Threadlinqs IntelligenceStart free

Daily debrief · Thursday2026-11-05

Daily Intelligence Briefing — Thursday, November 5, 2026

9 critical27 high9 medium1 low

On 2026-11-05, Threadlinqs published 44 new threat reports and updated 2, 9 rated critical and 27 high, spanning 242 MITRE ATT&CK techniques and 16 named threat actors. Coverage that day added 414 new detection rules and 969 extracted indicators.

New threats
442 updated
Critical / high
369 critical · 27 high
ATT&CK techniques
242Observed in the day’s reports
Threat actors
16Named in the reports
Indicators
969Count only · values are Red+
Detection rules
414New that day · rule text is Blue+

Edition date: · Last updated:

Summary & highlights

Module Overloading: Full PE Image Placed Inside a Carrier DLL Mapping (Malware Development Technique, cocomelonc). GhostMap: Android ZIP-parsing flaw (libziparchive/libandroidfw mismatch) lets a malicious APK trigger a persistent system_server crash loop. Chinese Nation-State Threat Activity Falls 41.4% in Q2-Q3 2026 While Remaining Above Russian and Iranian Activity (Trellix).

Highlights

  • TL-2026-5298 — CVE-2025-40944: Denial-of-Service Vulnerability in Siemens SIMATIC ET 200 Devices (SSA-674753)
  • TL-2026-5300 — Suspected MuddyWater Phishing Campaign Impersonating Israel Tax Authority Delivers SimpleHelp RMM to Israeli Organizations
  • TL-2026-5302 — Phexia macOS Malware Delivered via ClickFix, Using Polygon Smart Contracts (EtherHiding) for C2
  • TL-2026-5306 — Mirax Android RAT: Server-side Device Takeover Targeting META Banking Customers via Malicious Ads in Streaming Apps
  • TL-2026-5309 — BOSSAI: AI-Augmented Multi-Agent Attack Campaign Exposes Taiwan Emergency Dispatch and Patient Records

Theme of the day

Ransomware dominated today's observed activity, with double-extortion and ransomware-as-a-service operations prominent, alongside state-linked espionage and phishing aimed at Microsoft 365 and Entra ID accounts. Windows environments were the most frequently targeted platform, and posture held at SEVERE (22/25).

  • credential-theft
  • no-cve
  • remote-code-execution
  • windows
  • phishing

Threats published

46 threat lines in the 2026-11-05 debrief, most severe first; entries marked (update) revise an earlier report. Each links to its full profile.

Techniques observed

242 MITRE ATT&CK and ATLAS techniques appear across the day’s reports.

Threat actors

16 named threat actors across the reports.

Nation-state attribution

  • China
  • Iran
  • Taiwan
  • Russia
  • Syria
  • Belarus

Threat categories

  • THREAT_INTEL
  • VULNERABILITY
  • APT
  • MALWARE
  • PHISHING
  • RANSOMWARE
  • DATA_BREACH

Severity breakdown

  • critical9
  • high27
  • medium9
  • low1

Indicator & detection coverage

Counts only: the indicator values and detection rule text behind them unlock with TL Creds.

969 indicators of compromise · unlock with TL Creds. Compare plans
  • network 301
  • file 237
  • behavioral 86
  • entity 80
  • infrastructure 80
  • tool 74
  • malware 63
  • package 46
  • technique 2
414 new detection rules (100% of the day’s threats covered) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)