SITREP - Independent OSINT Channel

🔍 Nvidia patches high-severity DCGM Exporter flaw Researchers identified roughly 2,100 internet-exposed GPU servers running Nvidia DCGM Exporter, with hundreds potentially vulnerable to CVE-2026-47483 . The bug can let unauthenticated attackers trigger memory exhaustion and crash the GPU monitoring service. Nvidia fixed the issue in version 4.8.2. The exposure is operationally significant because DCGM telemetry…

🔍 FBI details China-linked email access portal The FBI says China-linked hackers operated a web portal that allowed third parties to search and retrieve stolen emails from compromised inboxes. The setup effectively turned harvested correspondence into a shared service, broadening access beyond the initial intrusion team, as outlined in the FBI findings . Operationally, this indicates a structured exploitation…

📡 Ransomware disrupts Japan’s IDCF Cloud IDC Frontier says a ransomware attack hit its IDCF Cloud platform on 7 October, forcing shutdown of network and systems in East Japan Region 1. The company says 495 firms and local governments are affected. Customer console access has been disabled across all regions during security checks, while the intrusion route and full scope remain under investigation. This is a cloud…

🔍 FakeGit reactivates at scale on GitHub FakeGit has resumed activity with 17,610 malicious GitHub repositories distributing SmartLoader, with over 13,000 repos pushed in 34 hours and a peak of 2,999 per hour. Researchers found 97% of sampled commits only modified README files, and 88% redirected download buttons to ZIP archives installing SmartLoader. At least 700 accounts appear tied to legitimate developers.…

🔍 Cisco flags five critical NX-OS flaws on Nexus switches Cisco has issued advisories for five critical vulnerabilities in NX-OS affecting Nexus 3000 and 9000 switches in standalone mode. The flaws impact NX-API, NGOAM, and MPLS OAM and can allow arbitrary code execution with root privileges or force device reloads. Exploitation depends on the affected features being enabled; Nexus 7000 and Nexus 9000 systems in ACI…

🔍 Low-cost Android phones found shipping with firmware-level malware Bitdefender’s Midnight Mimosa findings describe low-cost Android devices with MediaTek chipsets arriving with preinstalled malware in the system partition. The framework silently installs apps, commits ad fraud, and can register phones as residential proxies. Researchers tracked thousands of affected devices in more than 150 countries over roughly…

🔍 UAC-0099 deploys ASHVEIN RAT against Ukrainian government staff UAC-0099 is targeting Ukrainian government personnel with the ASHVEIN RAT , using HTML content to conceal command data. The activity is framed as a cyber-espionage campaign focused on government users rather than broad criminal distribution. Embedding instructions inside HTML adds a simple but effective layer of obfuscation, complicating static…

📡 Ukrainian strike disables Yandex cloud zone Yandex says its ru-central1-b availability zone is offline after a fire caused by a drone attack on its Sasovo datacenter, around 300 km southeast of Moscow. The company states operations at the site have been fully halted and told customers to use alternative recovery plans. Yandex Cloud also warned service restoration is not expected in the near term. The incident…

🔍 Shai-Hulud hits AI tooling via Tensorlake SDK A malicious release of Tensorlake’s SDK version 0.5.144 on npm was flagged 11 minutes after publication and later removed. Researchers link the package to the credential-stealing Shai-Hulud worm, with code overlap to the ChainDrop variant. Reported theft targets include cloud credentials, GitHub Actions secrets, browser passwords, crypto wallets, and service-account…

🔍 FBI seizes Flax Typhoon cyber infrastructure The FBI seized seven domains linked to China-connected Integrity Technology Group, disrupting the MicroScan vulnerability scanner and FishHub spear-phishing platform used in Flax Typhoon operations. U.S. officials say the tools supported scanning, intrusions, malware delivery, remote access, and data theft against critical infrastructure and other targets in the U.S.,…