Threadlinqs IntelligenceStart free

Daily debrief · Tuesday2026-11-10

Daily Intelligence Briefing — Tuesday, November 10, 2026

10 critical32 high9 medium1 low

On 2026-11-10, Threadlinqs published 49 new threat reports and updated 4, 10 rated critical and 32 high, spanning 265 MITRE ATT&CK techniques and 19 named threat actors. Coverage that day added 477 new detection rules and 1129 extracted indicators.

New threats
494 updated
Critical / high
4210 critical · 32 high
ATT&CK techniques
265Observed in the day’s reports
Threat actors
19Named in the reports
Indicators
1129Count only · values are Red+
Detection rules
477New that day · rule text is Blue+

Edition date: · Last updated:

Summary & highlights

Notepad++ 8.9.9 Fixes 6 Vulnerabilities (Local Privilege Escalation, Command Dispatch, Heap Overflows in MIME Tools) - No CVEs Assigned. Malicious npm package tw-pkgprobe-7731 targets developers integrating Twilio (credential harvesting). iVerify Advanced Mobile Threat Report 2026: Mobile Spyware Shifts Toward Everyday Users as Criminal Groups Fork Leaked iOS Exploit Kits for Credential and Crypto Theft.

Highlights

  • TL-2026-5613 — RevStealer Windows Infostealer (Elastic REF2859) Uses 14 Indirect Syscalls and EtherHiding C2 to Steal Browser and Wallet Credentials
  • TL-2026-5615 — AI-agent-coordinated attacks and 575+ malicious OpenClaw skills delivering malware (Acronis TRU Cyber Pulse 2026)
  • TL-2026-5623 — Vortex ransomware group claims Scripps (US healthcare) on leak site
  • TL-2026-5625 — RevStealer (REF2859) Infostealer Spread via 100+ Domains, Hijacked YouTube Channels and Fake AI/Cheat Tools
  • TL-2026-5626 — Operation Ghost Campus: AI Agents Steal OpenAI and DeepSeek API Keys From Exposed Servers and Harvest Data of 5,132 Chinese Students

Theme of the day

Today's threat activity centered on exploited edge and management infrastructure, including N-able N-central and GPUStack flaws added to CISA KEV, and Operation Snowball abusing Cisco BroadWorks. Identity-focused attacks against Microsoft Entra ID, Windows privilege escalation, and infostealers also featured prominently.

  • credential-theft
  • windows
  • ransomware
  • cisa-kev
  • authentication-bypass

Threats published

53 threat lines in the 2026-11-10 debrief, most severe first; entries marked (update) revise an earlier report. Each links to its full profile.

Techniques observed

265 MITRE ATT&CK and ATLAS techniques appear across the day’s reports.

Threat actors

19 named threat actors across the reports.

Nation-state attribution

  • Russia
  • North Korea
  • China

Threat categories

  • VULNERABILITY
  • SUPPLY_CHAIN
  • MALWARE
  • RANSOMWARE
  • PHISHING
  • DATA_BREACH
  • THREAT_INTEL
  • APT
  • CLOUD

Severity breakdown

  • critical10
  • high32
  • medium9
  • low1

Indicator & detection coverage

Counts only: the indicator values and detection rule text behind them unlock with TL Creds.

1129 indicators of compromise · unlock with TL Creds. Compare plans
  • network 373
  • file 335
  • infrastructure 100
  • behavioral 87
  • malware 75
  • entity 62
  • package 52
  • tool 45
477 new detection rules (100% of the day’s threats covered) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)