Threadlinqs IntelligenceStart free

Daily debrief · Friday2026-10-30

Daily Intelligence Briefing — Friday, October 30, 2026

9 critical18 high15 medium2 low

On 2026-10-30, Threadlinqs published 40 new threat reports and updated 4, 9 rated critical and 18 high, spanning 222 MITRE ATT&CK techniques and 8 named threat actors. Coverage that day added 396 new detection rules and 839 extracted indicators.

New threats
404 updated
Critical / high
279 critical · 18 high
ATT&CK techniques
222Observed in the day’s reports
Threat actors
8Named in the reports
Indicators
839Count only · values are Red+
Detection rules
396New that day · rule text is Blue+

Edition date: · Last updated:

Summary & highlights

Latrodectus / LummaStealer phishing infrastructure tracked via passive DNS and 302 redirects. "SMS of Death" Zero-Click Android Denial-of-Service via WapPushOverSms.decodeWapPdu() (Android 14-17). Latrodectus Loader – Script Obfuscation via Junk Comments and Self-Referencing Code (upd.msi sample).

Highlights

  • TL-2026-4819 — AhnLab ASEC September 2026 Domestic APT Trend Report - Spear-Phishing LNK/HTA/regsvr32 Chains Delivering XenoRAT, AutoIt Backdoors, Infostealer and Keylogger Against South Korea
  • TL-2026-4820 — Malicious Anthropic.claude-code extension version 2.1.313 distributed via Cursor Extension Marketplace (SSH backdoor and persistence on macOS and Windows)
  • TL-2026-4821 — Claude Code extension (anthropic.claude-code v2.1.313) on Open VSX poisoned with persistent SSH backdoor
  • TL-2026-4825 — AI-Agent-Driven Intrusion Campaign: Captured Attacker Logs Show Claude opus-4.5 and Codex gpt-5.2-codex Used to Breach 14+ Companies (Livewire CVE-2025-54068, CitrixBleed 2 CVE-2025-5777, Squid, Ghostscript, PwnKit, Dirty Pipe)
  • TL-2026-4829 — Kairos Go-based DDoS Botnet Infects Linux Devices via Passwordless Root Telnet

Theme of the day

Activity centered on windows, malware, credential-theft.

  • credential-theft
  • windows
  • no-cve
  • cisa-kev
  • remote-code-execution

Threats published

44 threat lines in the 2026-10-30 debrief, most severe first; entries marked (update) revise an earlier report. Each links to its full profile.

Techniques observed

222 MITRE ATT&CK and ATLAS techniques appear across the day’s reports.

Threat actors

8 named threat actors across the reports.

Nation-state attribution

  • Iran (reported, one campaign only)
  • China
  • Ethiopia
  • Russia / Iran
  • North Korea

Threat categories

  • MALWARE
  • VULNERABILITY
  • THREAT_INTEL
  • APT
  • SUPPLY_CHAIN
  • DATA_BREACH

Severity breakdown

  • critical9
  • high18
  • medium15
  • low2

Indicator & detection coverage

Counts only: the indicator values and detection rule text behind them unlock with TL Creds.

839 indicators of compromise · unlock with TL Creds. Compare plans
  • file 226
  • network 188
  • behavioral 127
  • entity 92
  • tool 63
  • infrastructure 59
  • malware 55
  • package 25
  • vulnerability 4
396 new detection rules (100% of the day’s threats covered) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)