TI Mindmap Hub | Weekly Threat Brief — Issue #41

Week of October 26 — November 1, 2026

⚡ TL;DR: What You Need to Know Right Now

Three developments define this week. I checked them against the full source reporting via MCP, which corrected the affected versions and the scope of the Threat of the Week, the attribution strength behind the DPRK PHP2Shell campaign, and the severity data in the vulnerability spotlight.

1. A tampered copy of Anthropic's Claude Code extension (versions 2.1.312 and 2.1.313) was served from Cursor's extension marketplace for about 11 hours on October 29, exposing up to 5,000 users. A 66-line loader prepended to the legitimate bundle planted an attacker SSH key, opened a reverse SSH tunnel and installed persistence on macOS, Linux and Windows while the extension kept working normally. Anthropic confirmed its systems were not compromised; the VS Code Marketplace, Open VSX and npm releases were unaffected. Uninstalling the extension removes none of the backdoor.
2. Binance lost about $6.4 billion in roughly 20 minutes after a DevOps engineer's laptop was compromised. No private keys were stolen: the attackers reached a service container that could make Binance's own hot-wallet signing infrastructure approve their withdrawals across ten blockchains. Chainalysis and TRM Labs attribute the theft to North Korea's TraderTraitor with varying confidence. About $3 billion was frozen within the first hours.
3. PHP2Shell and the Brotli decoder flaw both entered CISA's Known Exploited Vulnerabilities catalog. CVE-2026–109619 was added on October 26 with a three-day deadline; Brotli CVE-2026–111497 followed on October 27. CYFIRMA reports a suspected DPRK campaign targeting PHP servers in ten countries, while Wiz shows how hard reliable exploitation still is in the wild, and how fast exposure is shrinking.

Supply chain compromise stays in the top TTPs at 15 incidents, now 37 consecutive issues (#5–#41). Exploitation of public-facing applications and edge devices stays #1 at 26 incidents.

🌐 The Big Picture

63 reports. 43 CVEs, 21 of them exploited. And one theme ties the lead stories together: the developer workstation is now the most valuable endpoint in the enterprise.

The workstation is the target. The Claude Code incident planted SSH access on machines that hold source code, Git identities, cloud CLIs and AI keys. Binance's loss started on a DevOps laptop with a path to a container that could talk to the signing system. The "Black October" wave hit nine AI developer platforms whose real value was the customer credentials stored in their environment variables. Each case turns developer convenience (a trusted extension, programmatic access to production, secrets kept close to the build) into the attacker's shortest route to impact.

Trust in distribution keeps failing in new places. Issue #40 covered a hijacked maintainer pipeline (LiteLLM) and replaced release binaries (OVHcloud CLI). This week the weak link was a marketplace that redistributes someone else's extension: the vendor's own channels were clean, yet Cursor users received a backdoor under the vendor's name. For defenders, the publisher name on an extension is no longer enough; what matters is where the artifact came from and whether new versions can install themselves without review.

AI keeps moving into the attack loop. The AI-attack thread in this briefing went from capability demos (JADEPUFFER, Issue #24) to operator-steered agents (Gambit, #36), autonomous breaches (DIVD, #37), an exposed AI orchestration server (PaperCut, #39) and AI on every side of last week's stories (#40). This week the AI sits inside the tooling itself: NIK C2 sends prompts to OpenAI from the victim's own machine, GOLD OGRE used agentic AI to build and run Aur0ra ransomware intrusions, and the operators behind the suspected DPRK PHP2Shell campaign reportedly used a local AI model to rank public exploits. Meanwhile, stolen AI credentials have become a currency of their own, with Bedrock keys validated within 30 minutes of theft and resold through discounted model-routing services.

🛑 Threat of the Week: Tampered Claude Code Extension on the Cursor Marketplace

anthropic.claude-code 2.1.312 / 2.1.313 | Cursor extension marketplace | Exposure window: October 29, ~09:27 to 20:35 UTC | Up to 5,000 users | 4 reports this week

On October 29, Cursor's marketplace served a tampered copy of the Claude Code extension. Microsoft, citing Cursor's security notice, lists versions 2.1.312 and 2.1.313; most third-party analyses refer only to 2.1.313. The incident was confined to Cursor's marketplace: Microsoft confirmed the packages were never distributed through the Visual Studio Marketplace or npm, Socket's registry evidence refutes early claims of spread through Open VSX, and Anthropic confirmed to Microsoft that its systems were not compromised and that it did not build the malicious package.

How the loader worked. A 66-line JavaScript function was prepended to the authentic extension.js, so it ran as soon as the editor loaded the extension, with no user interaction and no Claude conversation required. The real extension kept working, and errors were silently swallowed. In sequence, the loader:

• collected hostname, username, OS, architecture, home and working directories, the global Git email, and the names (not the values) of up to 40 environment variables containing terms like KEY, TOKEN, SECRET, PASS, AWS or GCP;
• appended an attacker Ed25519 key with the comment svc-telemetry to ~/.ssh/authorized_keys and tried to enable SSH (Remote Login on macOS, sshd on Linux, OpenSSH Server on Windows);
• decoded a second, embedded private key and opened a reverse tunnel as tunnel@134.209.82[.]225 with -N -R '*:0:localhost:22', retrying every 60 seconds through autossh or ssh (a hidden PowerShell loop on Windows);
• installed persistence: a LaunchAgent at ~/Library/LaunchAgents/com.apple.sysmond.plist on macOS, an @reboot crontab entry on Linux, and a SysMon scheduled task requesting SYSTEM (with a sysmon.cmd Startup-folder fallback) on Windows;
• beaconed host details over plain HTTP to 134.209.82[.]225:8099/beacon about 1.5 seconds later.

What actually succeeded. Cursor reports that coding errors and administrator-permission requirements blocked SSH access on most macOS and Windows hosts. That limits remote access, not exposure: the key, the persistence scripts and the beacon may still have landed, and on any host where the tunnel came up the operator had interactive SSH, so the loader's artifacts may understate what happened next.

A note on the automated summary. The platform's write-up implied the loader harvested secrets from environment variables. It collected variable names only. That still tells an attacker which hosts carry cloud and CI credentials, but rotation should follow the investigation of SSH and tunnel activity, not the beacon alone.

Immediate actions:

• Identify every system that installed or auto-updated anthropic.claude-code 2.1.312 or 2.1.313 from the Cursor marketplace on October 29. Preserve the extension package, SSH files and startup artifacts before cleanup.
• Remove the svc-telemetry key after confirming its fingerprint (SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk). On Windows, also check C:\ProgramData\ssh\administrators_authorized_keys.
• Remove persistence: the com.apple.sysmond LaunchAgent with ~/.config/.smt and .smtk (macOS), the @reboot cron entry and the same files (Linux), the SysMon task, sysmon.cmd, smt.cmd and smtk (Windows). Kill ssh/autossh processes carrying -R *:0:localhost:22 and delete .stk_* identity files.
• Block 134.209.82[.]225 on ports 22 and 8099 and hunt for historical connections.
• Where SSH acceptance or tunnel traffic is confirmed, rotate SSH, Git, cloud and AI credentials from a clean machine, and prefer rebuilding the host.
• Going forward: restrict Cursor extensions to approved publishers and enable an installation cooldown for newly published versions, as Cursor's hardening guidance recommends.

→ Microsoft analysis · OpenSourceMalware technical breakdown · Socket on distribution scope · Sophos guidance

🔍 Patterns to Watch

Pattern #1: Binance and the Developer Laptop as a Signing Key

Binance's loss of about $6.4 billion did not involve stolen private keys. According to the company, a DevOps engineer's laptop may have been compromised, giving the attackers access to a service container from which withdrawal transactions could be submitted. TRM Labs assesses that the attackers could effectively instruct the hot-wallet signing system to sign arbitrary withdrawals. On Ethereum they abused EIP-7702 delegation to turn a hot wallet into an attacker-controlled sweeper; on the other nine chains the withdrawals were simply valid, signed transactions.

Two details matter for defenders. First, the attackers staged for at least 36 hours before moving funds, so the theft window is not the investigation window. Second, the initial access vector is not public. TraderTraitor's known playbook (fake recruiters, take-home coding tests, poisoned npm and PyPI packages, interview "audio plugins") is context, not a confirmed element of this intrusion.

What to do: treat developer and DevOps endpoints with production access as privileged infrastructure; monitor developer-to-container and container-to-signing activity; require independent policy validation for high-value transactions, so that a compromised endpoint cannot make the signing platform approve anything on its own.

→ Binance attack: how DPRK targets developer laptops

Pattern #2: PHP2Shell One Week On: KEV, a Suspected DPRK Campaign, and Unreliable Public Exploits

Last week's Threat of the Week has moved from disclosure to campaign. CVE-2026–109619 entered CISA KEV on October 26 with a remediation deadline of October 29, and its EPSS now sits at 0.99999.

The suspected DPRK campaign. CYFIRMA assesses with high confidence that Korean-speaking operators in the Lazarus ecosystem moved from reconnaissance (October 17–22) to scanning and exploitation (October 25–29). It captured a target list of 216 hosts in ten countries, led by the United States (49), Japan (47), India (31) and South Korea (30); the operators' claim of 581 targets and of successful web-shell installs is unverified. The operators reportedly ranked public proofs of concept with a locally hosted AI model before testing them in a lab. CYFIRMA itself notes there is no malware-family or infrastructure overlap with a specific Lazarus subgroup, and PolySwarm calls the link suspected and unconfirmed. Read it as a strong assessment, not proof.

Exploitation is real but not easy. Wiz saw attempts reach the memory-exhaustion stage but no successful end-to-end exploitation in its own telemetry. The public kit's heap layout is tuned to the official php:8.4.26-apache image with a 128 MB memory limit, and it depends on landing consecutive requests on the same Apache worker, which real deployments disrupt. Success has been shown only on a favorable single-worker honeypot. Some "PHP2Shell" tools do not exploit either CVE at all and depend on a lab-only file-inclusion endpoint.

Exposure is falling fast. Wiz measured a ~67% drop in distinct internet-exposed vulnerable machines, and fewer than 53% of initially affected organizations were still vulnerable a week after disclosure. The share of exposed systems on PHP 7.3 or older, which has no fix, fell only from 8.3% to 5.7%.

What to do: finish the upgrade (8.5.12, 8.4.27, 8.3.36, 8.2.35) and fully restart workers; hunt from October 17 for web workers spawning shells or downloaders; look for the string JACKALPOC in responses, which CYFIRMA describes as a strong sign that blind command execution succeeded.

→ CYFIRMA: suspected DPRK PHP2Shell campaign · Wiz: exploitation attempts and remediation trends · Agentic Report

Pattern #3: "Black October" and the Market for Stolen AI Access

During October at least nine AI developer platforms disclosed incidents: Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank. No single vulnerability or actor links them, but the pattern is consistent: get into developer infrastructure, read stored environment variables, prioritize AI and cloud credentials. Zeabur says it will shut down; Railway users allegedly lost about $371,000 in cryptocurrency through stored keys.

Wiz followed two stolen enterprise credentials downstream. Each was validated within 30 minutes of the vendor's credential-access event with a single Bedrock call: a request to Claude Fable 5.1 failed, a fallback to Opus 5.5 succeeded. Then came days of quiet, automated checks before the floods: about 800,000 Bedrock requests in 30 hours in one case and 1.7 million in 13 hours in the other, together more than $100,000 in list-price usage. Token patterns looked like resold coding-agent traffic. One reseller IP, 23.106.46[.]239, also hosted an ARTEX console; ARTEX is the open-source framework behind Storm-0940's campaign in Issue #40, but nothing here links the two operators.

The same economy shows up in malware. Cisco Talos' NIK C2 includes an ai_generate command that sends prompts to OpenAI from the victim's host and, if the operator supplies no key, uses the victim's own OPENAI_API_KEY, so the bill and the logs point to the victim. Issue #40's LiteLLM stealer tested stolen keys against Bedrock within hours. AI credentials are now treated like payment cards: stolen, checked, pooled and resold.

What to do: alert on Bedrock InvokeModel from new principals, quota and inference-profile enumeration followed by bursts, and global.* profile use where it is not expected; keep AI keys out of build-platform environment variables where possible, and set spend limits that fail closed.

→ Black October for AI developer platforms · NIK C2 · GOLD OGRE and Aur0ra

🧩 ATT&CK Spotlight: SSH Keys and Tunnels Are the New Persistence Default

318 techniques observed. T1190 Exploit Public-Facing Application leads at 48 observations across 24 reports, followed by T1105 Ingress Tool Transfer (44), T1071.001 Web Protocols (40), T1027 Obfuscated Files or Information (38) and T1082 System Information Discovery (36).

The notable newcomer in the top ten is T1572 Protocol Tunneling (28 observations across 14 reports). Read it together with T1098.004 SSH Authorized Keys, which appears in the week's top TTP cluster: the Claude Code loader planted a key and a reverse SSH tunnel, CYFIRMA expects authorized-key implants after PHP2Shell web shells, and Volt Typhoon's Silent Train framework stands up temporary SSH services and keys on relay devices before tearing them down. SSH is attractive because it is native, encrypted and expected on developer and server hosts, so it rarely trips malware detection.

Tactic distribution: defense evasion leads at 346, followed by execution (218) and credential access (212). Lateral movement is again the least observed tactic (32): the week's intrusions reached their targets through developer endpoints, trusted platforms and control planes rather than host-to-host movement.

Two detections worth adding:

• T1098.004: alert on writes to authorized_keys by anything other than an approved configuration tool, especially from editor, IDE or web-server process trees.
• T1572: alert on long-running ssh or autossh processes with -R remote forwarding from workstations, and on Chisel or FRP binaries anywhere outside approved admin hosts.

🔎 Vulnerability Spotlight: CVE-2026-111497, Brotli Decoder Out-of-Bounds Write ("Node2Shell" / "Broccoli2Shell")

CVE-2026–111497 | Google Brotli decoder 1.0.3–1.2.0 | In CISA KEV since October 27 (due November 10) | Exploited in the wild | Patch available

Issue #40 flagged Brotlipocalypse as not yet exploited. It is now in KEV. The bug is an out-of-bounds write in Brotli's streaming decoder (c/dec/decode.c) when it handles an invalid block-type switch. Any process that decompresses attacker-controlled Brotli data can be hit: servers accepting Content-Encoding: br request bodies, and clients that automatically decode compressed HTTP responses. Impact ranges from crashes and memory disclosure to code execution in some configurations.

The difficulty is reach, not the patch. Brotli is vendored into many runtimes and products. Microsoft's guidance covers .NET, Node.js, PowerShell 7, Visual Studio, PHP Windows builds, Git for Windows and Linux packages; Python's Brotli and brotlicffi are affected too, and other downstream platforms are listing their own fixes. Upgrading the system library does nothing for applications that ship their own copy.

A correction to the automated summary: the platform listed CVSS 9.8, but NVD has not published a score yet and Node.js rates its advisory High. The urgency comes from KEV status and an EPSS of 0.83, not from a CVSS number.

Immediate actions:

• Update Brotli to 1.0.10, 1.1.1 or 1.2.1 (brotlicffi 1.2.1.0), then update every runtime and product that bundles it, starting with Node.js and .NET.
• Rebuild self-contained applications and container images, and restart or redeploy workloads; a patched base image does not fix an old build.
• Where patching is delayed, strip or reject untrusted Content-Encoding: br request bodies at the edge, and limit automatic response decompression in outbound clients that talk to untrusted servers.
• Watch for crashes in services that decompress untrusted input; they can be the first visible sign of exploitation attempts.

→ Microsoft: PHP2Shell, Brotli and eMudhra guidance · Node2Shell reproduction · Wiz: Broccoli2Shell

CVE trend insight. 43 CVEs tracked: 14 critical, 16 high, 6 medium, 1 low; 21 exploited, 8 with public PoC, 4 without a patch. Beyond Brotli and PHP2Shell, the week included an unauthenticated PHP object injection in WordPress Gravity Forms (CVE-2026–103039), unpatched Linux kernel and ksmbd flaws, and continued edge exploitation of Fortinet (CVE-2025-64446) and Palo Alto GlobalProtect (CVE-2026-0257). Control planes remain a state-actor priority: Volt Typhoon exploited Cisco Catalyst SD-WAN (CVE-2026-20127), a VeloCloud Orchestrator zero-day (CVE-2026-16812) and N-able N-central (CVE-2025-8875, CVE-2025-8876).

🕵️ IOC Intelligence: One Clean Cluster, One Noisy VPN Exit

862 IOCs tracked this week, 855 unique. Only 6 shared infrastructure indicators, five of them from the Claude Code incident.

🔴 134.209.82[.]225: the Claude Code loader's tunnel server and beacon endpoint (SSH on 22, HTTP on 8099, /beacon). Shared across three reports and the highest-fidelity network indicator of the week. Hunt historical connections, not just new ones.

🔴 ecb58cb2…6bf15: the malicious extension.js entry point, not the VSIX package hash, so it will not match a marketplace download record. 7e0a5288…0e278 is the decoded tunnel private key file. For hosts, the SSH key fingerprint and the svc-telemetry comment are faster to hunt than file hashes.

🔴 ~/Library/LaunchAgents/com.apple.sysmond.plist: a name chosen to look like an Apple service. Inspect what it launches rather than trusting the label.

🟠 178.249.214[.]6: the platform tags it as Lazarus-linked PHP2Shell infrastructure. Wiz identifies it as a VPN exit node that opened 399 stalled connections to pin Apache workers on October 24. It appears in CYFIRMA's list, but a shared VPN exit is a weak indicator for attribution or blocking. Use it to scope hunting, not to name an actor.

🟠 JACKALPOC in HTTP responses and 92.118.112[.]100/nfs: from CYFIRMA's PHP2Shell reporting, a command-execution validation marker and a Mirai-style loader download. Both are more actionable than scanner IPs.

🟠 23.106.46[.]239 and 38.246.114[.]118: LLM-resale infrastructure that checked stolen Bedrock keys in late October (Wiz). Useful for cloud-log hunting, not for blocking at the edge.

📊 By the Numbers

• 63 threat reports analyzed
• 43 CVEs tracked: 14 critical, 21 exploited, 8 with PoC, 4 without a patch, average CVSS 8.22
• 862 IOCs (855 unique): 332 hashes, 155 IPs, 144 domains, 141 URLs
• 318 ATT&CK techniques observed
• Top sectors: Technology, AI and Software Development 44.4%; Cryptocurrency, Financial Services and DeFi 25.4%; Government, Critical Infrastructure and Telecom 22.2%
• Top vendors affected: Microsoft, Linux, PHP Group, Cisco, Google

📝 Honorable Mentions

Volt Typhoon's "Silent Train" Framework: Black Lotus Labs documents three years of disposable four-to-six-hop relay chains built from VPS, SOHO, IoT and enterprise devices, torn down after each session, and used to exploit control planes including Cisco Catalyst SD-WAN, VeloCloud Orchestrator and N-able N-central. U.S.-based exit nodes make the final hop look domestic.

Teams Help Desk Impersonation to AD CS Takeover: Microsoft investigated two intrusions that began with fake IT support on Teams and Quick Assist. One abused an ESC1 template to obtain certificates for privileged accounts and reached DCSync; the other chained PetitPotam with ESC8 relay to get a domain controller certificate. A single privileged account excluded from automated containment was enough to keep the first attacker exfiltrating data. Password resets do not revoke issued certificates.

#StopRansomware: SafePay: CISA reports more than 600 organizations hit through edge devices and VPN credentials, with NAS backups reset before encryption.

Polymarket Wallet Drainer via DebugBear CDN: a compromised third-party performance-monitoring script injected a drainer into Polymarket, taking 28.6 million POL from 33 accounts in 52 minutes. Another case of a trusted third-party script as the supply chain.

🔮 Looking Ahead

Extension marketplaces that redistribute other vendors' packages will be tested again. The Claude Code incident needed no compromise of the publisher, only of the channel. Expect organizations to start treating IDE extensions like any other software dependency: allowlisted publishers, pinned versions and a delay before new releases install.

PHP2Shell's next phase depends on exploit reliability. Public kits still fail on most real deployments, but the gap between "fails at scale" and "works against a tuned target" is exactly what a state actor with a lab closes. The shrinking exposed population will concentrate attention on whoever is left, especially PHP 7.3 and older.

Brotli's long tail will outlast its KEV deadline. Every vendored copy in a container image, desktop application or appliance needs its own rebuild, and many will not be found until something crashes.

The market for stolen AI access is now visible end to end: theft from developer platforms, validation within minutes, pooling, resale and floods of millions of requests. Expect providers and cloud platforms to respond with tighter key scoping, anomaly-based throttling and spend controls, and expect attackers to target the platforms that hold the most keys.

🚀 Explore the Full Intelligence on TI Mindmap HUB

Every threat covered in this briefing has a full analysis on the platform: STIX 2.1 bundles, structured IOC feeds, ATT&CK heatmaps, Diamond Model visualizations and Attack Flow diagrams. The STIX Constellation Knowledge Graph now holds 34,254+ canonical entities and 75,536+ observed relationships across 2,528+ ingested reports, available in beta via MCP. Full platform documentation is at docs.ti-mindmap-hub.com, and cross-source Agentic Reports are at ti-mindmap-hub.com/analytics.

→ Explore this week's full threat dataset on TI Mindmap HUB

TI Mindmap HUB is an independent research platform that transforms open-source cybersecurity intelligence into structured, actionable threat data. All intelligence in this report is derived exclusively from publicly available OSINT. AI-powered analysis enables comprehensive coverage; findings reflect information available as of the reporting date and are not a substitute for professional security assessment.

GitHub · Platform access · Documentation