[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbPSgzJss70cRS-5_6QQDXgCoe0jGqjntUic_80SdVtQ":3},{"article":4,"iocs":53,"watch_terms":70,"solutions":71,"lesson":158},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"1a82364a-51f8-4ec5-b2fc-e8a5b052e8b2","⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats","weekly-recap-387m-crypto-hack-citrix-exploits-ai-agents-go-off-script-and-more-t-92a47b","A domain used as harmless placeholder text showed up in roughly 1,700 repositories. Then somebody registered it and started serving malicious lures. That is the kind of week this was: forgotten assumptions turning into live attack surface. Elsewhere, weak service accounts, old bugs, exposed systems, phishing kits, and strangely easy exploit paths kept doing useful work for attackers. Nothing","This week's recap highlights a significant $387 million hack of cryptocurrency exchange Bitget, suspected to be carried out by North Korean hackers. Citrix has warned of actively exploited vulnerabilities in its NetScaler ADC and Gateway products, urging immediate patching. Additionally, a commonly used placeholder domain, 'third-party[.]com', was registered by an attacker and used to serve malicious lures, impacting approximately 1,700 repositories.","Weekly recap covers $387M crypto hack, Citrix NetScaler exploits, and a placeholder domain used for attacks.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fweekly-recap-387m-crypto-hack-citrix.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEh4-eWVCAN2nvZGZrKlwm-wminZE56MzJ_bVRK6CJfdBw9TXU4yQy6t9T0hDi0hSOskE9Xs6M-KCVEbVvBuL2DLDkew97W2iobOPZa9zqEBeGPWBnW8cftdD1FwzBLz7CIGVhJb1FwnS-35B62Jqc331zNQ67hZP-V2jKBT7yUxUV4rn8jMr27QCommYp-j\u002Fs1600\u002Fc-recap.jpg","2026-09-28T14:00:53+00:00","2026-09-28T18:00:47.47935+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"North Korean hackers","threat_actor",{"name":21,"type":22},"Citrix","vendor",{"name":24,"type":25},"NetScaler ADC","product",{"name":27,"type":25},"NetScaler Gateway",{"name":29,"type":22},"Bitget","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":30,"icon":32,"name":33,"slug":34},null,"Threat Intelligence","threat-intelligence",[36,41,46,51],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":52},{"id":30,"icon":32,"name":33,"slug":34},[54,58,61,65,68],{"type":55,"value":56,"context":57},"cve","CVE-2026-88771","Citrix NetScaler ADC and Gateway vulnerability allowing arbitrary command execution.",{"type":55,"value":59,"context":60},"CVE-2026-88772","Citrix NetScaler ADC and Gateway vulnerability allowing remote code execution or denial-of-service.",{"type":62,"value":63,"context":64},"domain","third-party.com","Placeholder domain registered and used for malicious lures.",{"type":62,"value":66,"context":67},"yoursite.com","Placeholder domain observed serving scams and scareware.",{"type":62,"value":69,"context":67},"your-domain.com",[21,29,24],{"controls":72,"vendors":152},[73,102,127],{"slug":74,"name":75,"problem":76,"products":77},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[78,86,94],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":103,"name":104,"problem":105,"products":106},"patch-management","Automated patch management","Known holes get closed in days, not months.",[107,115,123],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":103,"product_name":124,"url":125,"description":126},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":34,"name":128,"problem":129,"products":130},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[131,139,147],{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":148,"product_name":149,"url":150,"description":151},"dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",[153],{"slug":154,"name":21,"logo_path":155,"roles":156},"citrix","\u002Fvendor-logos\u002Fcitrix.png",[157],"affected",{"slug":159,"title":160,"body":161,"framework_refs":162,"framework_notes":178},"crypto-hack-citrix-exploits-poisoned-placeholder-domain-highlight-multi-front-threat-week","Crypto Hack, Citrix Exploits & Poisoned Placeholder Domain Highlight Multi-Front Threat Week","This week's incidents expose three distinct but equally dangerous attack surfaces: a $387M crypto exchange breach attributed to North Korean state-sponsored actors underscores how exchanges remain high-value targets with inadequate access controls; actively exploited Citrix NetScaler vulnerabilities demonstrate that unpatched internet-facing infrastructure continues to be low-hanging fruit for attackers; and the registration of a commonly used placeholder domain ('third-party[.]com') affecting ~1,700 repositories reveals how developers inadvertently introduce supply chain risk by referencing unregistered or abandoned domains in code. Collectively, these incidents matter because they show attackers operating across financial, infrastructure, and software supply chain vectors simultaneously. Organizations that lack rapid patching cadences, dependency hygiene practices, and real-time monitoring are exposed on multiple fronts at once.",[163,164,165,166,167,168,169,170,171,172,173,174,175,176,177],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 15: Service Provider Management","CIS Control 16: Application Software Security","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SA-12: Supply Chain Risk Management","NIST SP 800-53 CM-8: System Component Inventory","NIST SP 800-53 AC-6: Least Privilege","NIST CSF ID.SC-3: Supply Chain Risk Identification","NIST CSF RS.MI-3: Newly Identified Vulnerabilities Mitigated","ITIL Change Management: Emergency Change Procedures","ITIL Problem Management: Root Cause Analysis for Recurring Exploits","NIST SP 800-161: Cybersecurity Supply Chain Risk Management Practices","MITRE ATT&CK T1195: Supply Chain Compromise","MITRE ATT&CK T1190: Exploit Public-Facing Application",{}]