The Executive by MaxwellCTI: November 2, 2026
The Executive by MaxwellCTI: November 2, 2026
Get the full story at intel.maxwellcti.com.
Vapor Panda targeted over 200 organizations using the ARTEX AI framework, VOLTA-AUTODOXER malware uses LLMs to rank victims, and Trezor warned of a suspected hardware implant.
Novel techniques
China-linked Vapor Panda Targets 200 Organizations Using the ARTEX AI Framework
The China-linked threat actor Vapor Panda targeted over 200 organizations globally using the ARTEX AI penetration testing framework. This tool allowed command volume to exceed 1,500 commands per hour, compared to typical manual activity of up to 40 commands per hour. Targets included foreign ministries, telecom providers, and US-based organizations in the pharmaceutical, semiconductor, defense, nuclear, and financial sectors.
VOLTA-AUTODOXER Malware Uses LLMs to Prioritize and Rank Windows Victims
Cisco Talos and the CAIRN research effort identified a Windows infostealer named VOLTA-AUTODOXER that uses large language models to prioritize and rank victims by monetization value. This AI layer serves as effort displacement, relieving the operator of the analytical work required to triage raw credential logs. The malware harvests personal and financial data, including browser passwords, payment cards, and cloud-provider keys.
Business
Trezor Warns of Suspected Hardware Implant in Some Wallets
Trezor warned users about a suspected hardware implant in a Trezor Safe 5 device purchased from the reseller CryptoBilis. A customer reported that a cellular module and antenna could transmit the wallet recovery phrase over a mobile network. Trezor states that weighing devices is not a reliable method for detecting tampering.
Critical vulnerabilities
- Ivanti Connect Secure (CVE-2026-111357, CVE-2026-118527, CVE-2026-104935): unauthenticated attackers can obtain root-level code execution, and it is exploited; Ivanti has released patches. (story)
- Drupal Commerce Core (CVE-2026-118539): unauthenticated attackers can bypass protections on certain routes and entity fields, and it is being actively exploited; Drupal has released patches.
- Canonical LXD and MicroCloud (CVE-2026-112816): attackers can impersonate trusted clients and potentially gain root access on the host machine; Canonical has released security updates.