> ## Content Index
> Fetch the complete content index at: https://www.metacurity.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Google dismantles 1.3 million-device botnet built into Android TV boxes
- URL: https://www.metacurity.com/google-dismantles-1-3-million-device-botnet-built-into-android-tv-boxes/
- Published: 2026-11-03T12:28:21.000Z
- Updated: 2026-11-03T12:28:21.000Z
- Description: Chinese manufacturer Videostrong allegedly shipped devices preloaded with malware that hijacked users’ internet connections for proxy services and cybercrime. The Google takedown could disrupt more than 10m additional infected devices.
- Author: Cynthia B Brumfield
- Tags: Cybersecurity, News, #no-feature-image

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/11/xcpebotnet-1.png)

Malware system of XCPE botnet. Source: Google Threat Intelligence Group.

**Spend less time finding cybersecurity news. Get more out of it.**

Metacurity delivers the cybersecurity news, analysis, and insight that would take you hours—and sometimes days—to assemble yourself.

Every weekday, we sift through thousands of news articles, press releases, filings, court documents, and research reports, including details that vendor announcements and PR pitches leave out. We tell you what changed, why it matters, and what deserves your attention. Minimal vendor marketing. No outrage bait. No SEO filler.

**A paid subscription gives you:**

- **The full Metacurity archive:** Every newsletter, searchable and browsable.
- **Our weekly long-reads roundup:** The best cybersecurity writing from across the industry, selected and vetted to make your reading time count.
- **Specialized reports and analysis:** Periodic deep dives that go beyond the daily headlines.
- **A direct role in sustaining independent journalism:** Your subscription helps keep our editorial priorities focused on readers and the cybersecurity community.

If Metacurity saves you time, helps you spot an important development, or gives you a clearer understanding of the industry, please consider becoming a paid subscriber. Your support keeps that work going.

**Subscribe today—and thank you for reading and supporting Metacurity.**

[Upgrade my subscription](#/portal/account/plans)

### Google announced it worked with industry partners to dismantle a botnet made up of more than 1.3 million Android TV set-top boxes that ship with malicious software that secretly rents the user’s Internet connection out to strangers and conducts advertising fraud. 

Experts involved in the takedown say the action is likely to sever the botnet’s access to more than 10 million additional compromised systems, including other Internet of Things (IoT) products such as Android-based healthcare devices and karaoke machines.

Google Threat Intelligence Group (GTIG) said Google has severed ties with Videostrong Technology Co., a TV box manufacturer in China that GTIG and other industry experts concluded was responsible for including malware that enrolled more than 1.3 million set-top boxes in a botnet dubbed “XCPE” (named after one of the malware’s core code components).

GTIG said the XCPE botnet loaded the user’s device with software that makes their Internet address available for resale by multiple “residential proxy” services, which allow customers to rent Internet addresses as a way to anonymize their web traffic or spoof their true location. Residential proxy services are a major source of unwanted and often malicious traffic, including account takeover activity, advertising fraud, and mass content scraping for AI projects.

“Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices,” GTIG said, noting that Google took legal action to take down the domains and servers Videostrong used to control the botnet and install additional malware. “A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust, and represents a serious risk to those users. Without users’ knowledge or consent, infected devices were offered as a distribution mechanism for a wide array of criminal actors.”

GTIG calls out a number of residential proxy providers whose software development kits were routinely downloaded by devices infected by the XCPE botnet. Those include AppSalt, also known as Honeygain, which the Vilnius, Lithuania-based Oxylabs owns. In October 2026, Oxylabs was relaunched under a new brand called Source, after receiving $130 million in funding from private equity firm Warburg Pincus that reportedly valued the business at $3.6 billion. Oxylabs did not respond to a request for comment.

Another provider linked to the botnet was NetNut, a once sprawling residential proxy company operated by the publicly traded Israeli company Alarum Technologies. In July 2026, the FBI worked with industry partners to seize hundreds of domains associated with NetNut, saying the company was responsible for operating a separate botnet called Popa that enslaved TV boxes as residential proxies. Other proxy providers named in the GTIG report include EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb and GaGaNode. ([Brian Krebs / Krebs on Security](https://krebsonsecurity.com/2026/11/tech-firms-dismantle-botnet-that-turned-1-3m-tv-boxes-into-proxies/?ref=metacurity.com))

**Related:** [*Google*](https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet?ref=metacurity.com)*,* [*Bleeping Computer*](https://www.bleepingcomputer.com/news/security/google-disrupts-million-device-xcpe-android-malware-botnet-bans-tv-box-maker/?ref=metacurity.com)*,* [*CyberScoop*](https://cyberscoop.com/google-disrupts-xcpe-botnet-videostrong-android-devices/?ref=metacurity.com)*,* [*Cyber Security News*](https://cybersecuritynews.com/google-dismantles-xcpe-botnet/?ref=metacurity.com)*,* [*TechAeris*](https://techaeris.com/2026/11/02/xcpe-botnet-hid-in-1-3-million-android-tv/?ref=metacurity.com)*,* [*Help Net Security*](https://www.helpnetsecurity.com/2026/11/02/xcpe-botnet-android-backdoor/?ref=metacurity.com)*,* [*Security Affairs*](https://securityaffairs.com/202323/malware/inside-xcpe-the-botnet-that-turned-set-top-boxes-into-proxy-servers.html?ref=metacurity.com)*,* [*Advanced Television*](https://www.advanced-television.com/2026/11/03/google-shuts-the-door-on-xcpe-botnet/?ref=metacurity.com)*,* [*Nacionale*](https://www.nacionale.com/en/articles/xcpe-botnet-android-tv-boxes-hijacked-what-owners-should-do?ref=metacurity.com)*,* [*Shattered*](https://shattered.io/google-videostrong-xcpe-botnet-1-3-million-set-top-boxes-2026/?ref=metacurity.com)*,* [*Infosecurity Magazine*](https://www.infosecurity-magazine.com/news/police-tech-firms-team-up-to/?ref=metacurity.com)*,* [*Security Week*](https://www.securityweek.com/google-dismantles-xcpe-botnet-of-1-3-million-android-devices/?ref=metacurity.com)*,* [*Android Authority*](https://www.androidauthority.com/android-tv-box-maker-google-botnet-malware-3730930/?ref=metacurity.com)*,* [*The Register*](https://www.theregister.com/cyber-crime/2026/11/02/cops-bust-botnet-of-13m-infected-android-tv-boxes/5307045?ref=metacurity.com)

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/11/image-6.png)

Global distribution of x.cpe. Source: Google Threat intelligence Group.

### Europol announced that an international operation involving authorities in Albania, Cyprus, Finland, Germany, Kosovo, and North Macedonia, supported by Europol and Eurojust, has struck at the infrastructure of an investment fraud scheme with potential victims in over 50 countries. 

More than 100 servers were seized and sevensuspects arrested during coordinated action on 3 November 2026.

Led by the German Itzehoe Public Prosecutor's Office (Staatsanwaltschaft Itzehoe), the operation targeted a company suspected of supplying fraudulent trading websites to criminal groups. The entity is connected to call center operators who allegedly persuaded victims to hand over their savings. Investigators estimate losses exceeding EUR 4 million.

Authorities searched 17 locations and seized servers, other evidence and assets. Seven suspects were arrested with a view to extradition to Germany.

The action follows four years of investigation and earlier interventions in 2022 and 2025\. Evidence gathered during those operations led to the company allegedly operating the ‘crime-as-a-service’ model from Cyprus and Israel. Investigators also identified suspected clients operating fraudulent call centers in Albania, Kosovo\* and North Macedonia.

The scheme promised substantial, quick returns from trading in cryptocurrencies, foreign currencies or stocks. Behind seemingly legitimate platforms, supposed brokers used fictitious profits and sustained psychological pressure to persuade victims to invest more. ([Europol](https://www.europol.europa.eu/media-press/newsroom/news/investment-scams-potential-victims-in-least-50-countries-over-100-servers-seized?ref=metacurity.com))

**Related:** [*Eurojust*](https://www.eurojust.europa.eu/news/international-investment-fraud-scheme-dismantled-seven-arrests?ref=metacurity.com)

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/11/260311-Investment-scam-Server-Seizure-2.png.webp)

### According to data published by Arkham, Mercado Bitcoin, Brazil's largest cryptocurrency exchange, suffered a security incident involving approximately $46.3 million in assets.

"We identified and swiftly contained a security incident in one of our systems early this morning," the exchange said in a post on X. Mercado Bitcoin temporarily suspended deposits and withdrawals as a precaution while its teams investigate the incident, track the assets, and coordinate with authorities.

The exchange said the incident did not affect customers or result in a data breach. It also published the destination wallet addresses associated with the transactions to help blockchain security firms and other parties monitor and track the assets.

Tether CEO Paolo Ardoino confirmed that the stablecoin issuer had frozen more than 4.5 million USDT linked to the incident. ([Jason Shubnell / The Block](https://www.theblock.co/news/defi/2026-11-02-mercado-bitcoin-hack-46-million-brazil-exchange-432333?ref=metacurity.com))

**Related:** [*Arkham,*](https://arkm.com/explorer/entity/mercado-bitcoin-hacker?ref=metacurity.com)[*Bitcoinist.com*](https://bitcoinist.com/mercado-bitcoin-suspends-withdrawals-after-40m-in-suspcious-transfers/?ref=metacurity.com)*,* [*CryptoPotato*](https://cryptopotato.com/over-106m-in-crypto-stolen-from-eu-entity-zachxbt-tracks-attackers-laundering-trail/?ref=metacurity.com)*,* [*Chainalysis*](https://www.chainalysis.com/blog/chainalysis-response-mercado-bitcoin/?ref=metacurity.com)*,* [*Cyber Security News*](https://cybersecuritynews.com/mercado-bitcoin-suffers-cyberattack/?ref=metacurity.com)*,* [*Cointelegraph*](https://cointelegraph.com/news/mercado-bitcoin-hack?ref=metacurity.com)*,* [*Protos*](https://protos.com/mercado-bitcoin-hack-losses-are-at-46m-and-growing/?ref=metacurity.com)*,* [*Decrypt*](https://decrypt.co/382341/mercado-bitcoin-halts-withdrawals-40-million-hack?ref=metacurity.com)*,* [*CryptoSlate*](https://cryptoslate.com/tether-freezes-4-5-million-as-mercado-bitcoin-hacker-holds-46-million-in-crypto/?ref=metacurity.com)*,* [*The Record*](https://therecord.media/mercado-bitcoin-brazil-cryptocurrency-heist?ref=metacurity.com)*,* [*Bitcoin Magazine*](https://bitcoinmagazine.com/news/brazils-mercado-bitcoin-freezes-40-million?ref=metacurity.com)*,* [*CoinGape*](https://coingape.com/brazils-largest-crypto-exchange-mercado-bitcoin-hacked-for-over-40m/?ref=metacurity.com)*,* [*crypto.news*](https://crypto.news/tether-freezes-usdt-mercado-bitcoin-breach/?ref=metacurity.com)*,* [*Unchained*](https://unchainedcrypto.com/mercado-bitcoin-halts-withdrawals-over-security-incident-as-hypernative-flags-40-million-drain/?ref=metacurity.com)

### An unnamed entity in the European Union is suspected of losing more than $106 million from several of its accounts on centralized exchanges on Sunday, pseudonymous on-chain investigator ZachXBT said Monday in a post to his Telegram channel.

The funds were withdrawn as USDC and USDT stablecoins by what he called an “illicit actor.”

In the 24 hours that followed, the actor moved aggressively to cover their tracks, ZachXBT said. The attacker swapped USDC for ETH, sent funds through instant exchange services such as WellWallet and Kyrrex, converted some to the privacy coin Monero via Wagyu, and bridged assets across multiple blockchains.

ZachXBT published 11 Ethereum addresses tied to the theft.

Instant exchanges let users quickly swap one cryptocurrency for another, often with little identity verification, while Monero hides senders, receivers, and amounts, making it a popular tool for obscuring stolen funds.

Swapping out of USDC and USDT also matters because the companies behind those stablecoins can freeze them. ([Decrypt](https://decrypt.co/382383/mystery-106-million-crypto-theft-eu-entity-binance-hack?ref=metacurity.com))

**Related:** [*CryptoRank*](https://cryptorank.io/news/feed/4f9d2-eu-entity-suspected-of-losing-106m-in-crypto-exchange-heist-zachxbt?ref=metacurity.com)*,* [*The Defiant*](https://thedefiant.io/news/hacks/zachxbt-flags-suspected-106-million-plus-theft-from-eu-entity?ref=metacurity.com)*,* [*CoinMarketCap*](https://coinmarketcap.com/academy/article/zachxbt-eu-entity-106m-exchange-accounts-theft?ref=metacurity.com)

### Developers of the payment service BTCPay Server have warned about unauthorized withdrawals from users’ hot wallets, urging owners to shut down servers until the investigation is complete.

The first warning appeared on November 1 at 22:25 UTC. Developers suggested using the script ./btcpay-down.sh for shutdown.

BTCPay Server is a free, open-source payment system that allows online stores and other organizations to accept the leading cryptocurrency independently, without intermediaries.

Users host the software on their own or rented servers. The project does not centrally manage this infrastructure, so it cannot disable all installations itself.

BTCPay supports hot wallets: the seed phrase is stored on an internet-connected server and used for automatically signing outgoing transactions. This approach simplifies payments but poses risks if an attacker gains server access.

Project founder Nicolas Dorier reported that, according to preliminary data, servers with software older than version 2.4.2 were attacked. Developers have not received credible reports of thefts from servers running the current version 2.4.7\. ([Forklog](https://forklog.com/en/hackers-steal-bitcoin-from-btcpay-server-hot-wallets/?ref=metacurity.com))

***Related:*** [*CoinDesk*](https://www.coindesk.com/tech/2026/11/02/btcpay-a-bitcoin-payment-tool-tells-users-to-switch-off-their-servers-after-reports-of-drained-wallets?ref=metacurity.com)*,* [*CryptoSlate*](https://cryptoslate.com/btcpay-urges-bitcoin-merchants-to-replace-wallets-after-hackers-steal-an-estimated-1-6-million/?ref=metacurity.com)

### Germany’s digital minister, Karsten Wildberger, has confirmed that members of the Bundestag and the federal government received warnings from Apple that their iPhones may have been targeted by spyware.

Speaking on ARD’s *Bericht aus Berlin* on Sunday, Wildberger said there had been "a notification from Apple that certain devices may have been compromised with so-called spyware".

According to a letter from the Federal Office for Information Security (BSI) seen by Wildberger, the alerts began reaching the affected phones on 29 October. They warned that Apple had detected an attack using "mercenary spyware".

Wildberger said the BSI had "reacted super quickly" and written to everyone affected about what to do. He did not say how many politicians had received the alerts, or who they were.

According to Wildberger, the BSI advised those affected to assume - as a precaution - that their device may have been compromised, because the alerts do not show whether an attack succeeded. ([Simon Ormiston /EuroNews](https://www.euronews.com/2026/11/02/german-mps-and-ministers-warned-iphones-have-been-targeted-by-spyware?ref=metacurity.com))

**Related:** [*Tovima*](https://www.tovima.com/world/germany-says-lawmakers-phones-may-be-hacked-by-spyware/?ref=metacurity.com)*,* [*Security Affairs*](https://securityaffairs.com/202297/intelligence/apples-spyware-notifications-reach-the-bundestag-what-the-bsi-says-to-do-now.html?ref=metacurity.com)*,* [*The Cryptonomist*](https://en.cryptonomist.ch/2026/11/03/german-government-spyware-warning/?ref=metacurity.com)*,* [*Kyiv Post*](https://www.kyivpost.com/post/88944?ref=metacurity.com)*,* [*Techaeris*](https://techaeris.com/2026/11/02/mercenary-spyware-germany-warns-lawmakers/?ref=metacurity.com)*,* [*TechCrunch*](https://techcrunch.com/2026/11/02/germany-says-lawmakers-iphones-may-have-been-hacked-with-spyware/?ref=metacurity.com)*,* [*Financial Times*](https://www.ft.com/content/77626f75-01e9-4123-8510-a095b2231861?syn-25a6b1a6=1&ref=metacurity.com)

### OpenAI announced it is partnering with cybersecurity startup Cathedral, founded by former workers of Elon Musk's DOGE initiative, whose researchers will use OpenAI’s models alongside its teams to challenge its defenses, bringing differentiated expertise and approaches to finding weaknesses and helping us protect our platforms.

OpenAI also said it is making improvements to its Security Bug Bounty program, including more than quadrupling its rewards for critical findings. 

A critical vulnerability in a core product such as ChatGPT, Codex, or the API Platform will now earn up to $30,000\. Exceptional critical findings on those targets remain eligible for up to $100,000, and now up to $172,000 with bonuses. ([OpenAI](https://openai.com/index/preparing-our-next-security-sprint-to-harden-openai/?ref=metacurity.com))

**Related:** [*Help Net Security*](https://www.helpnetsecurity.com/2026/11/03/openai-bigger-bug-bounty-rewards/?ref=metacurity.com)*,* [*OpenAI*](https://openai.com/index/rewarding-defenders-with-bigger-bug-bounties?ref=metacurity.com)*,* [*Blockchain.News*](https://blockchain.news/news/openai-raises-bug-bounty-rewards-for-security-researchers?ref=metacurity.com)*,* [*Cyber Security News*](https://cybersecuritynews.com/openai-security-sprint/?ref=metacurity.com)*,* [*Kyiv Post*](https://www.kyivpost.com/post/88944?ref=metacurity.com)*,* [*TechCrunch*](https://techcrunch.com/2026/11/02/germany-says-lawmakers-iphones-may-have-been-hacked-with-spyware/?ref=metacurity.com)

### South Korean President Lee Jae Myung and first lady Kim Hea Kyung are having new passports issued after their passport and other personal information were leaked, the foreign ministry said.

The government and the police are investigating how the data was exposed, although they believe it was a leak, not an external cyberattack.

“The foreign ministry is swiftly taking measures to ensure the smooth reissuance of passports for all affected individuals, including the president and first lady,” ministry spokesperson Park Doo-soon said during a briefing.

The measures came after it was known that sensitive personal information of 168 people who were aboard the presidential jet for Lee’s trip to Europe in June had been uploaded to a security-related paid website.

The leak affected not only the presidential couple but also ranking officials, including then-chief of staff for policy Kim Yong-beom, National Security Adviser Wi Sung-lac, current Prime Minister Han Seong-sook and several Cabinet members, as well as senior officials from Cheong Wa Dae and the foreign ministry, security personnel and reporters traveling with the presidential delegation.

A local media outlet reported the previous day that a file titled “Passenger list (Republic of Korea-Belgium),” containing the information, was uploaded on June 2, before Lee departed for Europe on June 9, and remained accessible for months until recently.

The exposed information reportedly contained Korean and English names, affiliations, job titles, dates of birth, passport numbers, and passport issuance and expiration dates.

A foreign ministry official said the leaked spreadsheet appears to follow a format used by the ministry and that such documents are generally compiled by its protocol office, but noted that the file may have been altered after the original data was created, making it difficult to confirm it as an official ministry document.

"We view the incident as a data leak rather than a hacking incident," Park said. ([Park Ji-won / The Korea Times](https://www.koreatimes.co.kr/southkorea/politics/20261103/police-launch-probe-into-personal-data-leak-involving-president-lee?ref=metacurity.com))

**Related:** [*DPA*](https://www.yahoo.com/news/world/articles/south-korean-president-affected-data-170340801.html?guccounter=1&guce%5Freferrer=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS8&guce%5Freferrer%5Fsig=AQAAAI0kFpuRxJ00l3aKzzFp9Aeqc9JDbEoBteOuGH4elZeaolbsSfsixc9NKeVQhIBTaDQziFBxwi5uxuCPsacreytOFP%5F809yYi0F%5Fhr9lKAo%5Fvz6-IqfB-0dj9cNy3iz9VMV9sLRz9Yda7QL8gldCnztA-8Q0ZadbzoRqdWv2Yizp&ref=metacurity.com)*,* [*AFP*](https://www.france24.com/en/live-news/20261103-south-korea-investigates-online-leak-of-president-s-passport-details?ref=metacurity.com)*,* [*Korea JoongAng Daily*](https://www.koreajoongangdaily.com/korea/presidential-data-breach-may-have-been-internal-leak-foreign-ministry-says/12952457?ref=metacurity.com)*,* [*Anadoilu Ajansi*](https://www.aa.com.tr/en/asia-pacific/south-korea-probes-passport-data-leak-involving-president-167-others/4109306?ref=metacurity.com)*,* [*South China Morning Post*](https://www.scmp.com/news/asia/east-asia/article/3373065/south-korea-rushes-reissue-passports-president-lee-wife-after-data-leak?ref=metacurity.com)*,* [*The Korea Herald*](https://www.koreaherald.com/article/10924491?ref=metacurity.com)

### South Korean President Lee Jae Myung ​called for the creation of a ‌powerful government-wide cybersecurity body to coordinate functions scattered across agencies, pointing to limitations in the current capacity to protect critical systems.

"The ​existing security system, which centers on inspections and ​after-the-fact responses, is showing clear limitations," Lee told ⁠a cabinet meeting, calling for a comprehensive preventive ​system to protect public services and critical infrastructure.

Lee also ​referred to the multibillion-dollar theft affecting Binance, the world’s largest cryptocurrency exchange, but did not directly name North Korea, which the ​FBI has blamed for the attack. ([Kyu-seok Shim / Reuters](https://www.reuters.com/world/asia-pacific/south-koreas-lee-calls-powerful-government-wide-cybersecurity-body-2026-11-03/?ref=metacurity.com))

**Related:** [*South China Morning Post*](https://www.straitstimes.com/asia/east-asia/south-koreas-lee-calls-for-powerful-government-wide-cybersecurity-body?ref=metacurity.com)*,* [*Shattered*](https://shattered.io/south-korea-lee-cybersecurity-tsar-body-four-sectors-2026/?ref=metacurity.com)

### Singapore-based financial services company MoneySmart said on Tuesday (Nov 3) that personal data of some of its customers was copied by an "unauthorized third party" in a data security incident.

The company said that it discovered on Oct 29 that the third party had accessed some of its internal IT systems, and its investigation confirmed that some of its customers in Singapore and Hong Kong were affected.

The company stopped the unauthorized access and took steps to secure its systems soon after the discovery, said chief executive officer Vinod Nair in a note on the company's website.

MoneySmart also reported the incident to the relevant authorities and engaged independent cybersecurity and forensics experts to investigate further. ([Channel News Asia](https://www.channelnewsasia.com/singapore/moneysmart-data-breach-security-incident-6515356?ref=metacurity.com))

**Related:** [*The Straits Times*](https://www.straitstimes.com/singapore/moneysmart-data-breach-hits-spore-hk-users-ic-numbers-financial-info-potentially-exposed?ref=metacurity.com)*,* [*AsiaOne*](https://www.asiaone.com/singapore/moneysmart-data-breach-singapore-hong-kong?ref=metacurity.com)*,* [*TechInAsia*](https://www.techinasia.com/news/moneysmart-reports-customer-data-breach-singapore-hk?ref=metacurity.com)

### Hackers who breached Harvard University's Alumni Affairs and Development systems in November 2025 stole data linked to more than 850,000 unique email addresses, according to breach notification service Have I Been Pwned.

As the university discovered on November 18, 2025, the attackers gained access to the personal information of students, alumni, donors, staff, and faculty members, including email addresses, telephone numbers, home and business addresses, event attendance records, donation details, and "biographical information pertaining to University fundraising and alumni engagement activities."

However, Klara Jelinkova, Harvard's Vice President and University Chief Information Officer (CIO), said the breached IT systems didn't store Social Security numbers, passwords, payment card information, or financial information.

Although Harvard has not attributed the attack to a specific hacking group or threat actor, the ShinyHunters extortion gang claimed responsibility and said it stole over 1 million records containing identifiable information and donation data after breaching the university's systems. ([Sergiu Gatlan / Bleeping Computer](https://www.bleepingcomputer.com/news/security/harvard-university-data-breach-exposed-info-of-851-000-accounts/?ref=metacurity.com))

***Related:*** [*HaveIBeenPwned*](https://haveibeenpwned.com/Breach/Harvard?ref=metacurity.com)

### Financial technology company Abrigo has restored its Sageworks risk management application, except for borrower-facing capabilities, following an outage triggered by "irregular activity" in its environment.

On October 30, the company began emergency maintenance and took the Sageworks application offline to investigate suspicious activity detected earlier that day, with the outage continuing through the weekend.

Abrigo provides cloud-based software and analytics solutions for community banks and credit unions across the United States. According to the company, it serves more than 2,400 entities.

Its Sageworks product is a software platform that helps lenders process loan applications, analyze borrowers’ finances, assess creditworthiness, and monitor loan portfolios.

Due to its nature, Sageworks handles sensitive information, including banking customer details.

"We identified irregular activity in our environment, and, out of abundance of caution, we disabled the Sageworks application at approximately 11:25 am ET," the company said on Friday.

In status updates over the weekend, Abrigo said its investigation was ongoing but did not disclose details about the nature of the incident.

The incident impacted the following services: Online Portal Now, Sageworks Analyst, and Sageworks API.

In its latest update today, the company said that most of the Sageworks functionality had been restored, with the exception of borrower-facing features. ([Bill Toulas / Bleeping Computer](https://www.bleepingcomputer.com/news/security/fintech-platform-sageworks-taken-offline-after-suspected-cyberattack/?ref=metacurity.com))

**Related:** [*SC Media*](https://www.scworld.com/brief/abrigo-restores-sageworks-platform-following-irregular-activity?ref=metacurity.com)

### Today, election day in the United States, the Cybersecurity and Infrastructure Security Agency, established by President Trump in his first term, will be largely absent from monitoring election security, current and former CISA officials say, weakening the federal government’s ability to help states respond to problems ranging from routine vote-machine disruptions to online hoaxes to bad actors looking to undermine public confidence in the vote.

Instead, it is expected to offer light assistance to state and local election officials, many of whom fear the federal government is more likely to meddle with election results than to help safeguard them. There will be no scheduled briefings with reporters, an agency spokesman confirmed on Monday.

“The posture seems like the bare minimum,” said Geoff Hale, a former top election security official at CISA. Such an approach to election security, he said, was not well suited to identifying problems that cut across multiple voting jurisdictions or “the type of national security concerns that once drove the mission.”

It is a remarkable retreat from the agency’s history as a loud and visible presence around Election Day across both the first Trump and Biden administrations. ([Dustin Volz and Julian E. Barnes / The New York Times](https://www.nytimes.com/2026/11/02/us/politics/cisa-election-security-midterms.html?unlocked%5Farticle%5Fcode=1.NVE.OpBF.Bf4uSYVyUb4W&smid=url-share&ref=metacurity.com))

**Related:** [*NextGov/FCW*](https://www.nextgov.com/cybersecurity/2026/10/officials-see-gaps-election-communications-ai-makes-foreign-influence-easier/416583/?ref=metacurity.com)

### The clock is running out on Nick Andersen’s time to serve as acting director of the Cybersecurity and Infrastructure Security Agency, but there appear to be efforts afoot to keep him in the role for longer, with no permanent nominee in sight.

There’s broad support for the idea of Andersen retaining the position one way or another, which he’s held since February of this year. Since then, Sean Plankey withdrew his nomination for the Senate-confirmed position in April, and in June, Department of Homeland Security Secretary Markwayne Mullin said a likely replacement nominee had met with the president and was coming soon. Four months later, no nominee has materialized.

“We proudly support the work Acting CISA Director Nick Andersen has done in his role,” a DHS spokesperson said in response to questions about keeping Andersen on board and what became of that potential nominee. DHS referred CyberScoop to the White House for any further comment, but the White House didn’t respond to inquiries.

The easiest way to keep Andersen in the acting role would be to select a nominee, thus pausing his 210-day limit on serving as acting director, said Mark Montgomery, senior director of the Foundation for Defense of Democracies think tank’s Center on Cyber and Technology Innovation.

But “my gut reaction is that there’s just no appetite at the White House to say the four-letter ‘CISA’ to the president,” given his past animosity toward the agency, Montgomery said. “The way to keep Andersen in play is to nominate somebody. I think that stops the clock. But I don’t even think they can get the president to nominate Bugs Bunny. To me, that’s troubling.”

Multiple sources told CyberScoop they’ve been told that the administration has been working to keep Andersen in the job, possibly by shifting his title to “senior official performing the duties of” CISA director. ([Tim Starks / CyberScoop](https://cyberscoop.com/nick-andersen-cisa-acting-director-nomination/?ref=metacurity.com))

### OpenAI has appointed former US Army Secretary Dan Driscoll to oversee national-security modernization, adding a former senior military official to its efforts to expand the role of artificial intelligence in defense and cybersecurity.

Driscoll will advise on ways AI could bolster US security capabilities and cyber defenses, the company said Monday. The hire reflects OpenAI’s push to deepen its integration with the defense sector, secure government contracts and shape policy around military and intelligence AI deployment.

“The U.S. has an extraordinary opportunity to work with other countries to spread the adoption of democratic AI, and I’m excited to welcome Dan Driscoll to OpenAI to strengthen American leadership and help us do that,” OpenAI Chief Executive Sam Altman said.

Driscoll is a former Army officer and law-school classmate of Vice President JD Vance. Serving as civilian leader of the Army for 18 months, he pushed soldiers to adopt new battlefield technology and spearheaded multibillion-dollar private-sector partnerships to modernize base infrastructure and domestic logistics.

He stepped down from the Pentagon in September following months of tension with Defense Secretary Pete Hegseth over the direction of the service and the ouster of numerous senior Army officers. ([Gareth Vipers / Wall Street Journal](https://www.wsj.com/politics/national-security/openai-hires-former-army-secretary-dan-driscoll-to-cybersecurity-role-0e5cc0a1?st=cfNEPb&reflink=desktopwebshare%5Fpermalink&ref=metacurity.com))

**Related:** [*OpenAI*](https://openai.com/index/dan-driscoll-joins-openai?ref=metacurity.com)*,* [*CNBC*](https://www.cnbc.com/2026/11/03/openai-hires-dan-driscoll-national-security.html?ref=metacurity.com)*,* [*Political.org*](https://political.org/2026/11/02/openai-hires-former-army-secretary-dan-driscoll-for-national-security-role/?ref=metacurity.com)*,* [*Reuters*](https://www.reuters.com/business/openai-taps-former-us-army-secretary-dan-driscoll-national-security-role-2026-11-03/?ref=metacurity.com)*,* [*Bloomberg Law*](https://news.bloomberglaw.com/tech-and-telecom-law/openai-says-former-army-secretary-dan-driscoll-to-join-company?ref=metacurity.com)*,* [*Unite.AI*](https://www.unite.ai/former-army-secretary-dan-driscoll-joins-openai-as-senior-counselor/?ref=metacurity.com)*,* [*The Information*](https://www.theinformation.com/briefings/openai-hires-ex-army-secretary-senior-advisor?ref=metacurity.com)*,* [*Business Standard*](https://www.business-standard.com/technology/tech-news/why-openai-has-hired-ex-us-army-secretary-dan-driscoll-for-security-role-126110300383%5F1.html?ref=metacurity.com)*,* [*Gizmodo*](https://gizmodo.com/openai-hires-former-trump-admin-army-secretary-for-new-national-security-role-2000834160?ref=metacurity.com)*,* [*Türkiye Today*](https://www.turkiyetoday.com/business/openai-hires-former-us-army-secretary-dan-driscoll-for-new-national-security-role-3231593?ref=metacurity.com)*,* [*Washington Examiner*](https://www.washingtonexaminer.com/policy/national-security/4788952/openai-hires-ex-army-secretary-dan-driscoll/?ref=metacurity.com)

### Best Thing of the Day: Even Privacy-Respecting Browsers Should Be Held Accountable

A group of newspapers, including the New York Times and the New York Daily ​News, [sued](https://www.reuters.com/legal/litigation/new-york-times-sues-maker-brave-web-browser-over-copyrights-2026-11-02/?ref=metacurity.com) internet company Brave Software in Manhattan federal court ‌on Monday for allegedly scraping their articles for AI training and unlawfully enabling users of its web browser to circumvent their paywalls.

### Bonus Best Thing of the Day: Tell Us Something We Already Don't Know

UBS Group AG’s chief executive [said](https://www.bloomberg.com/news/articles/2026-11-03/ubs-ceo-ermotti-says-cyber-risks-rival-traditional-bank-threats?ref=metacurity.com) guarding against cyber attacks has become as important as — if not more important than — managing traditional credit and market risks, as such threats across the banking sector grow in frequency and sophistication.

### Extra Bonus Best Thing of the Day: You Can Run, But You Can't Hide

YouTube and internet investigator Colsto discovered an OSINT technique that [allows you](https://www.youtube.com/watch?v=UytYrhYLOKI&ref=metacurity.com) to geolocate any video using the obvious and even imperceptible sound of planes high in the sky.

### Worst Thing of the Day: Sometimes You Can Actually Hide

Japan's GMO Internet Group Inc. [failed to detect](https://www.asahi.com/ajw/articles/17019797?ref=metacurity.com) a cyberattack on a subsidiary’s service for about two and a half months, enabling the intruder to steal files from customers’ computers.

### Closing Thought