# Weekly Cybersecurity Roundup: Linux Kernel Bugs, Falcon Spyware, and GSocket Backdoors A comprehensive look at recent cyber threats, malware campaigns, and critical software vulnerabilities. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-11-12 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/1742581a-3da5-4b96-87d8-c14735f14610 ## Deceptive Cyber Threat Landscape Modern cyberattacks increasingly rely on disguising malicious activity as normal operations. Attackers leverage fake websites, stolen credentials, and trusted tools to bypass security measures. Artificial intelligence is accelerating this trend, enabling faster attack development while expanding the target surface for intruders who remain hidden even after initial vulnerabilities are patched. ## Binance Theft Laundering Tactics North Korean actors are laundering $6.43 billion stolen from Binance using over 20,000 wallets across 16 blockchains. They utilized 65,000 transactions and created six meme coins on the NEAR network to obfuscate funds. Despite international scrutiny, approximately $3.0 billion remains in linked addresses, primarily held in ETH and BTC assets. ## Persistent GSocket Linux Threats Microsoft reports a 356.2% increase in GSocket deployments on internet-facing Linux servers between March and August 2026. Attackers use this open-source tool to maintain persistent access after patching web application vulnerabilities. Most detections involve PHP, cPanel, and Apache environments, primarily impacting the education, research, and government sectors globally. ## Europol Disrupts Malware Infrastructure Europol and international partners successfully seized 235 servers and 257 domains linked to GootLoader, CastleRAT, and StealC malware. This operation targeted cybercrime-as-a-service models that facilitated ransomware and data theft. Authorities identified over 6 million stolen victim credentials that were being sold and repurposed for subsequent large-scale cyber-attacks against various organizations. ## Falcon Framework Browser Attacks The Falcon command and control framework compromises browsers via malicious JavaScript to steal session cookies, passwords, and emails. Operating within the browser, it sideloads Chrome extensions and delivers the Antino implant. Between March and May 2026, it targeted foreign affairs and defense ministries across one Middle Eastern and four Southeast Asian nations. ## Linux Kernel Vulnerability Discovery Microsoft identified 26,502 raw findings in Linux kernel subsystems, resulting in 59 public reports and 33 CVEs. Notably, CVE-2026-64563 involves a one-line state-reset bug in rhashtable. This flaw allows stable local privilege escalation on Linux and Android systems, even with SELinux enforcing, without requiring special user namespaces or specific kernel configurations. ## Silent Lynx Espionage Exposure An exposed server revealed Silent Lynx espionage operations targeting Central Asian critical infrastructure between April and October 2026. The data included stolen government intelligence and AI agents used for intrusions. Evidence, including Russian-language operations and Kazakh residential connection traffic, suggests a regional nexus focused on defense and transport sector data collection. ## Citrus Ransomware AI Integration The Russian-speaking Citrus group targets corporate Windows systems using compromised contractor accounts. The malware, a Sn00py-family variant written in Go, encrypts files with a .citrus extension. Attackers utilize AI-generated PowerShell scripts and commands, while actively clearing event logs and command history to hinder incident response and maintain stealth within the network. ## Cross-Chain Money Laundering Complexity To evade detection, attackers move stolen cryptocurrency through complex paths including bridges, cross-chain swap services, and decentralized exchanges. They utilize lending vaults and liquid-staking services to further fragment the trail. Privacy pools for Bitcoin, ETH, and SOL are also employed to mix assets, making it significantly harder to trace final destinations. ## Browser-Based Strategic Intelligence Collection Falcon and its variant PeckBirdy represent a shift toward browser-context attacks for strategic intelligence gathering. By injecting malicious JavaScript directly into government web applications and mail portals, attackers bypass traditional perimeter defenses. This method allows for the silent exfiltration of sensitive communications and session data from high-value targets in the public sector. ## Remediation Beyond Simple Patching Security teams must look beyond standard application patching to address persistent threats like GSocket. Because GSocket relays traffic through shared public networks, defenders cannot rely on blocking specific IP addresses. Effective remediation requires monitoring for deployment, privilege escalation, and unusual outbound connections on hosts to ensure complete removal of unauthorized access. ## Evolution of Cybercrime Operations The current threat landscape demonstrates a transition toward automated, AI-supported, and persistent attack methodologies. From the massive laundering of stolen crypto to the surgical compromise of government browsers, attackers are prioritizing long-term access and obfuscation. Organizations must adopt proactive, behavior-based detection strategies to counter these sophisticated, multi-stage, and highly adaptive criminal campaigns. ## Sources covering this story - https://thehackernews.com/2026/11/threatsday-59-linux-kernel-bugs-falcon.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._