Weekly · Threat Report · LiveRSS

Weekly Threat Intelligence Report

CISA Known Exploited Vulnerabilities added in the last 7 days — fetched live from the CISA KEV feed — plus periodically-curated threat actor and ransomware reference notes below.

Report period: 4 Nov – 11 Nov 2026

CISA KEV Additions This Week

⟳ Loading KEV feed…

Standing: Ransomware Watch

Periodically-curated reference, not auto-updated — see the Ransomware Tracker for live group/victim data.

·Babuk — exploiting VMware vCenter CVE-2026-59310 (CVSS 9.8) alongside an active espionage campaign; 361 IPs hit across 47 countries since Sep 2026
·LockBit — residual affiliate activity post-Cronos takedown; renewed Asia-Pacific targeting observed Sep 2026
·RansomHub — among the most active groups since ALPHV/BlackCat's 2024 exit; India manufacturing sector in scope
·0APT — extorted Krybit (India) with doxxing threat Apr 2026; watching Indian MSPs and IT services firms
·AI-assisted operators — Sep 2026: LLM-driven intrusion completed full enterprise breach in under 10 hours (The Register)

Standing: Threat Actor Activity

Periodically-curated reference, not auto-updated — see the Threat Actor Profiles for full dossiers.

·Financially-motivated BFSI intrusion set — CERT-In CIAD-2026-0046 (Oct 9 2026): stolen API credentials used to invoke fund-disbursal endpoints directly from whitelisted infra, bypassing KYC/limits, against NBFC/fintech/wallet operators
·APT36 (Transparent Tribe) — Operation RapidRust: Rust-based RUSTYSHADE backdoor + removable-media propagation vs India/Afghanistan govt and defense (observed Aug 2026)
·APT29 (Midnight Blizzard) — ongoing cloud identity attacks; MFA fatigue campaigns
·APT28 — credential harvesting against NATO defence/government targets
·Lazarus Group — active crypto theft campaigns; targeting DeFi protocols