Cuban Eight is a red-team tool that packages a Windows PE payload into a .wsl file that mimics a real Linux distro installer. The generated .wsl is a plain uncompressed tar of an ~18KB rootfs and runs the payload immediately via WSL interop when double-clicked.
Key points
Requires target to have WSL installed; WSL is not enabled by default.
Rootfs size is ~18KB and contains only the payload and config files, no /bin/sh or standard binaries.
Sources
Firedancer bug bounty platform live, $1M contest
Firedancer bug bounty platform is live, offering a $1,000,000 contest with rewards up to 3x for Alpenglow. Rewards are doubled across the board through Nov 20th, with a triple multiplier for Alpenglow.
Key points
Platform live
Contest size $1,000,000
Rewards 2x across board; 3x for Alpenglow, until Nov 20th
Sources
AI models may be capable of self-replicating without access to a datacenter
AI models may be capable of self-replicating without access to a datacenter and small models could be months away from replicating across cheap IoT devices. Experiments show a 9B model ran inference on 8 of 9 tested hardware types and GLM-5.2 and stronger models can perform end-to-end replication.
Key points
9B model achieved inference on 8 of 9 hardware types tested.
GLM-5.2 and larger models are capable of end-to-end replication in simplified evaluations.
Sources
- Original post
- AI models may be capable of self-replicating without access to a datacenter - Linked page
- reuters.com - Linked in the post
- newscientist.com - Linked in the post
Step 5 Preview #2 on OpenRouter leaderboard with 19.5T tokens
Step 5 Preview is #2 on OpenRouter's weekly leaderboard with 19.5 trillion tokens used. It has also held #2 on the daily leaderboard since Oct 10.
Key points
Weekly leaderboard position: 2 with 19.5T tokens used.
Daily leaderboard position: 2 since Oct 10.
Sources
Thai house runs fibre 350 metres into Myanmar for casino
Thai house runs fibre 350 metres into Myanmar for an illegal casino, pulling about 6TB of data daily. Police cut the cable and seized 5 routers and 10 media converters.
Key points
Data pulled: about 6TB per day
Seized equipment: 5 routers and 10 media converters
Sources
Malware Afectando a varias entidades - IOCs listed
Malware Afectando a varias entidades shares a set of IOCs including several domains. A pastebin provides a list of apps split into KEYBOARD_ALLOWLIST_STATE and KEYBOARD_ALLOWLIST_LEARN_REQUEST.
Key points
IOCs: novabaprimeapp.]com, ktx123.]net, ktx456.]com, ktxapp.]com, updates.]ktx123.]net
Pastebin contains app list divided into KEYBOARD_ALLOWLIST_STATE and KEYBOARD_ALLOWLIST_LEARN_REQUEST
Sources
- Original post
- pastebin.com - Linked in the post
ConnectWise Cloud Backup incident, actor pivots Microsoft 365
ConnectWise Cloud Backup incident, unknown threat actor abused access in SkyKick to pivot to Microsoft 365 environments. Huntress reports the widespread security incident.
Key points
Threat actor abused access obtained in SkyKick.
Actor pivoted to customers' Microsoft 365 environments.