Cyber Threat Intelligence Digest: Week 45

Executive Summary -
Highlights of Cyber Threat Intelligence Digest

Vulnerabilities

TP-Link Patches Three Vulnerabilities Affecting Tapo Cloud and Archer AX3000 - On 3 November 2026, TP-Link disclosed three high-severity vulnerabilities (CVE-2026-105821, CVE-2026-105822 and CVE-2026-118865) affecting its Tapo Cloud service and Archer AX3000 V2 routers. The Tapo Cloud issues were remediated on the cloud side, and the router flaw was fixed in firmware 1.1.3 Build 261026.

CVE-2026-105821 is a missing authorisation flaw in the Tapo Cloud MQTT broker, which fails to verify that a proxy request’s device ID belongs to the authenticated device, allowing a threat actor to obtain device service tokens and upload arbitrary content to Tapo Cloud storage. CVE-2026-105822 is a server-side request forgery (SSRF) flaw in the MQTT proxy, caused by insufficient host value validation, allowing requests to be redirected to a malicious server, potentially exposing internal data and enabling DDoS attacks. CVE-2026-118865 is an OS command injection flaw in the Archer AX3000 V2 Offline Download component, allowing an authenticated admin-level threat actor to execute arbitrary commands.

Google Patches Nine Chrome Vulnerabilities Including Actively Exploited Use-After-Free Flaw CVE-2026-125350 in XML - On 9 November 2026, Google released a Chrome security update addressing nine vulnerabilities, including CVE-2026-125350, an actively exploited use-after-free flaw in Chrome’s XML component. Google did not disclose the threat actors, exploitation methods, affected organisations or whether any compromises were confirmed. The fix is included in Chrome 157.0.8103.50/.51 for Windows and macOS and 157.0.8103.50 for Linux, rolling out over the coming days and weeks, and updating to the latest version is recommended.

CVE-2026-125350 and CVE-2026-125346 are use-after-free flaws in XML that could allow memory corruption, browser crashes or arbitrary code execution. CVE-2026-125343 (buffer overflow in Compositing), CVE-2026-125348 (out-of-bounds write in GPU) and CVE-2026-125344 (type confusion in V8) could each allow memory corruption or arbitrary code execution. CVE-2026-125345 (WebGL) and CVE-2026-125349 and CVE-2026-125342 (GPU) are uninitialised resource flaws that could expose sensitive information from uninitialised memory. CVE-2026-125347 is an incorrect authorisation flaw in FileSystem that could allow threat actors to bypass authorisation checks and access resources without appropriate permissions.

Alleged PoC for High-Severity Path Handling Vulnerability Affecting Multiple Apple macOS (CVE-2026-112487) - On 1 November 2026, a security researcher published an alleged proof-of-concept (PoC) exploit for CVE-2026-112487, a high-severity path handling vulnerability affecting macOS Golden Gate prior to 27.2, Sequoia prior to 15.8.2 and Tahoe prior to 26.7.2, which Apple fixed on 26 October 2026. Exploitation allows an authenticated local threat actor to escalate from a non-administrator account to root without a password. The flaw resides in the root-privileged com.apple.revisiond daemon, which accepts unvalidated XPC connections, performs copyfile operations to predictable paths that follow hardlinks and restore root ownership, and propagates caller-controlled ACLs to root-owned files.

The PoC adds an inheritable ACL to a staging directory, then races revisiond to retain a writable root-owned file containing a NOPASSWD: ALL sudoers entry. By forcing a copyfile fallback and planting hardlinks to /etc/sudoers at predictable paths, it causes revisiond to overwrite /etc/sudoers while preserving root ownership, then verifies success with sudo -n whoami. Insikt Group has not tested the PoC for accuracy or efficacy.

Potential Threats

Threat Actors Attempt to Exploit Able2Shell Vulnerabilities Affecting N-able N-central - On 9 November 2026, N-able reported a critical security incident involving unspecified vulnerabilities in its N-central platform after observing scanning activity linked to publicly disclosed proof-of-concept (PoC) exploit code. On 10 November, watchTowr also observed exploitation attempts against its N-central honeypots. Neither N-able nor watchTowr has reported evidence of successful exploitation in customer environments at the time of writing. As a precaution, N-able took its hosted N-central environments offline and advised on-premises customers to shut down their servers until a hotfix is available, affecting services across the US, Asia-Pacific and Europe. Ecoverse services accessible through N-able Login, including asset view, patching, vulnerability management, scripting, policies and tagging, remain available.

The advisory follows a security researcher’s report detailing multiple N-central vulnerabilities, collectively tracked as “Able2Shell”, with PoC exploits tested against prerelease version 2026.4.0.31. The described exploit chains combine credential disclosure, XML external entity (XXE) injection, cross-site scripting (XSS), path traversal and arbitrary file write, leading to remote command execution (RCE) with root privileges or administrator account creation, although some chains require existing access or admin interaction. No CVE identifiers have been assigned in the report.

Threat Actor Uses BOSSAI AI Agent Mesh to Conduct Automated Cyberattacks Across Multiple Countries - On 4 November 2026, Acronis published a report detailing a threat actor’s use of BOSSAI, an AI-driven attack framework of twelve specialised agents that automate reconnaissance, vulnerability identification, exploitation and post-compromise activity using LLMs, Model Context Protocol (MCP) servers and offensive tooling. The threat actor, operating as “bossjy”, targeted hundreds of organisations across government, finance, education, military, telecommunications, e-commerce and gambling sectors. Over a twelve-day period, Acronis confirmed data exfiltration or unauthorised access affecting around ten targets across three countries, recovering over 90,000 files (9 GB) including agent conversations, credentials and stolen victim data. Grok, OpenClaw, Claude Code and Codex managed infrastructure, Hermes handled most offensive requests, and Cursor, Trae and CyberStrike supported reconnaissance and tool development, alongside HalberdStrike, a PentestGPT-derived platform, and a cracked Acunetix installation.

The threat actor ran safety-alignment-removed DeepSeek, GLM and Qwen models locally, settling on an altered DeepSeek-V4 model (DS4) and routing Claude Code and Codex API calls to it. Hermes was configured to auto-approve actions and pursue exploitation independently, while reusable SKILL.md playbooks automated endpoint discovery, exploitation and credential extraction across sessions. Instructions were issued in Traditional Chinese, sometimes via WeChat and LINE, with outputs moved manually between frameworks. Hermes processed FOFA and Shodan results and scanned targets with nmap, nikto, ffuf, gobuster, dirsearch and sqlmap, executing around 3,300 terminal commands. HalberdStrike reports were passed to Hermes for attack-path analysis and then to Cursor, which produced scripts targeting LFI, JWT authentication bypass, authorisation fuzzing and reflected XSS, while Trae developed SQL injection scripts and collection utilities.

Threat Actors Compromise @ethersphere/bee-js and Swarm Desktop to Steal Cryptocurrency Wallet Keys and Deploy Persistent Backdoors - On 8 November 2026, StepSecurity reported the compromise of @ethersphere/bee-js version 13.3.0, a JavaScript client library for the Swarm decentralised storage network, with SafeDep later identifying a related compromise of Swarm Desktop version 0.56.2. The malicious releases steal Swarm wallet credentials and deploy persistent backdoors on Linux, macOS and Windows. In bee-js, the threat actor moved scripts/generate-version.cjs to the postinstall hook, causing it to request a platform-specific payload from hxxps://api[.]frameworkmetrics[.]xyz/v1/analytics, disguised as analytics traffic; Swarm Desktop embeds the same loader at startup. The payload exfiltrates config.yaml and swarm.key to hxxps://api[.]frameworkmetrics[.]xyz/v1/swarm/report, which together could grant access to the victim’s wallet. The number of exposed wallets and any stolen funds remain unknown.

On Linux and macOS, the payload installs evjawbreaker, a Go-based remote shell, in ~/.solidity/, persisting via the systemd service solidity-langsupport-runner.service or the LaunchAgent com.solidity.langsupport.runner. The implant connects over TLS, checks for analysis environments and retrieves its C2 address from the Ethereum smart contract 0xf8a900Db50b3331be6B768bA460BB59f3E40C344, allowing infrastructure changes without modifying the implant; the hub on 8 November was 193[.]57[.]9[.]155:4912. On Windows, an obfuscated PowerShell script bypasses UAC via UACME method 39 (or repeatedly prompts for elevation), adds a temporary Microsoft Defender exclusion and silently installs a signed ScreenConnect 25.4.3 client connecting to 185[.]232[.]84[.]169:8041, configured for hidden, unattended SYSTEM-level access.

General News

Cybercriminals are increasingly infecting regular people with spyware - According to a new iVerify report, cybercriminals are infecting devices with spyware at scale, increasingly targeting ordinary users. iVerify detected 1.07 infections per 1,000 consumer scans, from hundreds of thousands of devices checked, compared with 0.7 per 1,000 for enterprises, a gap it attributes to enforced patching, on-device detection and network controls. An average Fortune 500 company experiences around 65 infections per year, with many affected employees being rank-and-file staff rather than executives. Around 75% of detections involved criminals deploying the leaked Coruna or DarkSword iOS exploit kits, primarily for credential and cryptocurrency theft, while the remaining 25% involved mercenary spyware such as Pegasus. iVerify’s co-founder stated that criminals, rather than governments, are now the leading users of iPhone spyware, and urged businesses to stop focusing solely on VIPs and treat the threat as organisation-wide.

DarkSword, first made public in March, is a full-chain JavaScript-based iOS exploit kit delivered through watering hole attacks, infecting victims who simply visit a compromised website. Coruna is similarly delivered via malicious sites exploiting WebKit and kernel vulnerabilities, and has been used to steal cryptocurrency from over 42,000 iOS devices through fake Chinese-language financial websites. First discovered by Google Threat Intelligence Group in February 2025, Coruna has been tied to a former L3Harris Trenchant executive who was sentenced to seven years in prison in February 2026 for stealing and selling exploits. Victims of both kits received no Apple threat notifications, despite the frameworks offering device takeover comparable to Pegasus, including access to messages, photos, emails, microphones and cameras. Android faces a similar shift as cheap, turnkey spyware kits proliferate. Notably, infection rates did not decline despite consumer scan volumes quadrupling, whereas a December 2024 iVerify report found Pegasus on 2.5 per 1,000 devices, at a time when nation-state spyware dominated the threat landscape.

CEO-spoofing scammers used AI to help steal more than $100 million, feds say - The US Justice Department has indicted three men for allegedly defrauding companies of approximately $129 million between 2024 and 2026 using AI to impersonate corporate executives and lawyers. Two of the defendants were arrested in Spain this summer and the third was detained in the UK in September, with extradition requests pending for all three. Two are Israeli nationals and one is Spanish, and each faces up to 104 years in prison on charges including wire fraud, money laundering and aggravated identity theft. Alleged victims include hospitals in Missouri ($5 million) and California ($2.9 million), a Rhode Island bank ($2.6 million), a UK technology company ($11.5 million), a Massachusetts finance company ($4.6 million) and a Florida pet food company ($5.2 million).

According to court documents, the defendants and co-conspirators used AI to spoof the voices and images of real CEOs, contacting lower-level employees about a supposedly confidential financial transaction and then directing them to speak with lawyers from a large international firm, also impersonated using AI. One defendant allegedly followed a script to impersonate the lawyers, while another managed the laundering of funds, reportedly boasting of laundering $400 million since 1994, and had a previous bank fraud conviction from 2008. Stolen funds were wired to accounts across the US, Europe, the UAE and China before being converted to cryptocurrency. The FBI described the case as an example of criminals weaponising emerging technology and urged other potential victims to come forward. Lawyers for one defendant denied the charges, describing him as a cybersecurity and technology adviser and arguing that such expertise does not in itself establish involvement in the alleged conduct.

AI company Fireworks says hackers stole data, billing info during October breaches - AI infrastructure company Fireworks has disclosed two breaches in October 2026 that resulted in the theft of billing information and AI-related data. The first, discovered on 6 October and investigated by Palo Alto Networks Unit 42, was attributed to a well-known financially motivated cybercriminal group that stole account and billing information along with secrets granting access to users and applications, affecting a limited number of customer accounts. In a second incident on 23 October, threat actors compromised a third-party cloud provider hosting Fireworks’ R&D machines, using it the following day to reach development systems and run an unauthorised workload, accessing internal data, invoices, payment history and AI datasets. Affected customers have been notified, and Fireworks is working with Palo Alto Networks to harden its security posture and revoke compromised credentials. Notion confirmed that some of its customers were impacted, disconnecting from Fireworks, deleting its data held there, disabling its Insights feature and ceasing to serve open-weight models through the provider.

Fireworks linked the breaches to a wider wave of “LLMJacking” attacks recently highlighted by Google Threat Intelligence Group (GTIG) and Mandiant, in which threat actors hijack an organisation’s access to large language models. Mandiant has responded to multiple such incidents in 2026 across cloud and LLM providers, affecting financial services, retail, technology and transportation organisations in North America, South America and Asia-Pacific. Unlike cryptojacking, LLMJacking can generate fraudulent charges exceeding $100,000 in a single day, with cumulative costs reaching $1 million at some organisations. GTIG attributes the activity to diverse financially motivated clusters operating globally, some specialising in initial access before handing off to groups that monetise and resell LLM access, primarily through stolen tokens and credentials. GTIG expects threat actors to increasingly automate reconnaissance for exposed API tokens and exploit vulnerabilities in model routing middleware as enterprises adopt agentic workflows, sustaining a growing illicit resale market.

Threat Actor Weekly Graph

Over the past 7 days, we have been tracking the following intent and opportunity changes within our Threat Actor Landscape.

Intent represents the potential targets of a group. When a group is observed attacking a different organisation or entity, their intent will increase.

Opportunity represents the various methods and technologies these groups may use. For example, if a group started using a new attack vector, such as a new kind of ransomware, their opportunity would increase.

Both intent and opportunity are scored out of 100 and are responsible for scoring the group's severity. These updates can be seen below.