Threadlinqs IntelligenceStart free

Daily debrief · Tuesday2026-11-03

Daily Intelligence Briefing — Tuesday, November 3, 2026

10 critical25 high10 medium1 low

On 2026-11-03, Threadlinqs published 42 new threat reports and updated 5, 10 rated critical and 25 high, spanning 264 MITRE ATT&CK techniques and 17 named threat actors. Coverage that day added 423 new detection rules and 1133 extracted indicators.

New threats
425 updated
Critical / high
3510 critical · 25 high
ATT&CK techniques
264Observed in the day’s reports
Threat actors
17Named in the reports
Indicators
1133Count only · values are Red+
Detection rules
423New that day · rule text is Blue+

Edition date: · Last updated:

Summary & highlights

Certified Bad: Abuse of Extended Validation Code-Signing Certificates Shared Across Malware Families (SolarMarker et al.). Local Privilege Escalation via sudo iptables / iptables-save (Comment Newline Injection and --modprobe Abuse). CISA CI Fortify: Critical Infrastructure OT Isolation and Recovery Planning Guidance (2026).

Highlights

  • TL-2026-5131 — CVE-2026-31695: 5-Year-Old Linux Kernel virt_wifi Use-After-Free Allows Unprivileged Local Root
  • TL-2026-5132 — Qilin (Agenda) Ransomware Evolution: March vs October 2026 Variants (Forged Code-Signed, Modular, Hypervisor-Targeting)
  • TL-2026-5135 — ClickFix: Fake CAPTCHA/Verification Prompts Deliver Stealers, Loaders and RATs (DeerStealer, HijackLoader, AMOS, NetSupport RAT, WeaselStore)
  • TL-2026-5137 — Evolution of C2 Infrastructure: Blockchain-Based (On-Chain) C2 and EtherHiding Adoption by UNC5142, UNC5342 and Commodity Malware (Tsundere, SleepyDuck, SharkStealer)

Theme of the day

Posture held at SEVERE (22/25) across 29 threats, led by exploitation of exposed edge and management systems, including KEV-listed Cisco firewall flaws tied to APT31. Crypto hot-wallet theft, ransomware against Synology NAS, and botnet C2 and infostealer activity (Latrodectus, Sliver) also dominated.

  • credential-theft
  • privilege-escalation
  • supply-chain
  • financial-motivation
  • social-engineering

Threats published

47 threat lines in the 2026-11-03 debrief, most severe first; entries marked (update) revise an earlier report. Each links to its full profile.

Techniques observed

264 MITRE ATT&CK and ATLAS techniques appear across the day’s reports.

Threat actors

17 named threat actors across the reports.

Nation-state attribution

  • Russia
  • North Korea (UNC5342 only); UNC5142 and other families unattributed
  • Russia / China
  • China
  • North Korea

Threat categories

  • MALWARE
  • VULNERABILITY
  • THREAT_INTEL
  • SUPPLY_CHAIN
  • RANSOMWARE
  • APT
  • DATA_BREACH
  • PHISHING
  • ICS_SCADA
  • CLOUD

Severity breakdown

  • critical10
  • high25
  • medium10
  • low1

Indicator & detection coverage

Counts only: the indicator values and detection rule text behind them unlock with TL Creds.

1133 indicators of compromise · unlock with TL Creds. Compare plans
  • network 325
  • file 263
  • behavioral 158
  • infrastructure 107
  • entity 105
  • tool 64
  • malware 56
  • package 53
  • technique 1
  • vulnerability 1
423 new detection rules (100% of the day’s threats covered) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)