$6.3B Stolen, 1.3M TV Boxes Hijacked, and the FBI Got Hacked
Monday, November 2, 2026 · 5-minute read
The FBI has officially pinned the largest cryptocurrency theft in history on North Korean state-sponsored hackers known as TraderTraitor. They stole more than $6.3 billion in digital assets from the exchange Binance. North Korea has long used crypto theft to fund its weapons programs, but this one dwarfs everything before it.
↗ BleepingComputerAn Iran-linked hacking group called DarkBlinders spent August through October quietly breaking into the accounts of a high-profile person in Israel and a government cloud environment in the Kurdistan Region of Iraq. They got in using spear-phishing emails that tricked victims into downloading booby-trapped software. The group has previously hit aviation and telecom targets in the UAE and Iraq.
↗ The Hacker NewsAttackers broke into the systems that control refrigeration at supermarkets across several European countries and remotely changed temperature settings on freezers and cooling units. Multiple chains were hit. Spoiled food and potential public health risks followed. This is a striking example of operational technology attacks reaching everyday life.
↗ BleepingComputerAttackers are calling employees through Microsoft Teams while pretending to be IT support staff. Once they get the employee talking, they talk them into granting remote access to their computer. From there, the attackers use a Windows certificate feature called AD CS to steal credentials and company data. The whole attack starts with a Teams message — something most people trust without thinking twice.
NAS devices made by Synology are being hit by a ransomware strain called C3RB3R. Ransomware encrypts all your files and demands payment to get them back. Synology has told customers to update their devices immediately. NAS devices are popular targets because they often hold backups and large amounts of personal or business files — exactly what ransomware gangs want to lock up.
Two critical bugs in PHP let attackers take full control of any vulnerable web server — no login required. That covers roughly 70% of all websites on the internet, including those running WordPress, Drupal, Joomla, and Magento. Working exploits already exist and active attacks have been spotted in the wild. Government websites in Europe went offline after the bugs were disclosed. Cloudflare began blocking attack traffic within hours of the announcement.
Status: Emergency patch released — update PHP to the latest version immediately. If you run a WordPress or similar site, contact your host today.
Two critical flaws in Langflow — a popular open-source tool for building AI agents — let anyone on the internet run their own code on an affected server without needing an account or password. Every version from 1.0.0 through 1.12.8 is affected. IBM, which handles Langflow's security reports, flagged the flaws last week. Six other Langflow bugs are already on the US government's known-exploited list.
Status: Patch available — upgrade to version 1.13.0 immediately.
Ivanti patched two more zero-day vulnerabilities in its Connect Secure remote access product. Attackers have been chaining these two bugs together in real attacks since at least October 1. Ivanti's Connect Secure is used by thousands of companies to let employees connect to internal systems from home — making it a high-value target.
Status: Security updates released — IT teams should apply them immediately.
Google led a coordinated legal and technical operation to dismantle the XCPE botnet — a web of more than 1.3 million Android TV streaming boxes infected with malware. Google says it's highly confident that the device maker, Videostrong of Shenzhen, China, deliberately built a hidden backdoor called x.cpe into the boxes and sold access to criminals. Those criminals used the boxes to commit ad fraud and to route other people's internet traffic through victims' home connections. Google used legal action to shut down the servers controlling the botnet and more than a dozen malware families running through the backdoor. The troubling catch: the backdoor is still on the devices and owners cannot remove it themselves — meaning millions of TV boxes remain compromised even after the takedown.
What started as a hacking group stealing data has turned into one of the most explosive cybercrime investigations in years — involving a hack of the FBI itself, a murder-for-hire plot, and cybersecurity executives allegedly helping the very criminals they were supposed to fight.
ShinyHunters is a data extortion group that has claimed dozens of major breaches since 2019. Control of the group eventually passed to a teenager in Jordan known as "Rey." In late September, ShinyHunters hacked the FBI's own recruitment website — fbijobs.gov — and threatened to publish stolen personnel files containing medical records, Social Security numbers, and home addresses of FBI employees. That was a serious miscalculation. The FBI moved fast. Jordanian authorities detained Rey in early October. Meanwhile, Dutch police arrested a senior ShinyHunters suspect, Pepijn van der Stap, in the Netherlands — using flash-bang grenades to catch him while he was actively logged into online accounts, including Signal.
Here's where it gets stranger. Van der Stap's Signal messages led investigators to a Canadian cybersecurity executive named Edward Dubrovsky — a man who had literally written a book advising companies to engage with hackers during extortion incidents. The FBI alleges Dubrovsky was in regular contact with ShinyHunters, knew about new victims before those victims even knew they'd been hacked, and knew the group had stolen FBI data — but never told the bureau. He was arrested in October and faces charges of threatening to disclose stolen data and extortion. Prosecutors want him held without bail. According to KrebsOnSecurity, investigators also believe at least one executive at a large, unnamed US consulting firm actively helped run ShinyHunters' victim-shaming website, shinywire.com.
The lesson here goes beyond the headlines. It shows how the line between "cybersecurity professional" and "cybercriminal" can be deliberately blurred — and how gangs like ShinyHunters don't just rely on technical skills. They build relationships inside the industry meant to stop them. Watch this story closely. More arrests and revelations almost certainly lie ahead.