CISO Briefing: Ledger Implant Theft, Flax Typhoon Takedown, iRhythm Breach

Security leaders should note two developments first: Ledger confirmed a hardware implant tied to more than $93 million in drained crypto wallets sold through a single Southeast Asia reseller, and the FBI seized seven domains behind Chinese state-linked Flax Typhoon hacking tools while CISA added five related flaws to its Known Exploited Vulnerabilities catalog. Also this week: iRhythm disclosed a breach affecting at least 360,000 people, NVIDIA's GPU monitoring exporter left thousands of AI servers exposed to unauthenticated crashes, European wind and solar operators were found with thousands of internet-facing control systems, and Options Clearing Corporation named a new Chief Security Officer.

FBI seizes domains behind China-linked Flax Typhoon hacking tools

The FBI seized seven domains tied to Microscan and FishHub, reconnaissance and spear-phishing tools linked to Chinese state-sponsored group Flax Typhoon and operated through Integrity Technology Group. Between April and December 2022, Microscan scanned a South Carolina power company, airports in Japan and Poland, Taiwanese gas and power firms, and two Taiwanese universities later breached. FishHub, used as of March 2026, delivered remote-access malware via spear phishing; DOJ says about 20 Taiwanese universities are confirmed victims. Agencies urge patching, MFA, and disabling unused services. (Help Net Security)

CISA adds five more flaws exploited by Flax Typhoon actors to KEV catalog

CISA added five vulnerabilities—flaws in ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts and ISC BIND, with CVSS scores as high as 10.0—to its Known Exploited Vulnerabilities catalog after their use by Flax Typhoon actors tied to China-based Integrity Technology Group. A joint advisory from Australia, Canada, Japan, New Zealand, Spain, the UK and the US details exploitation involving scanning tools, cross-site scripting and password spraying against Microsoft Exchange servers. Federal agencies had until October 11, 2026, to patch or discontinue use; CISOs managing any of these products should confirm patch status immediately. (Security Affairs)

Hidden implant in Ledger wallets linked to over $93 million in crypto theft

Ledger said all confirmed cases from the October 9, 2026 wallet-draining incident involve devices sold through Southeast Asia reseller CryptoBilis, with on-chain researchers estimating losses above $93 million. Former Mt. Gox CEO Mark Karpelès said a tampered device contained a hidden circuit board with a microcontroller, antenna, LTE chip and e-SIM that captured recovery phrases shown on screen. Ledger confirmed one device held an unauthorized implant but has not detailed its mechanism, and it is now urging CryptoBilis purchasers to move assets to new devices with new seeds. (Help Net Security)

iRhythm discloses breach affecting at least 360,000 people

Medical device maker iRhythm disclosed that the data of at least 360,000 people was compromised in a June 2026 cyberattack, with notices filed in Texas, South Carolina and California. The company said hackers accessed third-party-hosted business applications via social engineering between June 3 and June 8, 2026, taking names, addresses, phone numbers, device serial numbers, insurance numbers and dates of birth. In its SEC 8-K filing, iRhythm said a threat actor demanded payment to avoid public disclosure; clinical systems, devices and manufacturing were not affected. (The Record (Recorded Future News))

Options Clearing Corporation names Jake Middleton Chief Security Officer

Options Clearing Corporation, the central counterparty clearing every listed U.S. options trade, announced the appointment of Jake Middleton as Chief Security Officer. OCC describes itself as the world's largest equity derivatives clearing organization, serving as central counterparty for options, futures and securities-lending transactions across multiple exchanges. The appointment adds a named security leader atop critical financial-market infrastructure that other market participants and regulators will likely track as part of their third-party risk reviews. (intelligence360)

Thousands of internet-exposed GPU servers vulnerable to NVIDIA DCGM flaw

Researchers at Lava found more than 2,000 internet-exposed GPU servers across nearly 300 organizations vulnerable to CVE-2026-47483, a high-severity flaw (CVSS 8.2) in NVIDIA's DCGM Exporter that lets unauthenticated attackers crash GPU monitoring and potentially disrupt AI workloads. NVIDIA published a bulletin on July 28, 2026. Affected GPUs, valued near $100 million, included Blackwell Ultra B300, H200, H100 and consumer RTX cards, with the US hosting 44% of exposed devices. NVIDIA recommends upgrading DCGM Exporter to version 4.8.2 or later and keeping monitoring tools off the public internet. (Help Net Security)

Dutch cyber center finds 8,547 exposed wind and solar systems across Europe

Modat and NCSC-NL, the Dutch government's cybersecurity center, found 8,547 internet-facing systems at wind farms and solar parks across 35 countries in and around the EU that should not be reachable online, ranging from login pages to a turbine control panel with a public Stop button. Spain, Greece, Italy and Germany account for most confirmed systems. Under NIS2, management bodies of essential and important entities must approve and oversee cybersecurity measures; researchers urge CIOs to inventory every remote vendor connection and pull admin interfaces off the internet immediately. (Help Net Security)