# Daily Intelligence Briefing — Tuesday, November 3, 2026

> On 2026-11-03, Threadlinqs published 42 new threat reports and updated 5, 10 rated critical and 25 high, spanning 264 MITRE ATT&CK techniques and 17 named threat actors. Coverage that day added 423 new detection rules and 1133 extracted indicators.

- **Edition:** 2026-11-03 (Tuesday)
- **Canonical:** https://intel.threadlinqs.com/debrief/2026-11-03
- **Last updated:** 2026-11-09
- **New threats:** 42 (5 updated)
- **Critical / high:** 10 critical, 25 high, 10 medium, 1 low
- **ATT&CK techniques:** 264
- **Threat actors:** 17
- **Indicators (count only):** 1133
- **New detection rules (count only):** 423

## Summary & highlights

Certified Bad: Abuse of Extended Validation Code-Signing Certificates Shared Across Malware Families (SolarMarker et al.). Local Privilege Escalation via sudo iptables / iptables-save (Comment Newline Injection and --modprobe Abuse). CISA CI Fortify: Critical Infrastructure OT Isolation and Recovery Planning Guidance (2026).

- [TL-2026-5131](https://intel.threadlinqs.com/threat/TL-2026-5131) — CVE-2026-31695: 5-Year-Old Linux Kernel virt_wifi Use-After-Free Allows Unprivileged Local Root
- [TL-2026-5132](https://intel.threadlinqs.com/threat/TL-2026-5132) — Qilin (Agenda) Ransomware Evolution: March vs October 2026 Variants (Forged Code-Signed, Modular, Hypervisor-Targeting)
- [TL-2026-5135](https://intel.threadlinqs.com/threat/TL-2026-5135) — ClickFix: Fake CAPTCHA/Verification Prompts Deliver Stealers, Loaders and RATs (DeerStealer, HijackLoader, AMOS, NetSupport RAT, WeaselStore)
- [TL-2026-5137](https://intel.threadlinqs.com/threat/TL-2026-5137) — Evolution of C2 Infrastructure: Blockchain-Based (On-Chain) C2 and EtherHiding Adoption by UNC5142, UNC5342 and Commodity Malware (Tsundere, SleepyDuck, SharkStealer)
- [TL-2026-5141](https://intel.threadlinqs.com/threat/TL-2026-5141) — Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware (BeautyStealer, Prime ReverseShell) and CVE-2025-8088 WinRAR lures

## Theme of the day

Posture held at SEVERE (22/25) across 29 threats, led by exploitation of exposed edge and management systems, including KEV-listed Cisco firewall flaws tied to APT31. Crypto hot-wallet theft, ransomware against Synology NAS, and botnet C2 and infostealer activity (Latrodectus, Sliver) also dominated.

credential-theft, privilege-escalation, supply-chain, financial-motivation, social-engineering

## Threats published

- [TL-2026-5124](https://intel.threadlinqs.com/threat/TL-2026-5124) — CRITICAL — Attackers Target Unpatched CryptoPayment Gateway WordPress Plugin Flaw (CVE-2026-81648) Exposing Wallet Credentials
- [TL-2026-5138](https://intel.threadlinqs.com/threat/TL-2026-5138) — CRITICAL — Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From Hot Wallets (LND macaroon credential exposure)
- [TL-2026-5158](https://intel.threadlinqs.com/threat/TL-2026-5158) — CRITICAL — Barracuda critical flaws (CVE-2026-116606, CVE-2026-111560) allow root access to ESG, ADC, Message Archiver, WAF and Web Security Gateway devices
- [TL-2026-5162](https://intel.threadlinqs.com/threat/TL-2026-5162) — CRITICAL — cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes (OPSSHIELD Supply-Chain Compromise)
- [TL-2026-5164](https://intel.threadlinqs.com/threat/TL-2026-5164) — CRITICAL — TraderTraitor (North Korea) months-long campaign leads to $6.34B Binance cryptocurrency theft
- [TL-2026-5165](https://intel.threadlinqs.com/threat/TL-2026-5165) — CRITICAL — Binance Wallet Infrastructure Compromise via Fake Job Interviews, Trojanized Homebrew Installer and Internal AI Tool Abuse (~$6.3B Theft, TraderTraitor)
- [TL-2026-5206](https://intel.threadlinqs.com/threat/TL-2026-5206) — CRITICAL — Android November 2026 Security Bulletin: Over 200 Vulnerabilities Patched, Including Critical Framework RCE (CVE-2026-58868)
- [TL-2026-4277](https://intel.threadlinqs.com/threat/TL-2026-4277) — CRITICAL — Node2Shell: Node.js Brotli Decoder Out-of-Bounds Write RCE Exploit (CVE-2026-111497) (update)
- [TL-2026-4751](https://intel.threadlinqs.com/threat/TL-2026-4751) — CRITICAL — CVE-2026-98432 - Linux Kernel IPv4 TCP SYN Race Condition / Use-After-Free (inet_opt / ireq_opt) Enabling Remote Kernel Memory Corruption and Reported Root Command Execution (update)
- [TL-2026-4804](https://intel.threadlinqs.com/threat/TL-2026-4804) — CRITICAL — Active Exploitation of WordPress Core Unauthenticated Upgrade-Window RCE (Versions 4.7 through 7.1.3) Hours After 7.1.4 Patch Release (update)
- [TL-2026-5131](https://intel.threadlinqs.com/threat/TL-2026-5131) — HIGH — CVE-2026-31695: 5-Year-Old Linux Kernel virt_wifi Use-After-Free Allows Unprivileged Local Root
- [TL-2026-5132](https://intel.threadlinqs.com/threat/TL-2026-5132) — HIGH — Qilin (Agenda) Ransomware Evolution: March vs October 2026 Variants (Forged Code-Signed, Modular, Hypervisor-Targeting)
- [TL-2026-5135](https://intel.threadlinqs.com/threat/TL-2026-5135) — HIGH — ClickFix: Fake CAPTCHA/Verification Prompts Deliver Stealers, Loaders and RATs (DeerStealer, HijackLoader, AMOS, NetSupport RAT, WeaselStore)
- [TL-2026-5137](https://intel.threadlinqs.com/threat/TL-2026-5137) — HIGH — Evolution of C2 Infrastructure: Blockchain-Based (On-Chain) C2 and EtherHiding Adoption by UNC5142, UNC5342 and Commodity Malware (Tsundere, SleepyDuck, SharkStealer)
- [TL-2026-5141](https://intel.threadlinqs.com/threat/TL-2026-5141) — HIGH — Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware (BeautyStealer, Prime ReverseShell) and CVE-2025-8088 WinRAR lures
- [TL-2026-5143](https://intel.threadlinqs.com/threat/TL-2026-5143) — HIGH — CTO at NCSC Weekly Summary (week ending July 19, 2026): Russian FSB Center 16 router exploitation, Turla, Daxin/Stupig, GoldenEyeDog DigiCert compromise, CVE-2026-40639
- [TL-2026-5150](https://intel.threadlinqs.com/threat/TL-2026-5150) — HIGH — NCSC Warns of AI-Enabled Ransomware Threat to UK Critical National Infrastructure by 2028 (PHP2Shell CVE-2026-109618/109619 cited)
- [TL-2026-5152](https://intel.threadlinqs.com/threat/TL-2026-5152) — HIGH — AI agent frameworks ARTEX (Vapor Panda, Storm-0940) and CyberStrikeAI scale China-linked intrusion campaigns
- [TL-2026-5157](https://intel.threadlinqs.com/threat/TL-2026-5157) — HIGH — Frontline Education Data Breach via Third-Party Software Vulnerability Impacts Over 1.3 Million People
- [TL-2026-5163](https://intel.threadlinqs.com/threat/TL-2026-5163) — HIGH — ClickFix Campaign via Microsoft Lookalike Domain (login.microsoftofice.cz) Targeting Czech Company with Unnamed PureBasic/Batch RAT
- [TL-2026-5168](https://intel.threadlinqs.com/threat/TL-2026-5168) — HIGH — 3AM (ThreeAM) Ransomware Hybrid Human/AI-Assisted Attack on UK School Estate
- [TL-2026-5173](https://intel.threadlinqs.com/threat/TL-2026-5173) — HIGH — Reachy Mini AI Robot Unauthenticated HTTP RCE Chain (CVE-2026-96455, CVE-2026-96456, CVE-2026-55419, CVE-2026-62661, CVE-2026-53605)
- [TL-2026-5175](https://intel.threadlinqs.com/threat/TL-2026-5175) — HIGH — Kimsuky (APT43) Dot-Padded LNK Spear-Phishing Tradecraft: Detection and Exploitation Analysis
- [TL-2026-5177](https://intel.threadlinqs.com/threat/TL-2026-5177) — HIGH — Fraudulent Shopify Stores Running 'Outsider'-Linked Phishing Kits (Outsider/JWR and Playswing)
- [TL-2026-5178](https://intel.threadlinqs.com/threat/TL-2026-5178) — HIGH — Docker Sandboxes (sbx CLI) Symlink Vulnerability Lets AI Agents Read/Write Host Files Outside Sandbox (CVE-2026-103916)
- [TL-2026-5179](https://intel.threadlinqs.com/threat/TL-2026-5179) — HIGH — WorkOS Internal Sales App Breached by Attacker Using ARTEX AI Offensive Framework
- [TL-2026-5186](https://intel.threadlinqs.com/threat/TL-2026-5186) — HIGH — Second Wave of Attacks on European Supermarket Refrigeration Controllers (Danfoss AK-SM/AK-SC, Copeland/Dixell XWEB) Forces Defrost Mode
- [TL-2026-5190](https://intel.threadlinqs.com/threat/TL-2026-5190) — HIGH — Whitearmor (emerging ransomware group) 'Project Trojan Horse' - initial access sales and insider recruitment
- [TL-2026-5191](https://intel.threadlinqs.com/threat/TL-2026-5191) — HIGH — Falcon Extortion Brand (UNC6671) Claims Buchanan Ingersoll & Rooney PC (US Law Firm) – ~260 GB Data Leak
- [TL-2026-5196](https://intel.threadlinqs.com/threat/TL-2026-5196) — HIGH — ARTEX Agentic AI Penetration-Testing Framework Abused by China-Aligned Actors Storm-0940 and VAPOR PANDA to Automate Enterprise and Cloud Intrusions
- [TL-2026-5198](https://intel.threadlinqs.com/threat/TL-2026-5198) — HIGH — Gorbag: Russia-aligned espionage group targets Ukrainian war crimes investigations and military aid routes (BeautyStealer, Prime ReverseShell, CVE-2025-8088)
- [TL-2026-5205](https://intel.threadlinqs.com/threat/TL-2026-5205) — HIGH — Supply Chain Attack Artifacts in GitHub Repositories and Developer Machines (Miasma, Shai-Hulud, ForceMemo, Megalodon, GhostAction, TeamPCP and others)
- [TL-2026-5209](https://intel.threadlinqs.com/threat/TL-2026-5209) — HIGH — October 2026 Campaigns: Device-Code Phishing Kits (SkyW4lker, GeorgeGinx, Mir0Auth), Fake AI Lures, and WKLP Python Infostealer/RAT
- [TL-2026-0888](https://intel.threadlinqs.com/threat/TL-2026-0888) — HIGH — EvilTokens Phishing-as-a-Service: Microsoft OAuth 2.0 Device Authorization Grant (Device Code) Phishing Against Microsoft 365 (update)
- [TL-2026-5064](https://intel.threadlinqs.com/threat/TL-2026-5064) — HIGH — The Rise of LLMJacking: Threat Actors Monetize Compromised Cloud and Model Resources (UNC6993, D1337-KAIROS, CVE-2026-40217) (update)
- [TL-2026-5122](https://intel.threadlinqs.com/threat/TL-2026-5122) — MEDIUM — Certified Bad: Abuse of Extended Validation Code-Signing Certificates Shared Across Malware Families (SolarMarker et al.)
- [TL-2026-5127](https://intel.threadlinqs.com/threat/TL-2026-5127) — MEDIUM — Local Privilege Escalation via sudo iptables / iptables-save (Comment Newline Injection and --modprobe Abuse)
- [TL-2026-5154](https://intel.threadlinqs.com/threat/TL-2026-5154) — MEDIUM — CISA CI Fortify: Critical Infrastructure OT Isolation and Recovery Planning Guidance (2026)
- [TL-2026-5155](https://intel.threadlinqs.com/threat/TL-2026-5155) — MEDIUM — Europol/Eurojust Takedown of Crime-as-a-Service Investment Scam Infrastructure: 100+ Servers Seized, 7 Arrested
- [TL-2026-5156](https://intel.threadlinqs.com/threat/TL-2026-5156) — MEDIUM — Haiou Jailbreak Bundle: 'Prompt Adware' Persistently Altering AI Coding Agent Instructions to Promote LLM Gateway (zz.aiapi2025.top)
- [TL-2026-5169](https://intel.threadlinqs.com/threat/TL-2026-5169) — MEDIUM — Fake-download campaign uses trojanized Inno Setup installers to deliver monetization payloads (WorldProxyPool, CharityEngine/BOINC, AW Manager)
- [TL-2026-5171](https://intel.threadlinqs.com/threat/TL-2026-5171) — MEDIUM — Wuffy AI Toy Dog Scam Network: 250+ Fake Storefronts Laundering Proceeds Through Shell Companies (Huntress Declassified: Money Train, Episode Four)
- [TL-2026-5184](https://intel.threadlinqs.com/threat/TL-2026-5184) — MEDIUM — HHS OCR Settles Ransomware Investigation of Lehigh Valley Health Network (ALPHV/BlackCat)
- [TL-2026-5208](https://intel.threadlinqs.com/threat/TL-2026-5208) — MEDIUM — Microsoft Analysis: 78% of Exploited Vulnerabilities Enable System Takeover and Privilege Escalation
- [TL-2026-5210](https://intel.threadlinqs.com/threat/TL-2026-5210) — MEDIUM — CVE-2026-25600: Hard-coded Cryptographic Secret in Trac d.o.o. PDBM (Process Database Manager) 1.0.0.0 Enables Administrative Credential Decryption
- [TL-2026-5130](https://intel.threadlinqs.com/threat/TL-2026-5130) — LOW — Shielder research: Hard-coded AES kernel key in U-Boot bootloader of Hi3519-based ARM device recovered via Unicorn Engine emulation
- [TL-2026-5146](https://intel.threadlinqs.com/threat/TL-2026-5146) — INFO — Microsoft Analysis of 383,000 Vulnerabilities: Takeover Flaws Dominate Exploited CVEs

## Techniques observed

[AML.T0051](https://intel.threadlinqs.com/technique/AML.T0051), [AML.T0054](https://intel.threadlinqs.com/technique/AML.T0054), T0812, T0813, T0815, T0822, T0826, T0827, T0828, [T0831](https://intel.threadlinqs.com/technique/T0831), [T0836](https://intel.threadlinqs.com/technique/T0836), T0855, [T0859](https://intel.threadlinqs.com/technique/T0859), T0879, [T0883](https://intel.threadlinqs.com/technique/T0883), T0886, [T1003](https://intel.threadlinqs.com/technique/T1003), [T1003.001](https://intel.threadlinqs.com/technique/T1003.001), [T1003.002](https://intel.threadlinqs.com/technique/T1003.002), [T1003.006](https://intel.threadlinqs.com/technique/T1003.006), [T1003.007](https://intel.threadlinqs.com/technique/T1003.007), [T1003.008](https://intel.threadlinqs.com/technique/T1003.008), [T1005](https://intel.threadlinqs.com/technique/T1005), [T1014](https://intel.threadlinqs.com/technique/T1014), [T1018](https://intel.threadlinqs.com/technique/T1018), [T1020](https://intel.threadlinqs.com/technique/T1020), [T1021](https://intel.threadlinqs.com/technique/T1021), [T1021.002](https://intel.threadlinqs.com/technique/T1021.002), [T1021.004](https://intel.threadlinqs.com/technique/T1021.004), [T1021.006](https://intel.threadlinqs.com/technique/T1021.006), [T1025](https://intel.threadlinqs.com/technique/T1025), [T1027](https://intel.threadlinqs.com/technique/T1027), [T1027.001](https://intel.threadlinqs.com/technique/T1027.001), [T1027.002](https://intel.threadlinqs.com/technique/T1027.002), [T1027.009](https://intel.threadlinqs.com/technique/T1027.009), [T1027.013](https://intel.threadlinqs.com/technique/T1027.013), [T1033](https://intel.threadlinqs.com/technique/T1033), [T1036](https://intel.threadlinqs.com/technique/T1036), [T1036.005](https://intel.threadlinqs.com/technique/T1036.005), [T1036.008](https://intel.threadlinqs.com/technique/T1036.008), [T1039](https://intel.threadlinqs.com/technique/T1039), [T1041](https://intel.threadlinqs.com/technique/T1041), [T1046](https://intel.threadlinqs.com/technique/T1046), [T1047](https://intel.threadlinqs.com/technique/T1047), [T1053.003](https://intel.threadlinqs.com/technique/T1053.003), [T1053.005](https://intel.threadlinqs.com/technique/T1053.005), [T1055](https://intel.threadlinqs.com/technique/T1055), [T1056](https://intel.threadlinqs.com/technique/T1056), [T1056.001](https://intel.threadlinqs.com/technique/T1056.001), [T1056.002](https://intel.threadlinqs.com/technique/T1056.002), [T1057](https://intel.threadlinqs.com/technique/T1057), [T1059](https://intel.threadlinqs.com/technique/T1059), [T1059.001](https://intel.threadlinqs.com/technique/T1059.001), [T1059.003](https://intel.threadlinqs.com/technique/T1059.003), [T1059.004](https://intel.threadlinqs.com/technique/T1059.004), [T1059.005](https://intel.threadlinqs.com/technique/T1059.005), [T1059.006](https://intel.threadlinqs.com/technique/T1059.006), [T1059.007](https://intel.threadlinqs.com/technique/T1059.007), [T1068](https://intel.threadlinqs.com/technique/T1068), [T1069](https://intel.threadlinqs.com/technique/T1069), [T1070](https://intel.threadlinqs.com/technique/T1070), [T1070.004](https://intel.threadlinqs.com/technique/T1070.004), [T1070.006](https://intel.threadlinqs.com/technique/T1070.006), T1070.008, [T1071](https://intel.threadlinqs.com/technique/T1071), [T1071.001](https://intel.threadlinqs.com/technique/T1071.001), [T1071.004](https://intel.threadlinqs.com/technique/T1071.004), [T1074.001](https://intel.threadlinqs.com/technique/T1074.001), [T1078](https://intel.threadlinqs.com/technique/T1078), [T1078.001](https://intel.threadlinqs.com/technique/T1078.001), [T1078.002](https://intel.threadlinqs.com/technique/T1078.002), [T1078.003](https://intel.threadlinqs.com/technique/T1078.003), [T1078.004](https://intel.threadlinqs.com/technique/T1078.004), [T1082](https://intel.threadlinqs.com/technique/T1082), [T1087](https://intel.threadlinqs.com/technique/T1087), [T1087.001](https://intel.threadlinqs.com/technique/T1087.001), [T1087.002](https://intel.threadlinqs.com/technique/T1087.002), [T1087.004](https://intel.threadlinqs.com/technique/T1087.004), [T1090](https://intel.threadlinqs.com/technique/T1090), [T1090.002](https://intel.threadlinqs.com/technique/T1090.002), [T1090.003](https://intel.threadlinqs.com/technique/T1090.003), [T1098](https://intel.threadlinqs.com/technique/T1098), [T1098.001](https://intel.threadlinqs.com/technique/T1098.001), [T1098.003](https://intel.threadlinqs.com/technique/T1098.003), [T1098.004](https://intel.threadlinqs.com/technique/T1098.004), [T1098.005](https://intel.threadlinqs.com/technique/T1098.005), [T1102](https://intel.threadlinqs.com/technique/T1102), [T1102.001](https://intel.threadlinqs.com/technique/T1102.001), [T1105](https://intel.threadlinqs.com/technique/T1105), [T1106](https://intel.threadlinqs.com/technique/T1106), [T1110](https://intel.threadlinqs.com/technique/T1110), [T1110.001](https://intel.threadlinqs.com/technique/T1110.001), [T1110.003](https://intel.threadlinqs.com/technique/T1110.003), [T1111](https://intel.threadlinqs.com/technique/T1111), [T1112](https://intel.threadlinqs.com/technique/T1112), [T1113](https://intel.threadlinqs.com/technique/T1113), [T1114.002](https://intel.threadlinqs.com/technique/T1114.002), [T1114.003](https://intel.threadlinqs.com/technique/T1114.003), [T1123](https://intel.threadlinqs.com/technique/T1123), [T1125](https://intel.threadlinqs.com/technique/T1125), [T1133](https://intel.threadlinqs.com/technique/T1133), [T1134.001](https://intel.threadlinqs.com/technique/T1134.001), [T1136.001](https://intel.threadlinqs.com/technique/T1136.001), [T1136.002](https://intel.threadlinqs.com/technique/T1136.002), [T1136.003](https://intel.threadlinqs.com/technique/T1136.003), [T1137](https://intel.threadlinqs.com/technique/T1137), T1137.005, [T1140](https://intel.threadlinqs.com/technique/T1140), [T1176](https://intel.threadlinqs.com/technique/T1176), [T1187](https://intel.threadlinqs.com/technique/T1187), [T1189](https://intel.threadlinqs.com/technique/T1189), [T1190](https://intel.threadlinqs.com/technique/T1190), [T1195](https://intel.threadlinqs.com/technique/T1195), [T1195.001](https://intel.threadlinqs.com/technique/T1195.001), [T1195.002](https://intel.threadlinqs.com/technique/T1195.002), [T1199](https://intel.threadlinqs.com/technique/T1199), [T1203](https://intel.threadlinqs.com/technique/T1203), [T1204.001](https://intel.threadlinqs.com/technique/T1204.001), [T1204.002](https://intel.threadlinqs.com/technique/T1204.002), [T1204.004](https://intel.threadlinqs.com/technique/T1204.004), [T1205](https://intel.threadlinqs.com/technique/T1205), [T1210](https://intel.threadlinqs.com/technique/T1210), [T1212](https://intel.threadlinqs.com/technique/T1212), [T1213](https://intel.threadlinqs.com/technique/T1213), [T1213.002](https://intel.threadlinqs.com/technique/T1213.002), [T1213.003](https://intel.threadlinqs.com/technique/T1213.003), [T1217](https://intel.threadlinqs.com/technique/T1217), [T1218.005](https://intel.threadlinqs.com/technique/T1218.005), [T1218.007](https://intel.threadlinqs.com/technique/T1218.007), [T1219](https://intel.threadlinqs.com/technique/T1219), [T1404](https://intel.threadlinqs.com/technique/T1404), [T1480](https://intel.threadlinqs.com/technique/T1480), [T1482](https://intel.threadlinqs.com/technique/T1482), T1484.002, [T1485](https://intel.threadlinqs.com/technique/T1485), [T1486](https://intel.threadlinqs.com/technique/T1486), [T1489](https://intel.threadlinqs.com/technique/T1489), [T1490](https://intel.threadlinqs.com/technique/T1490), [T1491.001](https://intel.threadlinqs.com/technique/T1491.001), [T1496](https://intel.threadlinqs.com/technique/T1496), [T1496.001](https://intel.threadlinqs.com/technique/T1496.001), [T1496.004](https://intel.threadlinqs.com/technique/T1496.004), [T1497](https://intel.threadlinqs.com/technique/T1497), [T1497.001](https://intel.threadlinqs.com/technique/T1497.001), [T1499](https://intel.threadlinqs.com/technique/T1499), [T1499.004](https://intel.threadlinqs.com/technique/T1499.004), [T1505](https://intel.threadlinqs.com/technique/T1505), [T1505.003](https://intel.threadlinqs.com/technique/T1505.003), [T1518.001](https://intel.threadlinqs.com/technique/T1518.001), [T1526](https://intel.threadlinqs.com/technique/T1526), [T1528](https://intel.threadlinqs.com/technique/T1528), [T1529](https://intel.threadlinqs.com/technique/T1529), [T1530](https://intel.threadlinqs.com/technique/T1530), [T1531](https://intel.threadlinqs.com/technique/T1531), [T1534](https://intel.threadlinqs.com/technique/T1534), [T1539](https://intel.threadlinqs.com/technique/T1539), [T1542](https://intel.threadlinqs.com/technique/T1542), [T1543.002](https://intel.threadlinqs.com/technique/T1543.002), [T1543.003](https://intel.threadlinqs.com/technique/T1543.003), [T1543.004](https://intel.threadlinqs.com/technique/T1543.004), [T1546](https://intel.threadlinqs.com/technique/T1546), [T1547.001](https://intel.threadlinqs.com/technique/T1547.001), [T1547.004](https://intel.threadlinqs.com/technique/T1547.004), [T1547.006](https://intel.threadlinqs.com/technique/T1547.006), [T1548](https://intel.threadlinqs.com/technique/T1548), [T1548.001](https://intel.threadlinqs.com/technique/T1548.001), [T1548.003](https://intel.threadlinqs.com/technique/T1548.003), [T1550](https://intel.threadlinqs.com/technique/T1550), [T1550.001](https://intel.threadlinqs.com/technique/T1550.001), [T1550.004](https://intel.threadlinqs.com/technique/T1550.004), [T1552](https://intel.threadlinqs.com/technique/T1552), [T1552.001](https://intel.threadlinqs.com/technique/T1552.001), [T1552.003](https://intel.threadlinqs.com/technique/T1552.003), [T1552.004](https://intel.threadlinqs.com/technique/T1552.004), [T1552.005](https://intel.threadlinqs.com/technique/T1552.005), [T1553.002](https://intel.threadlinqs.com/technique/T1553.002), [T1554](https://intel.threadlinqs.com/technique/T1554), [T1555](https://intel.threadlinqs.com/technique/T1555), [T1555.003](https://intel.threadlinqs.com/technique/T1555.003), [T1555.005](https://intel.threadlinqs.com/technique/T1555.005), [T1555.006](https://intel.threadlinqs.com/technique/T1555.006), [T1556](https://intel.threadlinqs.com/technique/T1556), [T1556.006](https://intel.threadlinqs.com/technique/T1556.006), [T1557](https://intel.threadlinqs.com/technique/T1557), [T1558](https://intel.threadlinqs.com/technique/T1558), T1558.001, [T1558.003](https://intel.threadlinqs.com/technique/T1558.003), T1558.004, [T1560](https://intel.threadlinqs.com/technique/T1560), [T1560.001](https://intel.threadlinqs.com/technique/T1560.001), [T1564.001](https://intel.threadlinqs.com/technique/T1564.001), T1564.002, [T1564.003](https://intel.threadlinqs.com/technique/T1564.003), [T1564.004](https://intel.threadlinqs.com/technique/T1564.004), [T1564.008](https://intel.threadlinqs.com/technique/T1564.008), [T1565](https://intel.threadlinqs.com/technique/T1565), [T1565.001](https://intel.threadlinqs.com/technique/T1565.001), [T1566](https://intel.threadlinqs.com/technique/T1566), [T1566.001](https://intel.threadlinqs.com/technique/T1566.001), [T1566.002](https://intel.threadlinqs.com/technique/T1566.002), [T1566.003](https://intel.threadlinqs.com/technique/T1566.003), [T1566.004](https://intel.threadlinqs.com/technique/T1566.004), [T1567](https://intel.threadlinqs.com/technique/T1567), [T1567.002](https://intel.threadlinqs.com/technique/T1567.002), [T1568](https://intel.threadlinqs.com/technique/T1568), [T1569.002](https://intel.threadlinqs.com/technique/T1569.002), [T1570](https://intel.threadlinqs.com/technique/T1570), [T1571](https://intel.threadlinqs.com/technique/T1571), [T1572](https://intel.threadlinqs.com/technique/T1572), [T1573.001](https://intel.threadlinqs.com/technique/T1573.001), [T1574.001](https://intel.threadlinqs.com/technique/T1574.001), T1578.002, [T1580](https://intel.threadlinqs.com/technique/T1580), [T1583](https://intel.threadlinqs.com/technique/T1583), [T1583.001](https://intel.threadlinqs.com/technique/T1583.001), [T1583.003](https://intel.threadlinqs.com/technique/T1583.003), [T1583.004](https://intel.threadlinqs.com/technique/T1583.004), [T1583.006](https://intel.threadlinqs.com/technique/T1583.006), T1583.007, [T1583.008](https://intel.threadlinqs.com/technique/T1583.008), [T1584.001](https://intel.threadlinqs.com/technique/T1584.001), [T1584.006](https://intel.threadlinqs.com/technique/T1584.006), [T1585.001](https://intel.threadlinqs.com/technique/T1585.001), [T1586](https://intel.threadlinqs.com/technique/T1586), [T1586.002](https://intel.threadlinqs.com/technique/T1586.002), [T1587](https://intel.threadlinqs.com/technique/T1587), [T1587.001](https://intel.threadlinqs.com/technique/T1587.001), [T1587.004](https://intel.threadlinqs.com/technique/T1587.004), [T1588](https://intel.threadlinqs.com/technique/T1588), [T1588.001](https://intel.threadlinqs.com/technique/T1588.001), [T1588.002](https://intel.threadlinqs.com/technique/T1588.002), [T1588.003](https://intel.threadlinqs.com/technique/T1588.003), [T1588.005](https://intel.threadlinqs.com/technique/T1588.005), [T1588.006](https://intel.threadlinqs.com/technique/T1588.006), [T1588.007](https://intel.threadlinqs.com/technique/T1588.007), [T1589](https://intel.threadlinqs.com/technique/T1589), [T1589.001](https://intel.threadlinqs.com/technique/T1589.001), [T1589.002](https://intel.threadlinqs.com/technique/T1589.002), [T1591](https://intel.threadlinqs.com/technique/T1591), [T1592](https://intel.threadlinqs.com/technique/T1592), [T1594](https://intel.threadlinqs.com/technique/T1594), [T1595](https://intel.threadlinqs.com/technique/T1595), [T1595.001](https://intel.threadlinqs.com/technique/T1595.001), [T1595.002](https://intel.threadlinqs.com/technique/T1595.002), [T1598](https://intel.threadlinqs.com/technique/T1598), [T1598.003](https://intel.threadlinqs.com/technique/T1598.003), [T1606](https://intel.threadlinqs.com/technique/T1606), [T1606.002](https://intel.threadlinqs.com/technique/T1606.002), [T1609](https://intel.threadlinqs.com/technique/T1609), [T1610](https://intel.threadlinqs.com/technique/T1610), [T1611](https://intel.threadlinqs.com/technique/T1611), [T1621](https://intel.threadlinqs.com/technique/T1621), T1642, [T1650](https://intel.threadlinqs.com/technique/T1650), [T1651](https://intel.threadlinqs.com/technique/T1651), T1656, [T1657](https://intel.threadlinqs.com/technique/T1657), [T1664](https://intel.threadlinqs.com/technique/T1664), [T1684.001](https://intel.threadlinqs.com/technique/T1684.001), [T1685](https://intel.threadlinqs.com/technique/T1685), [T1685.002](https://intel.threadlinqs.com/technique/T1685.002), [T1685.005](https://intel.threadlinqs.com/technique/T1685.005), [T1686](https://intel.threadlinqs.com/technique/T1686), [T1688](https://intel.threadlinqs.com/technique/T1688)

## Threat actors

[ALPHV](https://intel.threadlinqs.com/actor/ALPHV), [Qilin RaaS](https://intel.threadlinqs.com/actor/Qilin%20RaaS), [TA571](https://intel.threadlinqs.com/actor/TA571), [UNC5142](https://intel.threadlinqs.com/actor/UNC5142), [Gorbag](https://intel.threadlinqs.com/actor/Gorbag), [FSB Center 16](https://intel.threadlinqs.com/actor/FSB%20Center%2016), [VAPOR PANDA](https://intel.threadlinqs.com/actor/VAPOR%20PANDA), [3AM ransomware affiliate](https://intel.threadlinqs.com/actor/3AM%20ransomware%20affiliate), [Kimsuky](https://intel.threadlinqs.com/actor/Kimsuky), [Outsider PhaaS operators](https://intel.threadlinqs.com/actor/Outsider%20PhaaS%20operators), [WhiteArmor](https://intel.threadlinqs.com/actor/WhiteArmor), [Falcon](https://intel.threadlinqs.com/actor/Falcon), [Storm-0940](https://intel.threadlinqs.com/actor/Storm-0940), GlassWorm Operators, [TraderTraitor](https://intel.threadlinqs.com/actor/TraderTraitor), Storm-2992 (EvilTokens administrators), [UNC6993](https://intel.threadlinqs.com/actor/UNC6993)

Nation-state attribution: Russia, North Korea (UNC5342 only); UNC5142 and other families unattributed, Russia / China, China, North Korea

Threat categories: MALWARE, VULNERABILITY, THREAT_INTEL, SUPPLY_CHAIN, RANSOMWARE, APT, DATA_BREACH, PHISHING, ICS_SCADA, CLOUD

## Severity breakdown

- critical: 10
- high: 25
- medium: 10
- low: 1

## Indicator & detection coverage

Counts only; indicator values and detection rule text unlock per threat with TL Creds.

- Indicators of compromise: 1133 (network 325, file 263, behavioral 158, infrastructure 107, entity 105, tool 64, malware 56, package 53, technique 1, vulnerability 1)
- New detection rules: 423 (100% of the day’s threats covered)

## More editions

- Previous: [2026-11-02](https://intel.threadlinqs.com/debrief/2026-11-02)
- Next: [2026-11-04](https://intel.threadlinqs.com/debrief/2026-11-04)
- [Archive of daily debriefs](https://intel.threadlinqs.com/debrief/archive)
- [Latest debrief](https://intel.threadlinqs.com/debrief)

Canonical: https://intel.threadlinqs.com/debrief/2026-11-03