Wednesday, November 4, 2026

Daily Brief for 2026-11-04

## Top story
North Korean-linked Lazarus Group stole $6.34 billion from Binance using fake job interviews and malware delivered during recruitment. Attackers compromised an engineer, installed trojans via tampered Homebrew and AI tools, then accessed wallet signing services. Binance recovered 98% of funds; the breach underscores recruitment and AI-tool risks for defenders. (58 words)

## Exploitation & threats

• Node-RED CVE-2026-58115 exploited in the wild to deploy Linux bots and webshells on unprotected servers; Siemens fixed in V4.3.4.1.
• Binance campaign used social engineering and internal AI abuse for $6.34B wallet theft; FBI links to Lazarus Group.
• ARTEX AI multi-agent framework observed attacking 200+ organizations in 11 days across 14 countries.
• Google dismantled X.CPE botnet in 1.3 million Android TV boxes operated by Videostrong for proxy and ad fraud.
• 3AM ransomware deployed on UK school network via AI-automated tools and backup credential theft.

## Patch priorities

• CVE-2026-58115: Node-RED, upgrade to V4.3.4.1 and enable authentication.
• CVE-2026-61826: Bazarr, upgrade to 1.5.7-beta.14.
• CVE-2026-61738: SOCFortress CoPilot, upgrade to 0.1.77.
• CVE-2026-84295: Progress WS_FTP Server, upgrade to 2024.0.6 or 2025.0.3.
• CVE-2026-120338: Prefab Generative UI, upgrade to 0.21.0.
• CVE-2026-76418: Cisco ASA/FTD SSL VPN, apply vendor update when available.

## Breaches & incidents

• Binance lost $6.34 billion to North Korean hackers via fake job interviews and malware; 98% recovered, $2.85 billion frozen.
• Defense contractor connected personal Claude Code AI agent to Pentagon secure system, exfiltrating credentials to third-party site.
• Ransomware claims: Autoscribe Corporation (payoutsking), IHG Hotels (byod), SK Global Software (akira), and multiple others including Phillips Nizer (ransomhouse).
• UNM Hospital targeted by BYOD ransomware group; attackers offered $2,500 compensation after mistaken targeting.

## AI

• ChatGPT now handles 20% of Google search volume; OpenAI highlights visual AI interfaces as next search step.
• ARTEX AI framework enables multi-agent automated attacks on enterprises and governments.
• New model releases include speridlabs/idol (apache-2.0) and Pika-Labs/Pika-H3-Flex variants.

## Watchlist

• Upgrade Node-RED instances and review endpoint security tools for compromised devices.
• Replace credentials and decommission interview-related malware from Binance incident.
• Monitor for unpatched Cisco ASA SSL VPN and Langflow 1.0.0–1.12.8 instances.
• Follow up on pending Linux kernel fixes for CVE-2026-98432 across RHEL and Ubuntu.