ZeroFox Daily Intelligence Brief - November 2, 2026
ZeroFox Daily Intelligence Brief - November 2, 2026
ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Here is today’s daily roundup to give you and your clients an advantage over the adversary.
Brief Highlights
- FBI Attributes USD 6.3 Billion Binance Crypto Heist to North Korean Group
- Booba Project Increasingly Targeting U.S. Public Sector and Healthcare Entities
- More Airline Companies Impacted in Amadeus Breach
FBI Attributes USD 6.3 Billion Binance Crypto Heist to North Korean Group
What we know: The FBI has attributed the USD 6.3 billion cryptocurrency theft from Binance to North Korean state-sponsored threat group “TraderTraitor,” also tracked as Lazarus Group and APT38. Binance initially linked the breach to a compromised DevOps engineer's laptop, subsequent investigation later revealed additional points of compromise.
Context: Attackers reportedly deployed a self-destruct mechanism that destroyed tooling and traces as they progressed. The FBI has published 628 cryptocurrency addresses associated with the theft. Binance has covered approximately 95 percent of impacted amounts and resumed withdrawals on November 1.
- Meanwhile, at least three other entities related to cryptocurrency have disclosed cyber security incidents in the past week, including prediction market platform Polymarket, blockchain analytics firm Chainalysis, and hardware wallet maker Trezor. Trezor’s compromise is related to the compromised devices sold through Malaysia-based CryptoBilis, in which Ledger was also impacted.
Analyst note: Sustained attacks of this scale against major exchanges are very likely to erode institutional and retail confidence in centralised cryptocurrency platforms, potentially destabilising market liquidity in the near term. The FBI’s attribution is unlikely to disrupt North Korean state-sponsored operations directly, but in the near term the group’s ability to launder and liquidate the stolen funds is very likely to be complicated.
Booba Project Increasingly Targeting U.S. Public Sector and Healthcare Entities
Source: https://cloud.zerofox.com/intelligence_new/advanced_dark_web/113705
What we know: ZeroFox has observed ransomware and digital extortion (R&DE) group Booba Project targeting multiple U.S. public sector and healthcare entities, including Terrebonne Parish Consolidated Government (TPCG). TPCG had disclosed suspicious activity, exposing residents, employees, and vendors’ personally identifiable information, government identification numbers, financial account information, and biometric data among other data. .
Context: In the past month, healthcare was the most targeted sector by Booba Project, followed by government entities. Targeting of local government administrations in the United States comes ahead of midterm elections on November 3. Additionally, the U.S.-based medical alert service provider LifeFone is allegedly among the latest healthcare victims.
Analyst note: Booba Project is likely escalating and mostly targeting entities operating essential civic functions and emergency services due to their low tolerance for downtime, giving the group maximum coercion leverage for financial gain.
More Airline Companies Impacted in Amadeus Breach
What we know: Malaysia Airlines joined Hong Kong’s flagship carrier Cathay Pacific Airways in confirming a cybersecurity incident involving data breach at Amadeus Passenger Service System, a Spain-based travel tech firm. Previously, Japan Airlines and South Korea's Asiana Airlines confirmed customer data was compromised in the Amadeus breach.
Context: Cathay Pacific Airways confirmed an unauthorized party reportedly used login credentials assigned to an Amadeus system account to access a travel booking display environment. The access exposed reservation data (booking references, passenger names, and flight details) for approximately 53,000 Cathay Pacific bookings. Separately, on October 20, 2026, ZeroFox observed an untested threat actor "dharmaka" advertising network access allegedly associated with an unnamed Canada-based air ticket sales company, with the compromised system integrating with Amadeus platform.
Analyst note: Amadeus breach is likely to impact more airline entities, since the unauthorized access lasted more than three years on a platform that serves hundreds of airlines globally. Threat actors are likely to use the exposed booking references and itineraries to craft convincing phishing scams.
DEEP AND DARK WEB INTELLIGENCE
XSS user beybala: Untested threat actor "beybala" has advertised an alleged zero-day exploit targeting devices manufactured by NETGEAR, a U.S.-based networking hardware company, on predominantly Russian-language dark web forum XSS. The actor claims the exploit enables disclosure of stored credentials and secrets, including administrator password hashes, Wi-Fi pre-shared keys, ISP and Dynamic DNS credentials, SMB credentials, and TLS private keys. The alleged capabilities also include DNS hijacking of LAN clients, man-in-the-middle (MITM) interception of network traffic, and persistence through cron jobs or startup backdoors that reportedly survive reboots and password changes.
VULNERABILITY AND EXPLOIT INTELLIGENCE
CVE-2026-111357 and CVE-2026-118527: CISA has added two actively exploited Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-111357 is a missing authentication for a critical function flaw that could enable a local attacker with low privileges to escalate privileges. CVE-2026-118527 is a predictable identifier vulnerability that could enable a remote authenticated attacker to upload files containing attacker-controlled content to a known location on disk.
Indicators of Compromise (IOCs): Attacker-associated IP 108.165.147[.]64, suspicious requests to /dana-na/auth/url_default/welcome.cgi containing the X-DSCGI-PATH header, and malicious scripts including /data/.icscap/h.py, /tmp/ml.py, /tmp/rq5.py, /tmp/mk.py, and /tmp/rr.py. Attackers also tampered with /home/runtime/dlogs/debuglog and /var/log/audit/audit.log.
Affected products: Affected products are listed in this advisory.