Cyber Threat Intel Daily Briefing — 2026-11-03

CYBER THREAT INTEL

DAILY BRIEFING · 2026-11-03 12:15 UTC · REPORT BRIEF-20261103-121548

OPEN // LE

01

Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From Hot Wallets

BTCPay Server, a self-hosted, open-source cryptocurrency payment processor, has urged users to install the latest version of its software in response to reports of Bitcoin and Litecoin being stolen from hot wallets on instances running older versions. "Our investigation found that these attacks tar

SRC: The Hacker News Tue, 03 Nov 2026 14:01:48 +0530 https://thehackernews.com/2026/11/hackers-exploit-btcpay-server-flaw-to.html

02

Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw

Synology is urging customers to update the DiskStation Manager (DSM) software powering its Network Attached Storage (NAS) devices following ransomware attacks. The Taiwanese vendor said it observed threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated

SRC: The Hacker News Tue, 03 Nov 2026 13:13:07 +0530 https://thehackernews.com/2026/11/synology-nas-devices-targeted-in.html

03

Apple’s spyware notifications reach the Bundestag: what the BSI says to do now

Apple warns German Bundestag lawmakers of mercenary spyware attacks; BSI urges victims to assume compromise. The German government is warning politicians and public figures that they were targeted by government-backed spyware. The warning follows Apple’s notifications, which began reaching iPhones o

SRC: Security Affairs Tue, 03 Nov 2026 06:24:38 +0000 https://securityaffairs.com/202297/intelligence/apples-spyware-notifications-reach-the-bundestag-what-the-bsi-says-to-do-now.html

04

Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors

A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case of missing authentication for a critical function that could be exploited by an

SRC: The Hacker News Tue, 03 Nov 2026 11:04:41 +0530 https://thehackernews.com/2026/11/attackers-exploit-critical-siemens.html

05

Google Introduces $250,000 Root-in-Cloud Bug Bounty Reward

The top payout is for high-impact architectural research demonstrating full administrative control. The post Google Introduces $250,000 Root-in-Cloud Bug Bounty Reward appeared first on SecurityWeek.

SRC: SecurityWeek Mon, 02 Nov 2026 13:25:11 +0000 https://www.securityweek.com/google-introduces-250000-root-in-cloud-bug-bounty-reward/

06

UK Cyber Chief Says the UK Will Face AI Cyberattacks on Critical Infrastructure by 2028

The U.K. will likely face AI cyberattacks on its critical infrastructure by 2028 as criminals and states, including China and Russia, increasingly use AI in their cyber activity. The post UK Cyber Chief Says the UK Will Face AI Cyberattacks on Critical Infrastructure by 2028 appeared first on Securi

SRC: SecurityWeek Tue, 03 Nov 2026 09:49:12 +0000 https://www.securityweek.com/uk-cyber-chief-says-the-uk-will-face-ai-cyberattacks-on-critical-infrastructure-by-2028/

07

One Compromised Laptop, Billions Lost: The Binance Attack-Path Warning

The record theft shows how weak system separation, inadequate controls, and untested attack possibilities can turn one breach into systemic loss.

SRC: DarkReading Mon, 02 Nov 2026 22:27:24 GMT https://www.darkreading.com/cyberattacks-data-breaches/binance-hack-test-attack-paths

08

Chinese hackers use ARTEX AI in automated attacks against 200 orgs

Chinese hackers used ARTEX, an open-source, multi-agent AI penetration-testing framework, in attacks against more than 200 organizations across 14 countries. […]

SRC: BleepingComputer Mon, 02 Nov 2026 16:40:14 -0500 https://www.bleepingcomputer.com/news/security/chinese-hackers-use-artex-ai-in-automated-attacks-against-200-orgs/

09

Business groups mount fresh campaign for long-term renewal of information sharing law

Their target for extending CISA 2015 is the annual “must-pass” defense authorization bill, but a more than year-long standoff persists. The post Business groups mount fresh campaign for long-term renewal of information sharing law appeared first on CyberScoop.

SRC: CyberScoop Mon, 02 Nov 2026 21:04:42 +0000 https://cyberscoop.com/business-groups-cisa-2015-renewal-ndaa-cybersecurity/

10

CISA’s new strategy runs into America’s blind trust problem

Persistent credentials and forgotten software approvals leave essential operational networks vulnerable under CISA’s latest cybersecurity roadmap. The post CISA’s new strategy runs into America’s blind trust problem appeared first on CyberScoop.

SRC: CyberScoop Tue, 03 Nov 2026 11:00:00 +0000 https://cyberscoop.com/cisa-2030-strategy-operational-technology-blind-trust-op-ed/

11

Harvard University data breach exposed info of 851,000 accounts

Hackers who breached Harvard University's Alumni Affairs and Development systems in November 2025 stole data linked to more than 850,000 unique email addresses, according to breach notification service Have I Been Pwned. […]

SRC: BleepingComputer Tue, 03 Nov 2026 05:53:25 -0500 https://www.bleepingcomputer.com/news/security/harvard-university-data-breach-exposed-info-of-851-000-accounts/

12

Over 100 European Stores Hit as Supermarket Fridge Attacks Return

Attackers again tampered with internet-exposed refrigeration controllers, this time at stores in Belgium, Sweden, Ireland and beyond. The post Over 100 European Stores Hit as Supermarket Fridge Attacks Return appeared first on SecurityWeek.

SRC: SecurityWeek Tue, 03 Nov 2026 07:43:24 +0000 https://www.securityweek.com/over-100-european-stores-hit-as-supermarket-fridge-attacks-resume/

13

VOLTA, the infostealer that asks an AI which victims are worth the effort

VOLTA is an AI-powered infostealer that steals personal data, then uses LLMs to assess victims’ value and rank targets for attackers. Cisco Talos has analyzed a new Windows infostealer called VOLTA, which calls itself VOLTA-AUTODOXER. It steals the usual data, then hands the loot to a large language

SRC: Security Affairs Mon, 02 Nov 2026 18:34:13 +0000 https://securityaffairs.com/202281/malware/volta-the-infostealer-that-asks-an-ai-which-victims-are-worth-the-effort.html

14

Inside XCPE, the botnet that turned 1.3M set-top boxes into proxy servers

Google dismantled a 1.3 million-device botnet allegedly built by Android TV box maker Videostrong to enable ad fraud and proxy abuse. Google and its partners dismantled a backdoor called XCPE that had enrolled more than 1.3 million set-top boxes in a botnet. The result of the investigation into the

SRC: Security Affairs Tue, 03 Nov 2026 09:52:37 +0000 https://securityaffairs.com/202323/malware/inside-xcpe-the-botnet-that-turned-1-3m-set-top-boxes-into-proxy-servers.html

15

Google Dismantles XCPE Botnet of 1.3 Million Android Devices

The botnet was created and operated for financial gain by Android OEM/ODM Videostrong Technology. The post Google Dismantles XCPE Botnet of 1.3 Million Android Devices appeared first on SecurityWeek.

SRC: SecurityWeek Tue, 03 Nov 2026 09:22:09 +0000 https://www.securityweek.com/google-dismantles-xcpe-botnet-of-1-3-million-android-devices/

16

NATO’s Crossed Swords Exercise Brings AI Agents Into Cyber Operations Training

The NATO CCDCOE exercise in Estonia introduces AI agents and OpenAI Daybreak into joint cyber and kinetic operations training. The post NATO’s Crossed Swords Exercise Brings AI Agents Into Cyber Operations Training appeared first on SecurityWeek.

SRC: SecurityWeek Tue, 03 Nov 2026 08:49:03 +0000 https://www.securityweek.com/natos-crossed-swords-exercise-brings-ai-agents-into-cyber-operations-training/

17

New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food

Attackers remotely changed the settings on refrigeration controls at supermarkets in Belgium, Sweden, Estonia and other European countries overnight into Monday, November 2, warming fridges and freezers. No chain reported more than several dozen affected stores, and some had to throw away chilled a

SRC: The Hacker News Tue, 03 Nov 2026 12:57:07 +0530 https://thehackernews.com/2026/11/second-wave-of-cyberattacks-hits.html

[ SOURCE ] OpenPhish (18 indicator(s))