CryptoBandits Malware Doubles as a Backdoor, Abuses Tor

Multiple high-risk incidents reported: CryptoBandits is a new malware family that also functions as a backdoor, abuses Tor and a local SOCKS5 proxy to route stolen data and enable remote code execution. A large-scale credential theft campaign dubbed “FortiBleed” compromised roughly 86,000 internet-accessible Fortinet firewalls and VPNs. A Klue supply-chain compromise led to exfiltration of customer Salesforce data (including Huntress and Recorded Future). Splunk Enterprise is being actively exploited for unauthenticated remote code execution via CVE-2026-20253, prompting an urgent CISA three‑‑