InfoSec Briefing - November 13, 2026

🎧 Audio Briefing

Playback Speed:

BlueTeamSec briefing for Friday the 13th of November 2026. Four stories from the community on infosec.pub today.

CloudSEK published a look inside an exposed server belonging to the Silent Lynx threat group, which reveals operations targeting critical infrastructure across Central Asia between April and October this year. The interesting bit: they're using an AI agent called Hermes, powered by DeepSeek models, to automate reconnaissance, exfiltration, and log cleanup — which is either impressive tradecraft or a sign that someone left a door open, depending on your perspective.

Enea has written up the activities of two China-nexus groups, LIMINAL PANDA and SilentAir, both exploiting the global mobile interconnect system used by network operators. LIMINAL PANDA has compromised five to ten mobile operators across Asia, Africa, and Latin America using a variant of the GTPDoor implant, while SilentAir is targeting high-value individuals in Taiwan using malicious signalling over the SS7 and Diameter protocols, including silent SMS for location tracking. We've seen Chinese government-linked activity covered a few times in recent weeks — this one adds useful detail on mobile network exploitation specifically.

Matt Green has released a new detection artifact for identifying malicious HTTP.sys listeners on Windows, which came out of ESET's work on the CerealNeuron backdoor targeting Exchange servers. We covered that Turla campaign earlier in the week. The tool is essentially a triage-friendly version of the built-in netsh command — useful if you're hunting for kernel-level HTTP interception on Exchange or similar infrastructure.

And finally, ENISA has published its biennial report on the state of cybersecurity across the EU. The headline is that overall maturity is improving — average score up to just over seventy-one — but there's persistent unevenness across member states and ongoing systemic vulnerabilities in cross-border supply chains and legacy infrastructure. Worth a look if you're involved in EU-facing compliance or cross-border operations.

That's your lot for today. Attribution goes to the original article authors — the analysis here was automated as always.

📰 Articles Covered

Off the Rails: Inside an Exposed Silent Lynx Server - CloudSEK

The discovery of an exposed server belonging to the cyber-espionage actor "Silent Lynx" has provided unprecedented insight into the operations of a threat group targeting critical infrastructure in Central Asia. Below is a detailed precis of the incident.

### Incident Overview
Researchers discovered an unauthenticated, publicly exposed server (IP `89.125.213.123`) that acted as a repository for the threat group "Silent Lynx." The server contained a comprehensive, timestamped archive of the group’s operations spanning from April to October 2026. This cache included the group's malware tooling, exfiltrated victim data, and logs detailing the activities of an autonomous AI agent used to automate their espionage efforts.

### Victims and Impact
Silent Lynx has focused its intelligence-gathering operations primarily on government and national infrastructure sectors in Central Asia:
* **Tajikistan:** The group compromised the national railway network, gaining domain-level access, and successfully breached the government’s electronic document management (EDO) system, resulting in the theft of thousands of sensitive documents (personnel, defence, and procurement records).
* **Uzbekistan:** The "Smart Forestry" platform was compromised, with the attackers achieving host-level command execution.
* **Turkmenistan:** Evidence indicates the group was in the preparatory stages of campaigns using phishing lures themed around regional administration and national railways.

### Technical Details
* **AI-Driven Operations:** The group utilized "Hermes," a self-hosted AI agent powered by DeepSeek models. This agent significantly accelerated operations by automating reconnaissance, managing data collection, cleaning up logs, and executing authorized destructive commands.
* **Attack Chain:** Silent Lynx employed sophisticated phishing lures, utilizing LNK shortcuts disguised as ZIP, ISO, or PDF files to trigger PowerShell reverse shells. They further improved their success rate by incorporating an AMSI (Antimalware Scan Interface) bypass technique.
* **Tooling:** The arsenal identified includes "Laplas" and "Chvost" reverse shells, paired with custom service-installer wrappers.
* **Attribution:** Technical analysis suggests a nexus in Kazakhstan, supported by the operator's working hours (UTC+5) and test traffic observed originating from residential Kazakhtelecom connections.

### Security Implications
The primary implication of this discovery is the demonstrated shift toward **autonomous offensive operations**. The use of an AI agent like "Hermes" allows threat actors to scale their efforts, conduct faster data exfiltration, and maintain persistent operations with minimal human intervention. Furthermore, the incident serves as a stark reminder of the importance of Operational Security (OPSEC); the group's failure to secure a single directory allowed defenders to map their entire methodology.

### Guidance for Defenders
To mitigate risks associated with Silent Lynx and similar actors, security teams should focus on the following:

| Focus Area | Defensive Action |
| :--- | :--- |
| **Detection** | Monitor for LNK-based delivery chains mimicking government correspondence and hidden PowerShell processes. Implement detection signatures for "Laplas" and "Chvost" implants. |
| **Network Security** | Block communication with known operator infrastructure, specifically `89.125.213.123` and domains such as `foreverpeace[.]ru`. |
| **Infrastructure** | Prioritize patching legacy vulnerabilities (e.g., SMBv1, MS17-010) and enforce robust access controls to prevent the exploitation of weak authentication and credential reuse. |
| **Emerging Threats** | Prepare for "AI-assisted" threats by monitoring for anomalous, high-speed automated reconnaissance and unconventional data collection patterns that indicate non-human activity. |
The Enemy Within. Tracking LIMINAL PANDA and SilentAir through Mobile Networks - Enea

This report outlines a significant security threat involving two sophisticated, China-nexus threat actors—**LIMINAL PANDA** and **SilentAir**—that exploit vulnerabilities in the global IPX (IP eXchange) mobile interconnect system to target mobile network operators (MNOs) and their subscribers.

### **Summary of Incident**
Both actors leverage the inherent trust model of the global interconnect network, which facilitates communication between over 800 mobile operators. By compromising a single MNO, these actors gain the ability to launch attacks against other connected networks, enabling unauthorized access to subscriber data, location tracking, and covert persistent operations.

### **Affected Entities**
* **LIMINAL PANDA:** Has compromised an estimated 5–10 MNOs directly, with dozens more potentially impacted. Their activity is primarily concentrated in **Asia, Africa, and Latin America**.
* **SilentAir:** Primarily targets high-value political and government VIPs. While **Taiwan** is their main external target, they have successfully attacked subscribers in at least a dozen other countries globally.

### **Technical Details**

| Actor | Primary Tactics & Tools |
| :--- | :--- |
| **LIMINAL PANDA** | Utilizes **GTPDoor**, a Unix-based implant. They have evolved to **GTPDoor v3 (GTP-U-Door)**, which operates over the GTP-U (user data) protocol rather than the GTP-C (control) protocol, significantly complicating detection. |
| **SilentAir** | Compromises network nodes to inject malicious **SS7 and Diameter** signalling. They notably use "silent SMS" messages to verify the success of "Update Location" attacks without alerting the target user. |

### **Security Implications**
The core implication is that the global interconnect architecture is being weaponized against the very operators it is intended to connect.
* **Persistent Threat:** The use of sophisticated implants (like GTP-U-Door) allows actors to maintain long-term, covert access to critical network infrastructure.
* **Information Harvesting:** SilentAir’s ability to intercept calls/SMS and track locations poses a severe privacy and national security risk for targeted high-profile individuals.
* **Operational Overlap:** Enea observed correlations in timing and coordination between the two actors, suggesting a highly organized threat environment, even if formal links remain unconfirmed.

### **What Defenders Should Know**
To defend against these threats, MNOs must move beyond baseline security recommendations and adopt a "zero-trust" approach to the interconnect network:

* **Unified Visibility:** Implement comprehensive, cross-protocol monitoring that tracks signaling traffic across GTP-C, GTP-U, SS7, and Diameter simultaneously.
* **Treat IPX as Untrusted:** The interconnect interface should be treated as an untrusted entry point, with deep packet inspection and signaling analysis integrated into the wider corporate security profile.
* **Internal Scanning:** Actively search internal interfaces for indicators of lateral movement and C2 communications, specifically looking for malicious tools like *SIGTRANslator* or *Cordscan*, and identifying compromised network nodes.
* **Operational Control:** Maintain direct ownership and visibility of network assets. Outsourcing core operations to third-party vendors creates security blind spots that hinder incident response and investigation.
Windows.Detection.HttpSysListeners: Lists HTTP.sys request queues with their registered URLs and owning processes: easy to triage version of netsh http show servicestate view=requestq verbose=yes - Matt Green

This precis outlines the details of the `Windows.Detection.HttpSysListeners` artifact, which was developed to address the "CerealNeuron" backdoor.

### **What Happened**
In November 2026, ESET identified a backdoor dubbed "CerealNeuron" that targets Microsoft Exchange servers. The backdoor functions by registering its own URL prefixes directly within the Windows `HTTP.sys` driver, allowing it to intercept and manipulate incoming network traffic at the kernel level before it reaches legitimate services.

### **Who Is Affected**
Organizations running Microsoft Exchange servers are the primary targets of this threat. Because the backdoor operates at the `HTTP.sys` level, it can impact any environment relying on these servers, specifically those using HTTP-based communication that the attacker aims to hijack.

### **Security Implications**
The primary security risk is stealthy traffic interception. Because the malicious process intercepts requests before they reach Internet Information Services (IIS), these interactions often bypass standard IIS logging. This creates a significant blind spot, as traditional log-based monitoring tools will fail to record or alert on the malicious activity.

### **Technical Details**
The `Windows.Detection.HttpSysListeners` artifact serves as a triage tool that automates the analysis of `HTTP.sys` service states (similar to the command `netsh http show servicestate view=requestq verbose=yes`). Its detection mechanisms include:

* **URL Prefix Matching:** Scans for registered URL prefixes known to be associated with CerealNeuron.
* **Process Owner Analysis:** Identifies processes owning port 443 registrations. It flags processes that are not expected to be handling these requests.
* **Integrity Checking:** Performs cross-validation by comparing the PID reported by `HTTP.sys` against the list of running processes (`pslist`). A discrepancy here may indicate that a process is attempting to hide or manipulate its identity.
* **Handle Inspection:** Includes a secondary `QueueHandles` check, which identifies processes holding handles to `HTTP.sys` request queues, ensuring that detection is not solely dependent on the primary `RequestQueues` analysis.

### **Defender Guidance**
Defenders should note the following when utilizing this tool:
* **Live State Limitations:** This artifact detects only active, live listeners. If a backdoor is present but the listener is inactive, it will not be detected.
* **Baseline Management:** To effectively use the tool, defenders must define an `ExpectedOwnerRegex` (default is `w3wp.exe`) and a `KnownUrlRegex` for legitimate non-IIS processes to minimize false positives.
* **Locale Sensitivity:** While the tool is designed to support both modern and legacy `netsh` output formats, it is specifically configured to parse English locale outputs.
* **Defense Strategy:** Use this artifact as a proactive scanning tool to baseline legitimate `HTTP.sys` registrations and investigate anomalies that could indicate persistence or unauthorized interception.
ENISA reveals the State of Cybersecurity in the Union | ENISA - European Union Agency for Cybersecurity (ENISA)

The ENISA 2026 biennial report provides a comprehensive assessment of the European Union's cybersecurity landscape. It serves as a progress update required by the NIS2 Directive and establishes a new "strategic compass" to guide future policy and operational resilience 【1】.

### Executive Summary
* **What Happened:** ENISA assessed the EU’s cybersecurity posture, finding that while the overall maturity of the Union has improved, the threat environment remains substantial and continues to evolve due to technological and geopolitical shifts 【1】.
* **Who is Affected:** The findings apply to all EU Member States, essential and important entities, and the broader critical infrastructure landscape that relies on cross-border supply chains and digital operations 【1】.

### Security Implications & Technical Details
The report highlights a complex, fast-moving threat landscape driven by four primary factors:
* **AI as a Multiplier:** Artificial Intelligence is actively accelerating vulnerability discovery and exploitation. It is amplifying threats and exposure gaps between critical sectors while simultaneously aiding defensive capabilities 【1】.
* **Threat Drivers:** Activity is characterized by ideological motivation, geopolitical tension, and financial gain. Hacktivism continues to account for a high volume of incidents 【1】.
* **Systemic Vulnerabilities:** Despite improvements in supply chain management (scoring 89.91 on the EU Cybersecurity Index), risks remain regarding cross-border dependencies and legacy system limitations within critical infrastructure 【1】.
* **Maturity Disparities:** While the average EU Cybersecurity Index score is 71.53, progress is uneven. CSIRT maturity and national certification ecosystems show significant variance between Member States 【1】.

### What Defenders Should Know
The report identifies five strategic directions for organizations and policymakers to bolster resilience:

| Strategy | Focus Area |
| :--- | :--- |
| **Operational Efficiency** | Reduce cross-border and cross-legislative friction to ensure a seamless operational environment for entities spanning multiple Member States. |
| **Crisis Management** | Fine-tune information-sharing protocols and increase the involvement of all relevant actors to improve response capacity. |
| **Infrastructure Resilience** | Prioritize "security by design" to overcome legacy system limitations, manage AI-enabled threats, and secure the supply chain at every step. |
| **Vulnerability Handling** | Leverage improved Coordinated Vulnerability Disclosure (CVD) policies; the number of countries with such policies has grown from 7 to 17 since 2024. |
| **Workforce Development** | Address the widening cyber skills gap (which increased by 8% since 2024) through aggressive retention, upskilling, and education programs 【1】. |

Ultimately, defenders must prepare for a shift toward "regulatory compliance as a primary driver for investment" (cited by 70% of organizations) and transition toward broader, holistic resilience strategies rather than relying solely on siloed technical defenses 【1】.