# Daily Intelligence Briefing — Thursday, October 29, 2026

> On 2026-10-29, Threadlinqs published 42 new threat reports and updated 7, 13 rated critical and 24 high, spanning 238 MITRE ATT&CK techniques and 11 named threat actors. Coverage that day added 441 new detection rules and 1236 extracted indicators.

- **Edition:** 2026-10-29 (Thursday)
- **Canonical:** https://intel.threadlinqs.com/debrief/2026-10-29
- **Last updated:** 2026-11-04
- **New threats:** 42 (7 updated)
- **Critical / high:** 13 critical, 24 high, 10 medium, 2 low
- **ATT&CK techniques:** 238
- **Threat actors:** 11
- **Indicators (count only):** 1236
- **New detection rules (count only):** 441

## Summary & highlights

Chrome Extension Search-Hijacking Campaign ("Searchjacked"): 319 Extensions, 13.4M Installs, Queries Proxied via Operator Servers to Bing/Yahoo. Prediction Markets Emerge as a New Vertical for Traffer Teams (AtlasCore, PolyFucked, Magnetic Team). State of Ad Fraud 2026: AI-Assisted Schemes, Malicious iOS Scripts and Messenger Phishing Displace Cloaking.

- [TL-2026-4702](https://intel.threadlinqs.com/threat/TL-2026-4702) — Fake Phantom, Jupiter, and Bitget Firefox Extensions Target Cryptocurrency Wallets (bonto.io C2)
- [TL-2026-4705](https://intel.threadlinqs.com/threat/TL-2026-4705) — ESET APT Activity Report Q2 2026–Q3 2026: China-, Iran-, North Korea-, Russia- and Belarus-aligned APT campaigns
- [TL-2026-4707](https://intel.threadlinqs.com/threat/TL-2026-4707) — WordPress 7.1.4 Security Release Patches 22 Vulnerabilities Including Core-Update Race Condition RCE and Multiple Stored XSS
- [TL-2026-4713](https://intel.threadlinqs.com/threat/TL-2026-4713) — Breaking the Sound Barrier, Part II: Exploiting CVE-2024-54529 (macOS CoreAudio coreaudiod type confusion, PoC public)
- [TL-2026-4714](https://intel.threadlinqs.com/threat/TL-2026-4714) — MadApe: Previously Undocumented Microsoft Device Code Phishing Kit Using Business-Themed PDF Lures and Fake Document-Sharing Pages

## Theme of the day

AI-driven attacks surged as Yoba malware abused signed AI binaries for cryptomining and Anthropic models chained zero-days across platforms, while supply-chain and IoT botnet campaigns dominated severe threats.

windows, espionage, linux, cisa-kev, credential-theft

## Threats published

- [TL-2026-4703](https://intel.threadlinqs.com/threat/TL-2026-4703) — CRITICAL — Wing FTP Server Path Traversal (CWE-22) in User Base Folder Handling - CVE-2026-105420
- [TL-2026-4706](https://intel.threadlinqs.com/threat/TL-2026-4706) — CRITICAL — Cybersecurity Black Week: LiteLLM 1.107.0 PyPI/Docker supply-chain compromise, PHP2Shell (CVE-2026-109618/109619), Node2Shell (CVE-2026-111497), GitLab CVE-2026-110264, KSMBD flaws and eMudhra emSign intermediate CA key compromise
- [TL-2026-4729](https://intel.threadlinqs.com/threat/TL-2026-4729) — CRITICAL — Cisco Catalyst SD-WAN Authentication Bypass (CVE-2026-20127) Exploited by UAT-8616 and Tied to Volt Typhoon's 'Silent Train' Network; UAT-11473 KeyDrift/PolyFlame/LittleFilch Toolset
- [TL-2026-4744](https://intel.threadlinqs.com/threat/TL-2026-4744) — CRITICAL — Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities (Campaign Classic APSB26-162, Connect APSB26-182, Veeam B365 8.6 / B&R 13.1.2, Juniper Session Smart Router JSA112183)
- [TL-2026-4751](https://intel.threadlinqs.com/threat/TL-2026-4751) — CRITICAL — CVE-2026-98432 - Linux Kernel IPv4 TCP SYN Race Condition / Use-After-Free (inet_opt / ireq_opt) Enabling Remote Kernel Memory Corruption and Reported Root Command Execution
- [TL-2026-4761](https://intel.threadlinqs.com/threat/TL-2026-4761) — CRITICAL — Warp Panda exploits VMware ESX CVE-2026-41709; PHP2Shell (CVE-2026-109618/109619) chained with Fragnesia (CVE-2026-46300) to root firewalls
- [TL-2026-4771](https://intel.threadlinqs.com/threat/TL-2026-4771) — CRITICAL — ThreatsDay Bulletin: Fortinet Critical Firewall Updates (Details Embargoed), Gotenberg RCE CVE-2026-42589 Under Active Exploitation, PHP2Shell Scanning
- [TL-2026-3185](https://intel.threadlinqs.com/threat/TL-2026-3185) — CRITICAL — BlueMoon Exploit Kit Chains Chrome V8 Flaws CVE-2026-85046 and CVE-2026-87491 with Windows Kernel LPE CVE-2026-85880 (update)
- [TL-2026-3413](https://intel.threadlinqs.com/threat/TL-2026-3413) — CRITICAL — CVE-2026-97229: Critical GitLab Unauthenticated RCE via CI/CD Regex Compiler Integer Overflow (update)
- [TL-2026-4262](https://intel.threadlinqs.com/threat/TL-2026-4262) — CRITICAL — PHP Unpatched RCE CVE-2026-115560 Disclosed Two Days After Emergency PHP2Shell Patches (CVE-2026-109618/CVE-2026-109619) (update)
- [TL-2026-4665](https://intel.threadlinqs.com/threat/TL-2026-4665) — CRITICAL — Volt Typhoon 'Silent Train' Relay Framework Used to Conceal Zero-Day Exploitation (CVE-2026-16812, CVE-2026-20127, CVE-2025-8875, CVE-2025-8876, CVE-2024-39717) (update)
- [TL-2026-4669](https://intel.threadlinqs.com/threat/TL-2026-4669) — CRITICAL — CISA adds two KEVs: Broadcom VMware ESX CVE-2026-41709 (Insufficient Logging) and Linux Kernel CVE-2026-46300 (Fragnesia ESP-in-TCP page-cache LPE) (update)
- [TL-2026-4677](https://intel.threadlinqs.com/threat/TL-2026-4677) — CRITICAL — KeyDrift: UAT-11473 Activity on Cisco SD-WAN (CVE-2026-20127) (update)
- [TL-2026-4702](https://intel.threadlinqs.com/threat/TL-2026-4702) — HIGH — Fake Phantom, Jupiter, and Bitget Firefox Extensions Target Cryptocurrency Wallets (bonto.io C2)
- [TL-2026-4705](https://intel.threadlinqs.com/threat/TL-2026-4705) — HIGH — ESET APT Activity Report Q2 2026–Q3 2026: China-, Iran-, North Korea-, Russia- and Belarus-aligned APT campaigns
- [TL-2026-4707](https://intel.threadlinqs.com/threat/TL-2026-4707) — HIGH — WordPress 7.1.4 Security Release Patches 22 Vulnerabilities Including Core-Update Race Condition RCE and Multiple Stored XSS
- [TL-2026-4713](https://intel.threadlinqs.com/threat/TL-2026-4713) — HIGH — Breaking the Sound Barrier, Part II: Exploiting CVE-2024-54529 (macOS CoreAudio coreaudiod type confusion, PoC public)
- [TL-2026-4714](https://intel.threadlinqs.com/threat/TL-2026-4714) — HIGH — MadApe: Previously Undocumented Microsoft Device Code Phishing Kit Using Business-Themed PDF Lures and Fake Document-Sharing Pages
- [TL-2026-4715](https://intel.threadlinqs.com/threat/TL-2026-4715) — HIGH — NetamLoader: Unknown APT Targets Government-Customized Windows 10 OS in Asia via Patch My PC-Themed XAML/.NET Loader
- [TL-2026-4723](https://intel.threadlinqs.com/threat/TL-2026-4723) — HIGH — ARTEX China-developed agentic AI penetration-testing tool used in attacks on Japanese companies (and South Korean financial institutions)
- [TL-2026-4727](https://intel.threadlinqs.com/threat/TL-2026-4727) — HIGH — NIK C2: AI-enabled Go-based command-and-control framework with OpenAI API abuse, infostealer, HVNC and lock-screen ransomware modules (Cisco Talos)
- [TL-2026-4735](https://intel.threadlinqs.com/threat/TL-2026-4735) — HIGH — INJ3CTOR3 Campaign Targets FreePBX Servers with JOMANGY/ZenharR Webshells to Steal SIP Credentials for Phone Fraud
- [TL-2026-4738](https://intel.threadlinqs.com/threat/TL-2026-4738) — HIGH — GitHub Issues/PR Comment Injection Supply-Chain Campaign Targeting 61 Public Repositories via Vulnerable Workflows
- [TL-2026-4740](https://intel.threadlinqs.com/threat/TL-2026-4740) — HIGH — China-nexus WARP PANDA exploits VMware ESXi insufficient-logging flaw (CVE-2026-41709) against law firms
- [TL-2026-4746](https://intel.threadlinqs.com/threat/TL-2026-4746) — HIGH — GoldFactory Vwork: Weaponized Shelter Fork Enables App Cloning Alongside Gigabud Android Banking Trojan
- [TL-2026-4755](https://intel.threadlinqs.com/threat/TL-2026-4755) — HIGH — North Korean Threat Actors Operationalize AI Across Tradecraft (Jade/Coral/Jasper/Diamond/Onyx/Pearl/Sapphire/Emerald Sleet; ProcmacSteal)
- [TL-2026-4764](https://intel.threadlinqs.com/threat/TL-2026-4764) — HIGH — Polymarket Third-Party Script Compromise: Wallet-Draining Code Served via DebugBear RUM Script
- [TL-2026-4766](https://intel.threadlinqs.com/threat/TL-2026-4766) — HIGH — Clipbanker malware AnimateClipper (ZigClipper) and Efimer redirect crypto payments by swapping clipboard wallet addresses
- [TL-2026-4769](https://intel.threadlinqs.com/threat/TL-2026-4769) — HIGH — DefenderKiller: Open-Source PoC Abuses Legacy Microsoft Driver (KSLDriver.sys) to Terminate Endpoint Security Processes
- [TL-2026-4775](https://intel.threadlinqs.com/threat/TL-2026-4775) — HIGH — Amadey MaaS Backend Breached by Australian Signals Directorate; 180,000 Infected Computers Cut Off from Operator C2
- [TL-2026-4776](https://intel.threadlinqs.com/threat/TL-2026-4776) — HIGH — Hugging Face 'Load/Mine' Campaign: Malicious Qwen2 Model Repos Abuse trust_remote_code to Hijack GPUs for Pearl (PRL) Mining and Backdoor Xinference/GPUStack Hosts
- [TL-2026-4779](https://intel.threadlinqs.com/threat/TL-2026-4779) — HIGH — VAPOR PANDA Uses AI-Driven ARTEX Framework to Scale Global Espionage Campaign (BLOODALCHEMY)
- [TL-2026-4780](https://intel.threadlinqs.com/threat/TL-2026-4780) — HIGH — SonicWall SonicOS Management Interface Scanning Spike (May 2026) Echoing Pre-Disclosure Pattern of CVE-2026-0400
- [TL-2026-4787](https://intel.threadlinqs.com/threat/TL-2026-4787) — HIGH — Zimbra Collaboration stored XSS vulnerabilities CVE-2026-66911 and CVE-2026-66912 (fixed in 10.1.21)
- [TL-2026-4788](https://intel.threadlinqs.com/threat/TL-2026-4788) — HIGH — Szafir software vulnerabilities: XXE (CVE-2026-93570), path traversal (CVE-2026-93571), improper certificate validation (CVE-2026-106036)
- [TL-2026-4796](https://intel.threadlinqs.com/threat/TL-2026-4796) — HIGH — Prometei Botnet Linux Binary (Linux/Prometei.B) - Modular Monero Miner and Credential-Stealing Botnet, r2 + AI Reverse Engineering Analysis
- [TL-2026-1253](https://intel.threadlinqs.com/threat/TL-2026-1253) — HIGH — Claude Mythos / Project Glasswing: Autonomous AI Vulnerability Discovery Compresses the Find-to-Exploit Timeline (CVE-2026-4747 and the AI-Scale Disclosure Problem) (update)
- [TL-2026-4753](https://intel.threadlinqs.com/threat/TL-2026-4753) — MEDIUM — Chrome Extension Search-Hijacking Campaign ("Searchjacked"): 319 Extensions, 13.4M Installs, Queries Proxied via Operator Servers to Bing/Yahoo
- [TL-2026-4758](https://intel.threadlinqs.com/threat/TL-2026-4758) — MEDIUM — Prediction Markets Emerge as a New Vertical for Traffer Teams (AtlasCore, PolyFucked, Magnetic Team)
- [TL-2026-4759](https://intel.threadlinqs.com/threat/TL-2026-4759) — MEDIUM — State of Ad Fraud 2026: AI-Assisted Schemes, Malicious iOS Scripts and Messenger Phishing Displace Cloaking
- [TL-2026-4767](https://intel.threadlinqs.com/threat/TL-2026-4767) — MEDIUM — US Election Security: Voting Machine Patch Gaps and AI-Enabled Influence Campaigns
- [TL-2026-4778](https://intel.threadlinqs.com/threat/TL-2026-4778) — MEDIUM — Anthropic-Themed Phishing Campaign (Fake Private Preview Invites via GoTo Webinar) Steals Google and Microsoft Credentials and Bypasses Email Security Gateways
- [TL-2026-4782](https://intel.threadlinqs.com/threat/TL-2026-4782) — MEDIUM — GreyNoise: Attack Surges Against Network Infrastructure Vendors Precede CVE Disclosure by a Median of 11 Days (Cisco CVE-2026-20127, Fortinet CVE-2026-24858, SonicWall CVE-2026-0400)
- [TL-2026-4789](https://intel.threadlinqs.com/threat/TL-2026-4789) — MEDIUM — Residential Proxy SDKs Embedded in Everyday Apps Expose Users and Enterprises (IPIDEA, Bright Data partners)
- [TL-2026-4792](https://intel.threadlinqs.com/threat/TL-2026-4792) — MEDIUM — Nanocore RAT delivered via math-obfuscated VBScript loader (CyberChef deobfuscation walkthrough)
- [TL-2026-4793](https://intel.threadlinqs.com/threat/TL-2026-4793) — MEDIUM — Obfuscated HTA Cobalt Strike Downloader Script (Double URL-encoded/Base64 layers, URLDownloadToFile, VBScript second stage)
- [TL-2026-4795](https://intel.threadlinqs.com/threat/TL-2026-4795) — MEDIUM — W32/SkyAI (Topozuy/Skynet) Windows malware embeds AI prompt injection to evade AI-assisted malware analysis
- [TL-2026-4725](https://intel.threadlinqs.com/threat/TL-2026-4725) — LOW — Microsoft Entra ID Retires Microsoft-Provided SMS and Voice MFA (From Feb 2027): Passkeys Become Default, Admins Urged to Migrate
- [TL-2026-4747](https://intel.threadlinqs.com/threat/TL-2026-4747) — LOW — Cisco Open-Sources Quarry to Detect AI Agent Attacks Hidden in Individually Benign Steps (GTG-1002 and Mexican Government Claude Code Abuse Context)

## Techniques observed

AML.T0010.003, [AML.T0051](https://intel.threadlinqs.com/technique/AML.T0051), [AML.T0054](https://intel.threadlinqs.com/technique/AML.T0054), [T1003](https://intel.threadlinqs.com/technique/T1003), [T1003.001](https://intel.threadlinqs.com/technique/T1003.001), [T1003.003](https://intel.threadlinqs.com/technique/T1003.003), [T1003.008](https://intel.threadlinqs.com/technique/T1003.008), [T1005](https://intel.threadlinqs.com/technique/T1005), [T1008](https://intel.threadlinqs.com/technique/T1008), [T1012](https://intel.threadlinqs.com/technique/T1012), [T1016](https://intel.threadlinqs.com/technique/T1016), [T1021](https://intel.threadlinqs.com/technique/T1021), [T1021.001](https://intel.threadlinqs.com/technique/T1021.001), [T1021.004](https://intel.threadlinqs.com/technique/T1021.004), [T1021.005](https://intel.threadlinqs.com/technique/T1021.005), [T1027](https://intel.threadlinqs.com/technique/T1027), [T1027.002](https://intel.threadlinqs.com/technique/T1027.002), [T1027.004](https://intel.threadlinqs.com/technique/T1027.004), [T1027.009](https://intel.threadlinqs.com/technique/T1027.009), [T1027.010](https://intel.threadlinqs.com/technique/T1027.010), [T1027.013](https://intel.threadlinqs.com/technique/T1027.013), [T1033](https://intel.threadlinqs.com/technique/T1033), [T1036](https://intel.threadlinqs.com/technique/T1036), [T1036.004](https://intel.threadlinqs.com/technique/T1036.004), [T1036.005](https://intel.threadlinqs.com/technique/T1036.005), [T1037](https://intel.threadlinqs.com/technique/T1037), [T1037.004](https://intel.threadlinqs.com/technique/T1037.004), [T1040](https://intel.threadlinqs.com/technique/T1040), [T1041](https://intel.threadlinqs.com/technique/T1041), [T1046](https://intel.threadlinqs.com/technique/T1046), [T1048](https://intel.threadlinqs.com/technique/T1048), [T1053.003](https://intel.threadlinqs.com/technique/T1053.003), [T1053.005](https://intel.threadlinqs.com/technique/T1053.005), [T1055](https://intel.threadlinqs.com/technique/T1055), T1055.008, [T1055.012](https://intel.threadlinqs.com/technique/T1055.012), [T1056](https://intel.threadlinqs.com/technique/T1056), [T1056.001](https://intel.threadlinqs.com/technique/T1056.001), [T1056.003](https://intel.threadlinqs.com/technique/T1056.003), [T1057](https://intel.threadlinqs.com/technique/T1057), [T1059](https://intel.threadlinqs.com/technique/T1059), [T1059.001](https://intel.threadlinqs.com/technique/T1059.001), [T1059.003](https://intel.threadlinqs.com/technique/T1059.003), [T1059.004](https://intel.threadlinqs.com/technique/T1059.004), [T1059.005](https://intel.threadlinqs.com/technique/T1059.005), [T1059.006](https://intel.threadlinqs.com/technique/T1059.006), [T1059.007](https://intel.threadlinqs.com/technique/T1059.007), [T1068](https://intel.threadlinqs.com/technique/T1068), [T1069.002](https://intel.threadlinqs.com/technique/T1069.002), [T1070](https://intel.threadlinqs.com/technique/T1070), T1070.002, [T1070.003](https://intel.threadlinqs.com/technique/T1070.003), [T1070.004](https://intel.threadlinqs.com/technique/T1070.004), [T1070.006](https://intel.threadlinqs.com/technique/T1070.006), [T1071](https://intel.threadlinqs.com/technique/T1071), [T1071.001](https://intel.threadlinqs.com/technique/T1071.001), [T1074.001](https://intel.threadlinqs.com/technique/T1074.001), [T1078](https://intel.threadlinqs.com/technique/T1078), [T1078.004](https://intel.threadlinqs.com/technique/T1078.004), [T1082](https://intel.threadlinqs.com/technique/T1082), [T1087](https://intel.threadlinqs.com/technique/T1087), [T1087.002](https://intel.threadlinqs.com/technique/T1087.002), [T1087.004](https://intel.threadlinqs.com/technique/T1087.004), [T1090](https://intel.threadlinqs.com/technique/T1090), [T1090.001](https://intel.threadlinqs.com/technique/T1090.001), [T1090.002](https://intel.threadlinqs.com/technique/T1090.002), [T1090.003](https://intel.threadlinqs.com/technique/T1090.003), [T1098](https://intel.threadlinqs.com/technique/T1098), [T1098.004](https://intel.threadlinqs.com/technique/T1098.004), [T1098.005](https://intel.threadlinqs.com/technique/T1098.005), [T1102](https://intel.threadlinqs.com/technique/T1102), [T1102.001](https://intel.threadlinqs.com/technique/T1102.001), [T1105](https://intel.threadlinqs.com/technique/T1105), [T1106](https://intel.threadlinqs.com/technique/T1106), [T1110](https://intel.threadlinqs.com/technique/T1110), [T1110.003](https://intel.threadlinqs.com/technique/T1110.003), [T1110.004](https://intel.threadlinqs.com/technique/T1110.004), [T1111](https://intel.threadlinqs.com/technique/T1111), [T1112](https://intel.threadlinqs.com/technique/T1112), [T1113](https://intel.threadlinqs.com/technique/T1113), [T1114](https://intel.threadlinqs.com/technique/T1114), [T1114.002](https://intel.threadlinqs.com/technique/T1114.002), [T1123](https://intel.threadlinqs.com/technique/T1123), [T1125](https://intel.threadlinqs.com/technique/T1125), [T1132.001](https://intel.threadlinqs.com/technique/T1132.001), [T1133](https://intel.threadlinqs.com/technique/T1133), [T1134.001](https://intel.threadlinqs.com/technique/T1134.001), [T1136](https://intel.threadlinqs.com/technique/T1136), [T1136.001](https://intel.threadlinqs.com/technique/T1136.001), [T1136.002](https://intel.threadlinqs.com/technique/T1136.002), [T1140](https://intel.threadlinqs.com/technique/T1140), [T1176.001](https://intel.threadlinqs.com/technique/T1176.001), [T1185](https://intel.threadlinqs.com/technique/T1185), [T1189](https://intel.threadlinqs.com/technique/T1189), [T1190](https://intel.threadlinqs.com/technique/T1190), [T1195](https://intel.threadlinqs.com/technique/T1195), [T1195.001](https://intel.threadlinqs.com/technique/T1195.001), [T1195.002](https://intel.threadlinqs.com/technique/T1195.002), [T1199](https://intel.threadlinqs.com/technique/T1199), [T1203](https://intel.threadlinqs.com/technique/T1203), [T1204](https://intel.threadlinqs.com/technique/T1204), [T1204.001](https://intel.threadlinqs.com/technique/T1204.001), [T1204.002](https://intel.threadlinqs.com/technique/T1204.002), [T1204.004](https://intel.threadlinqs.com/technique/T1204.004), [T1210](https://intel.threadlinqs.com/technique/T1210), [T1211](https://intel.threadlinqs.com/technique/T1211), [T1212](https://intel.threadlinqs.com/technique/T1212), [T1213](https://intel.threadlinqs.com/technique/T1213), [T1213.002](https://intel.threadlinqs.com/technique/T1213.002), [T1213.003](https://intel.threadlinqs.com/technique/T1213.003), [T1218.005](https://intel.threadlinqs.com/technique/T1218.005), [T1219](https://intel.threadlinqs.com/technique/T1219), [T1222.002](https://intel.threadlinqs.com/technique/T1222.002), [T1406.002](https://intel.threadlinqs.com/technique/T1406.002), [T1417.002](https://intel.threadlinqs.com/technique/T1417.002), [T1418](https://intel.threadlinqs.com/technique/T1418), [T1437.001](https://intel.threadlinqs.com/technique/T1437.001), T1451, [T1453](https://intel.threadlinqs.com/technique/T1453), [T1480](https://intel.threadlinqs.com/technique/T1480), [T1480.001](https://intel.threadlinqs.com/technique/T1480.001), [T1484.001](https://intel.threadlinqs.com/technique/T1484.001), [T1485](https://intel.threadlinqs.com/technique/T1485), [T1496.001](https://intel.threadlinqs.com/technique/T1496.001), T1496.002, [T1497](https://intel.threadlinqs.com/technique/T1497), [T1497.001](https://intel.threadlinqs.com/technique/T1497.001), [T1497.003](https://intel.threadlinqs.com/technique/T1497.003), [T1498](https://intel.threadlinqs.com/technique/T1498), [T1499.002](https://intel.threadlinqs.com/technique/T1499.002), [T1499.004](https://intel.threadlinqs.com/technique/T1499.004), [T1505.003](https://intel.threadlinqs.com/technique/T1505.003), [T1513](https://intel.threadlinqs.com/technique/T1513), [T1516](https://intel.threadlinqs.com/technique/T1516), [T1518](https://intel.threadlinqs.com/technique/T1518), [T1518.001](https://intel.threadlinqs.com/technique/T1518.001), T1521.001, [T1526](https://intel.threadlinqs.com/technique/T1526), [T1528](https://intel.threadlinqs.com/technique/T1528), [T1530](https://intel.threadlinqs.com/technique/T1530), [T1539](https://intel.threadlinqs.com/technique/T1539), [T1543](https://intel.threadlinqs.com/technique/T1543), [T1543.002](https://intel.threadlinqs.com/technique/T1543.002), [T1543.003](https://intel.threadlinqs.com/technique/T1543.003), [T1544](https://intel.threadlinqs.com/technique/T1544), [T1546.004](https://intel.threadlinqs.com/technique/T1546.004), [T1546.015](https://intel.threadlinqs.com/technique/T1546.015), T1546.018, [T1547.001](https://intel.threadlinqs.com/technique/T1547.001), [T1548.001](https://intel.threadlinqs.com/technique/T1548.001), [T1548.002](https://intel.threadlinqs.com/technique/T1548.002), [T1550.001](https://intel.threadlinqs.com/technique/T1550.001), [T1552](https://intel.threadlinqs.com/technique/T1552), [T1552.001](https://intel.threadlinqs.com/technique/T1552.001), [T1552.004](https://intel.threadlinqs.com/technique/T1552.004), [T1552.005](https://intel.threadlinqs.com/technique/T1552.005), [T1553.002](https://intel.threadlinqs.com/technique/T1553.002), [T1555](https://intel.threadlinqs.com/technique/T1555), [T1555.003](https://intel.threadlinqs.com/technique/T1555.003), [T1556.003](https://intel.threadlinqs.com/technique/T1556.003), [T1557](https://intel.threadlinqs.com/technique/T1557), [T1557.001](https://intel.threadlinqs.com/technique/T1557.001), [T1559](https://intel.threadlinqs.com/technique/T1559), [T1559.001](https://intel.threadlinqs.com/technique/T1559.001), [T1560.001](https://intel.threadlinqs.com/technique/T1560.001), T1562, T1562.001, T1562.012, T1563.002, [T1564.001](https://intel.threadlinqs.com/technique/T1564.001), T1564.006, [T1565.001](https://intel.threadlinqs.com/technique/T1565.001), [T1565.002](https://intel.threadlinqs.com/technique/T1565.002), [T1566](https://intel.threadlinqs.com/technique/T1566), [T1566.001](https://intel.threadlinqs.com/technique/T1566.001), [T1566.002](https://intel.threadlinqs.com/technique/T1566.002), [T1566.003](https://intel.threadlinqs.com/technique/T1566.003), [T1567.002](https://intel.threadlinqs.com/technique/T1567.002), [T1568.002](https://intel.threadlinqs.com/technique/T1568.002), [T1569.002](https://intel.threadlinqs.com/technique/T1569.002), [T1570](https://intel.threadlinqs.com/technique/T1570), [T1571](https://intel.threadlinqs.com/technique/T1571), [T1572](https://intel.threadlinqs.com/technique/T1572), [T1573.001](https://intel.threadlinqs.com/technique/T1573.001), [T1573.002](https://intel.threadlinqs.com/technique/T1573.002), [T1574.001](https://intel.threadlinqs.com/technique/T1574.001), T1574.002, [T1574.006](https://intel.threadlinqs.com/technique/T1574.006), T1574.014, [T1583](https://intel.threadlinqs.com/technique/T1583), [T1583.001](https://intel.threadlinqs.com/technique/T1583.001), [T1583.003](https://intel.threadlinqs.com/technique/T1583.003), [T1583.006](https://intel.threadlinqs.com/technique/T1583.006), [T1583.008](https://intel.threadlinqs.com/technique/T1583.008), [T1584.001](https://intel.threadlinqs.com/technique/T1584.001), [T1584.004](https://intel.threadlinqs.com/technique/T1584.004), [T1584.008](https://intel.threadlinqs.com/technique/T1584.008), [T1585](https://intel.threadlinqs.com/technique/T1585), [T1585.001](https://intel.threadlinqs.com/technique/T1585.001), [T1585.002](https://intel.threadlinqs.com/technique/T1585.002), [T1586](https://intel.threadlinqs.com/technique/T1586), [T1587.004](https://intel.threadlinqs.com/technique/T1587.004), [T1588.002](https://intel.threadlinqs.com/technique/T1588.002), [T1588.005](https://intel.threadlinqs.com/technique/T1588.005), [T1588.006](https://intel.threadlinqs.com/technique/T1588.006), [T1588.007](https://intel.threadlinqs.com/technique/T1588.007), [T1589](https://intel.threadlinqs.com/technique/T1589), [T1589.001](https://intel.threadlinqs.com/technique/T1589.001), [T1591](https://intel.threadlinqs.com/technique/T1591), [T1592](https://intel.threadlinqs.com/technique/T1592), [T1592.002](https://intel.threadlinqs.com/technique/T1592.002), [T1593](https://intel.threadlinqs.com/technique/T1593), [T1595](https://intel.threadlinqs.com/technique/T1595), [T1595.001](https://intel.threadlinqs.com/technique/T1595.001), [T1595.002](https://intel.threadlinqs.com/technique/T1595.002), [T1596.005](https://intel.threadlinqs.com/technique/T1596.005), [T1598](https://intel.threadlinqs.com/technique/T1598), [T1598.003](https://intel.threadlinqs.com/technique/T1598.003), [T1601.002](https://intel.threadlinqs.com/technique/T1601.002), [T1602.002](https://intel.threadlinqs.com/technique/T1602.002), [T1606.002](https://intel.threadlinqs.com/technique/T1606.002), [T1608.001](https://intel.threadlinqs.com/technique/T1608.001), [T1608.005](https://intel.threadlinqs.com/technique/T1608.005), [T1611](https://intel.threadlinqs.com/technique/T1611), [T1620](https://intel.threadlinqs.com/technique/T1620), [T1622](https://intel.threadlinqs.com/technique/T1622), [T1628.001](https://intel.threadlinqs.com/technique/T1628.001), [T1651](https://intel.threadlinqs.com/technique/T1651), [T1655.001](https://intel.threadlinqs.com/technique/T1655.001), T1656, [T1657](https://intel.threadlinqs.com/technique/T1657), [T1660](https://intel.threadlinqs.com/technique/T1660), [T1665](https://intel.threadlinqs.com/technique/T1665), [T1684.001](https://intel.threadlinqs.com/technique/T1684.001), [T1685](https://intel.threadlinqs.com/technique/T1685), [T1685.005](https://intel.threadlinqs.com/technique/T1685.005), [T1685.006](https://intel.threadlinqs.com/technique/T1685.006), [T1686](https://intel.threadlinqs.com/technique/T1686)

## Threat actors

[AtlasCore](https://intel.threadlinqs.com/actor/AtlasCore), [IPIDEA proxy network operators](https://intel.threadlinqs.com/actor/IPIDEA%20proxy%20network%20operators), [GTG-1002](https://intel.threadlinqs.com/actor/GTG-1002), [INJ3CTOR3](https://intel.threadlinqs.com/actor/INJ3CTOR3), [WARP PANDA](https://intel.threadlinqs.com/actor/WARP%20PANDA), [GoldFactory](https://intel.threadlinqs.com/actor/GoldFactory), [Jade Sleet](https://intel.threadlinqs.com/actor/Jade%20Sleet), [VAPOR PANDA](https://intel.threadlinqs.com/actor/VAPOR%20PANDA), [Volt Typhoon - G1017](https://intel.threadlinqs.com/actor/Volt%20Typhoon%20-%20G1017), [APT31](https://intel.threadlinqs.com/actor/APT31), [UAT-11473](https://intel.threadlinqs.com/actor/UAT-11473)

Nation-state attribution: Russia / Iran, China, China, Iran, North Korea, Russia, Belarus, CN, North Korea

Threat categories: MALWARE, PHISHING, THREAT_INTEL, APT, VULNERABILITY, SUPPLY_CHAIN

## Severity breakdown

- critical: 13
- high: 24
- medium: 10
- low: 2

## Indicator & detection coverage

Counts only; indicator values and detection rule text unlock per threat with TL Creds.

- Indicators of compromise: 1236 (network 378, file 338, behavioral 171, entity 101, malware 71, infrastructure 69, tool 64, package 42, technique 2)
- New detection rules: 441 (100% of the day’s threats covered)

## More editions

- Previous: [2026-10-28](https://intel.threadlinqs.com/debrief/2026-10-28)
- Next: [2026-10-30](https://intel.threadlinqs.com/debrief/2026-10-30)
- [Archive of daily debriefs](https://intel.threadlinqs.com/debrief/archive)
- [Latest debrief](https://intel.threadlinqs.com/debrief)

Canonical: https://intel.threadlinqs.com/debrief/2026-10-29