Full Report
Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an actual feature. And somehow, it fits right in with this week's security stories. The rest gets interesting in different ways. A small permission can lead to a big theft. A trusted login can hide the wrong person. Old bugs are finding new victims, familiar tools are being put to strange uses, and
Analysis Summary
# Morning News Roll-up October 15, 2026
## Overview
This week's intelligence highlights the exploitation of known VPN vulnerabilities by ransomware groups, the rise of AI-assisted cryptocurrency drainers using DNS-based command-and-control (C2), and the escalation of Russian hybrid warfare tactics across Europe targeting critical infrastructure and psychological resilience.
## Top Stories
### Qilin and Settra Ransomware Exploit PAN-OS Flaw
- Summary: Threat actors are actively bypassing authentication in PAN-OS GlobalProtect and Prisma Access using CVE-2026-0257. Attackers use legitimate VPN sessions to blend in with remote traffic, facilitating lateral movement and data theft.
- Source: hxxps://thehackernews[.]com/2026/07/qilin-ransomware-attackers-exploit-pan[.]html
### Noir: A DNS-Powered Crypto Wallet Drainer
- Summary: A new wallet-drainer kit called "Noir" uses DNS TXT records and public DNS-over-HTTPS (DoH) services to identify active backend pools. It bypasses the need for seed phrases by obtaining spending permissions directly from victims.
- Source: hxxps://www[.]infoblox[.]com/blog/threat-intelligence/when-a-wallet-drainer-asks-dns-where-to-go/
### CikaBika Bot: Rust-Based RAT via Discord
- Summary: Researchers identified a Rust-based remote access trojan (RAT) named CikaBika Bot. The malware utilizes Discord as its primary command-and-control (C2) infrastructure to issue commands and exfiltrate data.
- Source: hxxps://thehackernews[.]com/2026/10/threatsday-adobe-rce-dns-wallet-theft[.]html#discord-based-remote-access-threat
---
# Main Topic
**Evolution of Evasive Data Theft and Infrastructure Exploitation**
The primary focus of this intelligence cycle is the shift toward "living off the land" and utilizing trusted services (VPNs, DNS, Discord) to mask malicious activity. This includes the Noir wallet drainer, which uses unusual "scare" features for victims, and the exploitation of critical network entry points by ransomware affiliates.
## Key Points
- **Unusual Features:** The Noir drainer kit includes a unique "scare" feature designed to taunt victims during data theft.
- **AI-Assisted Malware:** Noir is suspected to be developed and maintained with the assistance of Artificial Intelligence, lowering the barrier for complex malware creation.
- **DNS Abuse:** Malware is increasingly leveraging DNS TXT records and DoH (DNS over HTTPS) to resolve backend infrastructure, making traditional IP-based blocking ineffective.
- **Authentication Bypass:** Critical vulnerabilities in perimeter security (PAN-OS) are being used to grant attackers legitimate-looking remote access.
## Threat Actors
- **Qilin (Ransomware-as-a-Service):** Known for double-extortion tactics; currently exploiting PAN-OS vulnerabilities.
- **Settra:** A ransomware group observed co-exploiting the same vulnerabilities as Qilin.
- **Russian State-Sponsored Actors:** Engaging in hybrid warfare involving cyber and physical tactics to degrade European infrastructure.
- **Noir Developers:** Likely cybercriminal kit developers utilizing AI tools for malware maintenance.
## TTPs
- **Exploitation of Public-Facing Applications:** Targeting CVE-2026-0257 in PAN-OS GlobalProtect.
- **Command and Control (C2):** Using Discord (CikaBika Bot) and DNS TXT records (Noir) for stealthy communication.
- **Abuse of Trusted Permissions:** Obtaining "spending permissions" in crypto wallets rather than direct seed phrase theft to avoid triggering alarms.
- **Masquerading:** Using session hostnames like "kali" or legitimate VPN cookies to blend into network traffic.
## Affected Systems
- **Palo Alto Networks:** PAN-OS GlobalProtect and Prisma Access deployments.
- **Cryptocurrency Wallets:** Users of various hot wallets targeted by drainer kits.
- **Operating Systems:** Rust-based malware (CikaBika) targeting multiple platforms; NVIDIA Container environments (noted in escape flaws).
- **Adobe Software:** Vulnerabilities related to Remote Code Execution (RCE).
## Mitigations
- **Patch Management:** Immediately upgrade PAN-OS deployments to address CVE-2026-0257.
- **Session Control:** Terminate all active GlobalProtect sessions after patching and disable "authentication override cookies" where not strictly necessary.
- **DNS Monitoring:** Monitor for unusual DNS TXT record queries to public DoH providers (e.g., Google or Cloudflare DNS).
- **Endpoint Detection:** Investigate unexpected connections and hostnames (e.g., "kali") appearing within VPN logs.
- **Identity Security:** Implement runtime identity controls to detect AI-powered reconnaissance and privilege escalation.
## Conclusion
The current threat landscape is characterized by a "stealth-first" approach where attackers prioritize blending into legitimate traffic. The use of AI to generate malware like Noir and the exploitation of trusted perimeter devices by groups like Qilin indicate that organizations must move beyond simple patching. Defensive strategies should focus on monitoring session behavior, validating identity at runtime, and inspecting DNS traffic for non-standard use cases.