Weekly Cybersecurity Intelligence Report: Cyber Threats and Breaches 26 Oct to 01 Nov 2026

Overview: On 30 October 2026, Binance announced that unauthorized withdrawals had drained its hot wallets on 29 October, estimated the total impact at about $6.3 billion, and said the incident may involve a compromised DevOps engineer’s laptop.

Impact: Binance says about $3 billion has been frozen on-chain so far, that it will cover all losses from its SAFU fund and company funds, and that user funds are safe. TRM Labs measured about USD 6.36 billion moved across ten blockchains, valued at the time of each transfer, starting at 20:05 UTC on 29 October with most funds gone within about 20 minutes. Chainalysis puts the figure at about $6.4 billion and about $2.8 billion frozen; the frozen figures were measured at different times and by different parties. Sean Foley, a crypto markets expert at Macquarie University, told Al Jazeera on 30 October: “Any assets held at a centralised exchange are only as safe as the exchange itself.”

Details: Binance’s preliminary finding is that the compromised laptop may have let an attacker reach a service container and submit unauthorized withdrawal transactions, and Binance says it has found no evidence of a private key leak. TRM assesses that the attacker compromised Binance’s hot wallet signing infrastructure. On Ethereum, both TRM and Elliptic report that a single transaction carried 50 authorizations signed in advance, all pointing a Binance hot wallet at an attacker-controlled sweeper contract through an EIP-7702 delegation; the other nine chains saw ordinary signed transfers, which TRM says points to the signing infrastructure rather than a flaw in Ethereum. TRM and Chainalysis both attribute the theft to TraderTraitor, a North Korean unit, with high confidence, Chainalysis citing stolen Binance funds commingling on-chain in real time with proceeds of last month’s Bitget theft. The FBI attributed the theft to North Korea on 31 October 2026, and North Korea has denied it. Elliptic is more cautious on attribution, noting the Bitget overlap amounts to about $39,000. The outcome maps to MITRE ATT&CK T1657 (Financial Theft); the disclosures do not yet support mapping the initial access. Binance has promised a detailed post-mortem, and has continued to publish findings on the initial access since this reporting window closed; we will cover those in next week’s edition.

1Separate transaction signing from engineer workstations and from the containers engineers can reach, and require independent approval for every withdrawal path.

2Alert on any unexpected EIP-7702 delegation on treasury wallets, and on a single transaction carrying authorizations signed in bulk.

3Treat DevOps and platform engineer laptops as tier-zero assets, with phishing-resistant MFA and no standing access to production signing systems.

CISO takeaway: One engineering endpoint reached a system able to move billions in about 20 minutes, which makes developer access a crown-jewel path rather than an IT hygiene item. Map which endpoints can reach your highest-value transaction systems, and test that path the way an attacker would.

Overview: Through the last week of October 2026, airlines across Asia and Australia disclosed that unauthorized access to the passenger service system run by their vendor Amadeus IT Group had exposed customer booking data, in most cases from August 2023 until Amadeus contained the incident in September 2026. Asiana disclosed first on 23 October; by 1 November the list had grown to more than a dozen carriers.

Impact: The counts published so far:

Details: Asiana, Cathay Pacific, ANA and Star Flyer all state the intruder used login credentials assigned to an Amadeus system account, which maps to MITRE ATT&CK T1078 (Valid Accounts). Amadeus describes the cause differently: an Amadeus spokesperson told Reuters the company had found a vulnerability in a tool used to display booking information, said certain booking-display data had been accessible to unauthorized parties, and said it had found no evidence that financial data was accessed, because payment data is held separately. Amadeus says it has rotated credentials, added monitoring and seen no evidence the data has been misused, and has not said how many airlines or passengers are affected. JAL puts the access period at 10 August 2023 to 23 September 2026. Amadeus notified Korean Air and Asiana on 20 October, JAL on 23 October and Cathay on 28 October 2026. The disclosures do not say how the credentials were obtained or why three years of access went undetected.

1Ask every platform vendor that holds your customer data for its account-level access logs and the date its service accounts’ credentials were last rotated.

2Require vendors to alert on unusual record viewing by a single account, since bulk lookups over three years are a detectable pattern.

3Map which of your suppliers reach the same upstream platform, since the Japanese regional carriers here were exposed through ANA rather than directly.

4Warn affected customers about phishing that uses real booking details, as JAL and Malaysia Airlines have done.

CISO takeaway: One vendor account held three years of customer data belonging to more than a dozen airlines, and none of them could see it. Note also the disagreement in the record: the airlines’ notices describe misused credentials and Amadeus describes a vulnerability in a booking-display tool, which is the kind of gap that decides whether your own notification says “stolen credentials” or “software flaw.” Put third-party platforms that hold your customer data on the same credential rotation and monitoring standard as your own systems, and ask who else connects to them.

Overview: On 26 October 2026, the University of New Mexico Health Sciences Center disclosed a cybersecurity event that forced UNM Health to divert all ambulance traffic to other hospitals and cancel all clinic appointments for the day. UNM Hospital in Albuquerque houses New Mexico’s only Level I trauma center, as well as the state’s only burn unit and children’s hospital, and handles about a million patient visits and 80,000 emergency room patients a year.

Impact: Ambulances were diverted from 12:30 to 2:30 p.m. on 26 October, and outpatient surgeries and appointments were suspended for the rest of that day. Sandoval Regional Medical Center was included in the same shutdown. Health Sciences Center classes closed on 26 and 27 October. UNM confirmed in the early hours of 27 October that critical electronic systems were back online and ambulance traffic had returned to normal, and reported clinical operations fully functional across all UNM Health facilities on 28 October 2026.

Details: UNM says containment began around 11 a.m. on 26 October and that the event affected some end-user devices but did not penetrate core systems or servers. A ransomware group calling itself Byod, which emerged in September 2026, claimed the attack on its leak site and said it had compromised 36,000 systems across UNM’s main campus and hospital environments, including Active Directory forests, Group Policy infrastructure, the Microsoft Entra tenant and two Oracle databases, and had taken employee, patient, student, payroll and research data along with Cerner EHR rosters. Those are the group’s claims; no evidence has been published, and UNM has urged scepticism, stating that patient data was not compromised and that it made no concessions to any group. UNM has not disclosed the entry point or the attack type, and no government or vendor has attributed the incident, so no ATT&CK mapping is supported. Steven Swift, managing director at Suzu Labs, told eSecurity Planet that in a response like this “more systems than are strictly necessary may be put under containment,” which is one reason disruption can outlast the intrusion itself.

1Define in advance which loss of which clinical systems triggers ambulance diversion, so the decision is made on criteria rather than in the moment.

2Segment end-user devices from clinical core systems and test that the boundary holds when endpoints are compromised.

3Decide now who verifies a leak-site claim and what you say publicly while it is unverified, because the attacker’s figure will circulate before your own assessment is finished.

4Document a phased restoration order for clinical systems, as UNM used to bring hospitals back within hours.

CISO takeaway: An attack UNM says was confined to end-user devices still shut the state’s only Level I trauma center to incoming ambulances, because operations depend on the endpoints staff use. The gap between UNM’s assessment and Byod’s claim of 36,000 systems is the second lesson: your communications plan needs an answer ready for a number you cannot yet disprove.

Overview: On 29 October 2026, Revolve Group, which operates the REVOLVE and FWRD fashion sites, filed a Form 8-K under Item 8.01 disclosing that an unauthorized actor may have used automated means to access its systems and obtain the names, contact details, payment card numbers and expiration dates of customers who saved payment information to their online accounts.

Impact: State breach listings give the only published counts. Within this reporting window, Revolve had notified 127,200 Texas residents and 1,328 Vermont residents. As of 4 November 2026 the filings total at least 179,259 people, adding 46,813 in Massachusetts and 3,918 in Iowa. Revolve has published no company-wide total of its own, so the state figures are a floor rather than a tally. The 8-K does not mention card verification values. Revolve began notifying affected customers on 29 October 2026 and states there was no disruption to services and no expected material effect on its business.

Details: The Texas filing dates the incident to 11 September 2026 and its discovery to 29 September, so roughly three weeks passed before detection and a further month before public disclosure. Revolve says the activity has been stopped and remediated, that it notified federal law enforcement and hired outside cybersecurity experts, and that it has added security measures. The filing describes the method only as automated means and does not say whether customer accounts were taken over or a system was queried directly, so no ATT&CK mapping is supported. The filing is under Item 8.01 rather than Item 1.05, consistent with Revolve’s statement that it does not expect a material impact. The true scale may be considerably larger than the state filings suggest: Malwarebytes reported that data returned by the Texas Attorney General’s portal contained a figure of 1,515,073, labelled as the total number affected but not displayed on the public listing. Neither Revolve nor the Texas Attorney General has confirmed that figure.

1Stop storing full card numbers and expiry dates; use payment processor tokens for saved cards.

2Apply bot detection and rate limits to login, account and saved-payment endpoints, and alert on bulk retrieval of account data, since three weeks passed here before anyone noticed.

3Test customer-account APIs for authorization flaws that let one session read another customer’s data.

CISO takeaway: Saved cards are a convenience that turns every account endpoint into a payment data store. If your platform keeps card data, the account layer deserves the same testing as the checkout, because the attacker here never needed a vulnerability in the payment page, and automated retrieval ran for three weeks before detection. Note too how the scale emerged: not from the company’s own disclosure but from state filings arriving one at a time, which is how most of these numbers reach the public.

Overview: On 27 October 2026, the US Attorney’s Office for the Eastern District of New York announced that Artem Stryzhak, a 36-year-old Ukrainian national, was sentenced to 70 months in prison by Judge Pamela K. Chen for conspiracy to commit fraud, extortion and related activity in connection with computers.

Impact: DOJ says Stryzhak joined Nefilim as an affiliate around June 2021 while living in Barcelona, paying its administrators 20 percent of ransom proceeds, and moved to Hive around October 2021 as one of its earliest affiliates, deploying Hive against seven victims including law firms, a dentist’s office and a healthcare provider. Hive as a whole hit about 1,500 victims across 80 countries between June 2021 and January 2023 before the FBI disrupted it. Stryzhak was arrested in Spain in June 2024, extradited on 30 April 2025, and pleaded guilty in December 2025.

Details: The case documents the ransomware affiliate model: administrators rent the malware and infrastructure, and affiliates break in, deploy it and share the proceeds. Stryzhak’s move from Nefilim to Hive within about four months is a concrete illustration that affiliates are not tied to a single brand. The State Department offers up to $11 million for information on co-conspirator Volodymyr Tymoshchuk, the Nefilim administrator, who remains at large. The deployments described map to MITRE ATT&CK T1486 (Data Encrypted for Impact). US Attorney Joseph Nocella, Jr. said the sentence shows that “cybercriminals cannot hide from law enforcement.”

1Check incident records from 2021 to 2023 against published Nefilim and Hive indicators, since affiliates often reuse access and tooling.

2Report historic ransomware incidents to law enforcement even when recovered, because cases like this one take years to build.

3Test backup isolation against an affiliate who reaches domain administrator, the standard path before encryption.

CISO takeaway: Activity from 2021 produced a sentence in 2026, so enforcement cannot be part of a defence timeline. One affiliate worked two brands within four months, which favours controls that do not depend on knowing the ransomware name.