Cyber Threat Intel Daily Briefing — 2026-11-12

CYBER THREAT INTEL

DAILY BRIEFING · 2026-11-12 12:15 UTC · REPORT BRIEF-20261112-121552

OPEN // LE

01

Hackers Deploy Malware in Fresh ScreenConnect Campaign

The attackers exploited a vulnerability in a legitimate extension to bypass ScreenConnect authentication. The post Hackers Deploy Malware in Fresh ScreenConnect Campaign appeared first on SecurityWeek.

SRC: SecurityWeek Thu, 12 Nov 2026 10:39:34 +0000 https://www.securityweek.com/hackers-deploy-malware-in-fresh-screenconnect-campaign/

02

Hackers Target N-central Zero-Days as N-able Rushes Patches

The malicious activity started shortly after a researcher dropped over 30 zero-days. N-able patched the unauthenticated ones. The post Hackers Target N-central Zero-Days as N-able Rushes Patches  appeared first on SecurityWeek.

SRC: SecurityWeek Thu, 12 Nov 2026 09:39:55 +0000 https://www.securityweek.com/hackers-target-n-central-zero-days-as-n-able-rushes-patches/

03

Hackers plant GSocket on Linux servers for persistent access

Multiple threat actors are abusing GSocket, a legitimate open-source remote access tool, to maintain access to Linux servers even after patching the vulnerabilities exploited to gain initial access. […]

SRC: BleepingComputer Thu, 12 Nov 2026 04:38:00 -0500 https://www.bleepingcomputer.com/news/security/hackers-plant-gsocket-on-linux-servers-for-persistent-access/

04

Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover

A critical flaw in MongoDB Server allows an unauthenticated attacker to send two requests that trigger a crash on the database server. The crash occurs only if that server is later chosen to take over as the main server while it still lacks some recent changes. MongoDB, the company that makes the d

SRC: The Hacker News Thu, 12 Nov 2026 14:55:00 +0530 https://thehackernews.com/2026/11/critical-pre-auth-mongodb-flaw-cve-2026.html

05

Who Runs the Ransomware Group Qilin?

The cybercrime group Qilin has emerged as the world's most active ransomware affiliate program, claiming at least 365 victim organizations in the past three months alone. But even top Russian hackers make operational security mistakes, and the administrator of Qilin has made a few key missteps over

SRC: Krebs on Security Wed, 11 Nov 2026 18:06:01 +0000 https://krebsonsecurity.com/2026/11/who-runs-the-ransomware-group-qilin/

06

Maersk confirms data breach as WhiteArmor ransomware demands $5 million

Maersk announced that a threat actor gained unauthorized access to a local legacy system inherited through an earlier acquisition and extracted data from it. […]

SRC: BleepingComputer Wed, 11 Nov 2026 11:24:18 -0500 https://www.bleepingcomputer.com/news/security/maersk-confirms-data-breach-as-whitearmor-ransomware-demands-5-million/

07

Chinese AI Project Scouts Spies in Taiwan Chip Industry

The CCP built a Big Data system to scrape reams of information and learn about individuals abroad, to potentially target and exploit them. Think Alice Huang Lite.

SRC: DarkReading Thu, 12 Nov 2026 01:00:00 GMT https://www.darkreading.com/threat-intelligence/chinese-ai-project-scouts-spies-taiwan-chip-industry

08

Japan Pushes Emergency Funding for Cybersecurity as AI-Assisted Breaches Rise

The package adds public-private cyber responders, an AI-focused team run by the economic ministry, and more leeway to use the government's new active cyber-defense powers.

SRC: DarkReading Thu, 12 Nov 2026 00:00:00 GMT https://www.darkreading.com/cybersecurity-operations/japan-emergency-funding-cybersecurity-ai-assisted-breaches

09

Today: CISO Forum Virtual Summit 2026 Day 2 – Join Cybersecurity Leaders Online

Designed for cybersecurity leaders, this immersive two-day virtual event is your premier destination to discuss, share, and learn innovative risk management and defense strategies defining the modern enterprise. The post Today: CISO Forum Virtual Summit 2026 Day 2 – Join Cybersecurity Leaders Online

SRC: SecurityWeek Wed, 11 Nov 2026 16:29:42 +0000 https://www.securityweek.com/today-ciso-forum-virtual-summit-2026-join-global-cybersecurity-leaders/

10

Inside an AI Attack Against a US Retailer

When hand-typed commands failed to breach a US retailer, the attacker turned to AI-generated scripts, achieving lateral movement in minutes.

SRC: DarkReading Thu, 12 Nov 2026 11:00:00 GMT https://www.darkreading.com/cyberattacks-data-breaches/inside-ai-attack-us-retailer

11

Maersk Confirms Data Theft Amid $5 Million Extortion Attempt

The WhiteArmor ransomware group claims it stole 100GB of data from the shipping giant’s systems. The post Maersk Confirms Data Theft Amid $5 Million Extortion Attempt appeared first on SecurityWeek.

SRC: SecurityWeek Thu, 12 Nov 2026 08:38:47 +0000 https://www.securityweek.com/maersk-confirms-data-theft-amid-5-million-extortion-attempt/

12

Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories

Starting Tuesday, an attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write to, according to Aikido Security, a security software company. The stealer is built to take the secrets and cloud credentials that a repository's CI w

SRC: The Hacker News Thu, 12 Nov 2026 12:12:47 +0530 https://thehackernews.com/2026/11/4837-hijacked-github-accounts-ran-ci.html

13

Baker Tilly notifies clients of data breach at third-party provider

The Baker Tilly Advisory Group is notifying clients that a data breach has compromised certain personal information about them and their dependents. […]

SRC: BleepingComputer Wed, 11 Nov 2026 18:01:31 -0500 https://www.bleepingcomputer.com/news/security/baker-tilly-notifies-clients-of-data-breach-at-third-party-provider/

14

ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients

ConnectWise has taken the precautionary step of disabling five third-party extensions in partner environments following reports of unauthorized access. In an advisory posted on its site, the company said there is no evidence that the incident involves a compromise of its infrastructure or a vulnera

SRC: The Hacker News Thu, 12 Nov 2026 10:09:48 +0530 https://thehackernews.com/2026/11/screenconnect-attacks-target-at-least.html

15

Notion Customer Data Compromised in Fireworks AI Hack

The attackers accessed chat transcripts for fewer than 1% of Notion workspaces. Most transcripts were unattributable. The post Notion Customer Data Compromised in Fireworks AI Hack appeared first on SecurityWeek.

SRC: SecurityWeek Thu, 12 Nov 2026 11:08:52 +0000 https://www.securityweek.com/notion-customer-data-compromised-in-fireworks-ai-hack/

16

Microsoft confirms Windows security updates installation issues

Microsoft has confirmed reports that the November 2026 security updates are failing to install on Windows 11 systems with the October preview update. […]

SRC: BleepingComputer Thu, 12 Nov 2026 05:24:07 -0500 https://www.bleepingcomputer.com/news/microsoft/microsoft-confirms-kb5132061-installation-issues-0x80070306-0x800f0989-0x800f0993-errors/

17

Poland takes its national e-government platform offline after a cyberattack

Poland takes its e-government platform ePUAP offline after stopping a cyberattack, disrupting access to public services. Poland temporarily shut down ePUAP, the government platform citizens and businesses use to reach public services, after detecting and stopping a cyberattack. A notice on the gover

SRC: Security Affairs Thu, 12 Nov 2026 06:10:52 +0000 https://securityaffairs.com/202895/security/poland-takes-its-national-e-government-platform-offline-after-a-cyberattack.html

18

Attackers Say 'Hello' to a Different Scale of Cloud Attack

Researchers dubbed an attack chain "Greeter" after discovering that attackers deliberately covered their trail by leaving "hello" messages in logs.

SRC: DarkReading Wed, 11 Nov 2026 21:44:04 GMT https://www.darkreading.com/cloud-security/attackers-hello-scale-cloud-attack

[ SOURCE ] OpenPhish (18 indicator(s))