2nd November – Threat Intelligence Report
Our summary
Check Point's latest threat intelligence bulletin covers a wave of major incidents, including a roughly $6.3 billion cryptocurrency theft from Binance after attackers compromised a DevOps engineer's laptop, an attack widely attributed to a North Korean-linked group, and a script-based breach at prediction market Polymarket that redirected about $2.7 million in crypto. Data breaches also hit Japan Airlines (around 92,000 customers via a third-party reservation system) and the Florida Department of Education, where up to 4.9 million people's personal and financial-aid data may have been exposed. On the vulnerability front, researchers flagged active exploitation of HTTP2Shell (CVE-2026-111497), a remote code execution bug in Brotli decompression libraries beyond just Node.js, alongside a critical Linux kernel flaw (CVE-2026-98432, CVSS 9.8) affecting Multipath TCP, a Drupal Commerce Core access-control issue (CVE-2026-118539) already under attack, and a Cisco ASA/FTD SSL VPN crash bug (CVE-2026-76418) exploited before a patch existed. The report further details growing use of AI by threat actors, including North Korean operators and the GOLD OGRE ransomware gang, plus new malware campaigns such as Yoba, which impersonates ChatGPT and Claude installers, and the KeyDrift framework deployed against aerospace and defense targets through a Cisco SD-WAN authentication bypass.
Below is the opening; the full story is at Check Point Research.
From Check Point Research
For the latest discoveries in cyber research for the week of 2nd November, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
- Binance, a global cryptocurrency exchange, has suffered a cyberattack resulting in the theft of approximately $6.3 billion in digital assets. Attackers reportedly compromised a DevOps engineer’s laptop and abused internal wallet infrastructure to authorize unauthorized withdrawals. The incident ranks among the largest cryptocurrency thefts ever recorded and is linked to North Korean group.
- Polymarket, a US-based prediction market platform, has disclosed a cyberattack involving a compromised third-party service that distributed malicious JavaScript to its website. The script hijacked authenticated trading sessions and attempted unauthorized transactions. Approximately $2.7 million in cryptocurrency was traced to a suspected attacker-controlled wallet.
- Japan Airlines, a major Japanese international airline, has disclosed a third-party data breach affecting approximately 92,000 passengers through the Amadeus reservation system. Exposed records included passenger names and flight information. Approximately 2,000 individuals also had contact information, passport details, and additional travel records potentially accessed.
- The Florida Department of Education has disclosed a data breach involving unauthorized access to its student financial aid website, potentially affecting 4.9 million individuals. Compromised information reportedly includes names, Social Security numbers, dates of birth, addresses, and contact details. The incident was identified on October 19.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.