FlagThis — Daily Cybersecurity Intelligence Briefing

Beginning October 30, 2026, threat actors compromised Check Point Security Gateways running Gaia OS by chaining unauthenticated remote code execution in the Mobile Access portal (CVE-2026-109618, CVE-2026-109619) with a Gaia OS local privilege escalation zero-day (CVE-2026-123039) that abuses the Dynamic CLI IPC interface to obtain root. Attackers deployed TSGA and TSProxy backdoors, embedded web shells in login-page templates, exfiltrated firewall configurations, tampered with logs, pivoted via SSH to VMware ESXi, and deployed the destroy_v6 wiper. A couple of dozen customers were impacted; emergency hotfixes and dynamic_server process isolation are required.

Operation Tornado is a coordinated international law enforcement action targeting five Tor-hidden dark web markets facilitating opioid and fentanyl trafficking. The DOJ, Europol, FBI, DEA, and partner agencies executed 354 arrests and seized approximately $234 million in cryptocurrency and assets. Investigators deanonymized actors through blockchain analytics, seized server infrastructure and hosting logs, and extracted vendor-customer messaging databases, PGP keys, and administrative panels. The operation disrupts darknet drug distribution infrastructure and intercepts illicit financial flows supporting synthetic narcotics.

SignDrop is a locally exploitable Windows zero-day in the Common Log File System driver (clfs.sys) that permits standard local users to escalate privileges to SYSTEM. The exploit abuses the CLFS log-authentication and mitigation feature by forcing a privileged process, such as Windows Defender, to open a crafted container, triggering privileged companion file creation through path redirection. Successful exploitation requires Windows 11 26H2 with system age exceeding 90 days and the registry value HKLM\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode set to 0 or 1. Microsoft is investigating, reports no confirmed in-the-wild exploitation, and states Windows Defender blocks attempts.

SilentAir, a state-linked APT, compromises Asian telecommunications infrastructure to intercept SMS-based two-factor authentication codes targeting Taiwan mobile subscribers. The group exploits SS7/SIGTRAN signaling vulnerabilities and breached OSS/BSS management interfaces to access Home Location Register (HLR) and Home Subscriber Server (HSS) systems, enabling SMS redirection and one-time passcode capture. This bypasses SMS 2FA for government, financial, and technology sector accounts without endpoint compromise. C2 uses DNS tunneling or encrypted channels over ports 443/8443. Impact includes credential theft and persistent espionage across thousands of subscribers.

The FBI has issued a flash alert regarding Artex, an open-source agentic exploitation tool that automates complex attack chaining at machine speed. By leveraging scripted modules and AI-driven logic, Artex compresses the intrusion lifecycle, moving from initial access to privileged access in under three hours. The tool automates techniques across the MITRE ATT&CK framework, including execution, credential access, and lateral movement, significantly reducing the window for manual defender intervention. The widespread availability of Artex on GitHub increases the risk to under-resourced organizations, as the automation lowers the technical barrier for executing high-speed, sophisticated intrusions.

Self-propagating prompt payloads targeting Microsoft AutoGen, LangChain LangGraph, and CrewAI enable autonomous agent-to-agent malware propagation without host code execution vulnerabilities. Malicious natural-language instructions embedded in agent inputs, tool outputs, shared memory, or poisoned templates execute within LLM reasoning loops and replicate across inter-agent message queues, state graphs, and delegation chains. Attack vectors include indirect prompt injection, recursive delegation commands, and vector database memory poisoning. Impacts include unauthorized tool and code execution, lateral movement across agent swarms, data exfiltration, orchestration logic compromise, and supply chain contamination via malicious agent skills. Remediation requires strict I/O sanitization, least-privilege tool access, sandboxed execution, and runtime monitoring of shared state.

Liminal Panda, a state-aligned APT tracked alongside SilentAir, compromises mobile core networks by exploiting SS7 MAP/CAP and Diameter signaling protocols. The actor conducts cross-border espionage targeting Taiwanese and Asian telecom subscribers through SMS interception, voice call monitoring, real-time location tracking, and roaming interface abuse. Persistence is maintained via BPFdoor, an eBPF-based sleeper-cell implant deployed within telco environments. This signaling infrastructure compromise enables state-linked intelligence collection across global mobile networks without direct endpoint malware deployment.

Starting November 10, 2026, the wfx-loot campaign targeted 61,764 GitHub repositories by hijacking 4,837 user accounts using stolen session tokens. Attackers deployed a self-deleting "wfx" payload via malicious GitHub Actions workflow YAML files to exfiltrate CI secrets, specifically targeting AWS and Azure cloud credentials. While execution occurred in 1,806 repositories, the threat actor established persistent cloud backdoors within victim infrastructure that persist after secret rotation. This identity-driven supply chain attack underscores the risk of long-lived session tokens and insufficient CI/CD pipeline protections.

ARTEX is an autonomous, multi-agent LLM-driven offensive Command and Control (C2) framework that compresses the cyber attack lifecycle to as little as 15 minutes. Written in Go with a Next.js interface, the tool utilizes six specialized sub-agents to translate tactical objectives into machine-executable commands via frontier and open-source LLM APIs. Weaponized by threat actors including Storm-0940 (UNC7228) and Storm-3358, ARTEX facilitates high-velocity exploitation of Azure/AWS cloud control planes, Active Directory (via Kerberoasting and DCSync), and web applications through MySQL general_log JSP webshell injections. Its ability to generate semantically legitimate administrative activity necessitates a transition from static IOC-based detection to first-party behavioral telemetry.

Microsoft has disclosed CVE-2026-124194, an actively exploited zero-day spoofing vulnerability in Microsoft Outlook. Identified during the November 10, 2026, Patch Tuesday cycle, the flaw allows attackers to deliver specially crafted message files that, upon user interaction, trigger outbound connections to attacker-controlled infrastructure. This mechanism forces the leakage of Windows authentication data, specifically NTLM hashes, facilitating credential theft and potential NTLM relay attacks for lateral movement within enterprise environments. Both Microsoft MSRC and CISA have confirmed in-the-wild exploitation. This vulnerability poses a critical risk to domain identity security and requires immediate patching and monitoring of outbound SMB/NTLM traffic to untrusted external IPs.