# Daily Intelligence Briefing — Wednesday, November 4, 2026

> On 2026-11-04, Threadlinqs published 43 new threat reports and updated 2, 6 rated critical and 28 high, spanning 196 MITRE ATT&CK techniques and 15 named threat actors. Coverage that day added 405 new detection rules and 782 extracted indicators.

- **Edition:** 2026-11-04 (Wednesday)
- **Canonical:** https://intel.threadlinqs.com/debrief/2026-11-04
- **Last updated:** 2026-11-10
- **New threats:** 43 (2 updated)
- **Critical / high:** 6 critical, 28 high, 11 medium, 0 low
- **ATT&CK techniques:** 196
- **Threat actors:** 15
- **Indicators (count only):** 782
- **New detection rules (count only):** 405

## Summary & highlights

CVE-2026-25599: Missing Authentication, Clear-Text Transmission and Stored XSS in Orca Heat Pumps and Orca User Portal. CVE-2025-42611: Authentication bypass in multiple MikroTik RouterOS services via improper certificate validation (shared trust store). AI-Generated Malware: Source-Code Indicators and Trends (HUMAN Security / VoidLink / PROMPTSTEAL).

- [TL-2026-5214](https://intel.threadlinqs.com/threat/TL-2026-5214) — APT29 (Midnight Blizzard) watering holes target iOS and Android devices with n-day exploit chains (DarkSword, AndroSnitch)
- [TL-2026-5220](https://intel.threadlinqs.com/threat/TL-2026-5220) — WardenStealer and Aoki (Aokigahara) Infostealers Steal ChatGPT, Claude, and Codex Tokens That Survive Password Resets
- [TL-2026-5221](https://intel.threadlinqs.com/threat/TL-2026-5221) — rsync CPU Exhaustion via Algorithmic Complexity in hash_search() (CVE-2026-119741) - Fixed in 3.5.2
- [TL-2026-5224](https://intel.threadlinqs.com/threat/TL-2026-5224) — Advanced (Targeted) Ransomware Attacks - SI-CERT Analysis (CVE-2020-0688, BlueKeep RDP)
- [TL-2026-5226](https://intel.threadlinqs.com/threat/TL-2026-5226) — Q3 2026 Ransomware Leak-Site Surge: 30% More Victims Driven by 43 New Groups, With Questionable Claims

## Theme of the day

Today's wire was dominated by state-linked and extortion activity: Gorbag and other Russia-aligned groups hit Ukrainian government bodies, while exploited Cisco and Barracuda flaws, Entra ID account takeover, and double-extortion campaigns drove a SEVERE posture (22/25).

windows, ransomware, credential-theft, phishing, double-extortion

## Threats published

- [TL-2026-5211](https://intel.threadlinqs.com/threat/TL-2026-5211) — CRITICAL — SolarWinds Dameware Command Injection Vulnerability (CVE-2026-28336)
- [TL-2026-5230](https://intel.threadlinqs.com/threat/TL-2026-5230) — CRITICAL — Google Chrome 157 Security Update Fixes 213 Bugs Including 7 Critical Vulnerabilities (CVE-2026-121156, CVE-2026-121247, CVE-2026-121229, CVE-2026-121246, CVE-2026-121035, CVE-2026-121203, CVE-2026-121126)
- [TL-2026-5235](https://intel.threadlinqs.com/threat/TL-2026-5235) — CRITICAL — Critical Rails Active Storage Flaw (GHSA-f3w6-w445-fwh9) Lets Attackers Write Server Files via Crafted ImageMagick Uploads
- [TL-2026-5254](https://intel.threadlinqs.com/threat/TL-2026-5254) — CRITICAL — Critical Ruby on Rails Active Storage Flaw (GHSA-f3w6-w445-fwh9) Allows Server Secret Theft via Malicious Image Uploads to ImageMagick (CVE not yet assigned)
- [TL-2026-5271](https://intel.threadlinqs.com/threat/TL-2026-5271) — CRITICAL — Zyxel GS1900 Switch Zero-Day (CVE-2026-107441) Exploited by Kapibala in Red Heron Campaign, ~1,000 Switches Compromised
- [TL-2026-5206](https://intel.threadlinqs.com/threat/TL-2026-5206) — CRITICAL — Android November 2026 Security Bulletin: Over 200 Vulnerabilities Patched, Including Critical Framework RCE (CVE-2026-58868) (update)
- [TL-2026-5214](https://intel.threadlinqs.com/threat/TL-2026-5214) — HIGH — APT29 (Midnight Blizzard) watering holes target iOS and Android devices with n-day exploit chains (DarkSword, AndroSnitch)
- [TL-2026-5220](https://intel.threadlinqs.com/threat/TL-2026-5220) — HIGH — WardenStealer and Aoki (Aokigahara) Infostealers Steal ChatGPT, Claude, and Codex Tokens That Survive Password Resets
- [TL-2026-5221](https://intel.threadlinqs.com/threat/TL-2026-5221) — HIGH — rsync CPU Exhaustion via Algorithmic Complexity in hash_search() (CVE-2026-119741) - Fixed in 3.5.2
- [TL-2026-5224](https://intel.threadlinqs.com/threat/TL-2026-5224) — HIGH — Advanced (Targeted) Ransomware Attacks - SI-CERT Analysis (CVE-2020-0688, BlueKeep RDP)
- [TL-2026-5226](https://intel.threadlinqs.com/threat/TL-2026-5226) — HIGH — Q3 2026 Ransomware Leak-Site Surge: 30% More Victims Driven by 43 New Groups, With Questionable Claims
- [TL-2026-5227](https://intel.threadlinqs.com/threat/TL-2026-5227) — HIGH — XLoader (FormBook) Infostealer Delivered via Fake Business Order Phishing, RAR/JScript/LuaJIT Chain with In-Memory Injection
- [TL-2026-5229](https://intel.threadlinqs.com/threat/TL-2026-5229) — HIGH — Malicious cPGuard Updates Served in OpsShield Supply Chain Attack (Update CDN Compromise, cPGuard 5.88.12-5.88.19)
- [TL-2026-5237](https://intel.threadlinqs.com/threat/TL-2026-5237) — HIGH — China-Aligned SlippyNunchucks Hijacks Sogou Input Method DNS Requests to Deploy DarkVigil (FDMTP) Backdoor (CVE-2026-120422)
- [TL-2026-5240](https://intel.threadlinqs.com/threat/TL-2026-5240) — HIGH — Green Proxy: Undocumented Microsoft 365 AiTM Phishing-as-a-Service Platform
- [TL-2026-5245](https://intel.threadlinqs.com/threat/TL-2026-5245) — HIGH — Operation CloudFire: Google Calendar Phishing Campaign Hijacks Sessions and Bypasses MFA via Live Reverse Proxy (Nyasher)
- [TL-2026-5252](https://intel.threadlinqs.com/threat/TL-2026-5252) — HIGH — NIKKE PC Game Launcher CDN Compromise Delivers K2F Remote Access and Data-Stealing Malware
- [TL-2026-5253](https://intel.threadlinqs.com/threat/TL-2026-5253) — HIGH — Debian and Ubuntu APT Flaw (CVE-2026-109518) Lets MitM Attackers Swap Verified Packages and Run Code as Root
- [TL-2026-5260](https://intel.threadlinqs.com/threat/TL-2026-5260) — HIGH — Phishing Campaigns Bypass Microsoft 365 RejectDirectSend via Empty SMTP Envelope Sender (MAIL FROM:<>)
- [TL-2026-5261](https://intel.threadlinqs.com/threat/TL-2026-5261) — HIGH — PolinRider Loader Reappears in Hijacked npm Packages (12 malicious releases across 10 packages)
- [TL-2026-5264](https://intel.threadlinqs.com/threat/TL-2026-5264) — HIGH — Key Eater: Stolen Microsoft Entra ID Application Credentials Used to Breach 27 Organizations
- [TL-2026-5269](https://intel.threadlinqs.com/threat/TL-2026-5269) — HIGH — NCSC Annual Review 2026: AI-enabled malware and exploitation of legacy technology expected to target UK critical national infrastructure by 2028
- [TL-2026-5278](https://intel.threadlinqs.com/threat/TL-2026-5278) — HIGH — LockBit Ransomware v4.0 (LockBitGreen4.0-rc-577) Reverse Engineering Analysis
- [TL-2026-5280](https://intel.threadlinqs.com/threat/TL-2026-5280) — HIGH — MountLocker Ransomware v5.0 (XingLocker / Astro Locker) - Worm-Capable RSA-2048/ChaCha20 Locker: Reverse Engineering Analysis
- [TL-2026-5281](https://intel.threadlinqs.com/threat/TL-2026-5281) — HIGH — Darkside Ransomware v1.8.6.2 - Reverse Engineering Analysis
- [TL-2026-5283](https://intel.threadlinqs.com/threat/TL-2026-5283) — HIGH — PLAY Ransomware (PlayCrypt) - Reverse Engineering Analysis and Big Game Hunting Operations
- [TL-2026-5284](https://intel.threadlinqs.com/threat/TL-2026-5284) — HIGH — LockBit 2.0 Ransomware (Bitwise Spider) - Technical Reverse Engineering Analysis
- [TL-2026-5285](https://intel.threadlinqs.com/threat/TL-2026-5285) — HIGH — Rook Ransomware (.Rook) - Babuk-derived ransomware with AES-128/RSA-2048 encryption linked to BRONZE STARLIGHT
- [TL-2026-5286](https://intel.threadlinqs.com/threat/TL-2026-5286) — HIGH — DIAVOL Ransomware – Reverse Engineering Analysis (Wizard Spider-linked, .lock64)
- [TL-2026-5288](https://intel.threadlinqs.com/threat/TL-2026-5288) — HIGH — AtomSilo Ransomware – Reverse Engineering Analysis (RSA-512 + AES hybrid encryption) and Confluence CVE-2021-26084 / DLL Side-Loading Intrusion Chain
- [TL-2026-5289](https://intel.threadlinqs.com/threat/TL-2026-5289) — HIGH — OpenAI Cyber Model Uncovers 948 Linux Kernel Local Privilege Escalation Vulnerabilities
- [TL-2026-5290](https://intel.threadlinqs.com/threat/TL-2026-5290) — HIGH — DreamHost Data Breach via Third-Party File Manager Flaw Exposes FTP/SFTP and Webmail Credentials
- [TL-2026-5291](https://intel.threadlinqs.com/threat/TL-2026-5291) — HIGH — BlackMatter Ransomware v2.0 — Reverse Engineering Analysis (RSA-1024 / Modified ChaCha20, ICMLuaUtil UAC Bypass)
- [TL-2026-5198](https://intel.threadlinqs.com/threat/TL-2026-5198) — HIGH — Gorbag: Russia-aligned espionage group targets Ukrainian war crimes investigations and military aid routes (BeautyStealer, Prime ReverseShell, CVE-2025-8088) (update)
- [TL-2026-5213](https://intel.threadlinqs.com/threat/TL-2026-5213) — MEDIUM — CVE-2026-25599: Missing Authentication, Clear-Text Transmission and Stored XSS in Orca Heat Pumps and Orca User Portal
- [TL-2026-5216](https://intel.threadlinqs.com/threat/TL-2026-5216) — MEDIUM — CVE-2025-42611: Authentication bypass in multiple MikroTik RouterOS services via improper certificate validation (shared trust store)
- [TL-2026-5218](https://intel.threadlinqs.com/threat/TL-2026-5218) — MEDIUM — AI-Generated Malware: Source-Code Indicators and Trends (HUMAN Security / VoidLink / PROMPTSTEAL)
- [TL-2026-5225](https://intel.threadlinqs.com/threat/TL-2026-5225) — MEDIUM — Russian MVD Arrests 3 Suspected VasyGrek (Fluffy Wolf) Members; Financially Motivated Phishing/Golang Backdoor Campaigns Continue to be Tracked
- [TL-2026-5239](https://intel.threadlinqs.com/threat/TL-2026-5239) — MEDIUM — Increased Scanning for Vulnerable Legacy E-Mail Test Scripts (formail/mailtest.php variants, CVE-2000-0411 lineage)
- [TL-2026-5242](https://intel.threadlinqs.com/threat/TL-2026-5242) — MEDIUM — Multi-Stage Windows PowerShell Loader Chain Delivering Themida/UPX-Protected Native Payload (contis.exe) with In-Memory Cryptographic Reconstruction
- [TL-2026-5249](https://intel.threadlinqs.com/threat/TL-2026-5249) — MEDIUM — ShinyHunters Post-Arrest Brand Fight: Rival Factions, Shared Extortion Infrastructure and Impersonation (SLSH / Aegis / ShinyEquationCartel)
- [TL-2026-5251](https://intel.threadlinqs.com/threat/TL-2026-5251) — MEDIUM — Industrialized Cybercrime Economy: Commoditized Stealer Logs, Phishing Kits, Identity Fraud and Ransomware Services (Group-IB)
- [TL-2026-5272](https://intel.threadlinqs.com/threat/TL-2026-5272) — MEDIUM — Vercel deploys Device Bound Session Credentials (DBSC) against infostealer session cookie theft
- [TL-2026-5279](https://intel.threadlinqs.com/threat/TL-2026-5279) — MEDIUM — Rehub: Russian-Language Cybercrime Forum Emerging as Primary Ransomware Marketplace (Post-XSS/RAMP Takedowns)
- [TL-2026-5294](https://intel.threadlinqs.com/threat/TL-2026-5294) — MEDIUM — NCSC Annual Review 2026 Warns AI Could Accelerate Ransomware Attacks on Critical Infrastructure

## Techniques observed

[T1003](https://intel.threadlinqs.com/technique/T1003), [T1003.001](https://intel.threadlinqs.com/technique/T1003.001), [T1003.008](https://intel.threadlinqs.com/technique/T1003.008), [T1005](https://intel.threadlinqs.com/technique/T1005), [T1007](https://intel.threadlinqs.com/technique/T1007), [T1008](https://intel.threadlinqs.com/technique/T1008), [T1012](https://intel.threadlinqs.com/technique/T1012), [T1014](https://intel.threadlinqs.com/technique/T1014), [T1016](https://intel.threadlinqs.com/technique/T1016), [T1018](https://intel.threadlinqs.com/technique/T1018), [T1021.001](https://intel.threadlinqs.com/technique/T1021.001), [T1021.002](https://intel.threadlinqs.com/technique/T1021.002), [T1027](https://intel.threadlinqs.com/technique/T1027), [T1027.002](https://intel.threadlinqs.com/technique/T1027.002), [T1027.003](https://intel.threadlinqs.com/technique/T1027.003), [T1027.007](https://intel.threadlinqs.com/technique/T1027.007), [T1027.009](https://intel.threadlinqs.com/technique/T1027.009), [T1027.013](https://intel.threadlinqs.com/technique/T1027.013), T1027.017, [T1033](https://intel.threadlinqs.com/technique/T1033), [T1036](https://intel.threadlinqs.com/technique/T1036), [T1036.005](https://intel.threadlinqs.com/technique/T1036.005), [T1036.008](https://intel.threadlinqs.com/technique/T1036.008), [T1040](https://intel.threadlinqs.com/technique/T1040), [T1041](https://intel.threadlinqs.com/technique/T1041), [T1046](https://intel.threadlinqs.com/technique/T1046), [T1047](https://intel.threadlinqs.com/technique/T1047), [T1048](https://intel.threadlinqs.com/technique/T1048), [T1053.003](https://intel.threadlinqs.com/technique/T1053.003), [T1053.005](https://intel.threadlinqs.com/technique/T1053.005), [T1055](https://intel.threadlinqs.com/technique/T1055), T1055.003, [T1056.001](https://intel.threadlinqs.com/technique/T1056.001), [T1057](https://intel.threadlinqs.com/technique/T1057), [T1059](https://intel.threadlinqs.com/technique/T1059), [T1059.001](https://intel.threadlinqs.com/technique/T1059.001), [T1059.003](https://intel.threadlinqs.com/technique/T1059.003), [T1059.004](https://intel.threadlinqs.com/technique/T1059.004), [T1059.005](https://intel.threadlinqs.com/technique/T1059.005), [T1059.006](https://intel.threadlinqs.com/technique/T1059.006), [T1059.007](https://intel.threadlinqs.com/technique/T1059.007), T1059.011, [T1068](https://intel.threadlinqs.com/technique/T1068), [T1069.002](https://intel.threadlinqs.com/technique/T1069.002), [T1070.004](https://intel.threadlinqs.com/technique/T1070.004), [T1071.001](https://intel.threadlinqs.com/technique/T1071.001), [T1074.001](https://intel.threadlinqs.com/technique/T1074.001), [T1078](https://intel.threadlinqs.com/technique/T1078), [T1078.001](https://intel.threadlinqs.com/technique/T1078.001), [T1078.002](https://intel.threadlinqs.com/technique/T1078.002), [T1078.004](https://intel.threadlinqs.com/technique/T1078.004), [T1082](https://intel.threadlinqs.com/technique/T1082), [T1087.002](https://intel.threadlinqs.com/technique/T1087.002), [T1090](https://intel.threadlinqs.com/technique/T1090), [T1091](https://intel.threadlinqs.com/technique/T1091), [T1102.001](https://intel.threadlinqs.com/technique/T1102.001), [T1105](https://intel.threadlinqs.com/technique/T1105), [T1106](https://intel.threadlinqs.com/technique/T1106), [T1110.003](https://intel.threadlinqs.com/technique/T1110.003), [T1111](https://intel.threadlinqs.com/technique/T1111), [T1112](https://intel.threadlinqs.com/technique/T1112), [T1113](https://intel.threadlinqs.com/technique/T1113), [T1114](https://intel.threadlinqs.com/technique/T1114), [T1114.002](https://intel.threadlinqs.com/technique/T1114.002), [T1114.003](https://intel.threadlinqs.com/technique/T1114.003), [T1115](https://intel.threadlinqs.com/technique/T1115), [T1119](https://intel.threadlinqs.com/technique/T1119), [T1132.002](https://intel.threadlinqs.com/technique/T1132.002), [T1133](https://intel.threadlinqs.com/technique/T1133), [T1134.001](https://intel.threadlinqs.com/technique/T1134.001), [T1135](https://intel.threadlinqs.com/technique/T1135), [T1140](https://intel.threadlinqs.com/technique/T1140), [T1185](https://intel.threadlinqs.com/technique/T1185), [T1189](https://intel.threadlinqs.com/technique/T1189), [T1190](https://intel.threadlinqs.com/technique/T1190), [T1195](https://intel.threadlinqs.com/technique/T1195), [T1195.002](https://intel.threadlinqs.com/technique/T1195.002), [T1199](https://intel.threadlinqs.com/technique/T1199), [T1203](https://intel.threadlinqs.com/technique/T1203), [T1204.001](https://intel.threadlinqs.com/technique/T1204.001), [T1204.002](https://intel.threadlinqs.com/technique/T1204.002), [T1204.004](https://intel.threadlinqs.com/technique/T1204.004), [T1211](https://intel.threadlinqs.com/technique/T1211), [T1212](https://intel.threadlinqs.com/technique/T1212), [T1213.002](https://intel.threadlinqs.com/technique/T1213.002), [T1217](https://intel.threadlinqs.com/technique/T1217), [T1218.005](https://intel.threadlinqs.com/technique/T1218.005), T1218.009, [T1218.010](https://intel.threadlinqs.com/technique/T1218.010), [T1219](https://intel.threadlinqs.com/technique/T1219), [T1219.002](https://intel.threadlinqs.com/technique/T1219.002), [T1404](https://intel.threadlinqs.com/technique/T1404), [T1480](https://intel.threadlinqs.com/technique/T1480), [T1482](https://intel.threadlinqs.com/technique/T1482), [T1484.001](https://intel.threadlinqs.com/technique/T1484.001), [T1489](https://intel.threadlinqs.com/technique/T1489), [T1490](https://intel.threadlinqs.com/technique/T1490), [T1491.001](https://intel.threadlinqs.com/technique/T1491.001), [T1496](https://intel.threadlinqs.com/technique/T1496), [T1497](https://intel.threadlinqs.com/technique/T1497), [T1497.001](https://intel.threadlinqs.com/technique/T1497.001), [T1499](https://intel.threadlinqs.com/technique/T1499), [T1499.004](https://intel.threadlinqs.com/technique/T1499.004), [T1505.003](https://intel.threadlinqs.com/technique/T1505.003), [T1528](https://intel.threadlinqs.com/technique/T1528), [T1529](https://intel.threadlinqs.com/technique/T1529), [T1530](https://intel.threadlinqs.com/technique/T1530), [T1539](https://intel.threadlinqs.com/technique/T1539), [T1543.002](https://intel.threadlinqs.com/technique/T1543.002), [T1543.003](https://intel.threadlinqs.com/technique/T1543.003), T1546.001, [T1546.015](https://intel.threadlinqs.com/technique/T1546.015), [T1547.001](https://intel.threadlinqs.com/technique/T1547.001), [T1548.002](https://intel.threadlinqs.com/technique/T1548.002), [T1550.001](https://intel.threadlinqs.com/technique/T1550.001), [T1550.002](https://intel.threadlinqs.com/technique/T1550.002), [T1550.004](https://intel.threadlinqs.com/technique/T1550.004), [T1552](https://intel.threadlinqs.com/technique/T1552), [T1552.001](https://intel.threadlinqs.com/technique/T1552.001), [T1552.003](https://intel.threadlinqs.com/technique/T1552.003), [T1552.004](https://intel.threadlinqs.com/technique/T1552.004), [T1553](https://intel.threadlinqs.com/technique/T1553), [T1553.005](https://intel.threadlinqs.com/technique/T1553.005), [T1554](https://intel.threadlinqs.com/technique/T1554), [T1555](https://intel.threadlinqs.com/technique/T1555), [T1555.001](https://intel.threadlinqs.com/technique/T1555.001), [T1555.003](https://intel.threadlinqs.com/technique/T1555.003), [T1555.004](https://intel.threadlinqs.com/technique/T1555.004), [T1555.006](https://intel.threadlinqs.com/technique/T1555.006), [T1556](https://intel.threadlinqs.com/technique/T1556), [T1556.006](https://intel.threadlinqs.com/technique/T1556.006), [T1557](https://intel.threadlinqs.com/technique/T1557), [T1559.001](https://intel.threadlinqs.com/technique/T1559.001), [T1560](https://intel.threadlinqs.com/technique/T1560), [T1560.001](https://intel.threadlinqs.com/technique/T1560.001), [T1564.001](https://intel.threadlinqs.com/technique/T1564.001), [T1564.004](https://intel.threadlinqs.com/technique/T1564.004), [T1565.001](https://intel.threadlinqs.com/technique/T1565.001), [T1565.002](https://intel.threadlinqs.com/technique/T1565.002), [T1566](https://intel.threadlinqs.com/technique/T1566), [T1566.001](https://intel.threadlinqs.com/technique/T1566.001), [T1566.002](https://intel.threadlinqs.com/technique/T1566.002), [T1566.004](https://intel.threadlinqs.com/technique/T1566.004), [T1567](https://intel.threadlinqs.com/technique/T1567), [T1567.002](https://intel.threadlinqs.com/technique/T1567.002), [T1568](https://intel.threadlinqs.com/technique/T1568), [T1569.002](https://intel.threadlinqs.com/technique/T1569.002), [T1570](https://intel.threadlinqs.com/technique/T1570), [T1571](https://intel.threadlinqs.com/technique/T1571), [T1573](https://intel.threadlinqs.com/technique/T1573), [T1573.001](https://intel.threadlinqs.com/technique/T1573.001), [T1574.001](https://intel.threadlinqs.com/technique/T1574.001), T1574.002, [T1583](https://intel.threadlinqs.com/technique/T1583), [T1583.001](https://intel.threadlinqs.com/technique/T1583.001), [T1583.003](https://intel.threadlinqs.com/technique/T1583.003), [T1583.004](https://intel.threadlinqs.com/technique/T1583.004), [T1583.006](https://intel.threadlinqs.com/technique/T1583.006), [T1583.008](https://intel.threadlinqs.com/technique/T1583.008), [T1585](https://intel.threadlinqs.com/technique/T1585), [T1585.001](https://intel.threadlinqs.com/technique/T1585.001), [T1585.002](https://intel.threadlinqs.com/technique/T1585.002), [T1586](https://intel.threadlinqs.com/technique/T1586), [T1586.002](https://intel.threadlinqs.com/technique/T1586.002), [T1587.001](https://intel.threadlinqs.com/technique/T1587.001), [T1587.004](https://intel.threadlinqs.com/technique/T1587.004), [T1588.001](https://intel.threadlinqs.com/technique/T1588.001), [T1588.002](https://intel.threadlinqs.com/technique/T1588.002), [T1588.005](https://intel.threadlinqs.com/technique/T1588.005), [T1588.006](https://intel.threadlinqs.com/technique/T1588.006), [T1588.007](https://intel.threadlinqs.com/technique/T1588.007), [T1589](https://intel.threadlinqs.com/technique/T1589), [T1589.001](https://intel.threadlinqs.com/technique/T1589.001), [T1592](https://intel.threadlinqs.com/technique/T1592), [T1592.002](https://intel.threadlinqs.com/technique/T1592.002), [T1595.002](https://intel.threadlinqs.com/technique/T1595.002), T1595.003, T1597.002, [T1602.002](https://intel.threadlinqs.com/technique/T1602.002), [T1606.001](https://intel.threadlinqs.com/technique/T1606.001), [T1608.004](https://intel.threadlinqs.com/technique/T1608.004), [T1608.005](https://intel.threadlinqs.com/technique/T1608.005), [T1614](https://intel.threadlinqs.com/technique/T1614), [T1614.001](https://intel.threadlinqs.com/technique/T1614.001), [T1620](https://intel.threadlinqs.com/technique/T1620), [T1622](https://intel.threadlinqs.com/technique/T1622), T1642, [T1650](https://intel.threadlinqs.com/technique/T1650), [T1657](https://intel.threadlinqs.com/technique/T1657), [T1659](https://intel.threadlinqs.com/technique/T1659), [T1664](https://intel.threadlinqs.com/technique/T1664), [T1684.001](https://intel.threadlinqs.com/technique/T1684.001), T1684.002, [T1685](https://intel.threadlinqs.com/technique/T1685), [T1685.005](https://intel.threadlinqs.com/technique/T1685.005), [T1688](https://intel.threadlinqs.com/technique/T1688)

## Threat actors

[VasyGrek](https://intel.threadlinqs.com/actor/VasyGrek), [ShinyHunters](https://intel.threadlinqs.com/actor/ShinyHunters), [ReHub Forum Operators](https://intel.threadlinqs.com/actor/ReHub%20Forum%20Operators), [APT29](https://intel.threadlinqs.com/actor/APT29), [SlippyNunchucks](https://intel.threadlinqs.com/actor/SlippyNunchucks), [PolinRider operators](https://intel.threadlinqs.com/actor/PolinRider%20operators), [LockBit](https://intel.threadlinqs.com/actor/LockBit), [MountLocker](https://intel.threadlinqs.com/actor/MountLocker), [DarkSide](https://intel.threadlinqs.com/actor/DarkSide), [Play - G1040](https://intel.threadlinqs.com/actor/Play%20-%20G1040), [Cinnamon Tempest](https://intel.threadlinqs.com/actor/Cinnamon%20Tempest), [Periwinkle Tempest](https://intel.threadlinqs.com/actor/Periwinkle%20Tempest), [BlackMatter](https://intel.threadlinqs.com/actor/BlackMatter), [Kapibala](https://intel.threadlinqs.com/actor/Kapibala), [Gorbag](https://intel.threadlinqs.com/actor/Gorbag)

Nation-state attribution: Russia, China, North Korea, Russia, China, Iran, RU

Threat categories: VULNERABILITY, MALWARE, THREAT_INTEL, RANSOMWARE, APT, SUPPLY_CHAIN, PHISHING, CLOUD, DATA_BREACH

## Severity breakdown

- critical: 6
- high: 28
- medium: 11
- low: 0

## Indicator & detection coverage

Counts only; indicator values and detection rule text unlock per threat with TL Creds.

- Indicators of compromise: 782 (file 237, network 190, malware 84, entity 63, tool 60, behavioral 56, infrastructure 51, package 41)
- New detection rules: 405 (100% of the day’s threats covered)

## More editions

- Previous: [2026-11-03](https://intel.threadlinqs.com/debrief/2026-11-03)
- Next: [2026-11-05](https://intel.threadlinqs.com/debrief/2026-11-05)
- [Archive of daily debriefs](https://intel.threadlinqs.com/debrief/archive)
- [Latest debrief](https://intel.threadlinqs.com/debrief)

Canonical: https://intel.threadlinqs.com/debrief/2026-11-04