================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Friday, September 25, 2026 - 7:06 AM EDT ================================================================ Bitget disclosed that suspected North Korean hackers drained $351.6 million from its hot and warm wallets, the largest exchange theft of the year. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets | Feed Health EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Bitget's $351.6 million loss to suspected North Korean operators shows thieves moving upstream to custodians, while prosecutors seized bank accounts of Tether-linked payments group Capstone. see: Bitget Loses $351.6 Million to Suspected North Korean Hackers; Prosecutors Seize Accounts of a Tether-Linked Payments Group * [TREND] Microsoft's Storm-2570 profile shows one affiliate playbook behind Qilin, DragonForce, Anubis, and BERT, so post-compromise tradecraft names the intrusion earlier than any ransom note does. see: Storm-2570 Runs One Playbook Behind Four Ransomware Brands * [TREND] Russian drones that damaged Kyiv data centers on September 23 cut service at four or more providers, collapsing the distance between a physical hit and a network outage. see: Russia Pairs Drone Strikes With Cyber Sabotage in Europe * [UPDATE (new)] Attackers are hitting Roundcube's CVE-2026-48842 SQL injection live, fake payroll installers plant ScreenConnect and MacSync, and a no-permission app roots OnePlus 15 handsets that remain unpatched. see: Roundcube Webmail SQL Injection Draws Live Attacks; Fake Installers Deliver ScreenConnect and MacSync; OnePlus, Cloudflare, and File Watchers Give Up Data * [UPDATE (new)] Iran's seven-day ceasefire offer and a possible Hormuz reopening paused the bond selloff as Tokyo readied yen intervention, eurozone business lending halved, and mortgage rates topped 7%. see: Iran Offers a Seven-Day Ceasefire and a Hormuz Reopening; Tokyo Signals Yen Intervention With Washington's Blessing; Eurozone Business Lending Halves in August; Mortgage Rates Top 7% for the First Time Since January 2025 * [UPDATE (updated)] Pittsburgh's weekend brings the 49th Great Race as Joey Porter Jr.'s contract standoff enters another game week and the Pirates' home finale turned fans toward 2027. see: The Great Race Weekend Arrives; Porter's Contract Fight Finds Precedent; The Pirates Point at 2027 SECURITY ---------------------------------------------------------------- 1. ROUNDCUBE WEBMAIL SQL INJECTION DRAWS LIVE ATTACKS Vulnerabilities and Exploits · [patch, exploit] Latest developments: Researchers pinned the Roundcube flaw the Canadian Centre for Cyber Security flagged to CVE-2026-48842, rated 8.1, a pre-authentication SQL injection in the virtuser_query plugin that traces to backslash handling in a preg_replace() call. The bug affects Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, and an attacker reaches it with no login before injecting code. Anyone running a self-hosted Roundcube server should install the May 2026 patch immediately. - The Hacker News: https://thehackernews.com/2026/09/roundcube-pre-auth-sql-injection-flaw.html - SecurityWeek: https://www.securityweek.com/roundcube-webmail-vulnerability-in-attackers-crosshairs/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/critical-roundcube-flaw-now-actively-exploited-in-code-injection-attacks/ 2. FAKE INSTALLERS DELIVER SCREENCONNECT AND MACSYNC Ransomware and Cybercrime · [malware, stealer, social-engineering] Latest developments: Allure Security reported on September 25, 2026 that an attacker advertises desktop applications for three large United States payroll and human resources platforms that have never shipped one, and the installer plants ScreenConnect configured for silent remote control; Kaspersky traced the latest MacSync variant to a counterfeit cryptocurrency wallet called Toria, which runs its own website and draws traffic from X and Telegram. Ryan Merritt, director of security research at Allure Security, notes all three payroll providers deliver only web applications, so any downloadable client is a fake, and the MacSync variant steals credentials, wallet data, and files while pulling fresh payloads from public iCloud calendar events. Block installers for software that has no desktop edition and treat unsolicited wallet apps as hostile. - Help Net Security: https://www.helpnetsecurity.com/2026/09/25/fake-payroll-desktop-apps-screenconnect/ - Help Net Security: https://www.helpnetsecurity.com/2026/09/25/macsync-info-stealing-malware-for-macos/ - BleepingComputer: https://www.bleepingcomputer.com/news/security/macsync-malware-uses-public-icloud-calendars-to-deliver-new-payloads/ 3. ONEPLUS, CLOUDFLARE, AND FILE WATCHERS GIVE UP DATA Vulnerabilities and Exploits · [zero-day, cloud, mobile] Latest developments: Rasmus Moorats chained two flaws in OnePlus software to root a OnePlus 15 running current OxygenOS from an app that requests no permissions, and OnePlus told him the same flaws reach many more of its phones and OPPO's with no patch yet; Cloudflare and the researchers who found it disclosed on September 24, 2026 that a Containers flaw let one paying customer read disk data that other customers' containers left behind on the same server; and researchers showed that the file-change notification systems in Windows, Linux, and Android leak keystroke timing, browsing activity, and WhatsApp media events. Three separate boundaries that platforms ask users to trust—the Android permission model, container tenant isolation, and the operating system file watcher—hand over root, neighboring data, and user behavior. Cloudflare has fixed its flaw; OnePlus and OPPO owners have no patch to install. - The Hacker News: https://thehackernews.com/2026/09/unpatched-oneplus-flaws-let-installed.html - The Hacker News: https://thehackernews.com/2026/09/cloudflare-fixes-flaw-that-let-one.html - SecurityWeek: https://www.securityweek.com/windows-linux-android-file-notification-systems-leak-user-activity/ 4. RUSSIA PAIRS DRONE STRIKES WITH CYBER SABOTAGE IN EUROPE Nation-State Activity · [apt, critical-infrastructure] Latest developments: The internet monitoring group NetBlocks recorded partial connectivity losses at four or more internet providers serving Kyiv and other parts of Ukraine after a Russian drone attack on September 23, 2026 damaged data centers, as Dark Reading documented the wider pattern of cyber sabotage, disinformation, and drone attacks against the European countries supplying Ukraine. Russia combines network intrusion, influence operations, and physical strikes on the buildings that hold servers, so a data center hit now reads as an outage first. Operators with Ukrainian or frontline European infrastructure should plan capacity outside single physical sites. - Dark Reading: https://www.darkreading.com/physical-security/russia-hybrid-cyber-physical-war-europe - The Record: https://therecord.media/kyiv-internet-providers-report-outages-after-russian-strikes 5. BITGET LOSES $351.6 MILLION TO SUSPECTED NORTH KOREAN HACKERS Nation-State Activity · [breach, apt, cryptocurrency] Latest developments: Bitget disclosed on September 25, 2026 that attackers it suspects work for North Korea took $351.6 million out of its hot and warm wallets. Bitget, a cryptocurrency exchange, lost the funds from the wallets it keeps online to serve customer withdrawals. Exchanges holding warm wallets on internet-reachable infrastructure should re-examine signing controls and withdrawal limits. - BleepingComputer: https://www.bleepingcomputer.com/news/security/hackers-steal-3516-million-in-bitget-crypto-exchange-hack/ 6. STORM-2570 RUNS ONE PLAYBOOK BEHIND FOUR RANSOMWARE BRANDS Ransomware and Cybercrime · [ransomware, apt] Latest developments: Microsoft published tradecraft on September 24, 2026 for Storm-2570, a ransomware affiliate that reuses the same post-compromise tools and techniques whether it ends up deploying Qilin, DragonForce, Anubis, or BERT. Storm-2570 rents whichever encryptor it wants and leaves a consistent signature in the hours before deployment. Defenders who hunt that signature stop the intrusion ahead of encryption rather than after it. - Microsoft Security Blog: https://www.microsoft.com/en-us/security/blog/2026/09/24/beyond-ransomware-tracking-storm-2570-consistent-tradecraft-across-deployments/ BUSINESS AND POLITICS ---------------------------------------------------------------- * Iran Offers a Seven-Day Ceasefire and a Hormuz Reopening Latest developments: Iran's foreign minister handed Washington a seven-day ceasefire proposal overnight into Friday, September 25, saying the Strait of Hormuz could reopen within a week, and the global bond selloff paused as Brent retreated from its highs. The war has kept the Strait of Hormuz shut, and the prospect of reopening it dragged oil prices lower Friday, pulled eurozone government bond yields down, and steadied United States stock futures after a week that drove long-dated Treasury yields to two-decade highs. Traders weighed the diplomacy against continued Houthi missile fire at Saudi energy infrastructure, and analysts called the respite for debt markets tentative. - FT Home: https://www.ft.com/content/917a9cba-6afd-4ba3-8742-2b7601ecc2ba?syn-25a6b1a6=1 - FT World: https://www.ft.com/content/c5af4151-2c14-481b-8145-f5ec1f43a3f4?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/livecoverage/stock-market-today-dow-sp-500-nasdaq-09-25-2026?mod=rss_markets_main - WSJ Markets: https://www.wsj.com/finance/commodities-futures/oil-pulls-back-as-cautious-hopes-compete-with-escalation-d3308b21?mod=rss_markets_main * Tokyo Signals Yen Intervention With Washington's Blessing Latest developments: Japanese Finance Minister Satsuki Katayama said Friday, September 25, that President Trump raised the yen's weakness with Prime Minister Sanae Takaichi and that Treasury Secretary Scott Bessent would support fresh currency intervention. The yen has slid as the Bank of Japan tightens slowly from a 1.25% policy rate while American yields climb, and Katayama's remarks put Tokyo closer to selling dollars for the first time with explicit American cover. A Japanese intervention would jolt the dollar-yen market and the carry trades built on it. - FT World: https://www.ft.com/content/901ccfbc-6ddb-4fb3-b74d-1f337efca9ff?syn-25a6b1a6=1 - WSJ Markets: https://www.wsj.com/finance/currencies/trump-expressed-concerns-about-yen-weakness-japan-finance-minister-says-59dee203?mod=rss_markets_main * Prosecutors Seize Accounts of a Tether-Linked Payments Group Latest developments: United States prosecutors have seized bank accounts belonging to the payments group Capstone, the Financial Times reported Friday, September 25. Prosecutors allege Capstone moved hundreds of millions of dollars illegally for crypto companies, including Tether, at the direction of a Caribbean bank. The seizure reaches into the correspondent-banking plumbing that carries stablecoin flows, the channel banks rely on to know who stands behind crypto payments. - FT Home: https://www.ft.com/content/1477567d-64b0-431a-b707-e2a4f5a9f8dc?syn-25a6b1a6=1 * Eurozone Business Lending Halves in August Latest developments: Bank lending to eurozone businesses fell by half in August, figures published Friday, September 25, showed, the clearest sign yet that the European Central Bank's rate increase has begun to choke corporate investment. The collapse in new credit lands as German consumer confidence drops to its lowest level since May on energy costs and as the European Commission's energy commissioner warns national capitals that the continent faces its worst winter for energy prices since 2022, pressing the Trump administration to keep diesel flowing across the Atlantic. Weak credit, expensive fuel, and a widening French-German yield spread leave the euro exposed to renewed falls. - WSJ World News: https://www.wsj.com/finance/banking/bank-lending-to-eurozone-businesses-halved-in-august-11b0ec4b?mod=rss_worldnews - WSJ World News: https://www.wsj.com/economy/consumers/german-consumer-confidence-falls-to-lowest-since-may-on-energy-costs-32e99994?mod=rss_worldnews - FT World: https://www.ft.com/content/91684f96-6c7b-4b25-8486-d810d2088f9e?syn-25a6b1a6=1 PITTSBURGH ---------------------------------------------------------------- Weather: Today: Sunny, high 70F. Tonight: Mostly Clear, low 49F. Saturday: Mostly Sunny, high 71F. Business: * Thousands Skip Pennsylvania's Utility Assistance Latest developments: The Post-Gazette reported Friday, September 25, that thousands of eligible Pennsylvania households never sign up for the state's utility assistance programs and that regulators remain unconvinced by proposals to enroll them automatically. Pennsylvania's low-income programs discount electric and gas bills, and residential ratepayers across the state carry their entire cost. Automatic enrollment would pull in customers who qualify and never apply, a group that grows in consequence as winter heating bills rise. - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/powersource/2026/09/25/pennsylvania-utility-assistance-enrollment/stories/202609250013 * Mortgage Rates Top 7% for the First Time Since January 2025 Latest developments: The weekly survey published Thursday, September 24, put the average United States 30-year mortgage rate above 7% for the first time since January 2025, a fifth consecutive weekly increase. The climb follows the bond selloff that carried long-dated Treasury yields to their highest levels in two decades, and it raises the monthly cost of a Pittsburgh-area purchase for buyers already squeezed on price. Each of the past five weeks added to the rate. - TribLive: https://triblive.com/news/wire-stories/mortgage-rates-climb-for-5th-straight-week-pushing-average-rate-on-a-30-year-home-loan-above-7/ Around town: * Pennsylvania's Poor Bridges Grow Fewer Latest developments: The Post-Gazette reported Friday, September 25, that the latest national bridge report still rates many Pennsylvania spans poor while the state's count keeps improving. Pennsylvania carries one of the heaviest loads of aging bridges in the country, a legacy that drives the Pennsylvania Department of Transportation's repair schedule and the detours around Pittsburgh. The federal ratings track each span's deck, superstructure, and substructure. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/transportation/2026/09/25/national-bridge-report-pennsylvania-poor-bridges-ratings-fha/stories/202609240082 * A Dry, Seasonal Weekend and Shorter Days Latest developments: KDKA marked Friday, September 25, as the region's daylight "flip" day as fall air settled over Pittsburgh, and WTAE forecast a dry, seasonal weekend across Western Pennsylvania. The stretch of cool, sunny weather follows Friday morning's frost and holds through the Great Race weekend, with no rain in the forecast for Western Pennsylvania. - KDKA: https://www.cbsnews.com/pittsburgh/news/fall-like-weather-is-here-in-pittsburgh-and-so-is-the-lack-of-daylight-as-friday-is-flip-day/ - WTAE: https://www.wtae.com/article/dry-and-seasonal-weekend-for-western-pa/73880693 * Mama Lu, 95, Runs Pittsburgh's Feed Latest developments: Pittsburgh City Paper profiled Lucille "Mama Lu" Rago on Friday, September 25. Rago, 95, has built a large TikTok and Instagram following with videos showing off her flashy clothes, her Steelers fandom, and her humor. - Pittsburgh City Paper: https://www.pghcitypaper.com/arts-entertainment-2/meet-mama-lu-pittsburghs-95-year-old-social-media-star/ Events: * The Great Race Weekend Arrives Latest developments: The weekend guides now in print carry the 49th Great Race, the Hollywood Theater's 100th anniversary, and A Landing Ovation into the Saturday and Sunday just ahead, September 26 and 27. The Great Race, Pittsburgh's annual road race, fills downtown and the East End streets this weekend, with the Dollar Bank Junior Great Race alongside it; the Hollywood Theater marks its centennial; and A Landing Ovation pairs Pittsburgh Ballet Theatre with Pittsburgh Opera. NEXTpittsburgh's guide adds fall festivals and outdoor recreation across the region. - Post-Gazette Arts & Entertainment: https://www.post-gazette.com/life/recreation/2026/09/24/things-to-do-pittsburgh-this-weekend-1/stories/202609230059 - NEXTpittsburgh Events: https://nextpittsburgh.com/events/15-things-to-do-this-weekend-from-the-great-race-to-a-landing-ovation/ SPORTS ---------------------------------------------------------------- Pirates (81-78) Thu Sep 24 · Cardinals 1 · Pirates 2 · Final https://plaintextsports.com/mlb/2026-09-24/stl-pit Up Next · Pirates @ Tigers · Fri Sep 25, 6:40 PM https://plaintextsports.com/mlb/2026-09-25/pit-det Steelers (1-1, T-2nd in AFC North) Up Next · Bengals @ Steelers · Sun Sep 27, 1:00 PM https://plaintextsports.com/nfl/2026/week3/cin-pit Around the Teams: * Porter's Contract Fight Finds Precedent Latest developments: The Post-Gazette recounted Friday, September 25, how Rod Woodson and Darren Perry fought the Steelers over contracts and stayed in Pittsburgh anyway, as Joey Porter Jr.'s standoff reaches another game week; Matt Williamson and Wes Uhler delivered another Porter update on Thursday's SNR Drive. Cornerback Joey Porter Jr. and the Steelers remain apart on an extension, and Asante Samuel Jr. has played well in his place, a stretch the Post-Gazette detailed Thursday. Cincinnati visits Acrisure Stadium Sunday, September 27, at 1 p.m. ET on CBS. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/09/25/joey-porter-contract-talks-rod-woodson-darren-perry/stories/202609240003 - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/09/24/asante-samuel-joey-porter-contract/stories/202609240048 - Pittsburgh Steelers (YouTube): https://www.youtube.com/watch?v=3pvnVI0dUHE * The Pirates Point at 2027 Latest developments: The Post-Gazette reported Friday, September 25, that fans at the home finale spent the afternoon weighing what next season holds, and its season review argues September gives the Pirates reason to expect a different 2027. Pittsburgh missed the playoffs again, and the closing weeks brought the pieces the front office will build on: Paul Skenes finished his year with his 200th strikeout in his last start at PNC Park and faces an uncertain winter, and Brandon Lowe's bat carried the offense through the final homestand. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/09/25/mlb-home-finale-2027-season/stories/202609240060 - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/09/24/pirates-season-in-review-brandon-lowe-paul-skenes/stories/202609240034 - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/09/24/paul-skenes-cardinals-mlb-recap/stories/202609240071 * An FDNY Retiree Marks His Last Day at Acrisure Latest developments: The Post-Gazette published Mike Callan's story Friday, September 25, two days before he celebrates his retirement at the Steelers game. Callan, a New York City firefighter who worked the cleanup in lower Manhattan after the September 11 attacks, will spend his retirement day at Acrisure Stadium for Sunday's game against the Cincinnati Bengals. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/09/25/mike-callan-fdny-retirement-911-cleanup/stories/202609220036 Team USA: * ESPN Ranks the Americans by Club Form Latest developments: ESPN published its Player Performance Index Friday, September 25, ranking the 50 best United States men's national team players by their form at club level as the new World Cup cycle opens. Mauricio Pochettino has called a young group into the first three-week September international window, and the index measures which Americans arrive playing well for their clubs and which lag. The window runs through a set of friendlies that open the cycle toward the 2030 World Cup. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/50016805/ranked-top-50-usmnt-players-world-based-club-form-2026 READING ---------------------------------------------------------------- * Ed Zitron -- Where're All The AI Chips? Zitron chases the gap between the volume of AI accelerators the hyperscalers say they are buying and the compute capacity and revenue those chips actually produce, arguing the buildout's disclosed numbers fail to reconcile. https://www.wheresyoured.at/wherere-all-the-ai-chips/ * Stratechery -- An Interview with Colossus EIC Jeremy Stern About Profiling Mark Zuckerberg Ben Thompson talks with Colossus editor-in-chief Jeremy Stern about reporting long profiles of Mark Zuckerberg and other technology leaders, and what that access reveals about how the industry's founders see themselves. https://stratechery.com/2026/an-interview-with-colossus-eic-jeremy-stern-about-profiling-mark-zuckerberg/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,692.62 ▲ +1.2% Dow 51,674.22 ▼ -0.9% Nasdaq 26,787.67 ▲ +2.6% WTI crude 95.49 ▼ -6.7% EUR/USD 1.1450 ▼ -0.9% GBP/USD 1.3340 ▼ -1.0% USD/JPY 157.25 ▲ +1.6% FEED HEALTH ---------------------------------------------------------------- Security: 24 of 24 feeds loaded, 61 items in the 24-hour window. No recent items: Krebs on Security, Securelist (Kaspersky), Sophos News, Unit 42 (Palo Alto), Google Online Security Blog, Google Project Zero, The DFIR Report, Kim Zetter (Zero Day), Frank on Fraud, Wired Security. Pittsburgh: 9 of 9 feeds loaded, 60 items in the 48-hour window. Business and Politics: 8 of 8 feeds loaded, 60 items in the 36-hour window. Events: 4 of 4 feeds loaded, 16 items in the 120-hour window. Sports media: 6 of 6 feeds loaded, 30 items in the 96-hour window. Team USA: 3 of 3 feeds loaded, 30 items in the 72-hour window. No recent items: Guardian Olympics. Reading: 3 of 3 feeds loaded, 12 items in the 336-hour window. No recent items: Cal Newport. Markets (Yahoo Finance): 7 of 7 rows Weather (NWS): 3 forecast periods Scores (ESPN, plaintextsports): 2 teams via plaintextsports; mlb: ESPN failed (mlb: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nfl: ESPN failed (nfl: HTTP 403 (server: AkamaiGHost)); used plaintextsports; nhl: ESPN failed (nhl: HTTP 403 (server: AkamaiGHost)); used plaintextsports Summaries: 3 model call(s) served by claude-opus-5 (363s of model time; $1.89 at API list price). ================================================================ Generated 2026-09-25 07:06 EDT. Updated weekdays at about 7:05 AM, 10:05 AM, 1:35 PM, and 7:35 PM ET, and weekends at about 8:05 AM and 7:35 PM ET. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 3 Team USA feeds; WSJ World News, WSJ Markets, WSJ US Business, WSJ Politics, The Economist, FT Home, FT World, FT Markets; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN or plaintextsports.com. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================