InfoSec Briefing - November 07, 2026

🎧 Audio Briefing

Playback Speed:

This is the BlueTeamSec briefing for Saturday the 7th of November 2026, drawn from the community feed on infosec.pub.

CISA have added a SonicWall authentication bypass to the known exploited list — this one affects Gen7 and Gen8 appliances running SSLVPN, and lets attackers with basic local or LDAP credentials skip past SAML-enforced multi-factor entirely. It's being actively exploited against internet-facing portals, so if you're running SonicOS, patching is rather urgent.

Security Alliance have written up the Binance intrusion in detail — it's attributed to a North Korean group called TraderTraitor, also tracked as Jade Sleet. They're known for long-game social engineering against blockchain engineers, often maintaining access for weeks before moving laterally to steal cryptocurrency. This campaign's hit Binance, LayerZero, and a few others, and it's a useful case study if you work anywhere near that sector.

Brian Krebs has a rather awkward story involving residential proxy traffic exiting through White House network space. It turns out staff devices were running free apps with hidden bandwidth-monetisation SDKs, effectively letting third parties rent IP addresses and route traffic through government infrastructure. Over two hundred instances were logged in October alone — one of the proxy services involved has some colourful prior associations.

And Etugen have documented a large-scale Ivanti Connect Secure exploitation campaign that's been running since early October. Attackers chained two vulnerabilities to get unauthenticated root access, then deployed ransomware across at least a hundred and sixty-eight organisations. Notably, they managed to evade Ivanti's own integrity checking tool, so detection's been patchy. We flagged one of the CVEs back on the fourth when it went onto the known exploited list.

That's all for today. The articles are the work of their original authors — the analysis here was automated.

📰 Articles Covered

CVE-2026-19868 - CISA KEV

CVE-2026-19868 is a critical security vulnerability involving an authentication enforcement failure in SonicWall’s SonicOS SSLVPN service. It has been confirmed as actively exploited in the wild and is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog .

### Vulnerability Overview

| Aspect | Details |
| :--- | :--- |
| **Vendor/Product** | SonicWall SonicOS SSLVPN service (physical SMA appliances, virtual appliances, and firewalls) |
| **Vulnerability Type** | Authentication Enforcement / SAML MFA Bypass |
| **Severity** | High (CVSS 7.5) |
| **Impact** | Allows attackers with valid credentials for an alternate, less secure authentication method to bypass intended SAML/MFA requirements, granting unauthorized network access |

### Exploitation Context
* **MITRE ATT&CK Mapping:** Exploitation is occurring via **T1190 - Exploit Public-Facing Application**. Attackers are targeting internet-exposed SSLVPN services to gain entry into corporate networks .
* **Active Campaigns:** The vulnerability is being actively exploited in the wild. While specific threat actor groups are often identified as "in the wild" by security researchers in these contexts, the primary threat is the abuse of the bypass to circumvent MFA for VPN entry .

### Affected Versions
The flaw affects SonicOS SSLVPN services configured to use SAML for single sign-on authentication. Any version prior to the specific security patches released by SonicWall is considered exposed. Administrators must verify their current firmware version against the official SonicWall security advisory to determine if their specific build is impacted .

### Immediate Defender Actions
1. **Apply Official Patches:** Consult the [official SonicWall security advisory](https://www.sonicwall.com/support/product-notification/) immediately for the correct firmware update. Patching is the only definitive fix .
2. **Disable Alternate Auth:** If SAML is the primary intended authentication method, disable all secondary/alternate methods (local users, LDAP, RADIUS, TACACS+) to remove potential bypass vectors .
3. **Compensating Controls (If patching is delayed):**
* Restrict SSLVPN source IP addresses to trusted corporate networks or specific geographic regions.
* Place the appliance behind a Web Application Firewall (WAF) or reverse proxy that enforces its own SAML authentication.
* If possible, disable the SSLVPN service entirely and migrate to alternative remote access solutions (e.g., certificate-based IPsec or ZTNA) until patches are applied .
TraderTraitor vs Contagious Interview - A Look at Binance's Initial Incident Report - Security Alliance

This precis summarizes the findings from the Security Alliance radar report regarding **TraderTraitor** (also known as Jade Sleet or UNC4899) and its distinction from other DPRK-linked groups like "Contagious Interview."

### What Happened
TraderTraitor is a sophisticated, DPRK-linked threat actor responsible for high-impact attacks within the blockchain industry, including incidents at Binance, LayerZero, AFX, and Bitget. Unlike high-volume, indiscriminate campaigns, TraderTraitor conducts long-running, targeted intrusions. They gain footholds through highly realistic social engineering—often using legitimate-seeming job interviews and front companies—to deliver malware, eventually moving laterally to steal cryptocurrency or manipulate infrastructure.

### Who is Affected
The primary targets are **blockchain and cryptocurrency organizations**. Specifically, the group focuses on employees with privileged access to critical infrastructure, including:
* Engineers, DevOps, and Site Reliability Engineers (SREs).
* Individuals with repository or CI/CD administration access.
* Security personnel (via the compromise of third-party security appliances).

### Technical Details & Attack Clusters
TraderTraitor utilizes several distinct, sophisticated methods of operation:
* **Malicious Coding Tasks:** They conduct cold outreach on platforms like LinkedIn to trick engineers into completing "tasks," which lead to the deployment of trojanized Terraform registries and cross-platform backdoors (e.g., FLATROOF + ROOFDECK).
* **Realistic Front Companies:** They employ "real" human interaction during multi-stage recruitment, allowing them to pass basic due diligence. Delivered codebases may exploit vulnerabilities (such as CVE-2025-48384) to trigger arbitrary file writes and code execution.
* **0-day Exploitation:** They have demonstrated the ability to bypass endpoint defenses entirely by exploiting 0-day vulnerabilities in third-party security products, gaining internal management privileges.
* **Long-Term Dwell:** They exhibit high patience, maintaining footholds for 3 to 8 weeks, focusing on infrastructure-level manipulation (e.g., altering binaries or withdrawal commands) rather than simple credential theft.

### Security Implications
The group’s ability to conduct deep reconnaissance and design customized attack paths makes them a formidable threat. The primary risk is not just the initial endpoint compromise, but the subsequent **lateral movement and abuse of legitimate credentials/signing systems**. By the time they act, they have often achieved a level of access that allows them to bypass traditional signature-based detection and manipulate transaction flows directly.

### What Defenders Should Know
The report stresses that organizations must move beyond simple awareness training and endpoint monitoring. Key recommendations include:

| Category | Recommended Action |
| :--- | :--- |
| **Detection** | Focus on the "dwell window." Monitor for lateral movement, privilege escalation, and credential abuse rather than just initial access. |
| **Identity** | Treat developer sessions as privileged credentials. Use short-lived tokens and reduce standing permissions. |
| **Infrastructure** | Implement integrity monitoring for signing systems and verify transaction details through out-of-band channels. |
| **Environment** | Use disposable, isolated VMs for all external code tasks (interviews, vendor PoCs). Remove local admin rights from employee devices. |
| **Process** | Implement formal, security-led verification for all recruitment/job offers. |
| **Strategic Goal** | **Remove human access from production.** Transition to automated, scoped CI/CD pipelines where no individual holds standing production access. |

Defenders are cautioned that EDR should be treated only as a baseline, not a comprehensive defense, as TraderTraitor can evade many behavioral and signature-based detections.
Want to Rent an Internet Address at the White House? – Krebs on Security - Brian Krebs

The summary you provided accurately captures the core findings from the article on the White House residential proxy issue. Here is the synthesized precis based on those details:

### **Overview: White House Residential Proxy Infiltration**
Security researchers have identified a significant security lapse where mobile and computing devices within the Executive Office of the President’s network (AS2650) are functioning as residential proxy exit nodes. This allows third-party actors to rent and route internet traffic through the White House's network infrastructure, effectively masking their activities behind a high-trust government IP address.

### **Key Findings**
* **The Breach:** Between October 5 and November 3, 2026, Layer3 Intel documented 236 instances of proxy traffic originating from White House IP ranges. The issue is attributed to staff installing seemingly benign "free" applications that include hidden software development kits (SDKs) designed to monetize bandwidth.
* **Scope:** While only a small number of devices (fewer than 10) are currently implicated, the potential for exploitation is significant given the status of the network involved.
* **Notable Actors:** The investigation highlighted the involvement of services such as "Infatica," founded by Vladimir Fomenko—an individual previously associated with hosting infrastructure used in 2016 election interference.

### **Security Implications**
* **Bypassing Defenses:** Because government IP addresses are often whitelisted or viewed as inherently trustworthy by security systems, traffic originating from these nodes can easily bypass standard threat detection and IP-based filters.
* **Network Exposure:** Beyond simple anonymization, these proxy services can potentially grant external actors a foothold within the local networks where the infected devices reside, creating severe risks for lateral movement, data exfiltration, and malware deployment.
* **Operational Abuse:** These proxy networks are frequently utilized for malicious activities, including advertising fraud, mass scraping, and credential stuffing/account takeovers.

### **Defensive Takeaways**
* **Challenge Trust Models:** Security teams should move away from granting broad trust to specific IP ranges or ASN-based reputations. Assume that any device—regardless of its physical location—can be compromised or weaponized as a proxy node.
* **Enhanced Egress Monitoring:** Implement and enforce strict egress filtering policies to detect unauthorized or unusual outbound traffic.
* **Application Governance:** Defenders must prioritize auditing software on managed devices. Identifying and removing applications that contain residential proxy SDKs is critical.
* **Network Analytics:** Security operations centers should monitor DNS query logs to detect traffic directed toward known residential proxy provider domains, which can serve as early indicators of compromised devices.
An Ivanti Zero-Day Operation Where the Dead Proxy Was Named in the Operator's Notes - Etugen

This précis outlines the exploitation campaign targeting Ivanti Connect Secure appliances, as detailed in recent cybersecurity intelligence.

### **What Happened**
Since at least October 3, 2026, threat actors have engaged in a large-scale, multi-vector exploitation campaign targeting Ivanti Connect Secure appliances. The operation involves chaining multiple vulnerabilities to bypass authentication, achieve remote code execution, and escalate privileges to gain root access. The campaign is broad, international, and financially motivated, with evidence linking it to data theft and ransomware activities.

### **Who Is Affected**
The campaign impacts organizations globally across both the public (government) and private sectors. Victims are varied, and the operation appears to be a mass-exploitation effort rather than a narrow, targeted strike.

### **Security Implications**
The compromise allows attackers to gain persistent, unauthenticated root access to Ivanti appliances. Once inside, they move laterally to harvest sensitive credentials, including Active Directory (AD) data, Windows LAPS passwords, and BitLocker recovery keys. Critically, this malicious activity is designed to evade detection by Ivanti’s standard Integrity Checker Tool.

### **Technical Details**
The attackers exploit a chain of vulnerabilities to achieve their goals:
* **Authentication Bypass:** Uses the `X-DSCGI-PATH` header to bypass authentication via `wu.cgi`.
* **File Upload (`CVE-2026-118527`):** An authenticated file upload vulnerability used to write malicious Perl scripts to `/home/runtime/tmp/`.
* **Execution:** Malicious scripts (e.g., `ics-root-run-inband-*.pl`) are executed to gain command execution.
* **Privilege Escalation (`CVE-2026-111357`):** Used to elevate privileges to root via `/home/runtime/tmp/.invoke`.

The attackers managed their operations through a centralized infrastructure hosted on a Vultr server (`208.85.17[.]99`), which contained an extensive framework for exploit automation, logs of 168 successful breaches, and a "canonical memory file" documenting their operational processes.

### **What Defenders Should Know**

| Category | Action/Observation |
| :--- | :--- |
| **Patching** | Emergency deployment of fixed releases (**25.1.1.3** or **22.8R2.6**) is required. |
| **Network** | Block operator proxies: `208.85.17[.]99`, `108.165.147[.]64`, `139.84.235[.]230`, and `70.34.215[.]12`. Inspect traffic for malicious `X-DSCGI-PATH` headers. |
| **Endpoint** | Hunt for artifacts in `/home/runtime/tmp/` (e.g., `ics-root-run-inband-*.pl`) and monitor `.svc/authwatch.log` for credential watching behavior. |
| **Identity** | Assume all credentials accessible from the appliance (AD, LAPS, BitLocker) are compromised; rotate them immediately. |
| **Forensics** | Be aware that a "clean" result from Ivanti’s Integrity Checker Tool does not guarantee the appliance is uncompromised. Preserve logs and memory before performing any device resets. |

*Sources: 【1】*