Cyber Threat Brief — November 3 2026
1. ARTEX — software-vendor intrusions
TL;DR: WorkOS says it found unauthorized access to an internal sales app on 30 October and that the intruder used an AI-assisted offensive framework, which may be the ARTEX tooling Wiz, Google, and CrowdStrike have described. Hunt the identity bursts, the unsigned token, and the file markers below.
What’s New:
- On 2 November, WorkOS said it found unauthorized access on 30 October to an internal sales app. WorkOS does not name ARTEX, an actor, or a CVE.
- WorkOS says the data was CRM contacts, account histories, and excerpts of sales calls, support, and customer Slack, plus product-usage metadata. It reports no evidence that production application data was accessed.
- Wiz tracks an ARTEX-using actor that overlaps with Microsoft’s Storm-0940. Google Threat Intelligence tracks that cluster as UNC7228 and says other actors also use ARTEX. CrowdStrike says its VAPOR PANDA campaign is separate from Storm-0940.
- Wiz saw the user agent ReconProbe/1.0 in password-spray bursts. CrowdStrike names the directory C:\ProgramData\artx5v. Google saw files named artex-probe- followed by five digits.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| ReconProbe/1.0 | User agent | T1110.003 | IdP or WAF access log | Alert on User-Agent ReconProbe/1.0. Wiz saw it in the spray bursts and says each burst used a new user agent. |
/sign_in/oauth/microsoft/callback?code=AAAA&state=notvalidb64!! | URL | T1190 | Reverse proxy access log | Alert on this callback with code=AAAA and state=notvalidb64!!. |
eyJhbGciOiJub25lIn0.eyJlbWFpbCI6InRlc3RAdGVzdC5jb20ifQ. | Token | T1550 | Application auth log | Alert on this unsigned JWT. The payload email is [email protected]. |
| ForgotPassword | CloudTrail event | T1110 | AWS CloudTrail | Review Cognito ForgotPassword calls from one source against many users. |
*.js.map | Web path | T1595 | Web access log | Alert on a burst of GET requests for .js.map files. |
C:\ProgramData\artx5v\ | Directory | T1105 | Endpoint file listing | Search endpoints for C:\ProgramData\artx5v. CrowdStrike names this directory. |
artex-probe- | Filename prefix | T1105 | Endpoint file listing | Search for filenames that start with artex-probe-. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Partial — Okta Multiple Users Failing To Authenticate From Ip | Okta failures only, above nine users in five minutes. |
| Elastic | Partial — Entra ID User Sign-in Brute Force Attempted | Entra only, and needs 15 or more users within 30 minutes. |
| Sigma | Partial — Password Spray Activity | Fires only when Entra already labels the spray. |
Detection index: ESCU 5dba11f (2026-11-03) · elastic detection-rules d2f3cf1 (2026-11-03) · SigmaHQ 26a2c38 (2026-11-03).
Hunt hint: Search the IdP log for one address trying many accounts at about one attempt per second, and for User-Agent ReconProbe/1.0. Alert on the unsigned test JWT and on the OAuth callback that uses code=AAAA. In CloudTrail, review a burst of Cognito ForgotPassword events. On endpoints, search for C:\ProgramData\artx5v\ and for names that start with artex-probe-.
Sources: WorkOS bulletin, 2 November · Wiz, 22 October · Google Threat Intelligence, ARTEX and Friends · CrowdStrike, VAPOR PANDA · Microsoft, Storm-0940 · 22 October brief · 23 October brief
2. XCPE — Android TV-box botnet
TL;DR: Google says a preinstalled package enrolled more than 1.3 million Android TV boxes in a botnet that checks in to anyevonline.com and an MQTT broker. Remove or replace the box, because there is no firmware fix.
What’s New:
- GTIG’s 2 November post says Videostrong built the backdoor into the firmware, and that Google has banned Videostrong from Android certification.
- The package runs as com.oemservice, or as x.cpe, at android.uid.system, and it reinstalls from /oem/ into /data/app/.
- GTIG says MECOOL builds check in to mcstb.anyevonline.com on port 8000. The broker mqtt.szbboys.com resolves to 219.134.163.210 and 219.134.163.211 on TCP 3885, 3886, and 3887.
- Synthient independently names com.oemservice, signed by Skyworth Digital, the host extstb.anyevonline.com, and the same broker on those three ports.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| com.oemservice | Package | T1195.002 | Android package inventory | Remove the device. The package runs as a system app and reinstalls from /oem/. |
| extstb.anyevonline.com | Domain | T1071 | DNS | Block extstb.anyevonline.com. Synthient says the box checks in there for MQTT credentials. |
| mcstb.anyevonline.com | Domain | T1071 | DNS | Block mcstb.anyevonline.com. GTIG says MECOOL builds check in there on port 8000, and other builds use stb<AndroidVersion><Type>.anyevonline.com. |
| mqtt.szbboys.com | Domain | T1071 | DNS | Block mqtt.szbboys.com. Both reports name it as the MQTT broker. |
| 219.134.163.210 | IP | T1071 | Firewall | Block 219.134.163.210. Both reports resolve the broker here. |
| 219.134.163.211 | IP | T1071 | Firewall | Block 219.134.163.211. GTIG resolves the broker here. |
| TCP 3885 | Port | T1071 | Firewall | Block outbound TCP 3885 to the broker. |
| TCP 3886 | Port | T1071 | Firewall | Block outbound TCP 3886 to the broker. |
| TCP 3887 | Port | T1071 | Firewall | Block outbound TCP 3887 to the broker. |
| ott.szbboys.com | Domain | T1041 | DNS or proxy | Block ott.szbboys.com. GTIG names it as the file-upload host. |
| file.anyevonline.com | Domain | T1105 | DNS | Block file.anyevonline.com. Synthient says the host stores the backdoor packages. |
| com.abc.nexus | Package | T1105 | Android package inventory | Search for the loader package com.abc.nexus, then remove the device. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | No TV-box package, MQTT, or C2 domain rule. |
| Elastic | Partial — First Seen External MQTT Broker Connection | Needs parsed MQTT and misses the DNS check-in. |
| Sigma | None — verified | No MQTT broker or Android package rule. |
Hunt hint: Inventory Android TV boxes on guest and office networks. Remove a box whose package list shows com.oemservice. Block the check-in and broker names from the table at DNS, plus any other stb*.anyevonline.com host. Block the two broker addresses and outbound TCP 3885, 3886, and 3887. Replace a box that already checked in.
Sources: Google Threat Intelligence, 2 November · Synthient, 2 November
3. Gorbag — WinRAR CVE-2025-8088
TL;DR: ESET says Gorbag delivers a loader through a WinRAR archive that abuses CVE-2025-8088, which CISA has listed in KEV since 12 August 2025. Install WinRAR 7.13 or later on Windows.
What’s New:
- ESET says a RAR opened in a vulnerable WinRAR writes a decoy PDF, a shortcut in the Startup folder, and a PowerShell loader under %ProgramData%.
- ESET says the payload, BeautyStealer, sends stolen files to a Telegram chat or a FastAPI server. Its targets include .zs2, a Ukrainian signature-key file.
- CISA KEV lists CVE-2025-8088 for RARLAB WinRAR, added 12 August 2025, with a due date of 2 September 2025.
- RARLAB’s 7.13 notes describe the directory-traversal fix, and the WinRAR 7.13 notice names CVE-2025-8088. Only Windows builds are affected.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| WinRAR 7.13 | Fixed build | T1203 | Software inventory | Install WinRAR 7.13 or later from rarlab.com. That Windows build closes CVE-2025-8088. |
| 0589D2079FBEF814DC7BB95C4B3B555C8B933AF6 | SHA-1 | T1203 | Email or download hash | Quarantine a RAR with this SHA-1. ESET names the file Повідомлення 4726-49.rar. |
| Startup folder LNK | File | T1547.001 | Sysmon file create | Investigate a .lnk that WinRAR.exe writes under the Start Menu Startup folder. |
| %ProgramData% | Path | T1059.001 | Sysmon file create | Investigate a PowerShell script that WinRAR.exe writes under %ProgramData%. ESET says the Startup LNK runs it at each logon. |
| api.telegram.org | Domain | T1567 | DNS or proxy | Alert when a non-browser process sends to api.telegram.org. ESET says BeautyStealer uses the sendDocument API. |
| 142.111.194.73 | IP | T1041 | Firewall | Block 142.111.194.73. ESET says BeautyStealer used it for exfiltration. |
| .zs2 | Extension | T1005 | File listing | Search for unexpected collection of .zs2 files. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Partial — Windows Boot or Logon Autostart Execution In Startup Folder | Any startup write, with no WinRAR parent. |
| Elastic | Partial — Connection to Commonly Abused Web Services | DNS to api.telegram.org, not the Startup LNK. |
| Sigma | Covered — WinRAR Creating Files in Startup Locations | Startup write only, not the Telegram call. |
Hunt hint: Check WinRAR on Windows hosts and install 7.13 or later where the build is older. Alert when WinRAR.exe writes a shortcut into the Startup folder or a script under %ProgramData%. Alert when a non-browser process sends to api.telegram.org. Quarantine the RAR hash from the table. If an alert hits, isolate the host and keep the shortcut.
Sources: ESET, Gorbag · ESET on X · ESET IoC note · CISA KEV · RARLAB rarnew.htm · RARLAB WhatsNew.txt · WinRAR 7.13 notice
Status Updates
- Ivanti Connect Secure (CVE-2026-111357): KEV was due 2 November 2026 and is now overdue. The fix guidance is unchanged: move 25.1.2.2-and-prior nodes to the fixed 25.1.3.x release, as the 1 November correction says. CVE-2026-118527 is still due 13 November. 1 November brief.
- Plex Media Server (Plex2Shell-CVE-2026-96652): KEV for CVE-2026-96652 and CVE-2026-96655 is due today, 3 November 2026. CVE-2026-96654 and CVE-2026-96656 have been overdue since 23 October. The fix is still 1.43.3.10861. Plex. 21 October brief.
- Siemens Software Center (CVE-2026-110936): KEV is due today, 3 November 2026. The fix is still V4.0.9.8. Siemens SSA-580366. 21 October brief.
- European refrigeration controllers: SecurityWeek says over 100 stores were hit on 1–2 November, also in Finland, Italy, and Portugal. Lupovis says its Danfoss AK-SM decoys saw default-credential logins 20–30 October. Censys counts just over 1,000 exposed Danfoss StoreView panels. The cause is unconfirmed. 2 November brief. SecurityWeek. Censys.
- Retired from watch: OVHcloud CLI (OVHcloud-CLI-2026-10) and Rank Math PRO 3.0.123 (RankMath-SEO-Pro-3.0.123) (last update 2026-10-20). No new report or IOC set. 20 October brief.
- Watching (no change): KEV overdue: GitLab CVE-2026-97229 (11-02); Ruby Onigmo for GitLab (Ruby-Onigmo-2026-10-23, 11-02); Cisco ASA/FTD CVE-2026-76418 (11-02); PHP core PHP2Shell-CVE-2026-109618 (11-02); Linux kernel CVE-2026-46300 (10-29, retire-eligible 2026-11-07).
- Watching (no change): KEV overdue: Cisco Catalyst SD-WAN CVE-2026-20127 (10-29, retire-eligible 2026-11-05); BeyondTrust Remote Support CVE-2026-102764 (11-01). Not in KEV: GitLab CVE-2026-110264 (11-02); Synology DSM C3RB3R (Cerber-Synology-DSM-2026-10, 11-02).
- Watching (no change): KEV due: VMware ESX CVE-2026-41709 (10-29, due 2026-11-11); Brotli CVE-2026-111497 (10-28, due 2026-11-10); Adobe Commerce CVE-2026-48356 (10-28, due 2026-11-10). Not in KEV: Canonical LXD CVE-2026-112816 (11-01); LMCache CVE-2026-105192 (10-22).
- Watching (no change): LiteLLM-1.107.0-2026-10 (10-22); ConnectWise Cloud Backup (ConnectWise-CloudBackup-SkyKick-2026-10, 10-22); UpdraftCentral-2026-10 (10-19, retire-eligible 2026-11-04); eMudhra-CVE-2026-111943 (10-27); Tailscale SSH (Tailworm-Tailscale-SSH-2026-10, 10-28); Cursor-Claude-Code-2.1.313-2026-10 (10-31).