GoKawiil
Tech News
Wiz reports that a threat actor compromised IAM credentials for Qubole's AWS account and used them to assume unused, trusted IAM roles in dozens of customer AWS environments between October 14 and 26. The attacker surveyed cloud resources, pulled secrets from AWS Secrets Manager, SSM Parameter Store and Lambda variables, validated keys with TruffleHog, and downloaded data from accessible S3 buckets.
Security firm Sentra identified a supply-chain attack in which an attacker obtained credentials belonging to big-data platform Qubole and used the cross-account access that customer companies had granted to Qubole to pull data from more than a dozen organizations. Sentra reported the campaign to Wiz, which investigated alongside Sentra and Mandiant and has since published full research findings; the attacker reportedly moved between compromised accounts in roughly a second each.
Google Threat Intelligence Group and Mandiant report that cybercriminals are stealing access to commercial large language models through compromised cloud credentials and reselling that access on underground markets. In some cases, fraudulent usage charges topped $100,000 in a single day, with total costs to a victim organization reaching $1 million before the compromised access was cut off.
Google's Threat Intelligence Group and Mandiant found that attackers are stealing API keys and exploiting exposed LLM endpoints to resell unauthorized access through services called LLM mixers. Victim organizations have seen fraudulent usage spike past 1,000 requests per second, with some racking up over $100,000 in charges in a single day and cumulative losses reaching $1 million. One service, Jet Night, reportedly passed nearly $1 million in token costs to a single victim after executing more than 500,000 API calls in under eight hours.
Kevin Mandia's new security startup Armadin has closed a $255.5 million Series B round at a valuation exceeding $2.5 billion, led by Andreessen Horowitz and Accel with participation from Bain Capital Ventures, Redpoint, 8VC, Ballistic Ventures, Google Ventures, In-Q-Tel, Kleiner Perkins, and Menlo Ventures. The round follows a $190 million Series A just six months earlier, bringing Armadin's total funding to over $445 million. The company builds always-on 'agentic swarms' that continuously probe enterprise systems for vulnerabilities, chaining weaknesses together in a manner meant to replicate how attackers might exploit them.
Bitget disclosed that attackers who stole $387.5 million from its hot and warm wallets last week gained access by exploiting zero-day vulnerabilities in two third-party security appliances. Investigations by SlowMist and Mandiant found the attackers planted a web shell and malware, moved laterally to Bitget's production wallet job server, and used a custom withdrawal tool to execute transfers over roughly three hours starting September 24-25. Bitget had suspended withdrawals after detecting the unauthorized transfers.
Mandiant and other security firms say attackers began exploiting an unpatched Citrix NetScaler flaw, tracked as CVE-2026-88772, in early September to install custom web shells and tunneling malware, gain root access, steal credentials, and move into internal networks. Victims span government, financial services, education, legal, and professional services organizations in North America and Europe. Citrix disclosed two related zero-days, CVE-2026-88771 and CVE-2026-88772, on Sunday and released patches after researchers including GreyNoise and watchTowr flagged active exploitation.
Google's Mandiant and Threat Intelligence Group report that the ShinyHunters extortion gang, tracked as UNC6240, has modified its exploit for the Oracle PeopleSoft flaw CVE-2026-35273 to bypass web application firewall protections. By URL-encoding characters in the vulnerable /PSEMHUB/ endpoint path, such as '%50' for the letter 'P', attackers can slip past WAF rules that only check the literal, unencoded path while Oracle WebLogic still decodes and routes the request to the vulnerable endpoint.
Amazon announced that Kevin Mandia, who founded Mandiant and sold it to Google for $5.4 billion, will join its board. Mandia left Google in 2024 and has since started an AI-driven vulnerability-detection company called Armadin while remaining a general partner at Ballistic Ventures. As part of the appointment, he received roughly $1 million in stock that vests starting in 2027.
Google's Threat Intelligence Group reports that attackers are moving from simple AI-assisted coding to fully autonomous, multi-agent systems that plan and execute entire attacks with little human input. In one case, a financially motivated actor compromised cloud infrastructure and used an AI coding chatbot with markdown-based agent instructions to build and run a mass credential-harvesting operation in under six hours. Separately, researchers found an exposed command-and-control server running a framework called 'Recon' that autonomously managed reconnaissance and tens of thousands of harvested credentials.