Summary & highlights
NotC2: Proof-of-Concept Framework Abuses Amazon Bedrock, SQS, Lambda and SNS as Cloud Command-and-Control. NVIDIA Board Opens Independent Investigation into Reported Foreign Intelligence Targeting of CEO Jensen Huang. Corium: ClickFix Distribution and Campaign-Management Panel Advertised on Exploit.IN.
Highlights
- TL-2026-5524 — GHAPPIER Loader: npm Supply-Chain Compromise of @dforge-core/dforge-mcp 0.2.21 Beside DPRK-Linked PolinRider Campaign
- TL-2026-5526 — Credential-Theft and Remote Access Abuse: Infostealers, ClickFix, ScreenConnect RMM Abuse and AiTM Phishing (Elastic Security Labs, Nov 2026)
- TL-2026-5534 — SectopRAT delivered via GPULoader and VMLoader (GPU-based decryption, EtherHiding C2, FakeGuard AitM)
- TL-2026-5535 — Recorteiro: Rust banking trojan with 'Recort' screen-hole overlay fraud distributed via fake EnergiaLusa electricity bills in Portugal
- TL-2026-5537 — CastleLoader debuts in Red Canary top 10: paste-and-run delivery of NetSupport Manager, CastleRAT and .NET infostealer; KongTuke surge
Theme of the day
- credential-theft
- windows
- no-cve
- financial-motivation
- infostealer
Threats published
46 threat lines in the 2026-11-09 debrief, most severe first; entries marked (update) revise an earlier report. Each links to its full profile.
- Iranian-Affiliated Actors Exploit Internet-Exposed PLCs (Rockwell, Schneider, Siemens) in U.S. Critical Infrastructure (CISA AA26-097A)CRITICAL
- Web3Auth Infrastructure Flaw Exploited to Drain Keplr Wallets Created via Google/Apple Sign-in (Private Key Breach)CRITICAL
- Malicious @ethersphere/bee-js 13.3.0 npm Release and Swarm Desktop 0.56.2 Deliver SleepyDuck Ethereum C2 BackdoorCRITICAL
- Ethersphere bee-js 13.3.0 and Swarm Desktop 0.56.2 Supply-Chain Compromise Delivers Wallet-Stealing Malware and BackdoorsCRITICAL
- Able2Shell: 33 N-able N-central Vulnerabilities Chained into RCE and Root Privilege Escalation; N-able Takes Hosted Cloud OfflineCRITICAL
- CISA adds four KEVs: GPUStack CVE-2026-102895, SignalWire FreeSwitch CVE-2026-116779, OpenBSD OpenSSH CVE-2026-123158, IBM Aspera Faspex CVE-2026-123218CRITICAL
- CISA ICSA-26-307-01: Critical Authorization Bypass (CVE-2026-63017) and SQL Injection (CVE-2026-63774) in Subnet Solutions PowerSYSTEM CenterCRITICAL
- Malicious Cyber Activity Targeting Industrial Refrigeration and Cold Chain Monitoring Systems (Danfoss StoreView, Copeland/Dixell XWEB, Coolworld) (update)CRITICAL
- GHAPPIER Loader: npm Supply-Chain Compromise of @dforge-core/dforge-mcp 0.2.21 Beside DPRK-Linked PolinRider CampaignHIGH
- Credential-Theft and Remote Access Abuse: Infostealers, ClickFix, ScreenConnect RMM Abuse and AiTM Phishing (Elastic Security Labs, Nov 2026)HIGH
- SectopRAT delivered via GPULoader and VMLoader (GPU-based decryption, EtherHiding C2, FakeGuard AitM)HIGH
- Recorteiro: Rust banking trojan with 'Recort' screen-hole overlay fraud distributed via fake EnergiaLusa electricity bills in PortugalHIGH
- CastleLoader debuts in Red Canary top 10: paste-and-run delivery of NetSupport Manager, CastleRAT and .NET infostealer; KongTuke surgeHIGH
- FATF Targets Global Scam Compounds: Trafficked-Labor Fraud Operations Backed by Crypto, Instant Payments and AI-Enabled ContentHIGH
- Operation Snowball: Autonomous AI-Driven Intrusion Campaign Exploiting Cisco BroadWorks XSP (CVE-2026-20320) Against European TelecomHIGH
- GhostAction Supply Chain Campaign Expands: Malicious GitHub Actions Workflow Steals Cloud and AI Credentials from Tens of Thousands of RepositoriesHIGH
- ModSecurity WAF Vulnerabilities: Multipart filename* Upload Bypass (CVE-2026-104269) and XML Body Processor Uninitialized Pointer Dereference (CVE-2026-73857)HIGH
- WidzialniCMS < 2.5 unauthenticated file upload RCE (CVE-2026-110468, CVE-2026-110469) plus reflected XSS (CVE-2026-112204) and login lockout bypass (CVE-2026-112205)HIGH
- ForgeRock Attack Chain: Default admin:admin Felix Console Credentials and WAF Path-Encoding Bypass Lead to RCE and Remote Vehicle Unlock at Two AutomakersHIGH
- Remus Infostealer 1.3.9 Markets Persistent Gmail Access Feature (Enterprise Tier)HIGH
- Alleged AI-aided attack exploits MCP server flaw to breach German web host Mittwald (56 customer projects compromised)HIGH
- Copeland XWEB PRO refrigeration controllers abused for spam botnet, proxy/tunnel traffic and default-credential setpoint tampering (CVE-2026-25085 suspected entry point)HIGH
- Qubole Cross-Account Access Abused in the Wild: AWS Integration Role Assumption CampaignHIGH
- Abe Office (AbeAgent.exe): Signed Modular RAT/Stealer Bypassing Chrome and Edge App-Bound Encryption via Hidden-Desktop Browser and Elevation Service AbuseHIGH
- Windows Dangling COM Object Registration Local Privilege Escalation (CVE-2026-66804, incomplete fix for CVE-2026-50343 'Dark Elevator')HIGH
- Beget (Russian Cloud and Hosting Provider) Hit by Destructive Data-Wiper Attack via Compromised Management LayerHIGH
- LNbits Operators Urged to Shut Down Bitcoin Lightning Wallet Servers Amid Active Attacks via Extension ExploitHIGH
- Vanderbilt University hit in BYOD ransomware attack, data theft claimedHIGH
- Google Chrome XML Use-After-Free Zero-Day Exploited in the Wild (CVE-2026-125350)HIGH
- Second Wave of Attacks on European Supermarket Refrigeration Controllers (Danfoss AK-SM/AK-SC, Copeland/Dixell XWEB) Forces Defrost Mode (update)HIGH
- PolinRider Loader Reappears in Hijacked npm Packages (12 malicious releases across 10 packages) (update)HIGH
- Threat actors use agentic AI tooling (ARTEX) to find and abuse exposed secrets in GitHub and Azure (update)HIGH
- NotC2: Proof-of-Concept Framework Abuses Amazon Bedrock, SQS, Lambda and SNS as Cloud Command-and-ControlMEDIUM
- NVIDIA Board Opens Independent Investigation into Reported Foreign Intelligence Targeting of CEO Jensen HuangMEDIUM
- Corium: ClickFix Distribution and Campaign-Management Panel Advertised on Exploit.INMEDIUM
- Large-Scale Tech Support Scam Email Campaign Targeting Users and Organizations in Japan (13M+ Emails)MEDIUM
- Binance denies data breach after alleged ShinyHunters-branded data sale claim (335M user records)MEDIUM
- Vidar Infostealer Adds Custom VM and Per-Build Stream Ciphers for String ObfuscationMEDIUM
- "Office Party" flaw in Anthropic Claude DOCX/PPTX/XLSX skills (soffice.py LD_PRELOAD shim) enables code execution on LinuxMEDIUM
- Vexy Ransomware claims Albion Online Data Project (16 GB exfiltrated)MEDIUM
- Vexy Ransomware lists Living Word Schools (US education) as victimMEDIUM
- York University (Toronto) data breach exposes personal information submitted via 14 departmental web forms (2007-2026)MEDIUM
- AI Reward Hacking and Autonomous Sandbox Escape: OpenAI ExploitGym Evaluation Models Breach Hugging Face (Schneier DEF CON 34 Keynote Op-Ed)MEDIUM
- BluePhishing: Initial Access via Third-Party Agent Blueprint Consent (Microsoft Entra Agent ID)MEDIUM
- Infostealer Activity Weekly Report (2026-11-02 to 2026-11-09): 12,382 Compromised Machines, Lumma/Warden/VidarMEDIUM
- Insider Threat: FBI Supervisory Special Agent Pleads Guilty to Stealing $2.4M in Crypto Seized from Nation-State Hackers and Crime Victims (update)MEDIUM
Techniques observed
231 MITRE ATT&CK and ATLAS techniques appear across the day’s reports.
- T0812
- T0813
- T0815
- T0822
- T0826
- T0827
- T0828
- T0829
- T0831
- T0832
- T0836
- T0855
- T0859
- T0878
- T0879
- T0883
- T0886
- T0888
- T1003.003
- T1003.008
- T1005
- T1008
- T1020
- T1021
- T1021.002
- T1021.004
- T1027
- T1027.001
- T1027.002
- T1027.004
- T1027.013
- T1033
- T1036
- T1036.004
- T1036.005
- T1036.008
- T1037.004
- T1041
- T1046
- T1047
- T1048.003
- T1053
- T1053.003
- T1053.005
- T1055
- T1056.001
- T1057
- T1059
- T1059.001
- T1059.002
- T1059.003
- T1059.004
- T1059.005
- T1059.006
- T1059.007
- T1059.009
- T1068
- T1069.003
- T1070
- T1070.004
- T1071
- T1071.001
- T1072
- T1078
- T1078.001
- T1078.002
- T1078.004
- T1082
- T1083
- T1087
- T1087.004
- T1090
- T1090.003
- T1095
- T1098
- T1098.001
- T1098.004
- T1098.005
- T1102.001
- T1102.002
- T1105
- T1106
- T1110
- T1110.001
- T1110.002
- T1110.003
- T1110.004
- T1112
- T1113
- T1114
- T1114.002
- T1115
- T1119
- T1132.002
- T1133
- T1134.001
- T1134.002
- T1136
- T1136.001
- T1136.003
- T1140
- T1176
- T1176.001
- T1185
- T1189
- T1190
- T1195
- T1195.002
- T1199
- T1203
- T1204.001
- T1204.002
- T1204.004
- T1210
- T1211
- T1212
- T1213
- T1213.002
- T1213.003
- T1217
- T1218.011
- T1219
- T1219.002
- T1480.001
- T1484.001
- T1485
- T1486
- T1489
- T1490
- T1491.001
- T1496
- T1496.002
- T1497
- T1497.001
- T1499.004
- T1505
- T1505.003
- T1518.001
- T1526
- T1528
- T1529
- T1530
- T1539
- T1543.001
- T1543.002
- T1543.003
- T1546.003
- T1546.015
- T1547.001
- T1548
- T1548.002
- T1548.003
- T1550.001
- T1550.002
- T1550.004
- T1552
- T1552.001
- T1552.004
- T1552.005
- T1553.001
- T1553.002
- T1553.004
- T1553.005
- T1554
- T1555
- T1555.001
- T1555.003
- T1555.006
- T1557
- T1558.003
- T1559.001
- T1560
- T1560.001
- T1561
- T1562.003
- T1564.003
- T1565
- T1565.001
- T1566
- T1566.002
- T1566.003
- T1567
- T1568
- T1569.002
- T1571
- T1572
- T1573
- T1573.001
- T1574
- T1574.001
- T1574.006
- T1580
- T1583.001
- T1583.003
- T1583.006
- T1583.008
- T1584.005
- T1584.008
- T1585
- T1585.001
- T1587.004
- T1588.002
- T1588.003
- T1588.005
- T1588.007
- T1589
- T1589.002
- T1591
- T1593.003
- T1595
- T1595.001
- T1595.002
- T1596.005
- T1598
- T1608
- T1608.001
- T1608.004
- T1608.006
- T1613
- T1614
- T1619
- T1620
- T1622
- T1648
- T1651
- T1657
- T1659
- T1671
- T1684.001
- T1685
- T1686
Threat actors
11 named threat actors across the reports.
- Cassiopeia
- Vexy Ransomware
- Autonomous AI Agent
- GrayBravo
- BYOD
- Iranian-affiliated actors
- SleepyDuck
- Patrick Steven Yaroch
- IRGC Cyber-Electronic Command - Shahid Kaveh (attributed by French authorities)
- PolinRider operators
- Shahid Kaveh (CyberAv3ngers)
Nation-state attribution
- Iran
- North Korea
Threat categories
- MALWARE
- THREAT_INTEL
- PHISHING
- DATA_BREACH
- VULNERABILITY
- RANSOMWARE
- SUPPLY_CHAIN
- ICS_SCADA
- CLOUD
Severity breakdown
- critical8
- high24
- medium14
- low0
Indicator & detection coverage
Counts only: the indicator values and detection rule text behind them unlock with TL Creds.
922 indicators of compromise · unlock with TL Creds. Compare plans
- network 270
- file 187
- behavioral 128
- infrastructure 102
- entity 96
- tool 56
- package 42
- malware 41
414 new detection rules (100% of the day’s threats covered) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)