# Daily Intelligence Briefing — Sunday, November 1, 2026

> On 2026-11-01, Threadlinqs published 22 new threat reports and updated 7, 4 rated critical and 17 high, spanning 194 MITRE ATT&CK techniques and 9 named threat actors. Coverage that day added 261 new detection rules and 609 extracted indicators.

- **Edition:** 2026-11-01 (Sunday)
- **Canonical:** https://intel.threadlinqs.com/debrief/2026-11-01
- **Last updated:** 2026-11-07
- **New threats:** 22 (7 updated)
- **Critical / high:** 4 critical, 17 high, 7 medium, 1 low
- **ATT&CK techniques:** 194
- **Threat actors:** 9
- **Indicators (count only):** 609
- **New detection rules (count only):** 261

## Summary & highlights

Online Scam Volumes Double to Overtake Phishing (Akamai/Bolster AI data; AI-driven phishing kits and shorter attack lifespans). QuimaRAT: Java-based cross-platform Remote Access Trojan offered as Malware-as-a-Service. Cryptomining Campaign Targeting Linux SSH Servers (XMRig, ShellBot, XHide, Go-based downloaders).

- [TL-2026-4963](https://intel.threadlinqs.com/threat/TL-2026-4963) — DragonForce Ransomware Claims Victim lyserp.com (ERP Software Provider)
- [TL-2026-4965](https://intel.threadlinqs.com/threat/TL-2026-4965) — WhiteArmor ransomware/extortion group claims Hisense data theft (19 GB) and demands $5 million in Bitcoin
- [TL-2026-4969](https://intel.threadlinqs.com/threat/TL-2026-4969) — Threat Intelligence Snapshot Week 37 2026: FortiGate CVE-2025-25249 Exploitation (PivotC2), StyleSmuggler Magento/Adobe Commerce Zero-Day (CVE-2026-75650), BigBear 2.0 AiTM and Related Campaigns
- [TL-2026-4976](https://intel.threadlinqs.com/threat/TL-2026-4976) — TeamViewer Integer Overflow (CVE-2026-111585) Lets Malicious Hosts Compromise Support Technicians' Viewer Machines
- [TL-2026-4979](https://intel.threadlinqs.com/threat/TL-2026-4979) — APT SideWinder Domain Infrastructure Targeting South Asian Governments (CVE-2017-0199 Weaponized Documents)

## Theme of the day

Actively exploited cPanel & WHM authentication bypass via CRLF session injection dominated the day, alongside LiteLLM proxy exploit chains and Salt Typhoon's abuse of IOS XE CVE-2023-20198. APT SideWinder domain infrastructure targeting South Asia drove the espionage activity.

windows, no-cve, linux, credential-theft, data-exfiltration

## Threats published

- [TL-2026-4974](https://intel.threadlinqs.com/threat/TL-2026-4974) — CRITICAL — Dell PowerProtect Data Domain multiple vulnerabilities fixed (DSA-2026-416, NCSC-2026-0460)
- [TL-2026-4981](https://intel.threadlinqs.com/threat/TL-2026-4981) — CRITICAL — CVE-2026-112816: CVSS 10.0 LXD and MicroCloud TLS Client Authentication Bypass (Impersonation Without Private Key)
- [TL-2026-2438](https://intel.threadlinqs.com/threat/TL-2026-2438) — CRITICAL — Endor Labs Discloses 14 Critical/High Vulnerabilities Across Seven AI Orchestration Platforms (NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra, Apache Airflow) (update)
- [TL-2026-4686](https://intel.threadlinqs.com/threat/TL-2026-4686) — CRITICAL — PHP2Shell (CVE-2026-109618/CVE-2026-109619) + Fragnesia (CVE-2026-46300) Chain Roots 25 Servers, Breaches U.S. Government-Affiliated Network (update)
- [TL-2026-4963](https://intel.threadlinqs.com/threat/TL-2026-4963) — HIGH — DragonForce Ransomware Claims Victim lyserp.com (ERP Software Provider)
- [TL-2026-4965](https://intel.threadlinqs.com/threat/TL-2026-4965) — HIGH — WhiteArmor ransomware/extortion group claims Hisense data theft (19 GB) and demands $5 million in Bitcoin
- [TL-2026-4969](https://intel.threadlinqs.com/threat/TL-2026-4969) — HIGH — Threat Intelligence Snapshot Week 37 2026: FortiGate CVE-2025-25249 Exploitation (PivotC2), StyleSmuggler Magento/Adobe Commerce Zero-Day (CVE-2026-75650), BigBear 2.0 AiTM and Related Campaigns
- [TL-2026-4976](https://intel.threadlinqs.com/threat/TL-2026-4976) — HIGH — TeamViewer Integer Overflow (CVE-2026-111585) Lets Malicious Hosts Compromise Support Technicians' Viewer Machines
- [TL-2026-4979](https://intel.threadlinqs.com/threat/TL-2026-4979) — HIGH — APT SideWinder Domain Infrastructure Targeting South Asian Governments (CVE-2017-0199 Weaponized Documents)
- [TL-2026-4980](https://intel.threadlinqs.com/threat/TL-2026-4980) — HIGH — Talos IR Trends Q3 2026: IT help desk vishing and rising ransomware activity; Salt Typhoon exploiting CVE-2023-20198
- [TL-2026-4993](https://intel.threadlinqs.com/threat/TL-2026-4993) — HIGH — Microsoft Edge Logic-Bug Full Exploit Chain Enables Code Execution Without Memory Corruption (Pwn2Own Berlin 2026, Orange Tsai; CVE-2026-45495)
- [TL-2026-4994](https://intel.threadlinqs.com/threat/TL-2026-4994) — HIGH — Operation Fake KickOff: Recruiter-Impersonation AitM Phishing Abusing SaaS to Harvest Work Credentials
- [TL-2026-4996](https://intel.threadlinqs.com/threat/TL-2026-4996) — HIGH — Microsoft Edge Logic-Bug Full Chain: UXSS, Immersive Reader File Write and protocols.json Hijack Escape Sandbox to Windows Code Execution (Pwn2Own Berlin 2026)
- [TL-2026-4997](https://intel.threadlinqs.com/threat/TL-2026-4997) — HIGH — SloppyRAT: New ClickFix-Delivered Remote Access Trojan Supporting Ransomware Operations
- [TL-2026-5002](https://intel.threadlinqs.com/threat/TL-2026-5002) — HIGH — Compromised Injective SDK npm Package (@injectivelabs/sdk-ts 1.20.21) Exfiltrates Cryptocurrency Wallet Keys
- [TL-2026-5028](https://intel.threadlinqs.com/threat/TL-2026-5028) — HIGH — Active Exploitation of BTCPay Server Instances Draining Bitcoin Hot Wallets (Versions Older Than 2.4.2)
- [TL-2026-5029](https://intel.threadlinqs.com/threat/TL-2026-5029) — HIGH — TightVNC Viewer 2.8.88 x64 Pre-Authentication RCE via RFB Framebuffer Integer Overflow / Heap Buffer Overflow (No CVE) - PoC Released
- [TL-2026-1379](https://intel.threadlinqs.com/threat/TL-2026-1379) — HIGH — Jscrambler npm Package Compromised: IronWorm Cross-Platform Infostealer (Shai-Hulud Lineage) via Rust Native Binaries (update)
- [TL-2026-3470](https://intel.threadlinqs.com/threat/TL-2026-3470) — HIGH — Coruna and DarkSword iOS Exploit Kits Compromise iPhones via Single Malicious Website (UNC6353, UNC6691, UNC6748, PARS Defense) (update)
- [TL-2026-4624](https://intel.threadlinqs.com/threat/TL-2026-4624) — HIGH — Anthropic Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Android, Windows and Linux Exploits (CVE-2026-33096, CVE-2026-98432) (update)
- [TL-2026-4740](https://intel.threadlinqs.com/threat/TL-2026-4740) — HIGH — China-nexus WARP PANDA exploits VMware ESXi insufficient-logging flaw (CVE-2026-41709) against law firms (update)
- [TL-2026-4991](https://intel.threadlinqs.com/threat/TL-2026-4991) — MEDIUM — Online Scam Volumes Double to Overtake Phishing (Akamai/Bolster AI data; AI-driven phishing kits and shorter attack lifespans)
- [TL-2026-4995](https://intel.threadlinqs.com/threat/TL-2026-4995) — MEDIUM — QuimaRAT: Java-based cross-platform Remote Access Trojan offered as Malware-as-a-Service
- [TL-2026-5000](https://intel.threadlinqs.com/threat/TL-2026-5000) — MEDIUM — Cryptomining Campaign Targeting Linux SSH Servers (XMRig, ShellBot, XHide, Go-based downloaders)
- [TL-2026-5021](https://intel.threadlinqs.com/threat/TL-2026-5021) — MEDIUM — OWASP Warns AI Agents Are Lowering the Skill Barrier for Cyberattacks (LLM Exploit Generation Guide 2.0)
- [TL-2026-5024](https://intel.threadlinqs.com/threat/TL-2026-5024) — MEDIUM — Amazon Kiro IDE Prompt Injection Enabling Data Exfiltration via Malicious Workspace (CVE-2026-89332)
- [TL-2026-5026](https://intel.threadlinqs.com/threat/TL-2026-5026) — MEDIUM — Town of Whitsett, NC Microsoft 365 Account Compromise Used to Send Fake Payment Phishing Email
- [TL-2026-4559](https://intel.threadlinqs.com/threat/TL-2026-4559) — MEDIUM — Nefilim and Hive Ransomware Affiliate Artem Stryzhak Sentenced to 70 Months (update)
- [TL-2026-4978](https://intel.threadlinqs.com/threat/TL-2026-4978) — LOW — Hunting Malware C2 Infrastructure with FOFA Queries (AsyncRAT, Cobalt Strike, Amadey, Quasar RAT, Laplas Clipper, Sliver, Mythic, Supershell)

## Techniques observed

[AML.T0051](https://intel.threadlinqs.com/technique/AML.T0051), [AML.T0051.001](https://intel.threadlinqs.com/technique/AML.T0051.001), [T1003.001](https://intel.threadlinqs.com/technique/T1003.001), [T1003.003](https://intel.threadlinqs.com/technique/T1003.003), [T1005](https://intel.threadlinqs.com/technique/T1005), [T1018](https://intel.threadlinqs.com/technique/T1018), [T1021](https://intel.threadlinqs.com/technique/T1021), [T1021.001](https://intel.threadlinqs.com/technique/T1021.001), [T1021.004](https://intel.threadlinqs.com/technique/T1021.004), [T1021.005](https://intel.threadlinqs.com/technique/T1021.005), [T1027](https://intel.threadlinqs.com/technique/T1027), [T1027.006](https://intel.threadlinqs.com/technique/T1027.006), [T1027.007](https://intel.threadlinqs.com/technique/T1027.007), [T1027.010](https://intel.threadlinqs.com/technique/T1027.010), [T1027.013](https://intel.threadlinqs.com/technique/T1027.013), [T1030](https://intel.threadlinqs.com/technique/T1030), [T1033](https://intel.threadlinqs.com/technique/T1033), [T1036](https://intel.threadlinqs.com/technique/T1036), [T1036.003](https://intel.threadlinqs.com/technique/T1036.003), [T1036.004](https://intel.threadlinqs.com/technique/T1036.004), [T1036.005](https://intel.threadlinqs.com/technique/T1036.005), [T1037.004](https://intel.threadlinqs.com/technique/T1037.004), [T1040](https://intel.threadlinqs.com/technique/T1040), [T1041](https://intel.threadlinqs.com/technique/T1041), [T1046](https://intel.threadlinqs.com/technique/T1046), [T1047](https://intel.threadlinqs.com/technique/T1047), [T1049](https://intel.threadlinqs.com/technique/T1049), [T1053.003](https://intel.threadlinqs.com/technique/T1053.003), [T1053.005](https://intel.threadlinqs.com/technique/T1053.005), [T1055](https://intel.threadlinqs.com/technique/T1055), [T1057](https://intel.threadlinqs.com/technique/T1057), [T1059](https://intel.threadlinqs.com/technique/T1059), [T1059.001](https://intel.threadlinqs.com/technique/T1059.001), [T1059.003](https://intel.threadlinqs.com/technique/T1059.003), [T1059.004](https://intel.threadlinqs.com/technique/T1059.004), [T1059.005](https://intel.threadlinqs.com/technique/T1059.005), [T1059.006](https://intel.threadlinqs.com/technique/T1059.006), [T1059.007](https://intel.threadlinqs.com/technique/T1059.007), [T1068](https://intel.threadlinqs.com/technique/T1068), [T1069.002](https://intel.threadlinqs.com/technique/T1069.002), T1070.002, [T1070.004](https://intel.threadlinqs.com/technique/T1070.004), [T1070.006](https://intel.threadlinqs.com/technique/T1070.006), [T1071](https://intel.threadlinqs.com/technique/T1071), [T1071.001](https://intel.threadlinqs.com/technique/T1071.001), [T1074](https://intel.threadlinqs.com/technique/T1074), [T1078](https://intel.threadlinqs.com/technique/T1078), [T1078.004](https://intel.threadlinqs.com/technique/T1078.004), [T1082](https://intel.threadlinqs.com/technique/T1082), [T1083](https://intel.threadlinqs.com/technique/T1083), [T1087.001](https://intel.threadlinqs.com/technique/T1087.001), [T1087.002](https://intel.threadlinqs.com/technique/T1087.002), T1087.003, [T1090](https://intel.threadlinqs.com/technique/T1090), [T1090.001](https://intel.threadlinqs.com/technique/T1090.001), [T1090.003](https://intel.threadlinqs.com/technique/T1090.003), [T1095](https://intel.threadlinqs.com/technique/T1095), [T1098](https://intel.threadlinqs.com/technique/T1098), [T1098.005](https://intel.threadlinqs.com/technique/T1098.005), [T1102](https://intel.threadlinqs.com/technique/T1102), [T1102.001](https://intel.threadlinqs.com/technique/T1102.001), [T1102.002](https://intel.threadlinqs.com/technique/T1102.002), [T1105](https://intel.threadlinqs.com/technique/T1105), [T1106](https://intel.threadlinqs.com/technique/T1106), [T1110.001](https://intel.threadlinqs.com/technique/T1110.001), [T1110.003](https://intel.threadlinqs.com/technique/T1110.003), [T1111](https://intel.threadlinqs.com/technique/T1111), [T1112](https://intel.threadlinqs.com/technique/T1112), [T1113](https://intel.threadlinqs.com/technique/T1113), [T1114.002](https://intel.threadlinqs.com/technique/T1114.002), [T1123](https://intel.threadlinqs.com/technique/T1123), [T1125](https://intel.threadlinqs.com/technique/T1125), [T1132.001](https://intel.threadlinqs.com/technique/T1132.001), [T1133](https://intel.threadlinqs.com/technique/T1133), [T1134](https://intel.threadlinqs.com/technique/T1134), [T1134.004](https://intel.threadlinqs.com/technique/T1134.004), [T1135](https://intel.threadlinqs.com/technique/T1135), [T1136](https://intel.threadlinqs.com/technique/T1136), [T1136.001](https://intel.threadlinqs.com/technique/T1136.001), [T1136.002](https://intel.threadlinqs.com/technique/T1136.002), [T1140](https://intel.threadlinqs.com/technique/T1140), [T1185](https://intel.threadlinqs.com/technique/T1185), [T1189](https://intel.threadlinqs.com/technique/T1189), [T1190](https://intel.threadlinqs.com/technique/T1190), [T1195.001](https://intel.threadlinqs.com/technique/T1195.001), [T1195.002](https://intel.threadlinqs.com/technique/T1195.002), [T1202](https://intel.threadlinqs.com/technique/T1202), [T1203](https://intel.threadlinqs.com/technique/T1203), [T1204](https://intel.threadlinqs.com/technique/T1204), [T1204.001](https://intel.threadlinqs.com/technique/T1204.001), [T1204.002](https://intel.threadlinqs.com/technique/T1204.002), [T1204.004](https://intel.threadlinqs.com/technique/T1204.004), [T1210](https://intel.threadlinqs.com/technique/T1210), [T1211](https://intel.threadlinqs.com/technique/T1211), [T1212](https://intel.threadlinqs.com/technique/T1212), [T1213](https://intel.threadlinqs.com/technique/T1213), [T1213.002](https://intel.threadlinqs.com/technique/T1213.002), [T1218.011](https://intel.threadlinqs.com/technique/T1218.011), [T1219](https://intel.threadlinqs.com/technique/T1219), T1221, T1461, [T1480](https://intel.threadlinqs.com/technique/T1480), [T1486](https://intel.threadlinqs.com/technique/T1486), [T1489](https://intel.threadlinqs.com/technique/T1489), [T1490](https://intel.threadlinqs.com/technique/T1490), [T1496.001](https://intel.threadlinqs.com/technique/T1496.001), [T1497](https://intel.threadlinqs.com/technique/T1497), [T1497.001](https://intel.threadlinqs.com/technique/T1497.001), [T1499.004](https://intel.threadlinqs.com/technique/T1499.004), [T1505.003](https://intel.threadlinqs.com/technique/T1505.003), [T1518.001](https://intel.threadlinqs.com/technique/T1518.001), [T1526](https://intel.threadlinqs.com/technique/T1526), [T1528](https://intel.threadlinqs.com/technique/T1528), [T1530](https://intel.threadlinqs.com/technique/T1530), [T1537](https://intel.threadlinqs.com/technique/T1537), [T1539](https://intel.threadlinqs.com/technique/T1539), [T1543.001](https://intel.threadlinqs.com/technique/T1543.001), [T1543.002](https://intel.threadlinqs.com/technique/T1543.002), [T1546](https://intel.threadlinqs.com/technique/T1546), [T1546.015](https://intel.threadlinqs.com/technique/T1546.015), [T1547.001](https://intel.threadlinqs.com/technique/T1547.001), [T1547.006](https://intel.threadlinqs.com/technique/T1547.006), [T1547.013](https://intel.threadlinqs.com/technique/T1547.013), [T1550](https://intel.threadlinqs.com/technique/T1550), [T1550.001](https://intel.threadlinqs.com/technique/T1550.001), [T1550.004](https://intel.threadlinqs.com/technique/T1550.004), [T1552](https://intel.threadlinqs.com/technique/T1552), [T1552.001](https://intel.threadlinqs.com/technique/T1552.001), [T1552.004](https://intel.threadlinqs.com/technique/T1552.004), [T1552.005](https://intel.threadlinqs.com/technique/T1552.005), [T1553.005](https://intel.threadlinqs.com/technique/T1553.005), [T1555](https://intel.threadlinqs.com/technique/T1555), [T1555.001](https://intel.threadlinqs.com/technique/T1555.001), [T1555.003](https://intel.threadlinqs.com/technique/T1555.003), [T1555.005](https://intel.threadlinqs.com/technique/T1555.005), [T1556.003](https://intel.threadlinqs.com/technique/T1556.003), [T1557](https://intel.threadlinqs.com/technique/T1557), [T1560](https://intel.threadlinqs.com/technique/T1560), [T1560.001](https://intel.threadlinqs.com/technique/T1560.001), T1562.012, [T1564.001](https://intel.threadlinqs.com/technique/T1564.001), T1564.006, [T1565.001](https://intel.threadlinqs.com/technique/T1565.001), [T1566](https://intel.threadlinqs.com/technique/T1566), [T1566.001](https://intel.threadlinqs.com/technique/T1566.001), [T1566.002](https://intel.threadlinqs.com/technique/T1566.002), [T1566.003](https://intel.threadlinqs.com/technique/T1566.003), [T1566.004](https://intel.threadlinqs.com/technique/T1566.004), [T1567](https://intel.threadlinqs.com/technique/T1567), [T1567.002](https://intel.threadlinqs.com/technique/T1567.002), [T1568.002](https://intel.threadlinqs.com/technique/T1568.002), [T1569.002](https://intel.threadlinqs.com/technique/T1569.002), [T1570](https://intel.threadlinqs.com/technique/T1570), [T1572](https://intel.threadlinqs.com/technique/T1572), [T1573](https://intel.threadlinqs.com/technique/T1573), [T1573.001](https://intel.threadlinqs.com/technique/T1573.001), [T1573.002](https://intel.threadlinqs.com/technique/T1573.002), [T1574.001](https://intel.threadlinqs.com/technique/T1574.001), T1574.007, [T1583](https://intel.threadlinqs.com/technique/T1583), [T1583.001](https://intel.threadlinqs.com/technique/T1583.001), [T1583.003](https://intel.threadlinqs.com/technique/T1583.003), [T1583.006](https://intel.threadlinqs.com/technique/T1583.006), [T1584](https://intel.threadlinqs.com/technique/T1584), [T1586](https://intel.threadlinqs.com/technique/T1586), [T1586.002](https://intel.threadlinqs.com/technique/T1586.002), [T1587.001](https://intel.threadlinqs.com/technique/T1587.001), [T1587.004](https://intel.threadlinqs.com/technique/T1587.004), [T1588.001](https://intel.threadlinqs.com/technique/T1588.001), [T1588.002](https://intel.threadlinqs.com/technique/T1588.002), [T1588.007](https://intel.threadlinqs.com/technique/T1588.007), [T1589](https://intel.threadlinqs.com/technique/T1589), [T1589.002](https://intel.threadlinqs.com/technique/T1589.002), [T1591](https://intel.threadlinqs.com/technique/T1591), [T1592](https://intel.threadlinqs.com/technique/T1592), [T1592.002](https://intel.threadlinqs.com/technique/T1592.002), [T1595](https://intel.threadlinqs.com/technique/T1595), [T1595.002](https://intel.threadlinqs.com/technique/T1595.002), T1596.003, [T1596.005](https://intel.threadlinqs.com/technique/T1596.005), [T1608](https://intel.threadlinqs.com/technique/T1608), [T1608.004](https://intel.threadlinqs.com/technique/T1608.004), [T1609](https://intel.threadlinqs.com/technique/T1609), [T1610](https://intel.threadlinqs.com/technique/T1610), [T1611](https://intel.threadlinqs.com/technique/T1611), [T1620](https://intel.threadlinqs.com/technique/T1620), [T1622](https://intel.threadlinqs.com/technique/T1622), [T1649](https://intel.threadlinqs.com/technique/T1649), [T1657](https://intel.threadlinqs.com/technique/T1657), [T1659](https://intel.threadlinqs.com/technique/T1659), [T1684.001](https://intel.threadlinqs.com/technique/T1684.001), [T1685](https://intel.threadlinqs.com/technique/T1685), [T1685.005](https://intel.threadlinqs.com/technique/T1685.005), [T1685.006](https://intel.threadlinqs.com/technique/T1685.006)

## Threat actors

[DragonForce](https://intel.threadlinqs.com/actor/DragonForce), [WhiteArmor](https://intel.threadlinqs.com/actor/WhiteArmor), [UNC6671](https://intel.threadlinqs.com/actor/UNC6671), [Sidewinder - G0121](https://intel.threadlinqs.com/actor/Sidewinder%20-%20G0121), [Salt Typhoon - G1045](https://intel.threadlinqs.com/actor/Salt%20Typhoon%20-%20G1045), [O-UNC-038](https://intel.threadlinqs.com/actor/O-UNC-038), Artem Stryzhak, [UNC6353](https://intel.threadlinqs.com/actor/UNC6353), [WARP PANDA](https://intel.threadlinqs.com/actor/WARP%20PANDA)

Nation-state attribution: MY, India, China, Ukraine, Russia

Threat categories: PHISHING, MALWARE, THREAT_INTEL, VULNERABILITY, RANSOMWARE, APT, SUPPLY_CHAIN

## Severity breakdown

- critical: 4
- high: 17
- medium: 7
- low: 1

## Indicator & detection coverage

Counts only; indicator values and detection rule text unlock per threat with TL Creds.

- Indicators of compromise: 609 (network 194, file 143, behavioral 60, entity 48, malware 44, tool 44, package 43, infrastructure 33)
- New detection rules: 261 (100% of the day’s threats covered)

## More editions

- Previous: [2026-10-31](https://intel.threadlinqs.com/debrief/2026-10-31)
- Next: [2026-11-02](https://intel.threadlinqs.com/debrief/2026-11-02)
- [Archive of daily debriefs](https://intel.threadlinqs.com/debrief/archive)
- [Latest debrief](https://intel.threadlinqs.com/debrief)

Canonical: https://intel.threadlinqs.com/debrief/2026-11-01