Zyxel GS1900スイッチへの攻撃は、すでに修正済みの問題によるものとされていた。しかしBinarlyの研究者は、攻撃者が実際にはCVE-2026-107441として追跡されるゼロデイを利用していたことを突き止めた。これは境界外書き込みの脆弱性で、細工されたHTTPリクエストによりOSコマンドの実行を許す。先の修正を適用したスイッチも同じ攻撃にさらされたままであり、ウェブ管理インターフェースに到達できる者は誰でも、ログインせずにコマンドを実行できる。同じ報道サイクルでは、CiscoがUCS Central Softwareの遠隔コード実行の脆弱性を修正し、WatchGuardが認証および中間者攻撃の脆弱性を修正した。SonicWallはGMSの脆弱性を修正しないと表明した。
新たなLinuxマルウェアCWPdoorが、Control Web Panelの管理インターフェースの基盤であるウェブサーバーcwpsrvのトロイの木馬化ビルドとして配布されている。修復のためにログインするパネルそのものに、受動型のバックドアが埋め込まれている。同じ時期に、Level Infiniteは、Goddess of Victory: NIKKEのPC版ランチャーの公式CDN上にある4つのスクリプトファイルが、9月27日から11月4日の間に改ざんされていたことを公表した。さらに、OpenAI、SpaceX、Anthropicを装った偽のイベント招待による最近のフィッシングの流行がある。2つのPhaaSプラットフォームを通じて実行され、MicrosoftとGoogleの資格情報およびアクティブなセッションを窃取している。今週のテーマは、信頼された配布経路である。
UpTransportation — 1.9× its own prior share (70 claims, 37 expected)
UpEducation — 1.8× its own prior share (55 claims, 30 expected)
UpHealthcare — 1.2× its own prior share (111 claims, 94 expected)
DownAgriculture and Food Production — 0.6× its own prior share (21 claims, 37 expected)
25% of claims carry no sector label.
Brand churn
Of the 235 leak-site brands first seen since 2021-09-30, 75% were still claiming 30 days after their first post and 70% were still claiming 60 days after their first post and 67% were still claiming 90 days after their first post and 61% were still claiming 120 days after their first post (Kaplan-Meier; quiet = 60 days without a claim). 18% of the 214 old enough to judge posted on one day and never again; 38% made at least half their claims in their first week. New brands this month: 4 — newest: Destello (2026-11-05, 1 claim), Aoqin (2026-11-04, 5 claims), OBSOFT (2026-11-03, 6 claims).
Brands born before coverage began are excluded (their true age is unknown); a rebrand counts as one brand going quiet and another being born.
Targeting
Over the last 180 days, among brands with at least 20 labelled claims: safepay put 33% of its claims on Germany (6.3× every other brand's share); N0n put 33% of its claims on Transportation (7.3× every other brand's share); Storm put 78% of its claims on the United States (2.1× every other brand's share). Widest spread: nightspire across 10.6 effective sectors.
Lift = the brand's share of a sector or country over every other brand's share in the same window; exact binomial tails, Bonferroni-adjusted for the categories tested. Claims with no sector or an Unknown/Other label are excluded.
Posting clock
Over the last 180 days, among brands with at least 30 claims: clop released 94% of its claims on Wednesdays, half of them in 13:00–15:59 UTC; safepay released 60% of its claims on Mondays, half of them in 18:00–19:59 UTC; akira posted only 1 of 199 claims at weekends and half its claims in 12:00–13:59 UTC; half of play's claims appeared in 18:00–20:59 UTC. Leak sites overall are 35% quieter per weekend day than per weekday.
all brands by hour of day, 00–23 UTC; half of all claims land in 12:00–19:59 UTC.
Times are when trackers first saw each claim on the leak site, in UTC: not the attack time, not the operator's clock, and a site that is only reachable at certain hours shows the same pattern; batch releases show as spikes. Hour-of-day concentration: Rayleigh test; weekday shares: exact binomial against every other brand, Bonferroni-adjusted.
Leak-site claims as discovered by trackers, not confirmed breaches. Surprise compares the last 7 days with the group's own prior 173 days (Poisson). Victim claims: ransomware.live and leak-site trackers