Cyber Security News

Hacking Editorial Brief — November 12, 2026

Threat Actors Target Enterprise Infrastructure with Multi-Exploit Staging and Persistence Tools

Researchers observed threat actors targeting Qlik Sense servers with PowerShell reverse shell commands, according to The Hacker News. The attackers' infrastructure contained exploit tools for Apache ActiveMQ and Veeam Backup & Replication, indicating preparation for broader attacks beyond the initial Qlik Sense compromise, though researchers have not disclosed victim counts, campaign scope, or attribution. Separately, Microsoft Threat Intelligence discovered threat actors deploying GSocket on compromised Linux servers to maintain encrypted remote access channels after original vulnerabilities are patched. The technique allows attackers to establish persistent backdoors that survive remediation of initial entry points, though Microsoft has not specified affected organizations, deployment scale, or threat actor identity. Additionally, researchers disclosed "worse_query," an unpatched iOS sandbox escape vulnerability that allows malicious apps to read local files from other applications, potentially exposing cryptocurrency seed phrases, private keys, and login credentials across the Apple ecosystem, according to Apple Insider. Apple has not confirmed the vulnerability or announced remediation timelines.

Confirmed Breaches Include Maersk Ransomware Incident and Romanian Government Cyber Attack

Maersk confirmed attackers stole approximately 100 gigabytes of data from a legacy system inherited through its LF Logistics acquisition, with the WhiteArmor ransomware group demanding $5 million in bitcoin, according to CISO Series. The shipping company has not disclosed the compromise timeline or affected data types. Romania's intelligence agency attributed a cyber attack on an unspecified Romanian government organization to a hacking group linked to Russia's FSB security service, according to Reuters. The agency has not disclosed the attack timeline, affected systems, or data exfiltration details. Separately, Bacon County Hospital and Health System in Georgia disclosed that an unauthorized party accessed its network on July 10 and copied files around July 27, indicating a 17-day dwell time, though the hospital has not specified affected patient counts or data types exposed. Binance reported working to resolve what it described as a "complex attack" affecting approximately $6.3 billion in funds, according to AFP, though the company has not disclosed attack vectors, compromise timelines, or fund recovery status.

Additional Reported Activity: CloudSek reported that a hacking group with ties to Kazakhstan used the Hermes autonomous AI agent framework to steal over 2,000 national security documents from Tajikistan after discovering an exposed server, though the claim has not been independently verified. India reportedly bypassed its own procurement rules to acquire Israeli phone surveillance technology with capabilities extending beyond device cloning to cloud-based data access from major technology companies, according to Al Jazeera.

Sources: The Hacker News · Microsoft Security Blog · Apple Insider · CISO Series · Reuters · Becker's Hospital Review · AFP · Just Security · Al Jazeera