The Signal
Must Know
AI & Agents · Cyberscoop
What happened
CrowdStrike said China state-backed group Vapor Panda used the ARTEX automated agentic AI penetration-testing framework in a campaign that compromised about 140 sensitive targets in 11 days. [1]
Since Oct. 17, Vapor Panda targeted more than 200 organizations in at least 14 countries, including foreign ministries, senior government offices, defense and intelligence agencies, U.S. organizations in several sensitive sectors, and telecom providers. [1]
Why it matters
CrowdStrike reported that ARTEX, paired with DeepSeek, enabled requests as often as every 10 seconds and concurrent pursuit of multiple attack paths. [1]
AI & Agents · Theregister Security
What happened
The n0n ransomware operator targeted 23 organizations across 14 countries; investigators found no evidence that any documented compromise used vulnerability exploitation, while every documented entry relied on weak or stolen credentials. [2]
Reported entry methods included widespread RDP scanning, automated FortiGate SSL-VPN credential stuffing, exposed cloud credentials, and reused hosting-portal sessions. [2]
Why it matters
Impacts varied by target and included data theft, encryption, deletion of data and backups, and network disruption; the source says deletion and backup destruction can leave recovery problems that decryption alone cannot solve. [2]
Cloud · Malwarebytes Labs
What happened
Binance reported a security incident involving approximately $6.3 billion in cryptocurrency; Binance.US was not affected. [3]
Binance’s initial investigation identified a compromised DevOps engineer’s laptop as a possible entry point, with attackers accessing a service container and submitting unauthorized withdrawal transactions. [3]
Why it matters
TRM Labs estimated that about $6.36 billion left Binance wallets across ten blockchains, with most transfers occurring within approximately 20 minutes. [3]
AI & Agents · The Hacker News
What happened
Researchers at Parameter showed that a malicious ChatGPT share link could run an attacker’s code in the logged-in session of anyone who opened it, enabling access to that user’s private conversations. [4]
The researchers reported the flaw to OpenAI’s bug bounty program on October 18; OpenAI fixed it eight days later and rated it P1, its most serious category. [4]
Why it matters
The rapid reported fix is notable, while the finding keeps attention on how sharing workflows can intersect with authenticated private data. [4]
Also Worth Knowing
Identity · Cyberscoop
What happened
The Trump administration issued grand jury subpoenas to California election offices statewide ahead of the Nov. 3 voting deadline; the Los Angeles County Registrar of Voters confirmed receiving multiple subpoenas related to the investigation. [5]
Identity · Malwarebytes Labs
What happened
A group calling itself the Department of Peace said it stole and published personal details of more than 41,000 DHS workers; DHS said it was aware of a potential breach. [6]
AI & Agents · Malwarebytes Labs
What happened
Ads promoted browser extensions for manuals, PDF conversion, safer searches, and AI search; many routed users’ queries through operator-controlled servers before sending them to Yahoo or Bing. [7]