories
In the wfx-loot cyber-attack observed since 10 November, 4,837 hijacked GitHub accounts were used to scan 61,764 repositories. The attackers ran credential-stealing code in at least 1,806 repositories, collecting keys for cloud, development and AI services through GitHub Actions, npm installation scripts and other means. The initial account compromise vector for the overall campaign has not been established.
Related reports: 7 · last report →ScreenConnect abuse compromises computers at 48 organisations
Impact: Remote access software installed on at least 288 computers across 48 organisations
Attackers exploited a cloud-based ScreenConnect management environment and third-party extensions to install remote access software for their use on at least 288 computers across 48 organisations. ConnectWise disabled five potentially related third-party extensions in approximately 400 partner environments. The company is investigating attacks targeting ScreenConnect users.
Related reports: 6 · last report →Turla malware infiltrates Romanian government email servers
Impact: Compromise of Romanian government agencies' email systems
In December 2025, a breach by Turla, a hacking group linked to Russia's FSB, was discovered in Romanian government agencies' email systems. The attackers installed the malicious tool Cereal on Exchange servers and configured it to selectively collect emails related to NATO and the EU. Romanian intelligence authorities said they had restored services and blocked the attack, and that no exfiltration of sensitive information had been confirmed.
Related reports: 11 · last report →Data-collection script injected into Nordace checkout page
An unauthorised Google Tag Manager container and a data-collection script were injected into the checkout page of Hong Kong travel goods company Nordace. The script could send addresses, contact details and payment card information to an external destination, but whether any information was actually collected remains unconfirmed.
Read on ISSSource ↗Wallet-stealing malware injected into official Ethersphere releases
Ethersphere's automated release process was compromised, and malware was injected into bee-js 13.3.0 and Swarm Desktop 0.56.2. The attacker used stolen release automation credentials to distribute malicious versions through legitimate npm releases and desktop update channels. The malware was designed to steal wallet keys and passwords and install backdoors on Windows, macOS, and Linux, while the extent of actual infections and asset theft remains unknown.
Related reports: 5 · last report →Suspected malware on Busan University of Foreign Studies work PC raises data leak concerns
Investigating authorities notified Busan University of Foreign Studies after identifying signs of a suspected malware infection and a possible personal data leak involving a work PC at its Institute of Continuing Education. The PC held resident registration numbers, bank account numbers, contact details and other information about education programme participants and service contractor personnel. The university is investigating whether a leak actually occurred and the scale and scope of any impact.
Related reports: 9 · last report →Fake security tools on GitHub infect at least 2,000 Windows PCs
Impact: At least 2,000 Windows PCs infected
Attackers posted malicious projects on GitHub disguised as security scanning and log analysis tools to distribute malware to security professionals and developers. The malware included AsyncRAT and information stealers, and at least 2,000 Windows PCs were infected. Dr.Web published a technical analysis report on 5 November, but the affected organisations were not named.
Related reports: 2 →Plex flaws exploited to install miners and proxies on QNAP NAS devices
Impact: Some users' NAS devices compromised; number of affected devices not disclosed
Plex Media Server running on QNAP NAS devices was compromised through the Plex2Shell exploit chain. Attackers remotely executed malware without authentication and installed cryptocurrency miners and residential proxy programmes on some devices. QNAP recommended updating to the latest version and said it was supporting affected users, with no confirmed data loss.
Related reports: 5 · last report →White House network IPs linked to residential proxy use
Impact: Indications that six network IP addresses were used as exit nodes for 28 residential proxy services
Researchers found indications that six IP addresses on the White House network had been used as exit nodes for 28 residential proxy services. Another research firm concluded that InfaticaSDK had been running on a Windows 11 device. No official White House confirmation of a compromise was identified.
Read on SecurityWeek ↗Tampered Plerdy analytics script distributes mobile exploits
An attacker suspected to be APT29 tampered with the tracking script of Ukrainian web analytics service Plerdy to distribute exploit code for iOS and Android vulnerabilities. The attack also used compromised websites and spoofed domains to target entities in Ukraine, the United States, the United Kingdom and Europe.
Read on BreachNews ↗Two charged with hacking US university systems to mine cryptocurrency
Impact: Misuse of educational institutions’ networks and university supercomputers across several US states
Two Canadians were charged with breaching educational institutions’ networks and university supercomputers across several US states between 2016 and 2019 to install malware and cryptocurrency mining software. The compromised systems were used to mine Electroneum and store stolen login credentials, among other purposes. One of the defendants was extradited to the United States.
Related reports: 2 →Malicious apps distributed through legitimate websites posing as Samsung browser updates
Indications were found that external scripts encouraging users to install malicious apps had been inserted into legitimate websites across various sectors, including fishing, audio equipment and hospitals. The scripts prompt app installation by posing as Samsung browser updates, and the final malicious app operates by hiding from the standard app list.
Read on 전자신문 ↗China-linked group exploits Sogou Input Method communications to deploy backdoor
Impact: Backdoor deployed to institutions, Chinese-speaking users and multinational gambling companies across multiple countries
China-linked group SlippyNunchucks exploited DNS requests and unencrypted communications from Sogou Input Method and other software to deploy the DarkVigil backdoor. Victims were identified in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka, Oman and elsewhere, including institutions, Chinese-speaking users and multinational gambling companies. The cyber-attack campaign was disclosed on 4 November.
Related reports: 2 →Tampered NIKKE PC launcher files spread malware
An external domain used by the GODDESS OF VICTORY: NIKKE PC launcher was hijacked on 27 September 2026, and four official CDN scripts were altered, resulting in malware being distributed to users’ PCs from 30 October. The malware could remotely control computers and steal browser credentials, cryptocurrency wallets and development tool credentials, but the actual extent of data theft has not been confirmed. Level Infinite identified the issue on 4 November, replaced the altered files, refreshed the CDN cache and reported the incident to the Korea Internet & Security Agency (KISA), while introducing automatic scanning and removal and opening a channel for reports of harm.
Related reports: 32 · last report →Fake CAPTCHA on University of Seoul website tricks visitors into running malicious commands
From the afternoon of 30 October through 3 November, a fake CAPTCHA appeared on the University of Seoul's official website, prompting visitors to execute malicious commands. The university became aware of the incident on the morning of 3 November and took action to stop the screen from appearing from 2 pm. A current student reported following the instructions, and the university advised disconnecting from the internet and formatting affected PCs, among other measures, and pledged assistance with formatting. The entry point and cause remain under investigation, and the actual extent of infections has not been confirmed.
Related reports: 7 · last report →cPGuard update channel breach infects about 2,950 customer servers
Impact: Malicious scripts executed on about 2,950 customer servers; customer contact information, password hashes and sensitive server information stolen
An attacker stole credentials from cPGuard developer OPSSHIELD, breached its update distribution infrastructure and distributed malicious updates. About 2,950 customer Linux servers executed malicious scripts, resulting in backdoor installation and the collection of password hashes, SSH keys, and database and cloud credentials. Customer contact information and hashed passwords were also stolen from OPSSHIELD’s billing and licensing server.
Related reports: 7 · last report →Data-wiping attack destroys cloud data and backups at Russia's Beget
Impact: Loss of VPS, S3 and Kubernetes data and some backups, with disruption to websites, email and DNS services
Russian cloud and hosting provider Beget suffered a cyber-attack between the night of 1 November and 2 November, losing VPS, S3 and Kubernetes data as well as some backups. The attacker breached the management system and executed data-wiping malware, causing widespread disruption to customer websites, email and DNS services. The company disconnected all servers from the network to prevent the attack from spreading and began rebuilding and restoring its infrastructure. As of 10 November, it had restored 60% of shared hosting and 40% of dedicated servers, but estimated that the remaining file backups could support recovery for only about half of VPS users.
Related reports: 13 · last report →German MPs and government officials warned of iPhone spyware attacks
Members of Germany’s federal parliament and government foreign affairs officials were among those notified by Apple that their mobile phones may have been hacked using spyware. Germany’s Federal Office for Information Security advised them to assume their devices were infected and replace them. Whether any devices were actually compromised, the scale of any infection and who was behind the attacks remain unconfirmed.
Related reports: 3 · last report →