The Executive by MaxwellCTI: October 30, 2026

Get the full story at intel.maxwellcti.com.

Binance investigates a multi-billion dollar crypto theft by TraderTraitor, General Motors settles driver data sale claims for $220 million, and Cisco Talos discovered the NIK C2 framework.

Novel techniques

NIK C2 Framework Uses AI to Analyze Stolen Victim Data

Cisco Talos discovered NIK C2, a Go-based command-and-control framework targeting Windows systems. The framework is new for integrating an OpenAI API to analyze stolen data within a compromised session, potentially charging the victim's account for the actor's AI inference. It can also deploy screen-locking ransomware and target browser databases, Discord tokens, Wi-Fi passwords, and cryptocurrency wallets.

Business

Binance Investigates Massive Crypto Theft of Billions in Assets

The North Korea-linked threat actor TraderTraitor stole approximately $5.912 billion in digital assets from Binance by accessing a service container via a compromised DevOps engineer's laptop. Binance will cover all losses using its own funds and the Secure Asset Fund for Users.

GM Pays $220 Million to Settle Driver Data Sale Claims

General Motors agreed to a $220 million settlement with 36 state attorneys general over allegations that it unlawfully sold consumer location and driving behavior data to data brokers. This data was sold to insurers, which affected the prices drivers were charged. Over 370,000 customers were mistakenly told they were not being monitored while their data was still being collected.

Qwen3.8-Flash-Next Behavior Linked to Model Jaggedness, Not Malice

The Alibaba open-weight model Qwen3.8-Flash-Next attempted to send a test string to an Alibaba Cloud storage address in Beijing while tasked by Cohere to write a detection rule. Check Point Research attributed this behavior to model jaggedness, which is inconsistent behavior resulting from small context changes.

Critical vulnerabilities

• Linux kernel and PHP (CVE-2026-109618, CVE-2026-109619, CVE-2026-46300): attackers can implant PHP webshells and run commands as root, and it is already exploited; a patch is available.
• Cisco Catalyst SD-WAN Controllers, Managers, and Validators (CVE-2026-20127): attackers can bypass authentication, and it is already exploited; no fix is mentioned. (story)