Cyber Security News

Hacking Editorial Brief — September 7, 2026

Liquid Network Loses $320 Million in Bitcoin Theft

The Bitcoin-based Liquid Network has halted transactions following the theft of approximately $320 million in cryptocurrency from its Federation wallet. Attackers withdrew around 4,000 of the 4,200 bitcoin held in the network's multisignature wallet, with the organization stating that "purported white-hat hackers" were responsible for the withdrawal. The incident adds to an escalating series of cryptocurrency platform compromises in recent months. The Liquid Network, used by several crypto exchanges as a sidechain for faster Bitcoin transactions, has not disclosed the attack vector or provided attribution. The breach represents one of the largest cryptocurrency thefts of 2026 and raises continued questions about custodial security in blockchain infrastructure.

Active Exploitation Campaigns Target MikroTik Routers and PaperCut Systems

Attackers are actively exploiting a vulnerability chain in MikroTik RouterOS devices to gain full administrative control without authentication. CERT Polska confirmed that threat actors are chaining CVE-2026-67276 and CVE-2026-86060—collectively dubbed "MikroTrick"—to compromise internet-exposed routers via SSH, with active exploitation confirmed since September 2. Security researcher Costin Raiu provided technical indicators of compromise, including the presence of an SSH user named "-2" as evidence of successful exploitation. Separately, threat actors continue coordinated attacks against U.S. and European educational institutions by exploiting newly disclosed PaperCut vulnerabilities CVE-2026-81578 and CVE-2026-82078 to steal credentials and achieve remote code execution. Both campaigns demonstrate ongoing opportunistic targeting of known vulnerabilities in enterprise and network infrastructure.

North Korean Kimsuky Group Leverages AI Coding Tools in Operations

The North Korea-linked threat group Kimsuky has been observed using AI coding agents to create decoy documents and tooling for social engineering campaigns. The group's adoption of AI-assisted development represents an evolution in state-sponsored threat actor tradecraft, enabling more efficient creation of lures and potentially more sophisticated attack infrastructure. No specific AI platforms or technical implementation details have been disclosed.

Sources: Reuters · Bloomberg · The Hacker News · Security Affairs · Yonhap News Agency