N-able attackers exploit N-central flaws to mine cryptocurrency

The Hacker News reported on 13 November that N-able had disclosed active exploitation of flaws in N-central, tracked as 4EverAble2Shell and Agent2Shell, affecting devices running the latest N-central.The Hacker News Security firm Previdian attributed an unauthenticated exploit chain, 4EverAble2Shell, to unsafe class instantiation during SOAP fault processing in the bundled Apache Axis component; a crafted request can result in commands running as the nable service account.The Hacker News The Hacker News said attackers had moved from probing to deploying cryptocurrency miners, and cited Huntback as reporting that one IP address was used to install an XMRig Monero miner on 21 N-central servers.The Hacker News Nineteen of those servers were already on Hotfix 2.The Hacker News The chain is linked to CVE-2026-90436 and an N-central privilege-escalation weakness; root access on Windows is possible under specific conditions.The Hacker News N-able said it had restricted features and integrations in hosted environments while assessing disclosures and developing remediation, and the extent of exploitation beyond the reported infections remains unclear.The Hacker News

AnalysisThe report describes active exploitation and server infections, but does not establish the total number of affected N-central customers.The Hacker News

TSMC said in a filing to the US Securities and Exchange Commission on 12 November that data on some current and former employees had appeared on an external website.SecurityOnline The company said the records matched information held by a cloud service provider and that it had found no evidence its own systems were compromised.SecurityOnline TSMC said the exposed information was unrelated to its operations and customer data.SecurityOnline TSMC has not named the provider, identified the data fields or confirmed how many people were affected.CyberSIXTSecurityOnline SecurityOnline reported that Taiwanese media described a 6.9GB dataset, while a seller claimed it contained 46,000 records; TSMC has not confirmed either figure.CyberSIXTSecurityOnline The company said it was informing affected staff and working with the provider, investigating authorities and an outside cybersecurity firm.CyberSIXTSecurityOnline It has not said how the provider’s systems were accessed or whether other customers were affected.CyberSIXTSecurityOnline

AnalysisTSMC’s statement locates the records with a third-party provider, but the provider and the scale of exposure remain undisclosed.CyberSIXTSecurityOnline

Caixa Seguridade disclosed that attackers accessed and copied Caixa Vida e Previdência’s customer registration database.CyberSIXT The company said the exposure covered names and CPF tax numbers for all 7.6 million active customers as well as former customers; some records also included addresses, phone numbers, email addresses and dates of birth.CyberSIXT It found the unauthorised access on 6 November and reported the incident to Brazil’s data protection authority, other authorities and affected people on 11 November.CyberSIXT The company said its preliminary assessment found no evidence that financial or authentication data, including policy values, pension balances, bank details or passwords, had been taken.CyberSIXT It said it identified and blocked the methods used and hired an outside forensic firm to investigate the origin and scope.CyberSIXT The company also reported no evidence so far that the data had been published or misused; its investigation and monitoring were continuing.CyberSIXT

The US Department of Justice and FBI, working with international partners, removed Gootloader malware from more than 100 servers and seized US domains used to control the network, SecurityOnline reported.SecurityOnline The court-authorised operation included servers running hijacked WordPress websites used to trick visitors into downloading malicious files.SecurityOnline Authorities said infected computers were added to a botnet, with access sold to ransomware gangs.SecurityOnline Authorities said Gootloader had infected more than 25,000 computers worldwide since 2018 and was linked to 44 ransomware attacks in the United States, causing about US$28.8 million in claimed losses.SecurityOnline They said victims included the US Department of War and the Defense Industrial Base.SecurityOnline The operation formed part of multinational Operation Endgame, with Europol and police agencies in seven other countries involved; individual suspects were not named.SecurityOnline