"Since the theft it has used more than 20,000 wallets on 16 blockchains, at least 36 services and at least 65,000 transactions," Dr. Tom Robinson said — a concise summary of the scale and sophistication of the laundering tied to the record Binance breach. The week’s briefings show that attackers are increasingly combining automation, trusted tooling, and living-off-the-land techniques to make dangerous activity look routine — and to keep illicit access and funds moving long after the first compromise.
North Korea's crypto laundering network
Dr. Tom Robinson of Elliptic tied a single, record-setting theft from Binance — valued at $6.43 billion — to a sprawling, automated laundering effort. Elliptic found the operation used more than 20,000 wallets across 16 blockchains, at least 36 services, and roughly 65,000 transactions. Around $3.0 billion remains in addresses linked to the theft, mostly as ETH and BTC, and "a negligible amount has likely been cashed out," Robinson said.
The actors also created six meme coins on the NEAR blockchain (FUK, OLCCL, MEILI, MMLI, DABI, and SINU) to move roughly $430,000 of stolen funds. Tactics included moving assets through bridges and cross-chain swap services, swapping on DEXs, hopping through lending vaults and liquid-staking services, and mixing bitcoin through coinjoins — with ETH and SOL routed through the Privacy Cash pool.
North Korean spokesperson Kim Yo Jong denied involvement, calling allegations an "absurd" effort to "damage the international image of the DPRK."
GSocket: persistence after patching on Linux servers
Microsoft warned that multiple incidents have used GSocket, an open-source remote access tool, to maintain access on internet-facing Linux servers after initial vulnerabilities were fixed. "Because GSocket relays traffic through a shared public network, there is no threat actor-owned IP address or domain to block," Microsoft said, urging defenders not to treat application patching alone as complete remediation.
Telemetry showed devices with GSocket-related detections rose 356.2% from March through August 2026, with most detections tied to PHP web applications, cPanel hosts, and Apache. The top targeted sectors were education and research, followed by technology and communications, manufacturing, and government entities. Microsoft recommended looking for GSocket deployment, persistence, privilege escalation, and outbound connections on affected hosts.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageFalcon browser-based espionage and Antino delivery
Palo Alto Networks Unit 42 reported a JavaScript command-and-control framework known as Falcon (aka XG or Xiàng Gē) that compromises victims entirely inside the browser. "Operating entirely inside the browser context, attackers have used the framework to sideload malicious Chrome extensions and steal the following information: passwords, emails, session cookies, [and] communications," Unit 42 said.
Falcon shares near-identical URL structures and payload delivery mechanisms with PeckBirdy and appears to be a variant of the same core framework. Unit 42 observed actors placing malicious JavaScript directly in webmail portals and government web applications; Falcon has also been used to deliver an implant named Antino, which uses Microsoft OneDrive as a C2 channel. The campaigns targeted ministries of foreign affairs, defense and interior, and law enforcement agencies in one Middle Eastern country and four Southeast Asian countries between March and May 2026.
Microsoft’s Linux kernel sweep: 59 upstream reports, 33 CVEs
Microsoft’s MDASH scan of selected Linux kernel subsystems from late May to mid-June 2026 produced 26,502 raw findings that led to 59 public upstream reports and 33 assigned CVEs. Microsoft confirmed working local root privilege-escalation exploits existed for eight of those CVEs.
Microsoft singled out CVE-2026-64563 as an especially small but powerful bug: "CVE-2026-64563 is a one-line state-reset bug in rhashtable, the Linux kernel's shared resizable hash table," the company said. Because callers trust pointers returned by a table walk, Microsoft said, the flaw enabled stable local privilege escalation on Linux and affected Android with SELinux enforcing, without requiring unusual kernel configurations.
What this means for education and research, governments, and enterprise IT/contractors
- Education and research: These sectors showed up as primary targets for GSocket activity. Teams in campuses and labs should expect attacks that persist beyond initial web app compromises and should monitor for unusual outbound connections and privilege-escalation traces, per Microsoft’s guidance.
- Governments and critical infrastructure: Falcon campaigns targeted ministries and law enforcement, using in-place JavaScript to steal session cookies and credentials. Agencies operating webmail portals and government web applications need to account for browser-contained C2 and for implants using cloud storage channels like OneDrive.
- Enterprise IT and contractors: The new Citrus ransomware cases highlight that compromised contractor accounts can be a route to domain-wide deployment. Proofpoint’s BluePhishing disclosure also shows emerging OAuth/agent-consent abuse — enterprises should be aware that attackers can create agent identities via one-time consent links and obtain access tokens that act with assigned privileges.
This week's briefings underscore a recurring pattern: small implementation errors, trusted capabilities, and automation let attackers make malicious activity look ordinary and survive remediation. Law enforcement successes — such as Europol’s seizure of 235 servers and 257 domains tied to GootLoader, CastleRAT, and StealC activity and the identification of over 6 million victim credentials — show disruption is possible. But the persistence of funds, credentials, and implanted C2 channels raises a practical question for defenders and policy leaders alike: when a vulnerability is fixed or a domain seized, how will teams find and eliminate the hidden infrastructure and illicit flows that keep the attack alive?
