THE CYBERSECURITY BRIEFING
Daily reporting. Deeper analysis. Follow the evidence behind the headlines.
HIGHLIGHT OF THE DAY
Cybersecurity · In depth· 5 min read
The FBI has attributed Binance’s approximately $6.3 billion theft to North Korean activity and published addresses for transaction blocking. Withdrawals have begun reopening, but service availability, recovered funds and the intrusion’s root cause remain separate questions.
Cybersecurity
AT A GLANCE
Ivanti added CVE-2026-111357 and CVE-2026-118527 to its advisory on October 29 and released fixes; CISA added both to its Known Exploited Vulnerabilities catalog the next day. Ivanti says the flaws were exploited against a limited number of customers when chained with the previously disclosed CVE-2026-104935. Volexity reported that the activity included credential theft and Active Directory queries, and Rapid7 urges emergency patching and investigation for compromise.
What changed At the October 13 disclosure, the authentication bypass had a fix but the privilege-escalation component did not. Fixes now cover all three vulnerabilities.
Why it matters For Connect Secure operators, installing updates does not establish that an appliance is clean: the observed attack can escape Ivanti's integrity checks, leaving prior compromise unresolved.
What to watch next Rapid7 recommends a post-patch compromise investigation, with memory and logs preserved before rebooting where feasible; suspected compromise calls for recovery steps and credential rotation.
Rapid7 ↗The FBI said North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29, 2026, and linked the activity to TraderTraitor. The bureau and partner agencies say the stolen assets were converted mostly into Ethereum and urge crypto services to block transactions associated with 628 listed addresses. Binance resumed withdrawals in phases and said it had replaced about 95% of the stolen assets with its own funds; scammers have meanwhile circulated fake compensation offers.
What changed Binance says replacement of stolen assets rose from 90% to about 95%. The outstanding portion consists of less liquid tokens that the exchange says are harder to acquire at the required scale.
Why it matters For Binance customers, reopening withdrawals does not yet mean normal access: network-by-network checks and heavy traffic can still delay transfers.
What to watch next Binance says it will publish a post-incident report when its investigation concludes; the source gives no publication date.
HelpNet Security ↗LESS NOISE. MORE CONTEXT.
Sophos says the group it tracks as GOLD OGRE used Cursor AI agents, supplied with VPN logins and targets, to map networks, search for credentials and move laterally; in some incidents, agents reached domain management access. The company reports that three victims were later named on Aur0ra’s data leak site, while ransomware deployment remained under human control. Sophos says the operators presented the activity as authorized testing to evade tool guardrails.
Why it matters For enterprise defenders, the reported risk extends beyond AI-generated attack code: agents given network access searched internal files for passwords and, in some cases, reached domain management access. The evidence does not establish fully autonomous ransomware attacks.
HelpNet Security ↗Wiz Research says it recovered more than 13,500 planted branches from over 850 compromised GitHub accounts in a campaign it calls Gheist. According to the report, the campaign used stolen tokens to find accessible repositories, add workflows that printed repository secrets into logs, and download the results.
Why it matters For GitHub repository owners, a stolen token's reach defines the potential exposure: the tool targets every repository it can access, so one token can enable secret theft across multiple repositories rather than just one project.
HelpNet Security ↗