Cyber Threat Intel Daily Briefing — 2026-11-02

CYBER THREAT INTEL

DAILY BRIEFING · 2026-11-02 12:15 UTC · REPORT BRIEF-20261102-121523

OPEN // LE

01

Ivanti patches two more Connect Secure zero-days chained in attacks

Ivanti released security updates to patch two more Connect Secure (ICS) remote access gateway flaws that have been chained in zero-day attacks since at least October 1. […]

SRC: BleepingComputer Mon, 02 Nov 2026 04:33:26 -0500 https://www.bleepingcomputer.com/news/security/ivanti-patches-two-more-connect-secure-zero-days-chained-in-attacks/

02

Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain

CISA has added CVE-2026-111357 and CVE-2026-118527 to its KEV catalog after the Ivanti VPN flaws were chained in zero-day attacks. The post Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain appeared first on SecurityWeek.

SRC: SecurityWeek Mon, 02 Nov 2026 07:57:49 +0000 https://www.securityweek.com/ivanti-patches-two-more-zero-days-exploited-in-connect-secure-attack-chain/

03

Alpine Linux rebuilds GitLab after attempted RCE attack

Hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux's development infrastructure on October 20-21, prompting the open-source project to rebuild its GitLab server and reset all passwords over concerns of a possible compromise. […]

SRC: BleepingComputer Sun, 01 Nov 2026 10:11:21 -0500 https://www.bleepingcomputer.com/news/security/alpine-linux-rebuilds-gitlab-after-attempted-rce-attack/

04

Security Affairs newsletter Round 602 by Pierluigi Paganini – INTERNATIONAL EDITION

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. U.S. CISA adds Ivanti Connect Secure flaws to its Kno

SRC: Security Affairs Sun, 01 Nov 2026 13:22:58 +0000 https://securityaffairs.com/202200/breaking-news/security-affairs-newsletter-round-602-by-pierluigi-paganini-international-edition.html

05

Synology warns of C3RB3R ransomware attacks targeting NAS devices

Taiwanese network-attached storage (NAS) appliance maker Synology warned customers to update their devices immediately due to a surge in C3RB3r ransomware attacks. […]

SRC: BleepingComputer Mon, 02 Nov 2026 06:28:42 -0500 https://www.bleepingcomputer.com/news/security/synology-warns-customers-of-ongoing-c3rb3r-ransomware-attacks/

06

Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts

Cybersecurity researchers have disclosed details of a cyber espionage campaign specifically targeting Linux infrastructure associated with government entities and state-affiliated infrastructure. The activity, observed by Palo Alto Networks Unit 42 between October 2025 and April 2026, has been trac

SRC: The Hacker News Mon, 02 Nov 2026 16:19:59 +0530 https://thehackernews.com/2026/11/government-linux-servers-targeted-with.html

07

Hackers Send Fake Nuclear Threat Alerts to Ukrainian and Russian Citizens

Hackers reportedly hit Ukraine ‘s and Russia ‘s emergency alert apps, sending fake nuclear and attack warnings and raising concerns over public safety. Ukraine and Russia both said on Sunday night that hackers had compromised their emergency alert apps and used them to send fake warnings about air r

SRC: Security Affairs Mon, 02 Nov 2026 10:20:46 +0000 https://securityaffairs.com/202248/security/hackers-send-fake-nuclear-threat-alerts-to-ukrainian-and-russian-citizens.html

08

FBI Flags Over 600 Addresses Tied to North Korea’s Binance Heist

The FBI has officially pinned the $6 billion Binance hack on North Korea’s TraderTraitor as the attackers launder the stolen crypto. The post FBI Flags Over 600 Addresses Tied to North Korea’s Binance Heist appeared first on SecurityWeek.

SRC: SecurityWeek Mon, 02 Nov 2026 08:40:36 +0000 https://www.securityweek.com/fbi-flags-over-600-addresses-tied-to-north-koreas-binance-heist/

09

New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value

Cybersecurity researchers have discovered a new Windows infostealer malware called VOLTA-AUTODOXER (aka VOLTA) that makes use of a large language model (LLM) to rank a victim's stolen data by their monetization value. Like other typical stealer families, VOLTA is equipped to harvest passwords and c

SRC: The Hacker News Mon, 02 Nov 2026 11:21:07 +0530 https://thehackernews.com/2026/11/new-volta-infostealer-uses-claude.html

10

Chainalysis Discloses Data Breach Following AI-Driven Cyberattack

The attackers used offensive agentic techniques to access the company’s systems and internal tools. The post Chainalysis Discloses Data Breach Following AI-Driven Cyberattack appeared first on SecurityWeek.

SRC: SecurityWeek Mon, 02 Nov 2026 10:27:49 +0000 https://www.securityweek.com/chainalysis-discloses-data-breach-following-ai-driven-cyberattack/

11

Malicious Claude Code Extension Served in Cursor Supply Chain Attack

The extension performed host reconnaissance and attempted to create a reverse SSH tunnel. The post Malicious Claude Code Extension Served in Cursor Supply Chain Attack appeared first on SecurityWeek.

SRC: SecurityWeek Mon, 02 Nov 2026 11:29:39 +0000 https://www.securityweek.com/malicious-claude-code-extension-served-in-cursor-supply-chain-attack/

12

Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data

Attackers posing as IT support on Microsoft Teams talked employees into giving them remote control of their PCs. They then used insecure Active Directory Certificate Services (AD CS) settings to obtain login certificates for privileged accounts, including one for a domain controller. Microsoft said

SRC: The Hacker News Mon, 02 Nov 2026 16:38:45 +0530 https://thehackernews.com/2026/11/attackers-pose-as-it-support-on.html

13

Could Nick Andersen’s leadership outlast the clock on his acting role?

He has won praise for his leadership of CISA as acting director, and there’s talk of keeping him in the role beyond his current deadline. With no nominee yet in sight, he might be the White House’s best option. The post Could Nick Andersen’s leadership outlast the clock on his acting role? appeared

SRC: CyberScoop Mon, 02 Nov 2026 11:00:00 +0000 https://cyberscoop.com/nick-andersen-cisa-acting-director-nomination/

14

Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack

DebugBear says its DNS records were compromised via its domain registrar, and early findings show a single customer was targeted. The post Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack appeared first on SecurityWeek.

SRC: SecurityWeek Mon, 02 Nov 2026 09:33:15 +0000 https://www.securityweek.com/polymarket-returns-3-9-million-to-traders-as-debugbear-cites-dns-hijack/

15

Chainalysis Investigates Security Incident Involving AI-Driven Attack Techniques

Chainalysis suffered a cyberattack exposing customer names, emails and user IDs, while investigation data and passwords remain safe. Blockchain analytics firm Chainalysis says it was the target of a cybersecurity incident. A threat actor accessed its systems and internal tools and stole some non-sen

SRC: Security Affairs Mon, 02 Nov 2026 08:25:46 +0000 https://securityaffairs.com/202241/ai/chainalysis-investigates-security-incident-involving-ai-driven-attack-techniques.html

[ SOURCE ] OpenPhish (18 indicator(s))