Daily Threat Briefing: Sunday, November 15, 2026

#8 · 2026-11-15 · Severity: High

Threat types: ransomware, apt, data-breach, vulnerability-exploit · Industries: finance, government

Verified status

NVD check failed for part or all of this window. NVD coverage is incomplete.

TL;DR

• Top story: Ransomware: 6 new victims listed across 5 sectors
• Also notable: UnrealIRCd UnrealIRCd: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection
• Also notable: Cursor confirms security breach led to malicious Claude Code extension
• No new CISA KEV entries in this window

Executive summary

The overall threat level for this reporting window is high. Activity metrics include 30 items from abusech_malwarebazaar, 1086 items from abusech_threatfox, 100 items from abusech_urlhaus, 1 epss_scores item, 6 news_items, 6 ransomware_victims, 4 top_threats, and 1 verified_cves.

Top threats

1. Ransomware: 6 new victims listed across 5 sectors

Source : ransomware.live

Technical Details : The ransomware.live feed listed 6 victims in this window. The most affected sector was Financial Services with 2 listings.

• Severity : High
• Affected : Not applicable
• Fixed : Not applicable
• Workaround : Not applicable

Remediation Steps

1. Verify offline backups, patch internet-facing edge devices and review remote-access logins.
2. Record which systems or detection rules need follow-up.

Official References

• ransomware.live: https://www.ransomware.live

Reference : ransomware.live

---

2. UnrealIRCd UnrealIRCd: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection

CVE-2026-114713 | Disclosed: November 8, 2026
Project : UnrealIRCd UnrealIRCd

Technical Details : CISA confirmed exploitation in the wild. Use the linked guidance to check your exposure.

• Severity : High (CVSS 8.6)
• Affected : Affected versions are not listed in the available sources.
• Fixed : Check the vendor release notes.
• Workaround : None published. Upgrade when a fix is available.

Remediation Steps

1. Check the linked report for products you run and verify details with the vendor before acting.
2. Review exposed systems for signs of exploitation.
3. If remediation requires a restart, verify the fix and service health afterward.

Official References

• NVD CVE-2026-114713: https://nvd.nist.gov/vuln/detail/CVE-2026-114713
• CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• The Hacker News: https://thehackernews.com/2026/11/attackers-exploit-unrealircd-flaw-that.html

Reference : CVE-2026-114713

---

3. Cursor confirms security breach led to malicious Claude Code extension

Source : BleepingComputer

Technical Details : BleepingComputer published the linked report. Compare the report with activity in your environment.

• Severity : Medium
• Affected : Not applicable
• Fixed : Not applicable
• Workaround : Not applicable

Remediation Steps

1. Check the linked report for products you run and verify details with the vendor before acting.
2. Record which systems or detection rules need follow-up.

Official References

• BleepingComputer: https://www.bleepingcomputer.com/news/security/cursor-confirms-security-breach-led-to-malicious-claude-code-extension/

Reference : BleepingComputer

---

4. US disrupts North Korean campaign behind $400 million crypto theft

Source : BleepingComputer

Technical Details : Operators should compare the linked BleepingComputer report with activity in their environment, given a medium severity assessment. Review the report for products you run and verify details with the vendor before acting. Finally, record which systems or detection rules need follow-up.

• Severity : Medium
• Affected : Not applicable
• Fixed : Not applicable
• Workaround : Not applicable

Remediation Steps

1. Check the linked report for products you run and verify details with the vendor before acting.
2. Record which systems or detection rules need follow-up.

Official References

• BleepingComputer: https://www.bleepingcomputer.com/news/security/us-disrupts-north-korean-campaign-behind-400-million-crypto-theft/

Reference : BleepingComputer

---

Ongoing: previously reported

Today’s action checklist

• Ransomware activity is concentrated in Financial Services: verify offline backups, patch internet-facing edge devices and review remote-access logins.
• Pull current indicators from the linked abuse.ch and OTX pages and add them to blocklists or detection rules where relevant.
• Read the linked sources for the products you run and subscribe to vendor security notices.

Indicators

6 new ransomware victims were listed in this window.

Raw indicators are not republished here. Pull them from the source pages.

• ThreatFox: 1086 new IOCs (view on threatfox.abuse.ch)
• URLhaus: 100 new malicious URLs (view on urlhaus.abuse.ch)
• MalwareBazaar: 30 new malware samples (view on bazaar.abuse.ch)

Source notes

• CISA Advisories check failed for this window.
• CISA ICS Advisories check failed for this window.
• OTX skipped: OTX_KEY not set

Sources

• CISA Known Exploited Vulnerabilities Catalog
• CISA Cybersecurity Advisories and ICS Advisories
• This product uses data from the NVD API but is not endorsed or certified by the NVD
• EPSS scores by FIRST
• Ransomware victim data: ransomware.live
• Data: abuse.ch (URLhaus, ThreatFox, MalwareBazaar) Used non-commercially.
• BleepingComputer
• The Hacker News
• SecurityWeek
• The Record
• Krebs on Security
• NCSC UK
• CERT-EU

AI-assisted, published automatically, not human-reviewed; verify with vendors before acting.