By the N2K CyberWire staff
Top stories.
- Leak site publishes stolen data on 41,000 DHS employees.
- Binance suffers the largest crypto theft on record.
- Researchers analyze Volt Typhoon’s covert access network.
- Maximum-severity GitLab flaw is under active exploitation.
- A suspected surveillance operation targets Starlink users.
Leak site publishes stolen data on 41,000 DHS employees.
WIRED reports that a massive leak of Department of Homeland Security records has exposed information on more than 41,000 DHS employees and contractors, including details of undercover and surveillance programs. Leak website DDoSecrets published the data, which it obtained from a hacker group calling itself the “Department of Peace.” DDoSecrets says the data was stolen from DHS's Okta login system. An Okta spokesperson told WIRED, “We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised.”
The dataset includes email addresses, phone numbers, and office addresses of employees. The hacktivists say the breach was in response to DHS’s stepped-up Immigration and Customs Enforcement (ICE) operations. CyberScoop notes that the searchable website hosting the data was taken offline Thursday morning.
A DHS spokesperson said in a statement, “DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively. We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available.”
Most DSPM solutions stop at visibility. Does yours?
As cloud environments continue to expand, sensitive data can become difficult to track, classify, and protect. Understanding the maturity of your Data Security Posture Management (DSPM) program is an important step toward reducing risk and strengthening data security outcomes. Thales helps organizations identify, prioritize, and reduce risk through integrated data protection and remediation.
Binance suffers the largest crypto theft on record.
Cryptocurrency exchange Binance estimates that $6.3 billion was stolen in what is likely the largest crypto heist in history, the New York Times reports. Hackers began siphoning cryptocurrency from Binance wallets around 4:00 PM yesterday, and completed the theft in about twenty minutes. Binance suspended all deposits and withdrawals while it investigated the hack, and the exchange says it was able to freeze about half of the funds.
Blockchain intelligence firms TRM Labs and Chainalysis have attributed the theft to the North Korea-linked TraderTraitor operation. Tom Robinson, chief scientist and cofounder of Elliptic, told WIRED, “If North Korea is behind it, this one theft would almost double everything the regime has stolen in crypto to date.”
TRM Labs states, “Early on October 29, the operator deployed a first piece of code for the attack and tested it on two wallets. Later that day, it rehearsed the final version on a third wallet, then routed the test funds back to itself. Four hours after that rehearsal, the same code was installed on a Binance hot wallet.” The researchers say the attack “points to a compromise of Binance's hot wallet signing infrastructure.”
Binance says losses will be fully reimbursed, and the exchange has reserved more than $6.34 billion of company funds to cover the incident.
Authentication isn't enough. Control what every identity can do.
Your identities now include employees, vendors, machines, applications, workloads, and AI agents. See how Xage controls what every identity can access and what it can do, with just-in-time access, no standing privilege, and continuous control across critical infrastructure, data centers, and enterprise AI. Control every Identity.
Researchers analyze Volt Typhoon’s covert access network.
A report from Lumen’s Black Lotus Labs outlines a covert access network dubbed “Silent Train” used by the China-linked APT Volt Typhoon to target critical infrastructure entities. Silent Train is a network of compromised SOHO, IoT, and enterprise devices that Volt Typhoon uses to infiltrate sensitive American networks.
The researchers explain, “At a high level, Silent Train relied on a series of intermediary hops that insulated the attacker from both victims and threat hunters alike. Sessions began from virtual private servers (VPS) outside the U.S., then daisy-chained through compromised non-U.S. devices before pivoting within the U.S. to reach targets.”
The threat actor has used Silent Train to target “telecommunications providers, government, defense contractors, satellite and mission-critical communication services, universities, IT firms and critical infrastructure such as water, energy, transportation, maritime, rail, aviation, emergency services and other essential operations.”
Where cyber leaders come together to turn challenges into action.
The Aspen Cyber Summit brings together leading voices from government, industry, and civil society to address the cybersecurity challenges shaping our future. Join senior leaders and experts in Washington, DC, for consequential conversations focused on moving beyond identifying risks to advancing actionable, cross-sector solutions.
Maximum-severity GitLab flaw is under active exploitation.
The US Cybersecurity and Infrastructure Security Agency (CISA) has confirmed active exploitation of a maximum-severity GitLab vulnerability that was patched on October 12th, BleepingComputer reports. The vulnerability (CVE-2026-97229) can allow “an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.”
CISA has ordered Federal agencies to patch the flaw by Sunday, November 1st, and private-sector entities should follow suit.
A suspected surveillance operation targets Starlink users.
TrendAI researchers have found that Israeli ad tech company Discover-Tech heavily targeted Starlink users as part of a surveillance operation, Reuters reports. Discover-Tech was the subject of a report by Citizen Lab earlier this month, where researchers found that the company’s targeted ads were used to infect devices at Al Jazeera with spyware. Sources familiar with TrendAI's research said Discover-Tech was the number-one bidder for advertising space on Starlink traffic in 105 countries.
TrendAI published a report on the activity on October 15th, but did not name Discover-Tech directly. The researchers attribute the activity to an “ad-tech entity” tracked as “SHADOW-EARTH-79,” which the sources say is TrendAI’s codename for Discover-Tech. TrendAI said this entity “accounts for approximately 13% of all winning bid events in Starlink traffic, five times higher than average (approximately 3%) bids for other bidders, and the highest of any high-volume buyer,” adding that “Starlink is widely used in conflict zones where terrestrial networks are degraded.”
