TCSR Weekly Roundup: Ivanti Zero-Days, a Record Crypto Heist, and Supply-Chain Woes

Introduction

It was a heavy week for trusted infrastructure: Ivanti shipped patches for two more zero-days in an already exploited attack chain, a CVSS 10.0 flaw landed in LXD and MicroCloud, and several vendors — from Chainalysis to Northflank — disclosed intrusions with customer-facing consequences. Crypto theft also made headlines, with the FBI attributing a record Binance heist to North Korean actors.

Ivanti Patches More Exploited Zero-Days

• Ivanti has released patches for two additional zero-day vulnerabilities in Connect Secure, both reportedly used as part of a broader exploitation chain.
• Connect Secure appliances have been a repeated target this year, so organizations running them should apply the update promptly and review appliance logs for signs of prior compromise.

A CVSS 10.0 Flaw in LXD and MicroCloud

• A maximum-severity vulnerability in LXD and MicroCloud allows attackers to impersonate trusted clients without possessing a private key.
• Given the score and the nature of the flaw, environments relying on these container-management tools should check whether a fix is available and prioritize patching.

North Korea and the Record Binance Heist

• The FBI has linked a crypto theft from Binance — reported at roughly $6.3–6.4 billion — to North Korean hackers, with separate reporting tying it to the TraderTraitor campaign.
• The scale, if confirmed, would make it one of the largest crypto heists on record and underscores continued state-sponsored focus on cryptocurrency platforms.

Smaller-Scale Crypto and Supply-Chain Attacks

• Around $2.7 million was stolen from Polymarket traders via a hijacked DebugBear script — another reminder that compromised build or monitoring pipelines can directly hit end users.
• Northflank disclosed a security breach in which customers' AI API keys were abused, a novel twist on credential theft now that API keys carry real monetary value.
• Chainalysis confirmed an intrusion into internal tools with exposure of customer identity data; customers of identity-verification-heavy services should watch for follow-up notifications.

Malware and Mobile Threats

• A new infostealer dubbed VOLTA uses public AI models (Claude, Gemini, and Kimi) to rank stolen victim data by financial value — an example of attackers using commodity AI services for triage rather than novel capabilities.
• NetamLoader malware is targeting Windows 10 government systems in Asia through .NET injection.
• An Android "SMS of Death" exploit can remotely crash unpatched phones; users should install pending Android security updates.

Defensive Tooling and Community Notes

• Alpine Linux rebuilt its GitLab instance after an attempted remote code execution attack; the attempt was reportedly unsuccessful.
• Reddit will lock some content behind logins to combat scraping — a change that may affect OSINT and threat-intelligence workflows that rely on public Reddit data.
• Tool releases worth noting from the SANS community: Wireshark 5.0.0rc1, YARA-X 1.22.0 and 1.22.1, plus SANS coverage of OneNote file extraction — relevant for teams that parse attachments during incident response.
• A Syrian hacker has been sentenced to prison in the US after more than a decade on the run, closing out a long-running case.

Funding Watch

• Northstar Security emerged from stealth with $7 million in funding to identify "toxic risk combinations" — signals that detection of compounding, individually minor risks remains an investor-backed gap.