Cyber Security News

Hacking Editorial Brief — September 8, 2026

White-Hat Hackers Return Most of Liquid Network Bitcoin

In a significant development to yesterday's $320 million Liquid Network breach, the self-described white-hat hackers have returned approximately 3,400 of the 4,000 stolen bitcoin after Blockstream patched the exploited bridge vulnerability. Nearly 600 BTC—worth roughly $47 million—remains with the attackers. The partial return follows Blockstream's remediation of the underlying flaw, though neither the company nor the attackers have disclosed technical details of the vulnerability. The incident continues to underscore security challenges in cryptocurrency bridge infrastructure as the industry seeks institutional legitimacy.

Multiple Active Exploitation Campaigns Target Enterprise Infrastructure

Threat actors are exploiting recently disclosed vulnerabilities across several enterprise platforms in coordinated campaigns. Attackers are actively chaining two MikroTik RouterOS flaws to hijack routers with exposed SSH services, building on exploitation activity confirmed since September 2. Separately, researchers disclosed worm-like activity abusing ConnectWise ScreenConnect installations to distribute a four-stage VBScript payload that spreads to newly connected hosts, enabling lateral movement across managed environments. N-able has released its fourth hotfix in five weeks for CVE-2026-86218, a CVSS 10.0 unauthenticated remote code execution vulnerability in N-central, with incident reports indicating active exploitation in the wild. The overlapping campaigns demonstrate sustained opportunistic targeting of remote management and network infrastructure.

North Korean Operators Conceal Backdoor in HAProxy Load Balancers

North Korea-linked threat actors have deployed a sophisticated backdoor hidden within HAProxy load balancer installations, masking command-and-control traffic while maintaining normal load balancing functionality. The technique allows attackers to exfiltrate data through legitimate-appearing network traffic, complicating detection efforts. Technical implementation details and affected versions have not been publicly disclosed.

Sources: CoinDesk · Bleeping Computer · The Hacker News · Security Affairs