The Executive by MaxwellCTI: November 3, 2026

Get the full story at intel.maxwellcti.com.

Mercado Bitcoin confirmed a cyberattack, the BYOD ransomware gang claimed data theft from Michigan State University, and Abrigo took its Sageworks application offline after detecting irregular activity.

Novel techniques

CyberStrikeAI in the wild: the use of AI in real-world attacks on organizations

Kaspersky identified a campaign targeting educational organizations in Africa and Latin America using CyberStrikeAI, an open-source framework that uses a server-side LLM orchestrator to automate post-exploitation tasks. This tool increased the speed of attacks and lowered the skill requirement for the operator, leading to full domain compromise within three to four days. Kaspersky states the techniques used remain standard and detectable.

Business

Largest crypto exchange in Brazil confirms cyberattack as millions flow out of platform

Mercado Bitcoin suspended deposits and withdrawals following a cyberattack. Blockchain security companies reported that more than $46 million left the platform, though the company stated customer funds were not harmed. The incident affects a platform with approximately 4.5 million customers.

BYOD Ransomware Gang Claims Data Theft From Michigan State

The BYOD ransomware gang claimed to have stolen personal information of 1.3 million current and former students from Michigan State University. Michigan State University characterized the incident as a potential credential compromise event.

Fintech platform Sageworks taken offline after suspected cyberattack

Abrigo took its Sageworks risk management application offline on October 30 after detecting irregular activity. The outage impacted the Sageworks API, Sageworks Analyst, and Online Portal Now for a customer base of more than 2,400 community banks and credit unions in the United States. Additionally, the ShinyHunters extortion group alleged it stole 1.7 million Salesforce records and internal corporate data from Abrigo.

Cyberattacks Disrupt Refrigeration Systems at European Supermarkets

Cyberattacks targeting Sabcobel affected more than 115 stores, including ICA, Coop, Ahold Delhaize, Carrefour, Spar Colruyt, Intermarché, SuperValu, and Selver. One butcher shop, De Laet & Van Haver, reported an estimated 15,000 euros of ruined meat. Danfoss stated that affected businesses in the Netherlands had not taken measures after a French attack and were still using default passwords on systems not connected to a secure network.

Critical vulnerabilities

• GitLab GitLab (CVE-2026-97229): unauthenticated users can execute arbitrary code on the GitLab server, and it is already exploited; GitLab has released security patches.
• Ivanti Connect Secure (CVE-2026-111357, CVE-2026-118527, CVE-2026-104935, CVE-2024-21887, CVE-2023-46805, CVE-2024-21893, CVE-2025-0282, CVE-2025-22457): unauthenticated attackers can gain root-level code execution, and these are exploited; Ivanti has released security updates.