The Good, the Bad and the Ugly in Cybersecurity - Week 46 (2026)

The Good | Authorities Dismantle Crypto Scams, Ban Illicit Exchange & Seize Malware Infrastructure

Ukrainian law enforcement partnered with German authorities this week to dismantle a network of cryptocurrency scammers that stole over €4.3 million from victims in Europe. Operating out of Ukrainian centers, the criminals used social media and dating apps to carry out romance baiting and other schemes. 

After building up trust, they coerced victims into depositing funds into bogus trading platforms and attacker-controlled cryptocurrency wallets. Coordinated raids across four regions yielded hardware wallets, computer equipment, SIM cards, and over $13,000 in seized currencies. The four detained suspects remain in pre-trial custody and face up to 12 years in prison.

In the U.S., the Department of the Treasury cut off MEXC Global cryptocurrency exchange from the American financial system over extensive sanctions evasion and ties to cybercrime gangs. Between 2021 and 2026, the global platform facilitated over $16 billion in illicit transactions, according to an enforcement order from U.S. Financial Crimes Enforcement Network (FinCEN). 

Regulators identified MEXC as a key financial clearinghouse for ransomware gangs, darknet activity, and state-backed entities evading sanctions across Russia, Iran, and North Korea. While FinCEN calls out deficiencies in the exchange’s anti-money laundering and customer verification policies, MEXC states they are reviewing the order with legal and compliance experts. 

Europol and Eurojust also seized 257 domains and 235 servers powering the Gootloader, CastleRAT, and StealC malware operations. The joint takedown, part of the long-running Operation Endgame, spanned nine partner nations all targeting loaders, info-stealers, and remote access trojans (RATs) actively leveraged by cybercriminals to harvest corporate credentials and deploy secondary payloads. 

Investigators uncovered over six million compromised credentials and $6.4 million victim datasets stored across the criminal infrastructure. Now, authorities are forwarding the recovered records to public breach-notification services to alert affected organizations and users.

The Bad | Turla Attackers Deploy Cereal Malware to Spy on Government Exchange Servers

Russian state-backed threat group known as Turla is deploying a previously undocumented .NET cyberespionage framework dubbed Cereal to intercept communications on Microsoft Exchange servers across government organizations. Researchers began tracking the first wave of attacks in 2025 when Tulra compromised a government body in Kazakhstan before striking a Romanian state agency. In Romania shortly after, operators configured the toolset to selectively capture sensitive email correspondence involving representatives from NATO and the European Union.

Turla (aka Snake, UNC4210), linked to Russia's Federal Security Service (FSB), engineered Cereal for stealthy, long-term intelligence gathering. The malware avoids external command-and-control (C2) infrastructure entirely. Instead, it abuses the compromised Exchange server itself as a centralized execution hub and persistent collection point. The framework comprises eight modular components that rely extensively on data serialization and in-memory execution to conceal illicit activity from security defenders.

A primary module, named CerealBox, injects directly into Exchange's transport service process, EdgeTransport.exe. Once inside, it hijacks existing transport handlers to inspect message traffic without registering unauthorized transport agents or interrupting normal email delivery. The module automatically compresses, encrypts, and stages messages containing PDF, DOC, or DOCX attachments matching targeted sender, recipient, or subject criteria.

At the same time, a passive backdoor named CerealNeuron listens for incoming encrypted web requests designed to blend with regular Exchange traffic. Upon receiving instructions, it launches disposable CerealRunner binaries that execute memory-resident payloads to query Active Directory, extract LSA secrets, inspect mailboxes, and return encrypted results to the backdoor for exfiltration. 

Security analysts emphasize that Cereal's extensive concealment strategies reflect Turla’s deep understanding of .NET execution techniques running inside legitimate processes, marking a mature offensive platform ready for long-term, stealthy cyberespionage.

The Ugly | Threat Actors Breach Railway Infrastructure to Steal Customer AI Secrets

Cloud hosting platform Railway confirmed that threat actors exploited flaws within its build infrastructure to steal decrypted customer authentication secrets, resulting in an estimated $740,000 in unauthorized AI usage charges. 

The intrusion began on October 20 when adversaries exploited a previously unknown vulnerability to escape build filesystem isolation and capture internal credentials. Using these credentials, the attackers accessed stored build histories and obtained a copy of Railway's monorepo source code to identify further exploitation paths across the environment.

The attackers then exploited an improperly configured OIDC trust binding within Railway's cloud deployment system, moving laterally to compromise an orchestration server. Since that machine managed fleet workloads, it held credentials authorized to decrypt customer environment variables via cloud key management services. 

Between October 20 and October 21, the intrusion escalated into a 26-hour operational contest between Railway engineers and threat actors deploying autonomous AI agents to probe systems in parallel.

Forensic investigations revealed that the attackers specifically targeted environment variables containing API keys for major AI providers, likely seeking access for resale or model distillation. The breach potentially exposed credentials across at most 1.85% of workspaces, representing approximately 100,000 customer environments, alongside linked-account tokens for 1,852 users. However, forensic analysis showed no evidence that attackers accessed customer databases. The investigation also found no indication that attackers downloaded private Git repositories.

Railway fully evicted the threat actors on October 21, isolated each build within dedicated ephemeral virtual machines, and rotated affected tokens. While the company is coordinating with AI providers to secure customer refunds, it pledged to cover any fraudulent charges that vendors decline to reimburse. 

Watch the GBU Highlights