# Daily Intelligence Briefing — Thursday, November 5, 2026

> On 2026-11-05, Threadlinqs published 44 new threat reports and updated 2, 9 rated critical and 27 high, spanning 242 MITRE ATT&CK techniques and 16 named threat actors. Coverage that day added 414 new detection rules and 969 extracted indicators.

- **Edition:** 2026-11-05 (Thursday)
- **Canonical:** https://intel.threadlinqs.com/debrief/2026-11-05
- **Last updated:** 2026-11-11
- **New threats:** 44 (2 updated)
- **Critical / high:** 9 critical, 27 high, 9 medium, 1 low
- **ATT&CK techniques:** 242
- **Threat actors:** 16
- **Indicators (count only):** 969
- **New detection rules (count only):** 414

## Summary & highlights

Module Overloading: Full PE Image Placed Inside a Carrier DLL Mapping (Malware Development Technique, cocomelonc). GhostMap: Android ZIP-parsing flaw (libziparchive/libandroidfw mismatch) lets a malicious APK trigger a persistent system_server crash loop. Chinese Nation-State Threat Activity Falls 41.4% in Q2-Q3 2026 While Remaining Above Russian and Iranian Activity (Trellix).

- [TL-2026-5298](https://intel.threadlinqs.com/threat/TL-2026-5298) — CVE-2025-40944: Denial-of-Service Vulnerability in Siemens SIMATIC ET 200 Devices (SSA-674753)
- [TL-2026-5300](https://intel.threadlinqs.com/threat/TL-2026-5300) — Suspected MuddyWater Phishing Campaign Impersonating Israel Tax Authority Delivers SimpleHelp RMM to Israeli Organizations
- [TL-2026-5302](https://intel.threadlinqs.com/threat/TL-2026-5302) — Phexia macOS Malware Delivered via ClickFix, Using Polygon Smart Contracts (EtherHiding) for C2
- [TL-2026-5306](https://intel.threadlinqs.com/threat/TL-2026-5306) — Mirax Android RAT: Server-side Device Takeover Targeting META Banking Customers via Malicious Ads in Streaming Apps
- [TL-2026-5309](https://intel.threadlinqs.com/threat/TL-2026-5309) — BOSSAI: AI-Augmented Multi-Agent Attack Campaign Exposes Taiwan Emergency Dispatch and Patient Records

## Theme of the day

Ransomware dominated today's observed activity, with double-extortion and ransomware-as-a-service operations prominent, alongside state-linked espionage and phishing aimed at Microsoft 365 and Entra ID accounts. Windows environments were the most frequently targeted platform, and posture held at SEVERE (22/25).

credential-theft, no-cve, remote-code-execution, windows, phishing

## Threats published

- [TL-2026-5305](https://intel.threadlinqs.com/threat/TL-2026-5305) — CRITICAL — Multiple Vulnerabilities in Fortigate NGFW Before V7.4.1 on Siemens RUGGEDCOM APE1808 Devices (SSA-366067)
- [TL-2026-5307](https://intel.threadlinqs.com/threat/TL-2026-5307) — CRITICAL — Critical Citrix XenServer Vulnerability (CVE-2026-98432, CVE-2026-102703) Could Let Attackers Take Over Virtualization Hosts Without Authentication
- [TL-2026-5315](https://intel.threadlinqs.com/threat/TL-2026-5315) — CRITICAL — Storm-2603 Fileless ToolShell Breach of On-Prem SharePoint (CVE-2025-53770 / CVE-2025-53771) with Warlock/LockBit Ransomware
- [TL-2026-5322](https://intel.threadlinqs.com/threat/TL-2026-5322) — CRITICAL — Fastjson 1.x Gadget-Free RCE (CVE-2026-16723 / ThreatBook XVE-2026-39684) Under Active Exploitation
- [TL-2026-5328](https://intel.threadlinqs.com/threat/TL-2026-5328) — CRITICAL — Apache OFBiz Pre-Auth RCE (CVE-2026-68524) and Account Takeover (CVE-2026-109928) Patched in 24.09.08
- [TL-2026-5338](https://intel.threadlinqs.com/threat/TL-2026-5338) — CRITICAL — OpenSSH on musl libc (Alpine Linux) authentication bypass via overly long password ("*sshole")
- [TL-2026-5360](https://intel.threadlinqs.com/threat/TL-2026-5360) — CRITICAL — Marimo CVE-2026-39987: unauthenticated /terminal/ws RCE exploited to harvest AWS credentials and pivot to an SSH bastion in 8 seconds
- [TL-2026-5372](https://intel.threadlinqs.com/threat/TL-2026-5372) — CRITICAL — Multi-vendor vulnerability roundup: Node2Shell Brotli RCE (CVE-2026-111497, actively exploited, CISA KEV), WatchGuard CVE-2026-98432 (CVSS 9.8) and AuthPoint Gateway flaws, Cisco UCS Central CVE-2026-76506, SonicWall GMS CVE-2026-109593/109594 unpatched (EOL)
- [TL-2026-2611](https://intel.threadlinqs.com/threat/TL-2026-2611) — CRITICAL — Zyxel GS1900 Series Switches Stack-Based Buffer Overflow (CVE-2026-7273) Actively Exploited by Kapibala/Red Heron in Global 996-Device Campaign — Added to CISA KEV (update)
- [TL-2026-5298](https://intel.threadlinqs.com/threat/TL-2026-5298) — HIGH — CVE-2025-40944: Denial-of-Service Vulnerability in Siemens SIMATIC ET 200 Devices (SSA-674753)
- [TL-2026-5300](https://intel.threadlinqs.com/threat/TL-2026-5300) — HIGH — Suspected MuddyWater Phishing Campaign Impersonating Israel Tax Authority Delivers SimpleHelp RMM to Israeli Organizations
- [TL-2026-5302](https://intel.threadlinqs.com/threat/TL-2026-5302) — HIGH — Phexia macOS Malware Delivered via ClickFix, Using Polygon Smart Contracts (EtherHiding) for C2
- [TL-2026-5306](https://intel.threadlinqs.com/threat/TL-2026-5306) — HIGH — Mirax Android RAT: Server-side Device Takeover Targeting META Banking Customers via Malicious Ads in Streaming Apps
- [TL-2026-5309](https://intel.threadlinqs.com/threat/TL-2026-5309) — HIGH — BOSSAI: AI-Augmented Multi-Agent Attack Campaign Exposes Taiwan Emergency Dispatch and Patient Records
- [TL-2026-5318](https://intel.threadlinqs.com/threat/TL-2026-5318) — HIGH — Hawkmoth Anubis Ransomware Attack Uses New Backdoor.Lindnor and BYOVD Security Killers Against U.S. Organization
- [TL-2026-5320](https://intel.threadlinqs.com/threat/TL-2026-5320) — HIGH — Nova (formerly RALord) Ransomware-as-a-Service Group
- [TL-2026-5324](https://intel.threadlinqs.com/threat/TL-2026-5324) — HIGH — Bank Phishing Campaign Uses Fake 'Suspended' Pages for Returning Visitors to Evade Takedowns
- [TL-2026-5325](https://intel.threadlinqs.com/threat/TL-2026-5325) — HIGH — The State of Ransomware in Financial Services 2026 (Sophos survey)
- [TL-2026-5326](https://intel.threadlinqs.com/threat/TL-2026-5326) — HIGH — ChatGPT Lockdown Mode Bypass via HTML Preview Nested Iframes Enables Phishing, Malware Delivery, and Silent Data Exfiltration
- [TL-2026-5327](https://intel.threadlinqs.com/threat/TL-2026-5327) — HIGH — HEAVYGRAM: Telegram-based Surveillance Backdoor Linked to Handala Hack (Void Manticore / MOIS)
- [TL-2026-5329](https://intel.threadlinqs.com/threat/TL-2026-5329) — HIGH — Higher Education Sector Under Ransomware and Extortion Pressure: Interlock (CCBC, Springfield Public Schools) and ShinyHunters (Instructure Canvas) with AI Data-Exposure Risk
- [TL-2026-5330](https://intel.threadlinqs.com/threat/TL-2026-5330) — HIGH — CWPdoor: Trojanized Control Web Panel cwpsrv binary backdoors Linux servers
- [TL-2026-5331](https://intel.threadlinqs.com/threat/TL-2026-5331) — HIGH — Microsoft Q3 2026 Email Threat Landscape: Device Code Phishing via QR Salary-Review Lures and Agent Tesla RAR Campaign
- [TL-2026-5335](https://intel.threadlinqs.com/threat/TL-2026-5335) — HIGH — ARTEX AI-Powered Pentest Platform Abused for Autonomous Cybercrime Campaigns (Apple Certificates, Crypto Draining, Gaming Credentials)
- [TL-2026-5339](https://intel.threadlinqs.com/threat/TL-2026-5339) — HIGH — Chainalysis breach via agentic on-path (AitM) attack exposes user credentials and live authentication tokens
- [TL-2026-5340](https://intel.threadlinqs.com/threat/TL-2026-5340) — HIGH — APT29 Watering-Hole Campaign Against Mongolian Government Sites Using iOS WebKit and Chrome Android Exploits (CVE-2023-41993, CVE-2024-5274, CVE-2024-4671)
- [TL-2026-5346](https://intel.threadlinqs.com/threat/TL-2026-5346) — HIGH — BTMob Android RAT: February 2026 Source Code Leak Expands Access and Resale
- [TL-2026-5347](https://intel.threadlinqs.com/threat/TL-2026-5347) — HIGH — Fake OpenAI, SpaceX and Anthropic events used in device code and AiTM phishing to steal Microsoft and Google accounts
- [TL-2026-5350](https://intel.threadlinqs.com/threat/TL-2026-5350) — HIGH — Queens Public Library Ransomware Attack Disrupts Wi-Fi, On-Site Computers and Digital Services
- [TL-2026-5356](https://intel.threadlinqs.com/threat/TL-2026-5356) — HIGH — Vexy Ransomware claims ZipAI (Vietnam, Technology) - 15.73 GB exfiltrated
- [TL-2026-5361](https://intel.threadlinqs.com/threat/TL-2026-5361) — HIGH — Microsoft Paint Out-of-Bounds Read RCE Vulnerability (CVE-2026-83844)
- [TL-2026-5362](https://intel.threadlinqs.com/threat/TL-2026-5362) — HIGH — CRAFTY FALCON targets Indian fintechs via exposed APIs during weekends and low-monitoring periods
- [TL-2026-5363](https://intel.threadlinqs.com/threat/TL-2026-5363) — HIGH — Threat actors use agentic AI tooling (ARTEX) to find and abuse exposed secrets in GitHub and Azure
- [TL-2026-5367](https://intel.threadlinqs.com/threat/TL-2026-5367) — HIGH — HYFLOCK Ransomware-as-a-Service: Partial (First 4KB) Encryption of Larger Files
- [TL-2026-5368](https://intel.threadlinqs.com/threat/TL-2026-5368) — HIGH — Claude Dispatch "ThisBash" flaw lets malicious browser extensions drive Claude Desktop to execute commands locally or on other machines on the same account; Anthropic has not fixed it
- [TL-2026-0445](https://intel.threadlinqs.com/threat/TL-2026-0445) — HIGH — Linux Kernel 'Copy Fail' Local Privilege Escalation (CVE-2026-31431) — algif_aead 4-Byte Page Cache Write to setuid Root (update)
- [TL-2026-5311](https://intel.threadlinqs.com/threat/TL-2026-5311) — MEDIUM — Module Overloading: Full PE Image Placed Inside a Carrier DLL Mapping (Malware Development Technique, cocomelonc)
- [TL-2026-5312](https://intel.threadlinqs.com/threat/TL-2026-5312) — MEDIUM — GhostMap: Android ZIP-parsing flaw (libziparchive/libandroidfw mismatch) lets a malicious APK trigger a persistent system_server crash loop
- [TL-2026-5319](https://intel.threadlinqs.com/threat/TL-2026-5319) — MEDIUM — Chinese Nation-State Threat Activity Falls 41.4% in Q2-Q3 2026 While Remaining Above Russian and Iranian Activity (Trellix)
- [TL-2026-5334](https://intel.threadlinqs.com/threat/TL-2026-5334) — MEDIUM — OpenAI releases GPT-6 Cyber, an offensive-capable AI model rated Critical under its Preparedness Framework
- [TL-2026-5337](https://intel.threadlinqs.com/threat/TL-2026-5337) — MEDIUM — Malicious Browser Extensions Ecosystem: Needle and Lunex Malware, Clean-Then-Update Extension Campaigns
- [TL-2026-5345](https://intel.threadlinqs.com/threat/TL-2026-5345) — MEDIUM — Scans for Cisco IOS XE Web UI Vulnerability (CVE-2023-20198) with RootEvidence Opt-Out Headers
- [TL-2026-5355](https://intel.threadlinqs.com/threat/TL-2026-5355) — MEDIUM — Praetorian Brutus: Open-Source Multi-Protocol Credential Testing Engine Expands to 14 New Protocols with People Enumeration and Credential Persistence
- [TL-2026-5357](https://intel.threadlinqs.com/threat/TL-2026-5357) — MEDIUM — laZzzy Donut: Multi-Stage Loader Chain (Kramer-obfuscated Python, Donut shellcode, laZzzy loader)
- [TL-2026-5365](https://intel.threadlinqs.com/threat/TL-2026-5365) — MEDIUM — ChatGPT Subscription Payment Phishing Campaign Using Google API Redirect and Fake Login Page
- [TL-2026-5317](https://intel.threadlinqs.com/threat/TL-2026-5317) — LOW — OpenAI Finds GPT-6 Astra Covertly Underperforming on Safety Research and Exploit Tasks

## Techniques observed

[AML.T0051](https://intel.threadlinqs.com/technique/AML.T0051), [AML.T0053](https://intel.threadlinqs.com/technique/AML.T0053), [T0814](https://intel.threadlinqs.com/technique/T0814), [T1003.008](https://intel.threadlinqs.com/technique/T1003.008), [T1005](https://intel.threadlinqs.com/technique/T1005), [T1008](https://intel.threadlinqs.com/technique/T1008), [T1014](https://intel.threadlinqs.com/technique/T1014), [T1016](https://intel.threadlinqs.com/technique/T1016), [T1020](https://intel.threadlinqs.com/technique/T1020), [T1021.001](https://intel.threadlinqs.com/technique/T1021.001), [T1021.002](https://intel.threadlinqs.com/technique/T1021.002), [T1021.004](https://intel.threadlinqs.com/technique/T1021.004), [T1027](https://intel.threadlinqs.com/technique/T1027), [T1027.002](https://intel.threadlinqs.com/technique/T1027.002), [T1027.009](https://intel.threadlinqs.com/technique/T1027.009), [T1027.010](https://intel.threadlinqs.com/technique/T1027.010), [T1027.013](https://intel.threadlinqs.com/technique/T1027.013), [T1033](https://intel.threadlinqs.com/technique/T1033), [T1036](https://intel.threadlinqs.com/technique/T1036), [T1036.005](https://intel.threadlinqs.com/technique/T1036.005), [T1037.004](https://intel.threadlinqs.com/technique/T1037.004), [T1041](https://intel.threadlinqs.com/technique/T1041), [T1046](https://intel.threadlinqs.com/technique/T1046), [T1047](https://intel.threadlinqs.com/technique/T1047), [T1049](https://intel.threadlinqs.com/technique/T1049), [T1053.003](https://intel.threadlinqs.com/technique/T1053.003), [T1053.005](https://intel.threadlinqs.com/technique/T1053.005), [T1055](https://intel.threadlinqs.com/technique/T1055), T1055.003, [T1055.004](https://intel.threadlinqs.com/technique/T1055.004), [T1055.012](https://intel.threadlinqs.com/technique/T1055.012), [T1056.001](https://intel.threadlinqs.com/technique/T1056.001), [T1056.002](https://intel.threadlinqs.com/technique/T1056.002), [T1056.003](https://intel.threadlinqs.com/technique/T1056.003), [T1057](https://intel.threadlinqs.com/technique/T1057), [T1059](https://intel.threadlinqs.com/technique/T1059), [T1059.001](https://intel.threadlinqs.com/technique/T1059.001), [T1059.002](https://intel.threadlinqs.com/technique/T1059.002), [T1059.003](https://intel.threadlinqs.com/technique/T1059.003), [T1059.004](https://intel.threadlinqs.com/technique/T1059.004), [T1059.005](https://intel.threadlinqs.com/technique/T1059.005), [T1059.006](https://intel.threadlinqs.com/technique/T1059.006), [T1059.007](https://intel.threadlinqs.com/technique/T1059.007), T1059.008, [T1068](https://intel.threadlinqs.com/technique/T1068), [T1070](https://intel.threadlinqs.com/technique/T1070), [T1070.003](https://intel.threadlinqs.com/technique/T1070.003), [T1070.004](https://intel.threadlinqs.com/technique/T1070.004), [T1070.006](https://intel.threadlinqs.com/technique/T1070.006), [T1071.001](https://intel.threadlinqs.com/technique/T1071.001), T1071.002, [T1074.001](https://intel.threadlinqs.com/technique/T1074.001), [T1078](https://intel.threadlinqs.com/technique/T1078), [T1078.001](https://intel.threadlinqs.com/technique/T1078.001), [T1078.003](https://intel.threadlinqs.com/technique/T1078.003), [T1078.004](https://intel.threadlinqs.com/technique/T1078.004), [T1082](https://intel.threadlinqs.com/technique/T1082), [T1083](https://intel.threadlinqs.com/technique/T1083), [T1087](https://intel.threadlinqs.com/technique/T1087), [T1087.002](https://intel.threadlinqs.com/technique/T1087.002), [T1090](https://intel.threadlinqs.com/technique/T1090), [T1090.002](https://intel.threadlinqs.com/technique/T1090.002), [T1090.003](https://intel.threadlinqs.com/technique/T1090.003), [T1095](https://intel.threadlinqs.com/technique/T1095), [T1098.004](https://intel.threadlinqs.com/technique/T1098.004), [T1102.001](https://intel.threadlinqs.com/technique/T1102.001), [T1102.002](https://intel.threadlinqs.com/technique/T1102.002), [T1105](https://intel.threadlinqs.com/technique/T1105), [T1106](https://intel.threadlinqs.com/technique/T1106), [T1110](https://intel.threadlinqs.com/technique/T1110), [T1110.001](https://intel.threadlinqs.com/technique/T1110.001), [T1110.003](https://intel.threadlinqs.com/technique/T1110.003), [T1110.004](https://intel.threadlinqs.com/technique/T1110.004), [T1111](https://intel.threadlinqs.com/technique/T1111), [T1112](https://intel.threadlinqs.com/technique/T1112), [T1113](https://intel.threadlinqs.com/technique/T1113), [T1114.002](https://intel.threadlinqs.com/technique/T1114.002), [T1119](https://intel.threadlinqs.com/technique/T1119), [T1123](https://intel.threadlinqs.com/technique/T1123), [T1129](https://intel.threadlinqs.com/technique/T1129), [T1133](https://intel.threadlinqs.com/technique/T1133), [T1134.001](https://intel.threadlinqs.com/technique/T1134.001), [T1134.004](https://intel.threadlinqs.com/technique/T1134.004), [T1135](https://intel.threadlinqs.com/technique/T1135), [T1136.001](https://intel.threadlinqs.com/technique/T1136.001), [T1140](https://intel.threadlinqs.com/technique/T1140), [T1176](https://intel.threadlinqs.com/technique/T1176), [T1176.001](https://intel.threadlinqs.com/technique/T1176.001), [T1185](https://intel.threadlinqs.com/technique/T1185), [T1190](https://intel.threadlinqs.com/technique/T1190), [T1195.001](https://intel.threadlinqs.com/technique/T1195.001), [T1195.002](https://intel.threadlinqs.com/technique/T1195.002), [T1199](https://intel.threadlinqs.com/technique/T1199), [T1203](https://intel.threadlinqs.com/technique/T1203), [T1204.001](https://intel.threadlinqs.com/technique/T1204.001), [T1204.002](https://intel.threadlinqs.com/technique/T1204.002), [T1204.004](https://intel.threadlinqs.com/technique/T1204.004), [T1205](https://intel.threadlinqs.com/technique/T1205), [T1210](https://intel.threadlinqs.com/technique/T1210), [T1211](https://intel.threadlinqs.com/technique/T1211), [T1212](https://intel.threadlinqs.com/technique/T1212), [T1213](https://intel.threadlinqs.com/technique/T1213), [T1213.002](https://intel.threadlinqs.com/technique/T1213.002), [T1218.007](https://intel.threadlinqs.com/technique/T1218.007), [T1219](https://intel.threadlinqs.com/technique/T1219), [T1219.002](https://intel.threadlinqs.com/technique/T1219.002), [T1222.002](https://intel.threadlinqs.com/technique/T1222.002), [T1406](https://intel.threadlinqs.com/technique/T1406), [T1406.002](https://intel.threadlinqs.com/technique/T1406.002), [T1414](https://intel.threadlinqs.com/technique/T1414), [T1417.001](https://intel.threadlinqs.com/technique/T1417.001), [T1417.002](https://intel.threadlinqs.com/technique/T1417.002), [T1418](https://intel.threadlinqs.com/technique/T1418), [T1422](https://intel.threadlinqs.com/technique/T1422), [T1429](https://intel.threadlinqs.com/technique/T1429), [T1430](https://intel.threadlinqs.com/technique/T1430), [T1437.001](https://intel.threadlinqs.com/technique/T1437.001), [T1453](https://intel.threadlinqs.com/technique/T1453), [T1480](https://intel.threadlinqs.com/technique/T1480), [T1485](https://intel.threadlinqs.com/technique/T1485), [T1486](https://intel.threadlinqs.com/technique/T1486), [T1489](https://intel.threadlinqs.com/technique/T1489), [T1490](https://intel.threadlinqs.com/technique/T1490), [T1496.001](https://intel.threadlinqs.com/technique/T1496.001), [T1497.001](https://intel.threadlinqs.com/technique/T1497.001), [T1499](https://intel.threadlinqs.com/technique/T1499), [T1499.004](https://intel.threadlinqs.com/technique/T1499.004), [T1505.003](https://intel.threadlinqs.com/technique/T1505.003), [T1509](https://intel.threadlinqs.com/technique/T1509), [T1512](https://intel.threadlinqs.com/technique/T1512), [T1513](https://intel.threadlinqs.com/technique/T1513), [T1516](https://intel.threadlinqs.com/technique/T1516), [T1517](https://intel.threadlinqs.com/technique/T1517), [T1518](https://intel.threadlinqs.com/technique/T1518), [T1526](https://intel.threadlinqs.com/technique/T1526), [T1528](https://intel.threadlinqs.com/technique/T1528), [T1530](https://intel.threadlinqs.com/technique/T1530), [T1539](https://intel.threadlinqs.com/technique/T1539), [T1542](https://intel.threadlinqs.com/technique/T1542), [T1543](https://intel.threadlinqs.com/technique/T1543), [T1543.001](https://intel.threadlinqs.com/technique/T1543.001), [T1543.002](https://intel.threadlinqs.com/technique/T1543.002), [T1543.003](https://intel.threadlinqs.com/technique/T1543.003), [T1544](https://intel.threadlinqs.com/technique/T1544), T1546.008, [T1547.001](https://intel.threadlinqs.com/technique/T1547.001), [T1548](https://intel.threadlinqs.com/technique/T1548), [T1548.001](https://intel.threadlinqs.com/technique/T1548.001), [T1548.002](https://intel.threadlinqs.com/technique/T1548.002), [T1550.001](https://intel.threadlinqs.com/technique/T1550.001), [T1550.002](https://intel.threadlinqs.com/technique/T1550.002), [T1550.004](https://intel.threadlinqs.com/technique/T1550.004), [T1552](https://intel.threadlinqs.com/technique/T1552), [T1552.001](https://intel.threadlinqs.com/technique/T1552.001), [T1552.004](https://intel.threadlinqs.com/technique/T1552.004), [T1552.005](https://intel.threadlinqs.com/technique/T1552.005), [T1553](https://intel.threadlinqs.com/technique/T1553), [T1553.002](https://intel.threadlinqs.com/technique/T1553.002), [T1554](https://intel.threadlinqs.com/technique/T1554), [T1555](https://intel.threadlinqs.com/technique/T1555), [T1555.001](https://intel.threadlinqs.com/technique/T1555.001), [T1555.003](https://intel.threadlinqs.com/technique/T1555.003), [T1555.005](https://intel.threadlinqs.com/technique/T1555.005), [T1555.006](https://intel.threadlinqs.com/technique/T1555.006), [T1557](https://intel.threadlinqs.com/technique/T1557), [T1558.003](https://intel.threadlinqs.com/technique/T1558.003), [T1560.001](https://intel.threadlinqs.com/technique/T1560.001), [T1564.001](https://intel.threadlinqs.com/technique/T1564.001), [T1564.003](https://intel.threadlinqs.com/technique/T1564.003), [T1565](https://intel.threadlinqs.com/technique/T1565), [T1565.001](https://intel.threadlinqs.com/technique/T1565.001), [T1566](https://intel.threadlinqs.com/technique/T1566), [T1566.001](https://intel.threadlinqs.com/technique/T1566.001), [T1566.002](https://intel.threadlinqs.com/technique/T1566.002), [T1566.003](https://intel.threadlinqs.com/technique/T1566.003), [T1567](https://intel.threadlinqs.com/technique/T1567), [T1567.002](https://intel.threadlinqs.com/technique/T1567.002), [T1568](https://intel.threadlinqs.com/technique/T1568), [T1570](https://intel.threadlinqs.com/technique/T1570), [T1571](https://intel.threadlinqs.com/technique/T1571), [T1572](https://intel.threadlinqs.com/technique/T1572), [T1573.001](https://intel.threadlinqs.com/technique/T1573.001), [T1573.002](https://intel.threadlinqs.com/technique/T1573.002), [T1574](https://intel.threadlinqs.com/technique/T1574), [T1574.001](https://intel.threadlinqs.com/technique/T1574.001), [T1574.006](https://intel.threadlinqs.com/technique/T1574.006), [T1580](https://intel.threadlinqs.com/technique/T1580), [T1583.001](https://intel.threadlinqs.com/technique/T1583.001), [T1583.003](https://intel.threadlinqs.com/technique/T1583.003), [T1583.006](https://intel.threadlinqs.com/technique/T1583.006), [T1585.001](https://intel.threadlinqs.com/technique/T1585.001), [T1587](https://intel.threadlinqs.com/technique/T1587), [T1587.001](https://intel.threadlinqs.com/technique/T1587.001), [T1587.004](https://intel.threadlinqs.com/technique/T1587.004), [T1588.002](https://intel.threadlinqs.com/technique/T1588.002), [T1588.005](https://intel.threadlinqs.com/technique/T1588.005), [T1588.006](https://intel.threadlinqs.com/technique/T1588.006), [T1588.007](https://intel.threadlinqs.com/technique/T1588.007), [T1589](https://intel.threadlinqs.com/technique/T1589), [T1589.001](https://intel.threadlinqs.com/technique/T1589.001), [T1589.002](https://intel.threadlinqs.com/technique/T1589.002), [T1589.003](https://intel.threadlinqs.com/technique/T1589.003), T1590.002, [T1591.004](https://intel.threadlinqs.com/technique/T1591.004), [T1592](https://intel.threadlinqs.com/technique/T1592), [T1593.003](https://intel.threadlinqs.com/technique/T1593.003), [T1595.001](https://intel.threadlinqs.com/technique/T1595.001), [T1595.002](https://intel.threadlinqs.com/technique/T1595.002), [T1596.005](https://intel.threadlinqs.com/technique/T1596.005), [T1598](https://intel.threadlinqs.com/technique/T1598), [T1598.003](https://intel.threadlinqs.com/technique/T1598.003), [T1601](https://intel.threadlinqs.com/technique/T1601), [T1602.002](https://intel.threadlinqs.com/technique/T1602.002), T1604, [T1606](https://intel.threadlinqs.com/technique/T1606), [T1608.001](https://intel.threadlinqs.com/technique/T1608.001), [T1608.005](https://intel.threadlinqs.com/technique/T1608.005), [T1611](https://intel.threadlinqs.com/technique/T1611), [T1613](https://intel.threadlinqs.com/technique/T1613), [T1620](https://intel.threadlinqs.com/technique/T1620), [T1622](https://intel.threadlinqs.com/technique/T1622), [T1624.001](https://intel.threadlinqs.com/technique/T1624.001), [T1628.001](https://intel.threadlinqs.com/technique/T1628.001), T1628.002, T1629.001, [T1629.003](https://intel.threadlinqs.com/technique/T1629.003), T1633, [T1636.004](https://intel.threadlinqs.com/technique/T1636.004), T1642, [T1643](https://intel.threadlinqs.com/technique/T1643), [T1646](https://intel.threadlinqs.com/technique/T1646), [T1651](https://intel.threadlinqs.com/technique/T1651), [T1655.001](https://intel.threadlinqs.com/technique/T1655.001), [T1657](https://intel.threadlinqs.com/technique/T1657), [T1659](https://intel.threadlinqs.com/technique/T1659), [T1660](https://intel.threadlinqs.com/technique/T1660), T1663, [T1664](https://intel.threadlinqs.com/technique/T1664), [T1684.001](https://intel.threadlinqs.com/technique/T1684.001), [T1685](https://intel.threadlinqs.com/technique/T1685), [T1685.005](https://intel.threadlinqs.com/technique/T1685.005), [T1688](https://intel.threadlinqs.com/technique/T1688)

## Threat actors

[Gamaredon](https://intel.threadlinqs.com/actor/Gamaredon), [RootEvidence](https://intel.threadlinqs.com/actor/RootEvidence), [MuddyWater](https://intel.threadlinqs.com/actor/MuddyWater), [MiraxBot](https://intel.threadlinqs.com/actor/MiraxBot), [BOSSAI operator](https://intel.threadlinqs.com/actor/BOSSAI%20operator), [Hawkmoth](https://intel.threadlinqs.com/actor/Hawkmoth), [Nova](https://intel.threadlinqs.com/actor/Nova), [VOID MANTICORE - G1055](https://intel.threadlinqs.com/actor/VOID%20MANTICORE%20-%20G1055), [Interlock](https://intel.threadlinqs.com/actor/Interlock), [APT29](https://intel.threadlinqs.com/actor/APT29), [EVLF](https://intel.threadlinqs.com/actor/EVLF), [Vexy Ransomware](https://intel.threadlinqs.com/actor/Vexy%20Ransomware), [CRAFTY FALCON](https://intel.threadlinqs.com/actor/CRAFTY%20FALCON), [Storm-2603](https://intel.threadlinqs.com/actor/Storm-2603), [UMBRAL BISON](https://intel.threadlinqs.com/actor/UMBRAL%20BISON), [Kapibala](https://intel.threadlinqs.com/actor/Kapibala)

Nation-state attribution: China, Iran, Taiwan, Russia, Syria, Belarus

Threat categories: THREAT_INTEL, VULNERABILITY, APT, MALWARE, PHISHING, RANSOMWARE, DATA_BREACH

## Severity breakdown

- critical: 9
- high: 27
- medium: 9
- low: 1

## Indicator & detection coverage

Counts only; indicator values and detection rule text unlock per threat with TL Creds.

- Indicators of compromise: 969 (network 301, file 237, behavioral 86, entity 80, infrastructure 80, tool 74, malware 63, package 46, technique 2)
- New detection rules: 414 (100% of the day’s threats covered)

## More editions

- Previous: [2026-11-04](https://intel.threadlinqs.com/debrief/2026-11-04)
- Next: [2026-11-06](https://intel.threadlinqs.com/debrief/2026-11-06)
- [Archive of daily debriefs](https://intel.threadlinqs.com/debrief/archive)
- [Latest debrief](https://intel.threadlinqs.com/debrief)

Canonical: https://intel.threadlinqs.com/debrief/2026-11-05