# Daily Intelligence Briefing — Wednesday, November 11, 2026

> On 2026-11-11, Threadlinqs published 55 new threat reports and updated 4, 14 rated critical and 33 high, spanning 222 MITRE ATT&CK techniques and 12 named threat actors. Coverage that day added 531 new detection rules and 1072 extracted indicators.

- **Edition:** 2026-11-11 (Wednesday)
- **Canonical:** https://intel.threadlinqs.com/debrief/2026-11-11
- **Last updated:** 2026-11-12
- **New threats:** 55 (4 updated)
- **Critical / high:** 14 critical, 33 high, 10 medium, 1 low
- **ATT&CK techniques:** 222
- **Threat actors:** 12
- **Indicators (count only):** 1072
- **New detection rules (count only):** 531

## Summary & highlights

Apple Bluetooth/AirPlay Pairing Vulnerabilities Patched Across Apple Platforms (CVE-2026-113968, CVE-2026-113969, CVE-2026-113964, CVE-2026-113965, CVE-2026-113970). Microsoft Research 'Lazarus' Technique: Backdooring AI Agents by Editing Fewer Than 10 Model Neurons (Model Supply-Chain Risk). Unpatched and end-of-support software on Windows endpoints exposes KEV-listed vulnerabilities (Acronis TRU telemetry; CVE-2023-38831, CVE-2026-59265).

- [TL-2026-5729](https://intel.threadlinqs.com/threat/TL-2026-5729) — Linux kernel net/sched action-IDR use-after-free LPE (CVE-2026-53264) and perf/aux page-UAF LPE (CVE-2026-64300) with public exploit
- [TL-2026-5734](https://intel.threadlinqs.com/threat/TL-2026-5734) — Cisco BroadWorks XXE (CVE-2026-20320) and Openwave Messaging Webtop Media Transcoder (CVE-2026-111793) Actively Exploited; Added to CISA KEV
- [TL-2026-5737](https://intel.threadlinqs.com/threat/TL-2026-5737) — Intel Slim Bootloader Multiple Vulnerabilities (INTEL-SA-01526) - CVE-2026-50175, CVE-2026-35500, CVE-2026-41221, CVE-2026-41224, CVE-2026-44624, CVE-2026-28746
- [TL-2026-5739](https://intel.threadlinqs.com/threat/TL-2026-5739) — Windows Active Directory RCE Vulnerability (CVE-2026-119948) Allows Code Execution Over a Network
- [TL-2026-5741](https://intel.threadlinqs.com/threat/TL-2026-5741) — Imperial Kitten (Tortoiseshell / UNC1549 / Nimbus Manticore) Iranian IRGC-linked APT: TWOSTROKE, MINIBIKE/MiniJunk, LIGHTRAIL, TRUSTTRAP Targeting Aerospace, Defense and IT

## Theme of the day

Posture stayed SEVERE at 22/25, led by exploited zero-days in Chrome and Outlook, KEV-listed edge and PLM flaws, and the GhostFrame ESXi implant. AI supply-chain abuse, credential theft, and authentication bypasses rounded out the day's active threats.

windows, remote-code-execution, supply-chain, privilege-escalation, no-known-exploitation

## Threats published

- [TL-2026-5745](https://intel.threadlinqs.com/threat/TL-2026-5745) — CRITICAL — Intel and AMD November 2026 Patch Tuesday: 200+ vulnerabilities incl. critical TDX MigTD flaws (CVE-2026-61887, CVE-2026-44685, CVE-2026-61473)
- [TL-2026-5770](https://intel.threadlinqs.com/threat/TL-2026-5770) — CRITICAL — Ivanti EPM SQLi RCE (CVE-2026-121653) and CSA Missing Authentication (CVE-2026-121683); Citrix XenServer and Ivanti Sentry/EPMM Patches
- [TL-2026-5783](https://intel.threadlinqs.com/threat/TL-2026-5783) — CRITICAL — Critical Zoom Workplace for Windows Flaws (CVE-2026-108186, CVE-2026-108187) Allow Unauthenticated Remote Privilege Escalation
- [TL-2026-5794](https://intel.threadlinqs.com/threat/TL-2026-5794) — CRITICAL — N-able N-central: 33 Alleged Zero-Day Vulnerabilities Published with PoC ("Able2Shell" XXE-to-RCE chain); Platform Taken Offline
- [TL-2026-5795](https://intel.threadlinqs.com/threat/TL-2026-5795) — CRITICAL — Axis Camera Station and Camera Station Pro: Multiple Vulnerabilities (CVE-2026-13312, CVE-2026-12389, CVE-2026-12964 and others)
- [TL-2026-5797](https://intel.threadlinqs.com/threat/TL-2026-5797) — CRITICAL — CVE-2026-119618: Critical Unauthenticated RCE via Race Condition in Apache HTTP Server mod_http2 assign_headers()
- [TL-2026-5801](https://intel.threadlinqs.com/threat/TL-2026-5801) — CRITICAL — Zoom Workplace for Windows Critical Privilege Escalation (CVE-2026-108186, CVE-2026-108187) and ASUS Router Firmware Remote File Access Vulnerabilities (CVE-2026-88707 to CVE-2026-88710) Patched
- [TL-2026-5802](https://intel.threadlinqs.com/threat/TL-2026-5802) — CRITICAL — Fortinet2Shell: FortiClient Local API Origin Validation Flaw Enables Code Execution via Malicious Websites (CVE-2026-121529)
- [TL-2026-5803](https://intel.threadlinqs.com/threat/TL-2026-5803) — CRITICAL — CVE-2026-118383: Use-after-free vulnerability in MongoDB Server (replica set primary catch-up)
- [TL-2026-5814](https://intel.threadlinqs.com/threat/TL-2026-5814) — CRITICAL — Cisco Secure FMC Exploitation (CVE-2026-20079, CVE-2026-20316) by Qilin Affiliate UAT-11988 and Sandworm-Linked UAT-11823, with ScreenConnect (CVE-2026-84869) and PaperCut (CVE-2026-81578/82078) Management-Layer Exploitation
- [TL-2026-5815](https://intel.threadlinqs.com/threat/TL-2026-5815) — CRITICAL — Compromised GitHub Accounts Push CI Secret Stealer to Tens of Thousands of Repositories (November 2026 Wave)
- [TL-2026-5585](https://intel.threadlinqs.com/threat/TL-2026-5585) — CRITICAL — Able2Shell: 33 N-able N-central Vulnerabilities Chained into RCE and Root Privilege Escalation; N-able Takes Hosted Cloud Offline (update)
- [TL-2026-5681](https://intel.threadlinqs.com/threat/TL-2026-5681) — CRITICAL — Microsoft November 2026 Patch Tuesday (1,093 bugs) - Exploited Outlook CVE-2026-124194, Barracuda CVE-2026-116606/CVE-2026-111560 (CISA-directed), N-able N-central PoC scanning (update)
- [TL-2026-5711](https://intel.threadlinqs.com/threat/TL-2026-5711) — CRITICAL — Microsoft Patch Tuesday November 2026: ~1,095 vulnerabilities, 64 critical, one exploited Outlook NTLM-leak spoofing zero-day (CVE-2026-124194) (update)
- [TL-2026-5729](https://intel.threadlinqs.com/threat/TL-2026-5729) — HIGH — Linux kernel net/sched action-IDR use-after-free LPE (CVE-2026-53264) and perf/aux page-UAF LPE (CVE-2026-64300) with public exploit
- [TL-2026-5734](https://intel.threadlinqs.com/threat/TL-2026-5734) — HIGH — Cisco BroadWorks XXE (CVE-2026-20320) and Openwave Messaging Webtop Media Transcoder (CVE-2026-111793) Actively Exploited; Added to CISA KEV
- [TL-2026-5737](https://intel.threadlinqs.com/threat/TL-2026-5737) — HIGH — Intel Slim Bootloader Multiple Vulnerabilities (INTEL-SA-01526) - CVE-2026-50175, CVE-2026-35500, CVE-2026-41221, CVE-2026-41224, CVE-2026-44624, CVE-2026-28746
- [TL-2026-5739](https://intel.threadlinqs.com/threat/TL-2026-5739) — HIGH — Windows Active Directory RCE Vulnerability (CVE-2026-119948) Allows Code Execution Over a Network
- [TL-2026-5741](https://intel.threadlinqs.com/threat/TL-2026-5741) — HIGH — Imperial Kitten (Tortoiseshell / UNC1549 / Nimbus Manticore) Iranian IRGC-linked APT: TWOSTROKE, MINIBIKE/MiniJunk, LIGHTRAIL, TRUSTTRAP Targeting Aerospace, Defense and IT
- [TL-2026-5748](https://intel.threadlinqs.com/threat/TL-2026-5748) — HIGH — Local Privilege Escalation in Iperius Backup 8.8.3 for Windows via Elevated GUI Native Dialogs (CVE-2026-112174)
- [TL-2026-5751](https://intel.threadlinqs.com/threat/TL-2026-5751) — HIGH — CVE-2024-0244 – Unauthenticated Heap Buffer Overflow in Canon MF753Cdw Printer (Fax Job Handling, /wsd/print)
- [TL-2026-5752](https://intel.threadlinqs.com/threat/TL-2026-5752) — HIGH — Citrus Ransomware: VLESS tunnels, Sn00py encryption and LLM-assisted scripting (CVE-2026-54121, CVE-2020-1337)
- [TL-2026-5754](https://intel.threadlinqs.com/threat/TL-2026-5754) — HIGH — ClickFix Attacks Evolve: Malware Hidden in PNG Images and Windows Domain Controller Compromise (Huntress)
- [TL-2026-5756](https://intel.threadlinqs.com/threat/TL-2026-5756) — HIGH — Silent Lynx (UAT-6275 / TAG-193) exposed server: Laplas/Chvost implants and AI-agent-driven intrusions against Tajikistan railway and EDO, Uzbekistan Smart Forestry, and Turkmenistan-themed lures
- [TL-2026-5759](https://intel.threadlinqs.com/threat/TL-2026-5759) — HIGH — CRAFTY FALCON: AI-Assisted Financial Threat Actor Targeting Indian BFSI (CERT-In CIAD-2026-0058)
- [TL-2026-5769](https://intel.threadlinqs.com/threat/TL-2026-5769) — HIGH — Git Fixes 6 Vulnerabilities Enabling Code Execution via Cloned Repositories (CVE-2026-111760 et al.)
- [TL-2026-5771](https://intel.threadlinqs.com/threat/TL-2026-5771) — HIGH — Windows SignDrop 0-Day: CLFS (clfs.sys) Local Privilege Escalation to SYSTEM with Public PoC (No CVE Assigned)
- [TL-2026-5775](https://intel.threadlinqs.com/threat/TL-2026-5775) — HIGH — Qlik Sense Servers Targeted With PowerShell/Go Reverse Shells; ActiveMQ (CVE-2023-46604) and Veeam (CVE-2024-40711) Exploits Staged
- [TL-2026-5776](https://intel.threadlinqs.com/threat/TL-2026-5776) — HIGH — AI Is Both Target and Tool for Threat Actors: AI-Involved Supply-Chain, Malware and Extortion Trends (Insikt Group, Jul 2025 - Jul 2026)
- [TL-2026-5777](https://intel.threadlinqs.com/threat/TL-2026-5777) — HIGH — AntiFox agentic AI pentest platform (ARTEX fork) abused in IIS webshell to AWS credential-theft intrusions
- [TL-2026-5779](https://intel.threadlinqs.com/threat/TL-2026-5779) — HIGH — Falcon (XG / Xiàng Gē) Browser-Based C2 Framework and Antino Implant Targeting Government Webmail and Web Applications
- [TL-2026-5781](https://intel.threadlinqs.com/threat/TL-2026-5781) — HIGH — Maersk confirms data breach of legacy OCF/LF Logistics system as WhiteArmor ransomware demands $5 million
- [TL-2026-5782](https://intel.threadlinqs.com/threat/TL-2026-5782) — HIGH — North Korean Contagious Interview (WaterPlum) Campaign Compromises 30,000+ Devices, Steals $10.71M in Crypto
- [TL-2026-5785](https://intel.threadlinqs.com/threat/TL-2026-5785) — HIGH — QuoIntelligence Weekly Snapshot W39 2026: ClickFix/Exvicy, Graphalgo Go RAT, RemControl Android trojan, Windows Defender zero-day exploit (Nightmare Eclipse)
- [TL-2026-5786](https://intel.threadlinqs.com/threat/TL-2026-5786) — HIGH — Iran-Backed Network (IRGC / Kataib Hezbollah / HAYI) Directed London and European Attacks over FaceTime
- [TL-2026-5787](https://intel.threadlinqs.com/threat/TL-2026-5787) — HIGH — Qilin Ransomware-as-a-Service Group: Leadership Attribution (Haise / Rjun / Alexbigboss44) and Most Active Affiliate Program
- [TL-2026-5796](https://intel.threadlinqs.com/threat/TL-2026-5796) — HIGH — Threat actors weaponizing GSocket (gs-netcat) for stealthy C2 and persistence on compromised Linux web servers (CVE-2026-43284 LPE attempts)
- [TL-2026-5804](https://intel.threadlinqs.com/threat/TL-2026-5804) — HIGH — Baker Tilly Advisory Group client data breach via unnamed third-party service provider platform
- [TL-2026-5806](https://intel.threadlinqs.com/threat/TL-2026-5806) — HIGH — Active ScreenConnect Attacks Breach MSPs via Run Command, Deploying Rogue ScreenConnect Clients Across Dozens of Organizations
- [TL-2026-5807](https://intel.threadlinqs.com/threat/TL-2026-5807) — HIGH — Multiple Windows Remote Desktop Client Vulnerabilities Allow Code Execution (CVE-2026-119934, CVE-2026-119858, CVE-2026-119390, CVE-2026-95964)
- [TL-2026-5808](https://intel.threadlinqs.com/threat/TL-2026-5808) — HIGH — Software Supply Chain Attacks Weaponizing Trusted Developer Workflows (Shai-Hulud, Miasma, Hades, TeamPCP)
- [TL-2026-5809](https://intel.threadlinqs.com/threat/TL-2026-5809) — HIGH — OpenCode Remote Code Execution via /global/upgrade Content-Type Confusion and Cross-Site Request (GHSA-632h-h47v-g4x4)
- [TL-2026-5812](https://intel.threadlinqs.com/threat/TL-2026-5812) — HIGH — Dirty Cert: Cisco Smart Software Manager Silently Patched Post-Auth RCE via Certificate Upload (no CVE stated)
- [TL-2026-5819](https://intel.threadlinqs.com/threat/TL-2026-5819) — HIGH — Abuse of legitimate RMM and remote access tools (MeshAgent, ScreenConnect, Ammyy Admin, RDP): Acronis TRU analysis of RMM tool risk for SMBs, incl. CVE-2024-1709
- [TL-2026-5820](https://intel.threadlinqs.com/threat/TL-2026-5820) — HIGH — Microsoft Teams Phishing via Fake IT Helpdesk Impersonation (External Tenant Social Engineering)
- [TL-2026-5823](https://intel.threadlinqs.com/threat/TL-2026-5823) — HIGH — SCKit Campaign: Rogue ScreenConnect Clients Deployed Across 288 Devices at 48 Organizations via Hijacked ScreenConnect Panels and RMM+ Extension
- [TL-2026-5611](https://intel.threadlinqs.com/threat/TL-2026-5611) — HIGH — Google Chrome XML Use-After-Free Zero-Day Exploited in the Wild (CVE-2026-125350) (update)
- [TL-2026-5738](https://intel.threadlinqs.com/threat/TL-2026-5738) — MEDIUM — Apple Bluetooth/AirPlay Pairing Vulnerabilities Patched Across Apple Platforms (CVE-2026-113968, CVE-2026-113969, CVE-2026-113964, CVE-2026-113965, CVE-2026-113970)
- [TL-2026-5740](https://intel.threadlinqs.com/threat/TL-2026-5740) — MEDIUM — Microsoft Research 'Lazarus' Technique: Backdooring AI Agents by Editing Fewer Than 10 Model Neurons (Model Supply-Chain Risk)
- [TL-2026-5749](https://intel.threadlinqs.com/threat/TL-2026-5749) — MEDIUM — Unpatched and end-of-support software on Windows endpoints exposes KEV-listed vulnerabilities (Acronis TRU telemetry; CVE-2023-38831, CVE-2026-59265)
- [TL-2026-5758](https://intel.threadlinqs.com/threat/TL-2026-5758) — MEDIUM — ~45 Open-Source AI Hacking Frameworks Mapped; Hundreds of Agent Attack Consoles Exposed Online (ARTEX Family)
- [TL-2026-5788](https://intel.threadlinqs.com/threat/TL-2026-5788) — MEDIUM — MCP Server Supply Chain Weaknesses (uvx/npx Unpinned Dependencies) Could Expose API Keys and Administrator Credentials
- [TL-2026-5791](https://intel.threadlinqs.com/threat/TL-2026-5791) — MEDIUM — eBPF Rootkits Gaining Traction on Underground Forums (Flare research; BPFDoor, Symbiote, LinkPro, CVE-2017-16995 reposts)
- [TL-2026-5792](https://intel.threadlinqs.com/threat/TL-2026-5792) — MEDIUM — Apple Libnotify/notifyd Stack-Based Buffer Overflow (CVE-2026-64739)
- [TL-2026-5810](https://intel.threadlinqs.com/threat/TL-2026-5810) — MEDIUM — Why SBOMs Are Failing to Stop Supply Chain Attacks: XZ Utils Backdoor (CVE-2024-3094) and Axios npm Compromise (March 2026) as Case Studies
- [TL-2026-5811](https://intel.threadlinqs.com/threat/TL-2026-5811) — MEDIUM — Lazarus: Weight-Space Backdoor Technique Hidden in Dormant AI Model Neurons (Microsoft Research)
- [TL-2026-5821](https://intel.threadlinqs.com/threat/TL-2026-5821) — MEDIUM — 2026 FIFA World Cup Scam Wave: 35,000+ Fake Ticket, Shop and Streaming Sites
- [TL-2026-5798](https://intel.threadlinqs.com/threat/TL-2026-5798) — LOW — Utility Impostor Scams: Lookalike Domains, Scam Ads and Phishing-as-a-Service (Darcula V3) Targeting Utility Customers
- [TL-2026-5730](https://intel.threadlinqs.com/threat/TL-2026-5730) — INFO — Vulnerability backlog risk: nearly half of large-enterprise security teams close or deprioritize unverified findings (ProjectDiscovery survey)

## Techniques observed

AML.T0010, AML.T0018, AML.T0050, [AML.T0051](https://intel.threadlinqs.com/technique/AML.T0051), [T1003](https://intel.threadlinqs.com/technique/T1003), [T1003.003](https://intel.threadlinqs.com/technique/T1003.003), [T1003.006](https://intel.threadlinqs.com/technique/T1003.006), [T1003.008](https://intel.threadlinqs.com/technique/T1003.008), [T1005](https://intel.threadlinqs.com/technique/T1005), [T1008](https://intel.threadlinqs.com/technique/T1008), [T1014](https://intel.threadlinqs.com/technique/T1014), [T1018](https://intel.threadlinqs.com/technique/T1018), [T1021.001](https://intel.threadlinqs.com/technique/T1021.001), [T1021.002](https://intel.threadlinqs.com/technique/T1021.002), [T1021.004](https://intel.threadlinqs.com/technique/T1021.004), [T1021.006](https://intel.threadlinqs.com/technique/T1021.006), [T1027](https://intel.threadlinqs.com/technique/T1027), [T1027.003](https://intel.threadlinqs.com/technique/T1027.003), [T1027.004](https://intel.threadlinqs.com/technique/T1027.004), [T1027.007](https://intel.threadlinqs.com/technique/T1027.007), [T1033](https://intel.threadlinqs.com/technique/T1033), [T1036](https://intel.threadlinqs.com/technique/T1036), [T1036.004](https://intel.threadlinqs.com/technique/T1036.004), [T1036.005](https://intel.threadlinqs.com/technique/T1036.005), [T1036.007](https://intel.threadlinqs.com/technique/T1036.007), [T1037.004](https://intel.threadlinqs.com/technique/T1037.004), [T1039](https://intel.threadlinqs.com/technique/T1039), [T1040](https://intel.threadlinqs.com/technique/T1040), [T1046](https://intel.threadlinqs.com/technique/T1046), [T1048](https://intel.threadlinqs.com/technique/T1048), [T1053.003](https://intel.threadlinqs.com/technique/T1053.003), [T1053.005](https://intel.threadlinqs.com/technique/T1053.005), [T1055](https://intel.threadlinqs.com/technique/T1055), [T1055.012](https://intel.threadlinqs.com/technique/T1055.012), [T1056.001](https://intel.threadlinqs.com/technique/T1056.001), [T1056.002](https://intel.threadlinqs.com/technique/T1056.002), [T1056.003](https://intel.threadlinqs.com/technique/T1056.003), [T1057](https://intel.threadlinqs.com/technique/T1057), [T1059](https://intel.threadlinqs.com/technique/T1059), [T1059.001](https://intel.threadlinqs.com/technique/T1059.001), [T1059.003](https://intel.threadlinqs.com/technique/T1059.003), [T1059.004](https://intel.threadlinqs.com/technique/T1059.004), [T1059.005](https://intel.threadlinqs.com/technique/T1059.005), [T1059.006](https://intel.threadlinqs.com/technique/T1059.006), [T1059.007](https://intel.threadlinqs.com/technique/T1059.007), [T1068](https://intel.threadlinqs.com/technique/T1068), [T1069.002](https://intel.threadlinqs.com/technique/T1069.002), [T1070](https://intel.threadlinqs.com/technique/T1070), [T1070.003](https://intel.threadlinqs.com/technique/T1070.003), [T1070.004](https://intel.threadlinqs.com/technique/T1070.004), [T1070.006](https://intel.threadlinqs.com/technique/T1070.006), T1070.007, [T1071](https://intel.threadlinqs.com/technique/T1071), [T1071.001](https://intel.threadlinqs.com/technique/T1071.001), [T1071.004](https://intel.threadlinqs.com/technique/T1071.004), [T1072](https://intel.threadlinqs.com/technique/T1072), [T1074.001](https://intel.threadlinqs.com/technique/T1074.001), [T1078](https://intel.threadlinqs.com/technique/T1078), [T1078.001](https://intel.threadlinqs.com/technique/T1078.001), [T1078.003](https://intel.threadlinqs.com/technique/T1078.003), [T1078.004](https://intel.threadlinqs.com/technique/T1078.004), [T1082](https://intel.threadlinqs.com/technique/T1082), [T1087](https://intel.threadlinqs.com/technique/T1087), [T1087.002](https://intel.threadlinqs.com/technique/T1087.002), [T1087.004](https://intel.threadlinqs.com/technique/T1087.004), [T1090](https://intel.threadlinqs.com/technique/T1090), [T1090.002](https://intel.threadlinqs.com/technique/T1090.002), [T1090.003](https://intel.threadlinqs.com/technique/T1090.003), [T1095](https://intel.threadlinqs.com/technique/T1095), [T1098](https://intel.threadlinqs.com/technique/T1098), [T1102.001](https://intel.threadlinqs.com/technique/T1102.001), [T1102.002](https://intel.threadlinqs.com/technique/T1102.002), [T1105](https://intel.threadlinqs.com/technique/T1105), [T1106](https://intel.threadlinqs.com/technique/T1106), [T1110](https://intel.threadlinqs.com/technique/T1110), [T1110.002](https://intel.threadlinqs.com/technique/T1110.002), [T1110.003](https://intel.threadlinqs.com/technique/T1110.003), [T1111](https://intel.threadlinqs.com/technique/T1111), [T1113](https://intel.threadlinqs.com/technique/T1113), [T1114](https://intel.threadlinqs.com/technique/T1114), [T1119](https://intel.threadlinqs.com/technique/T1119), [T1132.001](https://intel.threadlinqs.com/technique/T1132.001), [T1133](https://intel.threadlinqs.com/technique/T1133), [T1136](https://intel.threadlinqs.com/technique/T1136), [T1136.001](https://intel.threadlinqs.com/technique/T1136.001), [T1140](https://intel.threadlinqs.com/technique/T1140), [T1176.001](https://intel.threadlinqs.com/technique/T1176.001), [T1185](https://intel.threadlinqs.com/technique/T1185), [T1187](https://intel.threadlinqs.com/technique/T1187), [T1189](https://intel.threadlinqs.com/technique/T1189), [T1190](https://intel.threadlinqs.com/technique/T1190), [T1195](https://intel.threadlinqs.com/technique/T1195), [T1195.001](https://intel.threadlinqs.com/technique/T1195.001), [T1195.002](https://intel.threadlinqs.com/technique/T1195.002), [T1199](https://intel.threadlinqs.com/technique/T1199), [T1202](https://intel.threadlinqs.com/technique/T1202), [T1203](https://intel.threadlinqs.com/technique/T1203), [T1204](https://intel.threadlinqs.com/technique/T1204), [T1204.001](https://intel.threadlinqs.com/technique/T1204.001), [T1204.002](https://intel.threadlinqs.com/technique/T1204.002), [T1204.004](https://intel.threadlinqs.com/technique/T1204.004), [T1205](https://intel.threadlinqs.com/technique/T1205), T1205.002, [T1210](https://intel.threadlinqs.com/technique/T1210), [T1211](https://intel.threadlinqs.com/technique/T1211), [T1212](https://intel.threadlinqs.com/technique/T1212), [T1213](https://intel.threadlinqs.com/technique/T1213), [T1213.002](https://intel.threadlinqs.com/technique/T1213.002), [T1213.003](https://intel.threadlinqs.com/technique/T1213.003), [T1218](https://intel.threadlinqs.com/technique/T1218), [T1218.005](https://intel.threadlinqs.com/technique/T1218.005), [T1218.007](https://intel.threadlinqs.com/technique/T1218.007), [T1218.011](https://intel.threadlinqs.com/technique/T1218.011), [T1219](https://intel.threadlinqs.com/technique/T1219), [T1219.002](https://intel.threadlinqs.com/technique/T1219.002), [T1222.001](https://intel.threadlinqs.com/technique/T1222.001), [T1222.002](https://intel.threadlinqs.com/technique/T1222.002), [T1404](https://intel.threadlinqs.com/technique/T1404), [T1417](https://intel.threadlinqs.com/technique/T1417), [T1480](https://intel.threadlinqs.com/technique/T1480), [T1482](https://intel.threadlinqs.com/technique/T1482), [T1484.001](https://intel.threadlinqs.com/technique/T1484.001), [T1485](https://intel.threadlinqs.com/technique/T1485), [T1489](https://intel.threadlinqs.com/technique/T1489), [T1490](https://intel.threadlinqs.com/technique/T1490), [T1497](https://intel.threadlinqs.com/technique/T1497), [T1497.001](https://intel.threadlinqs.com/technique/T1497.001), [T1499](https://intel.threadlinqs.com/technique/T1499), [T1499.004](https://intel.threadlinqs.com/technique/T1499.004), [T1505.003](https://intel.threadlinqs.com/technique/T1505.003), [T1513](https://intel.threadlinqs.com/technique/T1513), [T1518.001](https://intel.threadlinqs.com/technique/T1518.001), [T1526](https://intel.threadlinqs.com/technique/T1526), [T1528](https://intel.threadlinqs.com/technique/T1528), [T1530](https://intel.threadlinqs.com/technique/T1530), [T1534](https://intel.threadlinqs.com/technique/T1534), [T1539](https://intel.threadlinqs.com/technique/T1539), [T1542](https://intel.threadlinqs.com/technique/T1542), [T1542.001](https://intel.threadlinqs.com/technique/T1542.001), [T1543.001](https://intel.threadlinqs.com/technique/T1543.001), [T1543.002](https://intel.threadlinqs.com/technique/T1543.002), [T1543.003](https://intel.threadlinqs.com/technique/T1543.003), [T1546](https://intel.threadlinqs.com/technique/T1546), [T1546.004](https://intel.threadlinqs.com/technique/T1546.004), [T1547.001](https://intel.threadlinqs.com/technique/T1547.001), [T1547.006](https://intel.threadlinqs.com/technique/T1547.006), [T1548](https://intel.threadlinqs.com/technique/T1548), [T1550.002](https://intel.threadlinqs.com/technique/T1550.002), [T1550.004](https://intel.threadlinqs.com/technique/T1550.004), [T1552](https://intel.threadlinqs.com/technique/T1552), [T1552.001](https://intel.threadlinqs.com/technique/T1552.001), [T1552.004](https://intel.threadlinqs.com/technique/T1552.004), [T1552.005](https://intel.threadlinqs.com/technique/T1552.005), [T1552.007](https://intel.threadlinqs.com/technique/T1552.007), [T1553](https://intel.threadlinqs.com/technique/T1553), [T1553.002](https://intel.threadlinqs.com/technique/T1553.002), [T1554](https://intel.threadlinqs.com/technique/T1554), [T1555](https://intel.threadlinqs.com/technique/T1555), [T1555.001](https://intel.threadlinqs.com/technique/T1555.001), [T1555.003](https://intel.threadlinqs.com/technique/T1555.003), [T1555.006](https://intel.threadlinqs.com/technique/T1555.006), [T1556](https://intel.threadlinqs.com/technique/T1556), [T1557](https://intel.threadlinqs.com/technique/T1557), [T1557.001](https://intel.threadlinqs.com/technique/T1557.001), [T1558.003](https://intel.threadlinqs.com/technique/T1558.003), [T1559](https://intel.threadlinqs.com/technique/T1559), T1563.002, [T1564.001](https://intel.threadlinqs.com/technique/T1564.001), [T1565](https://intel.threadlinqs.com/technique/T1565), [T1565.001](https://intel.threadlinqs.com/technique/T1565.001), [T1566](https://intel.threadlinqs.com/technique/T1566), [T1566.001](https://intel.threadlinqs.com/technique/T1566.001), [T1566.002](https://intel.threadlinqs.com/technique/T1566.002), [T1566.003](https://intel.threadlinqs.com/technique/T1566.003), [T1566.004](https://intel.threadlinqs.com/technique/T1566.004), [T1567](https://intel.threadlinqs.com/technique/T1567), [T1567.001](https://intel.threadlinqs.com/technique/T1567.001), [T1567.002](https://intel.threadlinqs.com/technique/T1567.002), [T1569.002](https://intel.threadlinqs.com/technique/T1569.002), [T1570](https://intel.threadlinqs.com/technique/T1570), [T1571](https://intel.threadlinqs.com/technique/T1571), [T1572](https://intel.threadlinqs.com/technique/T1572), [T1573](https://intel.threadlinqs.com/technique/T1573), [T1573.001](https://intel.threadlinqs.com/technique/T1573.001), [T1573.002](https://intel.threadlinqs.com/technique/T1573.002), [T1574.001](https://intel.threadlinqs.com/technique/T1574.001), [T1574.006](https://intel.threadlinqs.com/technique/T1574.006), T1578.002, [T1580](https://intel.threadlinqs.com/technique/T1580), [T1583](https://intel.threadlinqs.com/technique/T1583), [T1583.001](https://intel.threadlinqs.com/technique/T1583.001), [T1583.003](https://intel.threadlinqs.com/technique/T1583.003), [T1583.006](https://intel.threadlinqs.com/technique/T1583.006), [T1583.008](https://intel.threadlinqs.com/technique/T1583.008), [T1585.001](https://intel.threadlinqs.com/technique/T1585.001), [T1585.003](https://intel.threadlinqs.com/technique/T1585.003), [T1586](https://intel.threadlinqs.com/technique/T1586), [T1586.003](https://intel.threadlinqs.com/technique/T1586.003), [T1587.004](https://intel.threadlinqs.com/technique/T1587.004), [T1588.002](https://intel.threadlinqs.com/technique/T1588.002), [T1588.005](https://intel.threadlinqs.com/technique/T1588.005), [T1588.006](https://intel.threadlinqs.com/technique/T1588.006), [T1588.007](https://intel.threadlinqs.com/technique/T1588.007), [T1591](https://intel.threadlinqs.com/technique/T1591), [T1593.003](https://intel.threadlinqs.com/technique/T1593.003), [T1595.002](https://intel.threadlinqs.com/technique/T1595.002), T1595.003, [T1598.003](https://intel.threadlinqs.com/technique/T1598.003), [T1598.004](https://intel.threadlinqs.com/technique/T1598.004), [T1608.001](https://intel.threadlinqs.com/technique/T1608.001), [T1608.006](https://intel.threadlinqs.com/technique/T1608.006), [T1611](https://intel.threadlinqs.com/technique/T1611), [T1619](https://intel.threadlinqs.com/technique/T1619), [T1620](https://intel.threadlinqs.com/technique/T1620), [T1648](https://intel.threadlinqs.com/technique/T1648), [T1649](https://intel.threadlinqs.com/technique/T1649), [T1651](https://intel.threadlinqs.com/technique/T1651), [T1657](https://intel.threadlinqs.com/technique/T1657), [T1684.001](https://intel.threadlinqs.com/technique/T1684.001), [T1685](https://intel.threadlinqs.com/technique/T1685), [T1685.005](https://intel.threadlinqs.com/technique/T1685.005), [T1686](https://intel.threadlinqs.com/technique/T1686)

## Threat actors

[Storm-0940](https://intel.threadlinqs.com/actor/Storm-0940), [Bohrium](https://intel.threadlinqs.com/actor/Bohrium), [Citrus](https://intel.threadlinqs.com/actor/Citrus), [YoroTrooper](https://intel.threadlinqs.com/actor/YoroTrooper), [CRAFTY FALCON](https://intel.threadlinqs.com/actor/CRAFTY%20FALCON), [MSNightmare](https://intel.threadlinqs.com/actor/MSNightmare), [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP), [WhiteArmor](https://intel.threadlinqs.com/actor/WhiteArmor), [WageMole](https://intel.threadlinqs.com/actor/WageMole), [IRGC](https://intel.threadlinqs.com/actor/IRGC), [Qilin](https://intel.threadlinqs.com/actor/Qilin), [Andariel](https://intel.threadlinqs.com/actor/Andariel)

Nation-state attribution: China, Iran, Kazakhstan (medium confidence), North Korea, Russia, KP

Threat categories: VULNERABILITY, SUPPLY_CHAIN, THREAT_INTEL, MALWARE, PHISHING, APT, RANSOMWARE, CLOUD, DATA_BREACH

## Severity breakdown

- critical: 14
- high: 33
- medium: 10
- low: 1

## Indicator & detection coverage

Counts only; indicator values and detection rule text unlock per threat with TL Creds.

- Indicators of compromise: 1072 (file 316, network 274, infrastructure 98, entity 92, tool 87, package 78, behavioral 70, malware 56, technique 1)
- New detection rules: 531 (100% of the day’s threats covered)

## More editions

- Previous: [2026-11-10](https://intel.threadlinqs.com/debrief/2026-11-10)
- [Archive of daily debriefs](https://intel.threadlinqs.com/debrief/archive)
- [Latest debrief](https://intel.threadlinqs.com/debrief)

Canonical: https://intel.threadlinqs.com/debrief/2026-11-11