SECURITYINTEL DAILY BRIEF ■ ThreatIntel BriefMonday, November 02, 2026 INTEL CONFIDENCE 70% | THREAT LEVEL CRITICAL |
|
THREAT OF THE DAY Canonical LXD MicroCloud Critical CVSS 10.0 Auth Flaw | CRITICAL |
|
5 C2 IPs | 0 OTX IOCs | 11 ARTICLES |
|
■ ANALYST TLDR The FBI has officially attributed the record $6.43 billion Binance cryptocurrency heist to North Korea's state-sponsored TraderTraitor group. Meanwhile, Canonical disclosed a critical CVSS 10.0 vulnerability in LXD and MicroCloud allowing client impersonation over HTTPS APIs without private keys, and Alpine Linux rebuilt its infrastructure following an attempted critical GitLab RCE exploit. Additionally, attackers compromised a third-party DebugBear script on Polymarket to steal $2.7 million from traders, while government systems in Asia face targeted NetamLoader malware infections via .NET injection. |
|
■ CRITICAL STORIES CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key Attackers with network access to the HTTPS API can bypass authentication using only a trusted client's public certificate, allowing full administrative access. |
Alpine Linux rebuilds GitLab after attempted RCE attack Malicious actors attempted to exploit a critical remote code execution vulnerability in Alpine Linux's development infrastructure, triggering server rebuilds and organization-wide password resets. |
Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script A supply chain attack on third-party page-speed monitoring code injected malicious script into Polymarket, manipulating user sessions to drain funds. |
FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist The FBI officially attributed the largest crypto heist in history to North Korean threat actor TraderTraitor (Jade Sleet / Pressure Chollima). |
|
■ CVEs IDENTIFIED [CVE-TBD] Canonical LXD & MicroCloud — CVSS 10.0 Authentication Bypass / Public Cert Impersonation |
[CVE-TBD] GitLab — Remote Code Execution (RCE) attempt on Alpine Linux infrastructure |
[CVE-TBD] DebugBear / Polymarket Script — Third-party Supply Chain JavaScript Hijacking & Asset Theft |
[CVE-TBD] Microsoft Windows 10 (Custom Build) — NetamLoader Malware Execution via .NET Injection |
|
■ THREAT ACTORS TraderTraitor (aka Jade Sleet, Pressure Chollima, PUKCHONG, Slow Piston) | State-Sponsored (North Korea) |
Attributed by FBI for stealing $6.43 billion in virtual assets from Binance. |
Unidentified Threat Actor (NetamLoader Operator) | Cyberespionage / APT |
Targeting government Windows 10 systems in Asia using custom .NET injection chains. |
Unidentified Threat Actor (Alpine Linux / GitLab Exploiters) | Cybercriminal / Opportunistic |
Attempted RCE exploitation against Alpine Linux GitLab development infrastructure. |
|
|
|
■ ATT&CK TTPs | T1190 | | Exploit Public-Facing Application | Remote exploitation attempts against GitLab servers and Canonical LXD/MicroCloud HTTPS APIs. |
| T1556 | | Modify Authentication Process | LXD/MicroCloud authentication bypass using public certificates without requiring private keys. |
| T1195.002 | | Supply Chain Compromise: Compromise Software Dependencies | Compromise of third-party DebugBear script hosted on Polymarket website. |
| T1055 | | Process Injection | NetamLoader using custom .NET injection techniques targeting Windows 10 systems. |
| T1204.002 | | User Execution: Malicious File | Delivery and extraction of malicious payloads embedded in Microsoft OneNote (.one) files. |
|
■ PATCH PRIORITY Canonical LXD — CVSS 10.0 authentication bypass enabling unauthenticated client impersonation — [THN] |
Canonical MicroCloud — Shared CVSS 10.0 API authentication vulnerability — [THN] |
GitLab — Active RCE exploitation attempt prompting full infrastructure rebuilds — [BC] |
Third-Party Web Scripts (DebugBear / Web Apps) — Active supply chain exploitation draining web application sessions — [THN] |
|
|
|
■ RECOMMENDED ACTIONS TODAY | 1 | [P1] Patch Canonical LXD and MicroCloud deployments immediately to fix the CVSS 10.0 authentication bypass vulnerability [CVE-TBD]. |
| 2 | [P1] Audit GitLab server infrastructure for signs of compromise, apply critical updates, and reset credentials [CVE-TBD]. |
| 3 | [P1] Implement Subresource Integrity (SRI) hashes and strict Content Security Policy (CSP) headers for third-party scripts like DebugBear on web applications. |
| 4 | [P2] Monitor .NET assembly loads and memory injection activity on Windows 10 enterprise hosts to mitigate NetamLoader [CVE-TBD]. |
| 5 | [P2] Block or restrict email ingress and execution of unverified Microsoft OneNote (.one) files containing embedded attachments [CVE-TBD]. |
|
|
|
C2 IP BLOCKLIST · AbuseCH Feodo · Showing 5 of 5 IP ADDRESS 162.243.103.246 | PORT 8080 | STATUS OFFLINE | MALWARE Emotet | COUNTRY US |
IP ADDRESS 50.16.16.211 | PORT 443 | STATUS ONLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 34.204.119.63 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 178.62.3.223 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY GB |
IP ADDRESS 27.133.154.218 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY JP |
|
FULL IOC EXPORT — GOOGLE SHEET All live IOCs with full SHA256 hashes (OTX), IPs, and domains. 2 tabs: C2 IPs · OTX IOCs
Updated daily · Export as CSV to import directly into your tools ■ Open Full IOC Sheet → |
|
IOC SOURCES: AbuseCH Feodo · AlienVault OTX
NEWS: THN · KRB · SANS · REC · BC · SW · AWS · GCP · MSFT · U42 · SCH · MWB |