# Daily Intelligence Briefing — Monday, November 2, 2026

> On 2026-11-02, Threadlinqs published 37 new threat reports and updated 4, 10 rated critical and 14 high, spanning 210 MITRE ATT&CK techniques and 10 named threat actors. Coverage that day added 369 new detection rules and 866 extracted indicators.

- **Edition:** 2026-11-02 (Monday)
- **Canonical:** https://intel.threadlinqs.com/debrief/2026-11-02
- **Last updated:** 2026-11-08
- **New threats:** 37 (4 updated)
- **Critical / high:** 10 critical, 14 high, 16 medium, 1 low
- **ATT&CK techniques:** 210
- **Threat actors:** 10
- **Indicators (count only):** 866
- **New detection rules (count only):** 369

## Summary & highlights

Infostealers Weekly Report 2026-10-26 to 2026-11-02: Generic Stealer, Warden Stealer, Acreed, Remus, Vidar. Chainalysis Confirms Cyberattack: Unauthorized Access to Internal Tools via 'Offensive Agentic Techniques' Exposes Customer Account Data. Threat Actor Impersonates ~32 AI Bots (ChatGPT, Claude, Perplexity, Meta) to Hunt for .env Secrets and API Keys.

- [TL-2026-5030](https://intel.threadlinqs.com/threat/TL-2026-5030) — Hackers Target 61 GitHub Repositories With Command Injection Attacks to Steal CI/CD Secrets
- [TL-2026-5032](https://intel.threadlinqs.com/threat/TL-2026-5032) — ARTEX Autonomous AI Pentest Framework Weaponized by UNC7228 / Storm-0940 for Automated Network Intrusions, Cloud Abuse and Data Theft
- [TL-2026-5039](https://intel.threadlinqs.com/threat/TL-2026-5039) — CyberStrikeAI: AI-orchestrated pentest/C2 framework used in real-world attacks on educational institutions in Africa and Latin America
- [TL-2026-5042](https://intel.threadlinqs.com/threat/TL-2026-5042) — ChatGPT Web Frontend Cross-Frame Flaw (MathLive postMessage + srcdoc iframe + YouTube oEmbed JSONP CSP Bypass) Enables Account Hijack and Private Conversation Theft via Single Shared Link
- [TL-2026-5044](https://intel.threadlinqs.com/threat/TL-2026-5044) — C3RB3R (Cerber-variant) Ransomware Campaign Against Internet-Exposed Synology NAS Devices (Unpatched / End-of-Life DSM; Disputed Entry Vector: CVE-2024-10441 vs CVE-2026-13639 / CVE-2026-13684)

## Theme of the day

remote-code-execution, infostealer, windows, no-cve, linux

## Threats published

- [TL-2026-5058](https://intel.threadlinqs.com/threat/TL-2026-5058) — CRITICAL — Critical Langflow Flaws (CVE-2026-93680, CVE-2026-110186) Allow Unauthenticated Attackers to Run Code on Servers
- [TL-2026-5068](https://intel.threadlinqs.com/threat/TL-2026-5068) — CRITICAL — BTCPay Server hot wallet thefts via unauthorized administrator access on outdated instances (v2.4.1 and earlier)
- [TL-2026-5075](https://intel.threadlinqs.com/threat/TL-2026-5075) — CRITICAL — Balancer V2 ComposableStablePool Rounding/Invariant Manipulation Exploit (Nov 2025)
- [TL-2026-5091](https://intel.threadlinqs.com/threat/TL-2026-5091) — CRITICAL — CVE-2026-21656 - Johnson Controls Frick Controls Quantum HD Pre-Authentication Code Injection (CWE-94)
- [TL-2026-5103](https://intel.threadlinqs.com/threat/TL-2026-5103) — CRITICAL — NCSC CTO Weekly Summary (week ending 2026-09-13): actively exploited Cisco FMC (CVE-2026-20079/20316), PaperCut NG/MF (CVE-2026-81578/82078), MikroTik RouterOS and FortiGate (CVE-2025-25249) flaws; NetScaler SAML bypass (CVE-2026-19490); BlueMoon exploit kit
- [TL-2026-5105](https://intel.threadlinqs.com/threat/TL-2026-5105) — CRITICAL — CVE-2026-58115: Max-severity Node-RED unauthenticated flow-deployment flaw (Siemens SIMATIC IoT2050) exploited to deliver Linux malware
- [TL-2026-3420](https://intel.threadlinqs.com/threat/TL-2026-3420) — CRITICAL — Ivanti Connect Secure Authentication Bypass by Spoofing Zero-Day (CVE-2026-104935) Exploited in the Wild (update)
- [TL-2026-4075](https://intel.threadlinqs.com/threat/TL-2026-4075) — CRITICAL — Node.js October 2026 Security Releases Fix 10 Vulnerabilities Including Brotli Decoder RCE and TLS Hostname Verification Bypasses (CVE-2026-111497, CVE-2026-105483, CVE-2026-106069, CVE-2026-105482) (update)
- [TL-2026-4799](https://intel.threadlinqs.com/threat/TL-2026-4799) — CRITICAL — Binance security incident: compromised DevOps engineer laptop leads to service container access and ~$6.3 billion in unauthorized withdrawals (update)
- [TL-2026-4981](https://intel.threadlinqs.com/threat/TL-2026-4981) — CRITICAL — CVE-2026-112816: CVSS 10.0 LXD and MicroCloud TLS Client Authentication Bypass (Impersonation Without Private Key) (update)
- [TL-2026-5030](https://intel.threadlinqs.com/threat/TL-2026-5030) — HIGH — Hackers Target 61 GitHub Repositories With Command Injection Attacks to Steal CI/CD Secrets
- [TL-2026-5032](https://intel.threadlinqs.com/threat/TL-2026-5032) — HIGH — ARTEX Autonomous AI Pentest Framework Weaponized by UNC7228 / Storm-0940 for Automated Network Intrusions, Cloud Abuse and Data Theft
- [TL-2026-5039](https://intel.threadlinqs.com/threat/TL-2026-5039) — HIGH — CyberStrikeAI: AI-orchestrated pentest/C2 framework used in real-world attacks on educational institutions in Africa and Latin America
- [TL-2026-5042](https://intel.threadlinqs.com/threat/TL-2026-5042) — HIGH — ChatGPT Web Frontend Cross-Frame Flaw (MathLive postMessage + srcdoc iframe + YouTube oEmbed JSONP CSP Bypass) Enables Account Hijack and Private Conversation Theft via Single Shared Link
- [TL-2026-5044](https://intel.threadlinqs.com/threat/TL-2026-5044) — HIGH — C3RB3R (Cerber-variant) Ransomware Campaign Against Internet-Exposed Synology NAS Devices (Unpatched / End-of-Life DSM; Disputed Entry Vector: CVE-2024-10441 vs CVE-2026-13639 / CVE-2026-13684)
- [TL-2026-5053](https://intel.threadlinqs.com/threat/TL-2026-5053) — HIGH — Public PoC for Windows Ancillary Function Driver for WinSock (afd.sys) Privilege Escalation - CVE-2023-21768
- [TL-2026-5057](https://intel.threadlinqs.com/threat/TL-2026-5057) — HIGH — XCPE Android Set-Top Box Botnet: Videostrong Technology Firmware Supply-Chain Backdoor Disrupted by Google
- [TL-2026-5059](https://intel.threadlinqs.com/threat/TL-2026-5059) — HIGH — Bitter (TA397) Deploys PapRAT (C++ and Rust) via LNK, MSI/VHDX and RAR Chains Against South Asian Organizations
- [TL-2026-5063](https://intel.threadlinqs.com/threat/TL-2026-5063) — HIGH — DarkBlinders (CL-STA-1178 / REF8685, Iran state-aligned) Compromises Israeli Target and Iraqi Kurdish Government Cloud Environment via ShelbyLoader V2, Blackwood and GitHub C2
- [TL-2026-5064](https://intel.threadlinqs.com/threat/TL-2026-5064) — HIGH — The Rise of LLMJacking: Threat Actors Monetize Compromised Cloud and Model Resources (UNC6993, D1337-KAIROS, CVE-2026-40217)
- [TL-2026-5069](https://intel.threadlinqs.com/threat/TL-2026-5069) — HIGH — VOLTA-AUTODOXER: AI-Powered Windows Infostealer Ranks Stolen Data by Monetization Value
- [TL-2026-5092](https://intel.threadlinqs.com/threat/TL-2026-5092) — HIGH — BYOD ransomware gang claims Michigan State University breach (1.3M current and former students)
- [TL-2026-5110](https://intel.threadlinqs.com/threat/TL-2026-5110) — HIGH — PixelSmash – FFmpeg MagicYUV Decoder Heap Out-of-Bounds Write (CVE-2026-8461)
- [TL-2026-5116](https://intel.threadlinqs.com/threat/TL-2026-5116) — HIGH — Bad Sushi: China-nexus phishing operations shift to residential proxy networks (Japan/Taiwan targeting)
- [TL-2026-5041](https://intel.threadlinqs.com/threat/TL-2026-5041) — MEDIUM — Infostealers Weekly Report 2026-10-26 to 2026-11-02: Generic Stealer, Warden Stealer, Acreed, Remus, Vidar
- [TL-2026-5046](https://intel.threadlinqs.com/threat/TL-2026-5046) — MEDIUM — Chainalysis Confirms Cyberattack: Unauthorized Access to Internal Tools via 'Offensive Agentic Techniques' Exposes Customer Account Data
- [TL-2026-5047](https://intel.threadlinqs.com/threat/TL-2026-5047) — MEDIUM — Threat Actor Impersonates ~32 AI Bots (ChatGPT, Claude, Perplexity, Meta) to Hunt for .env Secrets and API Keys
- [TL-2026-5054](https://intel.threadlinqs.com/threat/TL-2026-5054) — MEDIUM — ChatGPT Plus Billing Phishing Kit Uses Rotating WordPress Sites to Steal Payment Details and OTPs
- [TL-2026-5056](https://intel.threadlinqs.com/threat/TL-2026-5056) — MEDIUM — Structural Patch Gap from AI-Driven Vulnerability Discovery (Project Glasswing) - SOC Implications
- [TL-2026-5077](https://intel.threadlinqs.com/threat/TL-2026-5077) — MEDIUM — iPhone BootROM Flaws (checkm8 CVE-2019-8900, usbliter8) Could Be Used to Undermine Cryptocurrency Wallet Security
- [TL-2026-5098](https://intel.threadlinqs.com/threat/TL-2026-5098) — MEDIUM — Ransomware Targeting of Small and Medium-Sized Businesses: Credential Theft, Unpatched Edge Devices, BYOVD and Backup Targeting
- [TL-2026-5108](https://intel.threadlinqs.com/threat/TL-2026-5108) — MEDIUM — ScarfaceStealer: Sandbox-Aware Anti-Analysis and Blockchain-Based C2 Configuration (Electron/NSIS Loader)
- [TL-2026-5109](https://intel.threadlinqs.com/threat/TL-2026-5109) — MEDIUM — NCSC Warning: AI-Powered Malware Highly Likely to Be Used in Ransomware Attack on UK Critical National Infrastructure by 2028
- [TL-2026-5111](https://intel.threadlinqs.com/threat/TL-2026-5111) — MEDIUM — Spamhaus Botnet Threat Update January–June 2026: Sliver Overtakes Cobalt Strike as Leading C&C Family
- [TL-2026-5112](https://intel.threadlinqs.com/threat/TL-2026-5112) — MEDIUM — Spamhaus Botnet Spotlight: Pressure Rises on Botnets (Threat Update July-December 2025) - VenomRAT, Latrodectus, CrazyRDP Takedown
- [TL-2026-5113](https://intel.threadlinqs.com/threat/TL-2026-5113) — MEDIUM — Spamhaus Botnet Threat Update July to December 2025: C&C Activity Up 24%, RATs 42% of Top 20 Botnet Malware
- [TL-2026-5117](https://intel.threadlinqs.com/threat/TL-2026-5117) — MEDIUM — Spamhaus Botnet Threat Update January to June 2025: 26% Rise in Botnet C&C Activity
- [TL-2026-5118](https://intel.threadlinqs.com/threat/TL-2026-5118) — MEDIUM — FreeBSoD: LLM-Assisted FreeBSD Kernel Exploit Development Yields Two Jail Escape Chains (CVE-2026-3038)
- [TL-2026-5119](https://intel.threadlinqs.com/threat/TL-2026-5119) — MEDIUM — SolarMarker: Actions-On-Target — On-Device Fraud via Custom VNC (Saturn) and Browser Data Theft
- [TL-2026-5120](https://intel.threadlinqs.com/threat/TL-2026-5120) — MEDIUM — Impostor Certificates: Threat Actors Impersonating Businesses to Obtain Code-Signing Certificates for SolarMarker and Other Malware
- [TL-2026-5099](https://intel.threadlinqs.com/threat/TL-2026-5099) — LOW — Microsoft Security Research: What Exploited Vulnerabilities Have in Common - Data-Driven Analysis of Real-World Attacks

## Techniques observed

[T1003.001](https://intel.threadlinqs.com/technique/T1003.001), [T1003.002](https://intel.threadlinqs.com/technique/T1003.002), [T1003.006](https://intel.threadlinqs.com/technique/T1003.006), [T1005](https://intel.threadlinqs.com/technique/T1005), [T1008](https://intel.threadlinqs.com/technique/T1008), [T1016](https://intel.threadlinqs.com/technique/T1016), T1016.002, [T1018](https://intel.threadlinqs.com/technique/T1018), [T1020](https://intel.threadlinqs.com/technique/T1020), [T1021](https://intel.threadlinqs.com/technique/T1021), [T1021.002](https://intel.threadlinqs.com/technique/T1021.002), [T1021.005](https://intel.threadlinqs.com/technique/T1021.005), [T1021.006](https://intel.threadlinqs.com/technique/T1021.006), [T1027](https://intel.threadlinqs.com/technique/T1027), [T1027.010](https://intel.threadlinqs.com/technique/T1027.010), [T1033](https://intel.threadlinqs.com/technique/T1033), [T1036](https://intel.threadlinqs.com/technique/T1036), [T1036.003](https://intel.threadlinqs.com/technique/T1036.003), [T1036.005](https://intel.threadlinqs.com/technique/T1036.005), [T1040](https://intel.threadlinqs.com/technique/T1040), [T1041](https://intel.threadlinqs.com/technique/T1041), [T1046](https://intel.threadlinqs.com/technique/T1046), [T1047](https://intel.threadlinqs.com/technique/T1047), [T1048.003](https://intel.threadlinqs.com/technique/T1048.003), [T1053.003](https://intel.threadlinqs.com/technique/T1053.003), [T1053.005](https://intel.threadlinqs.com/technique/T1053.005), [T1055](https://intel.threadlinqs.com/technique/T1055), T1055.009, [T1056](https://intel.threadlinqs.com/technique/T1056), [T1056.001](https://intel.threadlinqs.com/technique/T1056.001), [T1057](https://intel.threadlinqs.com/technique/T1057), [T1059](https://intel.threadlinqs.com/technique/T1059), [T1059.001](https://intel.threadlinqs.com/technique/T1059.001), [T1059.003](https://intel.threadlinqs.com/technique/T1059.003), [T1059.004](https://intel.threadlinqs.com/technique/T1059.004), [T1059.006](https://intel.threadlinqs.com/technique/T1059.006), [T1059.007](https://intel.threadlinqs.com/technique/T1059.007), [T1068](https://intel.threadlinqs.com/technique/T1068), [T1070](https://intel.threadlinqs.com/technique/T1070), T1070.002, [T1070.004](https://intel.threadlinqs.com/technique/T1070.004), [T1070.006](https://intel.threadlinqs.com/technique/T1070.006), [T1071](https://intel.threadlinqs.com/technique/T1071), [T1071.001](https://intel.threadlinqs.com/technique/T1071.001), [T1074.001](https://intel.threadlinqs.com/technique/T1074.001), [T1078](https://intel.threadlinqs.com/technique/T1078), [T1078.004](https://intel.threadlinqs.com/technique/T1078.004), [T1082](https://intel.threadlinqs.com/technique/T1082), [T1083](https://intel.threadlinqs.com/technique/T1083), [T1087](https://intel.threadlinqs.com/technique/T1087), [T1087.002](https://intel.threadlinqs.com/technique/T1087.002), [T1087.004](https://intel.threadlinqs.com/technique/T1087.004), [T1090](https://intel.threadlinqs.com/technique/T1090), [T1090.002](https://intel.threadlinqs.com/technique/T1090.002), [T1098](https://intel.threadlinqs.com/technique/T1098), [T1098.001](https://intel.threadlinqs.com/technique/T1098.001), [T1098.003](https://intel.threadlinqs.com/technique/T1098.003), [T1098.004](https://intel.threadlinqs.com/technique/T1098.004), [T1102](https://intel.threadlinqs.com/technique/T1102), [T1105](https://intel.threadlinqs.com/technique/T1105), [T1106](https://intel.threadlinqs.com/technique/T1106), [T1110.003](https://intel.threadlinqs.com/technique/T1110.003), [T1111](https://intel.threadlinqs.com/technique/T1111), [T1113](https://intel.threadlinqs.com/technique/T1113), [T1114](https://intel.threadlinqs.com/technique/T1114), [T1114.002](https://intel.threadlinqs.com/technique/T1114.002), [T1119](https://intel.threadlinqs.com/technique/T1119), [T1127](https://intel.threadlinqs.com/technique/T1127), [T1132.001](https://intel.threadlinqs.com/technique/T1132.001), [T1133](https://intel.threadlinqs.com/technique/T1133), [T1134.001](https://intel.threadlinqs.com/technique/T1134.001), [T1135](https://intel.threadlinqs.com/technique/T1135), [T1136](https://intel.threadlinqs.com/technique/T1136), [T1136.001](https://intel.threadlinqs.com/technique/T1136.001), [T1136.003](https://intel.threadlinqs.com/technique/T1136.003), [T1140](https://intel.threadlinqs.com/technique/T1140), [T1176](https://intel.threadlinqs.com/technique/T1176), [T1189](https://intel.threadlinqs.com/technique/T1189), [T1190](https://intel.threadlinqs.com/technique/T1190), [T1195](https://intel.threadlinqs.com/technique/T1195), [T1195.001](https://intel.threadlinqs.com/technique/T1195.001), [T1195.002](https://intel.threadlinqs.com/technique/T1195.002), [T1195.003](https://intel.threadlinqs.com/technique/T1195.003), [T1199](https://intel.threadlinqs.com/technique/T1199), [T1202](https://intel.threadlinqs.com/technique/T1202), [T1203](https://intel.threadlinqs.com/technique/T1203), [T1204.001](https://intel.threadlinqs.com/technique/T1204.001), [T1204.002](https://intel.threadlinqs.com/technique/T1204.002), [T1204.004](https://intel.threadlinqs.com/technique/T1204.004), [T1210](https://intel.threadlinqs.com/technique/T1210), [T1211](https://intel.threadlinqs.com/technique/T1211), [T1212](https://intel.threadlinqs.com/technique/T1212), [T1213](https://intel.threadlinqs.com/technique/T1213), [T1213.003](https://intel.threadlinqs.com/technique/T1213.003), [T1218.007](https://intel.threadlinqs.com/technique/T1218.007), [T1218.011](https://intel.threadlinqs.com/technique/T1218.011), [T1219](https://intel.threadlinqs.com/technique/T1219), [T1398](https://intel.threadlinqs.com/technique/T1398), [T1404](https://intel.threadlinqs.com/technique/T1404), [T1406](https://intel.threadlinqs.com/technique/T1406), [T1407](https://intel.threadlinqs.com/technique/T1407), [T1414](https://intel.threadlinqs.com/technique/T1414), [T1418](https://intel.threadlinqs.com/technique/T1418), [T1422](https://intel.threadlinqs.com/technique/T1422), [T1426](https://intel.threadlinqs.com/technique/T1426), [T1437.001](https://intel.threadlinqs.com/technique/T1437.001), [T1486](https://intel.threadlinqs.com/technique/T1486), [T1490](https://intel.threadlinqs.com/technique/T1490), [T1491.001](https://intel.threadlinqs.com/technique/T1491.001), T1496.002, [T1496.004](https://intel.threadlinqs.com/technique/T1496.004), [T1497](https://intel.threadlinqs.com/technique/T1497), [T1497.001](https://intel.threadlinqs.com/technique/T1497.001), [T1497.003](https://intel.threadlinqs.com/technique/T1497.003), [T1499.004](https://intel.threadlinqs.com/technique/T1499.004), [T1505](https://intel.threadlinqs.com/technique/T1505), [T1505.003](https://intel.threadlinqs.com/technique/T1505.003), [T1513](https://intel.threadlinqs.com/technique/T1513), [T1516](https://intel.threadlinqs.com/technique/T1516), [T1518](https://intel.threadlinqs.com/technique/T1518), [T1518.001](https://intel.threadlinqs.com/technique/T1518.001), [T1521](https://intel.threadlinqs.com/technique/T1521), [T1526](https://intel.threadlinqs.com/technique/T1526), [T1528](https://intel.threadlinqs.com/technique/T1528), [T1539](https://intel.threadlinqs.com/technique/T1539), [T1542](https://intel.threadlinqs.com/technique/T1542), [T1544](https://intel.threadlinqs.com/technique/T1544), [T1547.001](https://intel.threadlinqs.com/technique/T1547.001), [T1550](https://intel.threadlinqs.com/technique/T1550), [T1550.001](https://intel.threadlinqs.com/technique/T1550.001), [T1550.002](https://intel.threadlinqs.com/technique/T1550.002), [T1550.003](https://intel.threadlinqs.com/technique/T1550.003), [T1550.004](https://intel.threadlinqs.com/technique/T1550.004), [T1552](https://intel.threadlinqs.com/technique/T1552), [T1552.001](https://intel.threadlinqs.com/technique/T1552.001), [T1552.004](https://intel.threadlinqs.com/technique/T1552.004), [T1553](https://intel.threadlinqs.com/technique/T1553), [T1553.002](https://intel.threadlinqs.com/technique/T1553.002), [T1555](https://intel.threadlinqs.com/technique/T1555), [T1555.003](https://intel.threadlinqs.com/technique/T1555.003), [T1556](https://intel.threadlinqs.com/technique/T1556), [T1557](https://intel.threadlinqs.com/technique/T1557), T1558.001, [T1558.003](https://intel.threadlinqs.com/technique/T1558.003), [T1560](https://intel.threadlinqs.com/technique/T1560), T1562, [T1564.001](https://intel.threadlinqs.com/technique/T1564.001), [T1565.001](https://intel.threadlinqs.com/technique/T1565.001), [T1566](https://intel.threadlinqs.com/technique/T1566), [T1566.001](https://intel.threadlinqs.com/technique/T1566.001), [T1566.002](https://intel.threadlinqs.com/technique/T1566.002), [T1566.003](https://intel.threadlinqs.com/technique/T1566.003), [T1567](https://intel.threadlinqs.com/technique/T1567), [T1568](https://intel.threadlinqs.com/technique/T1568), [T1571](https://intel.threadlinqs.com/technique/T1571), [T1572](https://intel.threadlinqs.com/technique/T1572), [T1573](https://intel.threadlinqs.com/technique/T1573), [T1573.001](https://intel.threadlinqs.com/technique/T1573.001), [T1573.002](https://intel.threadlinqs.com/technique/T1573.002), [T1574.001](https://intel.threadlinqs.com/technique/T1574.001), [T1574.006](https://intel.threadlinqs.com/technique/T1574.006), T1574.014, [T1575](https://intel.threadlinqs.com/technique/T1575), T1578.002, [T1580](https://intel.threadlinqs.com/technique/T1580), [T1583](https://intel.threadlinqs.com/technique/T1583), [T1583.001](https://intel.threadlinqs.com/technique/T1583.001), [T1583.003](https://intel.threadlinqs.com/technique/T1583.003), [T1583.004](https://intel.threadlinqs.com/technique/T1583.004), [T1583.006](https://intel.threadlinqs.com/technique/T1583.006), [T1584.005](https://intel.threadlinqs.com/technique/T1584.005), [T1585](https://intel.threadlinqs.com/technique/T1585), [T1585.001](https://intel.threadlinqs.com/technique/T1585.001), [T1587](https://intel.threadlinqs.com/technique/T1587), [T1587.001](https://intel.threadlinqs.com/technique/T1587.001), [T1587.004](https://intel.threadlinqs.com/technique/T1587.004), [T1588.002](https://intel.threadlinqs.com/technique/T1588.002), [T1588.003](https://intel.threadlinqs.com/technique/T1588.003), [T1588.005](https://intel.threadlinqs.com/technique/T1588.005), [T1588.006](https://intel.threadlinqs.com/technique/T1588.006), [T1588.007](https://intel.threadlinqs.com/technique/T1588.007), [T1591](https://intel.threadlinqs.com/technique/T1591), [T1595](https://intel.threadlinqs.com/technique/T1595), [T1595.002](https://intel.threadlinqs.com/technique/T1595.002), T1595.003, T1596.003, [T1598.003](https://intel.threadlinqs.com/technique/T1598.003), T1604, [T1608.001](https://intel.threadlinqs.com/technique/T1608.001), [T1608.005](https://intel.threadlinqs.com/technique/T1608.005), [T1608.006](https://intel.threadlinqs.com/technique/T1608.006), [T1609](https://intel.threadlinqs.com/technique/T1609), [T1610](https://intel.threadlinqs.com/technique/T1610), [T1611](https://intel.threadlinqs.com/technique/T1611), [T1620](https://intel.threadlinqs.com/technique/T1620), T1623.001, [T1624.001](https://intel.threadlinqs.com/technique/T1624.001), [T1626](https://intel.threadlinqs.com/technique/T1626), [T1629.003](https://intel.threadlinqs.com/technique/T1629.003), [T1633.001](https://intel.threadlinqs.com/technique/T1633.001), [T1643](https://intel.threadlinqs.com/technique/T1643), [T1646](https://intel.threadlinqs.com/technique/T1646), [T1649](https://intel.threadlinqs.com/technique/T1649), [T1655.001](https://intel.threadlinqs.com/technique/T1655.001), T1656, [T1657](https://intel.threadlinqs.com/technique/T1657), [T1665](https://intel.threadlinqs.com/technique/T1665), [T1684.001](https://intel.threadlinqs.com/technique/T1684.001), [T1685](https://intel.threadlinqs.com/technique/T1685), [T1685.002](https://intel.threadlinqs.com/technique/T1685.002)

## Threat actors

[SolarMarker operators](https://intel.threadlinqs.com/actor/SolarMarker%20operators), [UNC7228](https://intel.threadlinqs.com/actor/UNC7228), [Videostrong Technology Co.](https://intel.threadlinqs.com/actor/Videostrong%20Technology%20Co.), [HAZY TIGER](https://intel.threadlinqs.com/actor/HAZY%20TIGER), [DarkBlinders](https://intel.threadlinqs.com/actor/DarkBlinders), [UNC6993](https://intel.threadlinqs.com/actor/UNC6993), [BYOD](https://intel.threadlinqs.com/actor/BYOD), [APT31](https://intel.threadlinqs.com/actor/APT31), [UTA0576](https://intel.threadlinqs.com/actor/UTA0576), [TraderTraitor](https://intel.threadlinqs.com/actor/TraderTraitor)

Nation-state attribution: China, IN, Iran, North Korea

Threat categories: MALWARE, DATA_BREACH, THREAT_INTEL, PHISHING, VULNERABILITY, RANSOMWARE, SUPPLY_CHAIN, APT, CLOUD, ICS_SCADA

## Severity breakdown

- critical: 10
- high: 14
- medium: 16
- low: 1

## Indicator & detection coverage

Counts only; indicator values and detection rule text unlock per threat with TL Creds.

- Indicators of compromise: 866 (network 241, file 184, entity 102, behavioral 97, infrastructure 73, tool 63, malware 57, package 48, vulnerability 1)
- New detection rules: 369 (100% of the day’s threats covered)

## More editions

- Previous: [2026-11-01](https://intel.threadlinqs.com/debrief/2026-11-01)
- Next: [2026-11-03](https://intel.threadlinqs.com/debrief/2026-11-03)
- [Archive of daily debriefs](https://intel.threadlinqs.com/debrief/archive)
- [Latest debrief](https://intel.threadlinqs.com/debrief)

Canonical: https://intel.threadlinqs.com/debrief/2026-11-02