Varonis Threat Labs presents NotC2, a proof-of-concept using SQS, Lambda, SNS and Amazon Bedrock for post-compromise AWS command and control, detailing its permissions, cloud-log detection signals and defensive controls.
🔗 https://cyber.hendryadrian.com/article/16847/varonis-demonstrates-notc2-ai-powered-c2-framework-built-on-aws

Censys’ 2026 report estimates about 134,000 internet-exposed ICS hosts globally, up 4% since 2024. It identifies mobile-network hosting, expanded attack surfaces, weak configurations, and network concentration as factors sustaining exposure.
🔗 https://cyber.hendryadrian.com/article/16887/censys-report-finds-persistent-exposure-of-internet-facing-ics

Apiiro found secrets in 1,122 public copies of Claude Code’s settings.local.json. Researchers did not test whether most remain valid; one notified company confirmed its key was live. Git history and forks can retain the files.
🔗 https://cyber.hendryadrian.com/article/16914/apiiro-finds-secrets-in-1-122-public-claude-code-settings-files

A Telegram-based investigation maps Dark Storm Team’s account and channel changes, claimed attacks, DDoS services and group relationships. It cautions that availability checks do not prove attacks and that some affiliations remain unclear.
🔗 https://cyber.hendryadrian.com/article/17037/investigation-traces-dark-storm-team-s-operations-ddos-services-and-alliances

Crédit Mutuel Arkéa says an attacker reached its network through a service provider’s platform and used the bank’s account for fraudulent transfers. ZachXBT estimated losses at $133 million, but the bank did not confirm that figure.
🔗 https://cyber.hendryadrian.com/article/17043/french-bank-reports-service-provider-attack-133m-loss-estimate-unconfirmed

CTM360 says it identified 1,000+ incidents in fake gift-card campaigns impersonating major brands. The portals use deceptive verification loops to drive surveys, app installs and paid subscriptions; CTM360 says no rewards were delivered in tested flows.
🔗 https://cyber.hendryadrian.com/article/17044/ctm360-details-fake-gift-card-scams-that-monetize-users-through-affiliate-offers

Microsoft says Storm-3358 used ARTEX in attacks on financial organizations, combining web application exploitation, web shells, compromised credentials and RATs. The report includes detection guidance, hunting queries and IOCs.
🔗 https://cyber.hendryadrian.com/article/17137/microsoft-reports-storm-3358-using-artex-to-target-financial-organizations

Metasploit Framework 6.5.9 adds exploit modules for unauthenticated RCE in Citrix NetScaler and Cisco Secure Email Gateway, GitLab CI/CD RCE, Flowise account takeover, OpenBullet2 flaws, and LoongArch64 payload support.
🔗 https://cyber.hendryadrian.com/article/17177/metasploit-framework-6-5-9-adds-rce-modules-for-network-devices-gitlab-and-more

Hexastrike reconstructs a Qilin intrusion at a German company, detailing S5PIVOT, a Python-based SOCKS5 backconnect proxy, credential-led access, evidence of cloud exfiltration and encryption, and defensive lessons. The total data transferred remains unknown.
🔗 https://cyber.hendryadrian.com/article/17349/hexastrike-details-s5pivot-proxy-in-qilin-ransomware-intrusion

Brava Security emerged from stealth with a $15 million seed round. The startup says its platform simulates attacker behavior, analyzes security telemetry for gaps, and rewrites SIEM detections.
🔗 https://cyber.hendryadrian.com/article/17459/brava-security-raises-15-million-for-ai-powered-attack-simulation-platform

Iris Ohyama says unauthorized access to a third-party cloud service may have exposed personal information of up to 7.7 million Iris Plaza customers. The company suspended affected services; no misuse or financial loss had been reported as of November 5.
🔗 https://cyber.hendryadrian.com/article/17631/iris-ohyama-says-cloud-intrusion-may-have-exposed-data-of-7-7-million-people

A researcher found South Korea’s NCSC domain still listed two nameservers on expired aegis-k[.]com. The registry referral was fixed, but the agency’s zone still lists them and lacks DNSSEC; the article reports no evidence of abuse.
🔗 https://cyber.hendryadrian.com/article/17698/expired-nameserver-domain-exposed-south-korea-s-cyber-agency-to-dns-hijacking-risk

Apiiro found 2,539 secrets across 1,994 public repositories containing Claude Code settings files, including historical commits and forks. It did not test whether the credentials worked; one contacted organization confirmed its key was live.
🔗 https://cyber.hendryadrian.com/article/17697/apiiro-finds-2-539-secrets-in-public-repositories-containing-claude-code-settings

Apiiro researchers found 2,539 secrets across 1,994 public repositories containing Claude Code configuration files. They did not test credentials; one organization confirmed an exposed key was live.
🔗 https://cyber.hendryadrian.com/article/17782/researchers-find-2-539-secrets-in-public-repositories-containing-claude-code-configurations

StepSecurity found that @ethersphere/bee-js 13.3.0 runs attacker-controlled code at install, targeting Swarm Desktop wallet files and installing persistence. The report does not establish how many systems were affected or whether funds were stolen.
🔗 https://cyber.hendryadrian.com/article/17803/ethersphere-bee-js-13-3-0-compromise-targets-wallet-data-and-installs-persistent-access

This roundup covers EU data-sharing and cloud clauses, GDPR-related Advocate General opinions, AI oversight, CNIL session-replay recommendations, the UK NCSC’s cyber-threat review, and NIST cybersecurity guidance for self-employed businesses.
🔗 https://cyber.hendryadrian.com/article/17879/privacy-cybersecurity-94-eu-data-rules-ai-oversight-and-security-guidance

Google DeepMind reports AI-assisted methods that reduce the cost of RSA-1024 signature forgery and repeated key factoring. The findings concern legacy 1024-bit systems; modern 2048-bit-or-larger keys remain secure, the researchers say.
🔗 https://cyber.hendryadrian.com/article/17880/google-deepmind-ai-agents-reduce-the-cost-of-attacking-rsa-1024

Acronis researchers say a Taiwan-based attacker used BOSSAI AI agents to access systems and collect data across several countries, including Taipei emergency dispatch records. A separate patient-data platform was exposed, but theft from it was not established.
🔗 https://cyber.hendryadrian.com/article/17901/researchers-say-bossai-ai-agents-helped-a-taiwan-based-attacker-steal-taipei-dispatch-records

U.S. agencies warn that attackers are targeting internet-accessible refrigeration controllers. Attacks disrupted supermarket cooling in Europe, and a French blood-storage provider incident affected three facilities; the attackers remain unidentified.
🔗 https://cyber.hendryadrian.com/article/17903/u-s-agencies-warn-of-attacks-on-industrial-refrigeration-controllers

Former OpenAI engineer Abdulrahman Alfozan pleaded not guilty to allegedly planting a covert recording device in an executive meeting room to record sensitive conversations. The next hearing is scheduled for November 17, 2026.
🔗 https://cyber.hendryadrian.com/article/17902/former-openai-engineer-pleads-not-guilty-to-allegedly-planting-covert-recorder

Binance’s initial post-mortem traces a wallet incident affecting $6.34B in assets to a tampered developer-tool install and a fake job assignment that enabled access to its wallet-signing service.
🔗 https://cyber.hendryadrian.com/article/17933/binance-post-mortem-traces-6-3b-wallet-heist-to-fake-job-offer