Summary & highlights
CVE-2026-25599: Missing Authentication, Clear-Text Transmission and Stored XSS in Orca Heat Pumps and Orca User Portal. CVE-2025-42611: Authentication bypass in multiple MikroTik RouterOS services via improper certificate validation (shared trust store). AI-Generated Malware: Source-Code Indicators and Trends (HUMAN Security / VoidLink / PROMPTSTEAL).
Highlights
- TL-2026-5214 — APT29 (Midnight Blizzard) watering holes target iOS and Android devices with n-day exploit chains (DarkSword, AndroSnitch)
- TL-2026-5220 — WardenStealer and Aoki (Aokigahara) Infostealers Steal ChatGPT, Claude, and Codex Tokens That Survive Password Resets
- TL-2026-5221 — rsync CPU Exhaustion via Algorithmic Complexity in hash_search() (CVE-2026-119741) - Fixed in 3.5.2
- TL-2026-5224 — Advanced (Targeted) Ransomware Attacks - SI-CERT Analysis (CVE-2020-0688, BlueKeep RDP)
- TL-2026-5226 — Q3 2026 Ransomware Leak-Site Surge: 30% More Victims Driven by 43 New Groups, With Questionable Claims
Theme of the day
Today's wire was dominated by state-linked and extortion activity: Gorbag and other Russia-aligned groups hit Ukrainian government bodies, while exploited Cisco and Barracuda flaws, Entra ID account takeover, and double-extortion campaigns drove a SEVERE posture (22/25).
- windows
- ransomware
- credential-theft
- phishing
- double-extortion
Threats published
45 threat lines in the 2026-11-04 debrief, most severe first; entries marked (update) revise an earlier report. Each links to its full profile.
- SolarWinds Dameware Command Injection Vulnerability (CVE-2026-28336)CRITICAL
- Google Chrome 157 Security Update Fixes 213 Bugs Including 7 Critical Vulnerabilities (CVE-2026-121156, CVE-2026-121247, CVE-2026-121229, CVE-2026-121246, CVE-2026-121035, CVE-2026-121203, CVE-2026-121126)CRITICAL
- Critical Rails Active Storage Flaw (GHSA-f3w6-w445-fwh9) Lets Attackers Write Server Files via Crafted ImageMagick UploadsCRITICAL
- Critical Ruby on Rails Active Storage Flaw (GHSA-f3w6-w445-fwh9) Allows Server Secret Theft via Malicious Image Uploads to ImageMagick (CVE not yet assigned)CRITICAL
- Zyxel GS1900 Switch Zero-Day (CVE-2026-107441) Exploited by Kapibala in Red Heron Campaign, ~1,000 Switches CompromisedCRITICAL
- Android November 2026 Security Bulletin: Over 200 Vulnerabilities Patched, Including Critical Framework RCE (CVE-2026-58868) (update)CRITICAL
- APT29 (Midnight Blizzard) watering holes target iOS and Android devices with n-day exploit chains (DarkSword, AndroSnitch)HIGH
- WardenStealer and Aoki (Aokigahara) Infostealers Steal ChatGPT, Claude, and Codex Tokens That Survive Password ResetsHIGH
- rsync CPU Exhaustion via Algorithmic Complexity in hash_search() (CVE-2026-119741) - Fixed in 3.5.2HIGH
- Advanced (Targeted) Ransomware Attacks - SI-CERT Analysis (CVE-2020-0688, BlueKeep RDP)HIGH
- Q3 2026 Ransomware Leak-Site Surge: 30% More Victims Driven by 43 New Groups, With Questionable ClaimsHIGH
- XLoader (FormBook) Infostealer Delivered via Fake Business Order Phishing, RAR/JScript/LuaJIT Chain with In-Memory InjectionHIGH
- Malicious cPGuard Updates Served in OpsShield Supply Chain Attack (Update CDN Compromise, cPGuard 5.88.12-5.88.19)HIGH
- China-Aligned SlippyNunchucks Hijacks Sogou Input Method DNS Requests to Deploy DarkVigil (FDMTP) Backdoor (CVE-2026-120422)HIGH
- Green Proxy: Undocumented Microsoft 365 AiTM Phishing-as-a-Service PlatformHIGH
- Operation CloudFire: Google Calendar Phishing Campaign Hijacks Sessions and Bypasses MFA via Live Reverse Proxy (Nyasher)HIGH
- NIKKE PC Game Launcher CDN Compromise Delivers K2F Remote Access and Data-Stealing MalwareHIGH
- Debian and Ubuntu APT Flaw (CVE-2026-109518) Lets MitM Attackers Swap Verified Packages and Run Code as RootHIGH
- Phishing Campaigns Bypass Microsoft 365 RejectDirectSend via Empty SMTP Envelope Sender (MAIL FROM:<>)HIGH
- PolinRider Loader Reappears in Hijacked npm Packages (12 malicious releases across 10 packages)HIGH
- Key Eater: Stolen Microsoft Entra ID Application Credentials Used to Breach 27 OrganizationsHIGH
- NCSC Annual Review 2026: AI-enabled malware and exploitation of legacy technology expected to target UK critical national infrastructure by 2028HIGH
- LockBit Ransomware v4.0 (LockBitGreen4.0-rc-577) Reverse Engineering AnalysisHIGH
- MountLocker Ransomware v5.0 (XingLocker / Astro Locker) - Worm-Capable RSA-2048/ChaCha20 Locker: Reverse Engineering AnalysisHIGH
- Darkside Ransomware v1.8.6.2 - Reverse Engineering AnalysisHIGH
- PLAY Ransomware (PlayCrypt) - Reverse Engineering Analysis and Big Game Hunting OperationsHIGH
- LockBit 2.0 Ransomware (Bitwise Spider) - Technical Reverse Engineering AnalysisHIGH
- Rook Ransomware (.Rook) - Babuk-derived ransomware with AES-128/RSA-2048 encryption linked to BRONZE STARLIGHTHIGH
- DIAVOL Ransomware – Reverse Engineering Analysis (Wizard Spider-linked, .lock64)HIGH
- AtomSilo Ransomware – Reverse Engineering Analysis (RSA-512 + AES hybrid encryption) and Confluence CVE-2021-26084 / DLL Side-Loading Intrusion ChainHIGH
- OpenAI Cyber Model Uncovers 948 Linux Kernel Local Privilege Escalation VulnerabilitiesHIGH
- DreamHost Data Breach via Third-Party File Manager Flaw Exposes FTP/SFTP and Webmail CredentialsHIGH
- BlackMatter Ransomware v2.0 — Reverse Engineering Analysis (RSA-1024 / Modified ChaCha20, ICMLuaUtil UAC Bypass)HIGH
- Gorbag: Russia-aligned espionage group targets Ukrainian war crimes investigations and military aid routes (BeautyStealer, Prime ReverseShell, CVE-2025-8088) (update)HIGH
- CVE-2026-25599: Missing Authentication, Clear-Text Transmission and Stored XSS in Orca Heat Pumps and Orca User PortalMEDIUM
- CVE-2025-42611: Authentication bypass in multiple MikroTik RouterOS services via improper certificate validation (shared trust store)MEDIUM
- AI-Generated Malware: Source-Code Indicators and Trends (HUMAN Security / VoidLink / PROMPTSTEAL)MEDIUM
- Russian MVD Arrests 3 Suspected VasyGrek (Fluffy Wolf) Members; Financially Motivated Phishing/Golang Backdoor Campaigns Continue to be TrackedMEDIUM
- Increased Scanning for Vulnerable Legacy E-Mail Test Scripts (formail/mailtest.php variants, CVE-2000-0411 lineage)MEDIUM
- Multi-Stage Windows PowerShell Loader Chain Delivering Themida/UPX-Protected Native Payload (contis.exe) with In-Memory Cryptographic ReconstructionMEDIUM
- ShinyHunters Post-Arrest Brand Fight: Rival Factions, Shared Extortion Infrastructure and Impersonation (SLSH / Aegis / ShinyEquationCartel)MEDIUM
- Industrialized Cybercrime Economy: Commoditized Stealer Logs, Phishing Kits, Identity Fraud and Ransomware Services (Group-IB)MEDIUM
- Vercel deploys Device Bound Session Credentials (DBSC) against infostealer session cookie theftMEDIUM
- Rehub: Russian-Language Cybercrime Forum Emerging as Primary Ransomware Marketplace (Post-XSS/RAMP Takedowns)MEDIUM
- NCSC Annual Review 2026 Warns AI Could Accelerate Ransomware Attacks on Critical InfrastructureMEDIUM
Techniques observed
196 MITRE ATT&CK and ATLAS techniques appear across the day’s reports.
- T1003
- T1003.001
- T1003.008
- T1005
- T1007
- T1008
- T1012
- T1014
- T1016
- T1018
- T1021.001
- T1021.002
- T1027
- T1027.002
- T1027.003
- T1027.007
- T1027.009
- T1027.013
- T1027.017
- T1033
- T1036
- T1036.005
- T1036.008
- T1040
- T1041
- T1046
- T1047
- T1048
- T1053.003
- T1053.005
- T1055
- T1055.003
- T1056.001
- T1057
- T1059
- T1059.001
- T1059.003
- T1059.004
- T1059.005
- T1059.006
- T1059.007
- T1059.011
- T1068
- T1069.002
- T1070.004
- T1071.001
- T1074.001
- T1078
- T1078.001
- T1078.002
- T1078.004
- T1082
- T1087.002
- T1090
- T1091
- T1102.001
- T1105
- T1106
- T1110.003
- T1111
- T1112
- T1113
- T1114
- T1114.002
- T1114.003
- T1115
- T1119
- T1132.002
- T1133
- T1134.001
- T1135
- T1140
- T1185
- T1189
- T1190
- T1195
- T1195.002
- T1199
- T1203
- T1204.001
- T1204.002
- T1204.004
- T1211
- T1212
- T1213.002
- T1217
- T1218.005
- T1218.009
- T1218.010
- T1219
- T1219.002
- T1404
- T1480
- T1482
- T1484.001
- T1489
- T1490
- T1491.001
- T1496
- T1497
- T1497.001
- T1499
- T1499.004
- T1505.003
- T1528
- T1529
- T1530
- T1539
- T1543.002
- T1543.003
- T1546.001
- T1546.015
- T1547.001
- T1548.002
- T1550.001
- T1550.002
- T1550.004
- T1552
- T1552.001
- T1552.003
- T1552.004
- T1553
- T1553.005
- T1554
- T1555
- T1555.001
- T1555.003
- T1555.004
- T1555.006
- T1556
- T1556.006
- T1557
- T1559.001
- T1560
- T1560.001
- T1564.001
- T1564.004
- T1565.001
- T1565.002
- T1566
- T1566.001
- T1566.002
- T1566.004
- T1567
- T1567.002
- T1568
- T1569.002
- T1570
- T1571
- T1573
- T1573.001
- T1574.001
- T1574.002
- T1583
- T1583.001
- T1583.003
- T1583.004
- T1583.006
- T1583.008
- T1585
- T1585.001
- T1585.002
- T1586
- T1586.002
- T1587.001
- T1587.004
- T1588.001
- T1588.002
- T1588.005
- T1588.006
- T1588.007
- T1589
- T1589.001
- T1592
- T1592.002
- T1595.002
- T1595.003
- T1597.002
- T1602.002
- T1606.001
- T1608.004
- T1608.005
- T1614
- T1614.001
- T1620
- T1622
- T1642
- T1650
- T1657
- T1659
- T1664
- T1684.001
- T1684.002
- T1685
- T1685.005
- T1688
Threat actors
15 named threat actors across the reports.
- VasyGrek
- ShinyHunters
- ReHub Forum Operators
- APT29
- SlippyNunchucks
- PolinRider operators
- LockBit
- MountLocker
- DarkSide
- Play - G1040
- Cinnamon Tempest
- Periwinkle Tempest
- BlackMatter
- Kapibala
- Gorbag
Nation-state attribution
- Russia
- China
- North Korea
- Russia, China, Iran
- RU
Threat categories
- VULNERABILITY
- MALWARE
- THREAT_INTEL
- RANSOMWARE
- APT
- SUPPLY_CHAIN
- PHISHING
- CLOUD
- DATA_BREACH
Severity breakdown
- critical6
- high28
- medium11
- low0
Indicator & detection coverage
Counts only: the indicator values and detection rule text behind them unlock with TL Creds.
782 indicators of compromise · unlock with TL Creds. Compare plans
- file 237
- network 190
- malware 84
- entity 63
- tool 60
- behavioral 56
- infrastructure 51
- package 41
405 new detection rules (100% of the day’s threats covered) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)