Threadlinqs IntelligenceStart free

Daily debrief · Saturday2026-10-31

Daily Intelligence Briefing — Saturday, October 31, 2026

7 critical28 high12 medium2 low

On 2026-10-31, Threadlinqs published 42 new threat reports and updated 8, 7 rated critical and 28 high, spanning 234 MITRE ATT&CK techniques and 14 named threat actors. Coverage that day added 463 new detection rules and 965 extracted indicators.

New threats
428 updated
Critical / high
357 critical · 28 high
ATT&CK techniques
234Observed in the day’s reports
Threat actors
14Named in the reports
Indicators
965Count only · values are Red+
Detection rules
463New that day · rule text is Blue+

Edition date: · Last updated:

Summary & highlights

Stored XSS vulnerabilities in Request Tracker and RT for Incident Response (CVE-2026-105454, CVE-2026-105455, CVE-2026-105456). Cloudflare Q3 2026 DDoS Threat Report: 18.2 Million Network-Layer Attacks (+38% QoQ) Driven by Dysphoria, Evooo1Bot and Booter Services. The Mac Malware of 2024 - Objective-See annual review of macOS stealers, ransomware and backdoors (BeaverTail, SpectralBlur, LightSpy, NotLockBit).

Highlights

  • TL-2026-4878 — Windows Minifilter Driver N-day Privilege Escalation - Public PoC (ALPC Write Primitive / PPID Spoofing Exploits)
  • TL-2026-4883 — Russia-aligned actors exploit CVE-2025-8088 (WinRAR path traversal in ClamAV's bundled UnRAR) via MDaemon mail server scanning to drop HELLAGE/HELLTAG backdoors without user interaction
  • TL-2026-4892 — DPRK BeaverTail Native macOS Variant Masquerading as MiroTalk Conferencing App (InvisibleFerret Payload)
  • TL-2026-4894 — DPRK SpectralBlur macOS Backdoor (TA444 / BlueNoroff)
  • TL-2026-4895 — The Mac Malware of 2023: macOS Ransomware, Stealers, and DPRK/Iran-Linked APT Malware (Objective-See Annual Review)

Theme of the day

Network infrastructure attacks surged alongside a major Binance breach via DevOps compromise, while AI-driven intrusion campaigns and industrial incidents dominated the day's severe threats.

  • ransomware
  • windows
  • infostealer
  • macos
  • dprk

Threats published

50 threat lines in the 2026-10-31 debrief, most severe first; entries marked (update) revise an earlier report. Each links to its full profile.

Techniques observed

234 MITRE ATT&CK and ATLAS techniques appear across the day’s reports.

Threat actors

14 named threat actors across the reports.

Nation-state attribution

  • North Korea
  • Russia
  • North Korea; Iran
  • Iran
  • Palestine

Threat categories

  • VULNERABILITY
  • THREAT_INTEL
  • MALWARE
  • PHISHING
  • RANSOMWARE
  • APT

Severity breakdown

  • critical7
  • high28
  • medium12
  • low2

Indicator & detection coverage

Counts only: the indicator values and detection rule text behind them unlock with TL Creds.

965 indicators of compromise · unlock with TL Creds. Compare plans
  • file 266
  • network 262
  • behavioral 125
  • entity 69
  • malware 65
  • infrastructure 60
  • tool 50
  • package 37
  • host 21
  • technique 8
  • software 2
463 new detection rules (100% of the day’s threats covered) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)