> InfoSec News Nuggets – 11/03/2026

FBI links $6.3 billion Binance hack to North Korea The FBI and federal partners have attributed the $6.3 billion theft from cryptocurrency exchange Binance to North Korea’s TraderTraitor hacking group, the same unit blamed for the $1.5 billion Bybit heist in 2025. Blockchain intelligence firm TRM Labs estimates the attackers moved $6.36 billion out of Binance’s wallets in roughly 20 minutes, making it the largest crypto theft on record, while about $3.24 billion remains parked in addresses linked to the hack. Binance says its preliminary investigation points to a compromised engineer’s laptop that gave the attacker access to an internal service used to submit unauthorized withdrawals, and the exchange has pledged to cover all customer losses.   Apple warns German officials of targeted spyware attacks Germany’s Federal Office for Information Security (BSI) has warned that several members of the Bundestag and other public figures received Apple threat notifications about targeted mercenary spyware attacks, with alerts arriving from October 29. Apple’s latest round of notifications went out to targeted users in 99 countries, and the BSI says it cannot yet determine whether the alerts reflect successful infections or attempted attacks, nor which spyware or operators are involved. The agency is urging recipients to update their devices immediately, enable Lockdown Mode permanently, and, for those at high risk, consider replacing devices, resetting accounts and changing phone numbers.   Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw Synology is urging customers to update the DiskStation Manager (DSM) software on their NAS devices after threat actors began exploiting a vulnerability patched in December 2024 to deploy ransomware on systems running outdated versions. While the company did not name the exact flaw, it pointed to an advisory covering three bugs, including the critical CVE-2024-10441 remote code execution vulnerability rated 9.8 on the CVSS scale. Users have reported infections by C3RB3R ransomware, which locks files with a “.L0CK3D” extension, and Synology recommends enabling automatic updates to keep DSM current.   Google disrupts XCPE botnet, bans the company behind it Google has shut down the servers behind XCPE, a backdoor embedded in the firmware of more than 1.3 million Android TV set-top boxes, and attributed the operation with high confidence to Videostrong Technology, the company that manufactured many of the devices. The manufacturer allegedly sold access to criminal affiliates who pushed modules for ad fraud, residential proxy networks, credential theft and further malware, and Google estimates that taking down the affiliates’ command domains also cuts off access to at least 10 million additional compromised devices. Google has banned the company and any future affiliates from building certified Android devices and has tightened firmware integrity checks for certified Android TV hardware.   Trezor warns of suspected crypto-theft implant in hardware wallet Hardware wallet maker Trezor is warning customers after receiving a credible report of a suspected crypto-theft implant inside a Trezor Safe 5 sold by Southeast Asian reseller CryptoBilis, the same retailer tied to a recent Ledger implant incident. An Indonesian buyer reportedly found an extra circuit board with a cellular module and antenna between the device’s main board and screen, apparently capable of reading the recovery phrase off the display and transmitting it over a mobile network. Trezor, which cut ties with CryptoBilis on October 9, advises anyone who bought a device from the reseller since March 2026 to stop using it and move funds to a newly created wallet with a new recovery phrase. The post InfoSec News Nuggets – 11/03/2026 appeared first on AboutDFIR - The Definitive Compendium Project.