Cyber Security News

Hacking Editorial Brief — November 9, 2026

GitHub Supply Chain Campaign Delivers Credential-Stealing Workflows to Tens of Thousands of Repositories

Researchers have identified a supply chain campaign dubbed GhostAction that pushed malicious GitHub Actions workflows into tens of thousands of repositories to exfiltrate cloud and AI credentials, according to GBHackers. The campaign targeted repositories to inject credential-stealing automation into CI/CD pipelines, though the disclosure does not specify the exact compromise count, which organizations were affected, or whether the threat actors successfully exfiltrated credentials from targeted environments. The attack method represents a supply chain vector focused on developer infrastructure rather than production software dependencies.

Chinese-Linked Intrusion Follows ConnectWise Breach, Researchers Report Over 2,250 Microsoft 365 Tenants Compromised

Chinese-linked threat actors breached ConnectWise infrastructure and subsequently compromised over 2,250 Microsoft 365 tenants using the ARTEX AI framework, security researchers report. The campaign follows yesterday's Microsoft disclosure attributing ARTEX abuse to Storm-3358 targeting Southeast Asian financial organizations. The ConnectWise breach disclosure does not detail the initial compromise vector, the timeline between the infrastructure breach and downstream tenant compromises, or whether the 2,250 figure represents attempted or successful intrusions. ConnectWise has not publicly confirmed the breach or provided incident details.

Belarusian and Russian Opposition Groups Claim 23TB Data Exfiltration from Rosstat Statistics Agency

Belarusian CyberPartisans and Silent Crow claim to have breached Russia's Rosstat state statistics agency and exfiltrated 23 terabytes of data including military casualty figures related to the Ukraine war, according to SC World. The threat actors published differing casualty estimates—Silent Crow claiming nearly 400,000 Russian deaths while CyberPartisans reported lower figures—based on data they assert came from the breach. Russian authorities have not confirmed the intrusion, and the casualty figures have not been independently verified by government or intelligence sources. The reported breach follows a pattern of hacktivist operations targeting Russian government infrastructure since 2022.

Additional Confirmed Activity: CISA and FBI jointly warned of ongoing attacks targeting industrial refrigeration and cold chain monitoring systems globally, following recent incidents affecting European supermarket networks. Researchers documented Anubis ransomware operators using a previously undocumented backdoor called Lindnor against Microsoft SQL servers at a U.S. organization. ModSecurity web application firewall disclosed two high-severity vulnerabilities allowing attackers to bypass file upload restrictions or crash server workers.

Sources: GBHackers · SC World · Pravda · Cybersecurity News