The Hot Drop for 11-02-2026

• 300 tenants recorded successful authentications from the IP address 144[.]172[.]64[.]128.
• Standard Conditional Access policies do not govern application-only (service principal) access tokens.
• Approximately 1,000 Entra ID tenants experienced authentication attempts from the IP address 144[.]172[.]64[.]128.

Microsoft has tied ARTEX to a China-linked group in a campaign against Microsoft 365 tenants that used stolen ConnectWise credentials. Victims of ARTEX attacks include organizations in government, technology, chemicals, manufacturing, and telecommunications. ARTEX can map a Windows network, steal service account passwords, and try to spread to domain controllers with very little human help. In one case, ARTEX pulled more than 110,000 Active Directory objects and read the Domain Admins group.

Researchers at Google Cloud’s Google Threat Intelligence Group and Mandiant identified ARTEX activity during incident response work. The original author of ARTEX took the code down from GitHub in October 2026 because of abuse. Copies of the code still spread through community forks, including ScopeWeaver and a paid version called ARTEX PRO.

Huntress identified the start of the attack chain as the unauthorized use of a stolen credential to sign in as the ConnectWise Cloud Backup application from the IP address 144[.]172[.]64[.]128 on October 15, 2026. The IP address 144[.]172[.]64[.]128 is associated with a hosting provider rather than the Microsoft cloud infrastructure from which the application normally operates. Because standard Conditional Access policies do not govern application-only service principal access tokens, the compromised application identity bypassed standard user authentication controls. A targeted wave of the attack then deployed an automated sweep targeting Graph tokens via SkyKick applications between 09:25:04 and 12:35:50 UTC.

The automated sweep was followed by a manual post-exploitation sweep between 13:54:39 and 14:20:24 UTC targeting Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Entra ID, and Office 365 Management APIs. Approximately 1,000 Entra ID tenants experienced authentication attempts from the IP address 144[.]172[.]64[.]128. Of those tenants, 300 recorded successful authentications from the IP address 144[.]172[.]64[.]128. The attackers utilized a tool named ARTEX, which can map a Windows network, steal service account passwords, and attempt to spread to domain controllers with minimal human intervention.

Password spraying occurred against four law firm tenants from 144.172.64[.]128 between October 13 and 14. The same IP address was used on October 13 and 14 to attempt password guessing at four law firms.

Huntress identified a second, targeted wave of attempts from the IP address 144.172.64[.]128 on October 15, 2026, which singled out a narrow scope of 16 tenants but were unsuccessful. Huntress confirmed abuse of the Microsoft Teams application in one tenant, stating high confidence that the threat actor also targeted the ConnectWise Cloud Management apps for Exchange Online, Microsoft Teams, and SharePoint. Huntress identified almost 1,000 Entra tenants with sign-in activity from the IP address associated with the unauthorized activity, out of which 300 succeeded. The app's credential was used to obtain Microsoft Graph tokens in customer tenants from 144.172.64[.]128 between 06:13 and 08:34 UTC on October 15, 2026.

ConnectWise Cloud Backup's identity signed in to customer Microsoft 365 tenants from 144.172.64[.]128 on October 15, 2026, and received Microsoft Graph access tokens. The ConnectWise Cloud Management app for Microsoft Teams added itself to the Global Administrator role in one customer tenant between 03:44 and 03:49 UTC on October 15, 2026. Unknown threat actors compromised Microsoft 365 tenants by obtaining unauthorized access to ConnectWise application identities, prompting ConnectWise to disable seven application identities as it continues its investigation. Confirmed active abuse of the Teams application identity 24205314-2b89-4e07-a2a4-579e898a5640 occurred in at least one customer tenant.

ConnectWise temporarily suspended Cloud Management and SaaS Security services as part of its containment response after threat actors exploited stolen application credentials to compromise downstream Microsoft 365 tenants. ConnectWise Cloud Backup, SaaS Security, and Cloud Management services were taken offline while the company investigates the incident. ConnectWise suspended access to several of its cloud services after discovering that unauthorized actors had gained access to Microsoft 365 tenants.

Huntress reported that the stolen credential was used on October 15, 2026, between 06:13 and 08:34 UTC, to sign in as the backup application from the IP address 144[.]172[.]64[.]128, which is attributed to a hosting provider rather than the Microsoft cloud infrastructure from which the application normally operates.

On October 17, 2026, ConnectWise disabled seven application identities, including the backup app, its Cloud Management product, and five associated apps, to prevent unauthorized access to Microsoft 365 tenants. As part of the containment response on October 17, 2026, ConnectWise revoked the certificates used for the affected application connections and invalidated the shared Cloud Backup credentials. ConnectWise suspended the Cloud Backup service by revoking certificates used for affected application connections across all users at 07:00 UTC on October 17, 2026. ConnectWise temporarily suspended its Cloud Management and SaaS Security services as part of its containment response to the incident.

Six distinct outlets reported on the incident, including The Hacker News, Infosecurity Magazine, Help Net Security, Huntress, SOC Fortress, and Cybersecurity News. Huntress is the primary source for specific technical details regarding the unauthorized sign-ins, the targeted wave of attempts, and the abuse of the Microsoft Teams application identity. The Hacker News, Infosecurity Magazine, and Help Net Security provided derivative reporting on ConnectWise's containment actions, including the disabling of application identities and the suspension of cloud services. SOC Fortress provided corroborating analysis on the dual-sweep methodology and the scope of authentication attempts from the malicious IP address.

Cybersecurity News reported on the attribution of the ARTEX tool to a China-linked group and the identification of the activity by researchers at Google Cloud and Mandiant. All claims in the available reporting are stated with certainty, with no allegations or unverified reports noted in the source material. No confirmed disagreements between outlets were identified. No timeline updates were identified.

• BeyondTrust says CVE-2026-102764 affects supported Remote Support versions up to 26.2.3.
• The vulnerability, tracked as CVE-2026-102764, could let an unauthenticated remote attacker perform file operations on an affected appliance.
• The document root for the web server is set to /home/msfuser/ingredi-24.1.2/app/www/public.
• The tested version of Remote Support was 24.1.2, build 1524046, revision 4208-ddcf90715106aa0c0e19c103f8d2c412af4beff3.
• The vulnerability affects Remote Support versions 26.2.3 and earlier unless the required patch has been applied.
• The vulnerability affects supported BeyondTrust Remote Support versions up to and including 26.2.3.

No background yet from current sources.

The vulnerability, tracked as CVE-2026-102764, could let an unauthenticated remote attacker perform file operations on an affected appliance. The flaw involves an anti-spoofing check in the app/brain component, specifically within the function FUN_01566ae0, which rejects network packets where the source router matches the receiving router's actual ID. Downstream code recognizes a reserved local alias, allowing the validation to be bypassed. The exploit utilizes the UploadFiles function to retrieve the worker's /proc/self/environ file to identify the installation directory.

The environment file contains the variable BG_app_root, which points to the application root directory, such as /home/msfuser/ingredi-24.1.2. The web server's document root is configured to /home/msfuser/ingredi-24.1.2/app/www/public. Successful exploitation results in code execution in the context of the msfuser account, which has UID 1000, establishing unauthenticated remote code execution as the site user. Mandiant says the attackers copied /bin/sh to /usr/bin/dbus-authd, changed the file’s owner to root, and enabled the Set User ID (SUID) permission.

Analysts from Google Cloud’s Threat Intelligence Group noted that the attackers deployed the SAWFLY webshell and BARECLAW tunneler after exploiting the flaw.

No details yet about who was affected or the impact from current sources.

BeyondTrust reported that the actor exploited the flaw on 2026-08-29 against one hosted Remote Support instance and one self-hosted appliance. Mandiant linked the activity to ARMORY CASTLE, a suspected China-nexus group previously tracked as UNC5221. According to Rapid7, the Metasploit module returns code execution in the context of msfuser, UID 1000, establishing unauthenticated remote code execution as the site user. According to Rapid7, an origin-validation flaw in BeyondTrust Remote Support allows an unauthenticated attacker to write files on the appliance and execute code as the site's operating-system user.

The exploit leverages the UploadFiles function to retrieve the worker's /proc/self/environ, which contains the BG_app_root variable pointing to the application root directory, such as /home/msfuser/ingredi-24.1.2. Indicators of compromise include the SHA-1 hash ddcf90715106aa0c0e19c103f8d2c412af4beff3, the SHA-256 hash dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb, and the SHA-256 hash 1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462.

BeyondTrust says it patched all hosted Remote Support customers by 2026-10-09. The vulnerability affects supported BeyondTrust Remote Support versions up to and including 26.2.3 unless the required patch has been applied.

• Based on MITRE ATT&CK guidance for Exploit Public-Facing Application (T1190): To mitigate the risk of exploitation of public-facing applications, organizations should deploy capabilities that detect, block, and mitigate conditions indicative of software exploits.
• Based on MITRE ATT&CK guidance for Exploit Public-Facing Application (T1190): Network traffic filtering should be employed to restrict ingress and egress traffic, limiting adversary movement and data exfiltration.
• Based on MITRE ATT&CK guidance for Exploit Public-Facing Application (T1190): Application isolation and sandboxing can be implemented to restrict the execution of code to a controlled environment, preventing potentially malicious code from affecting the rest of the system.
• Based on MITRE ATT&CK guidance for Vulnerability Scanning (T1595.002): Pre-compromise mitigations should include limiting information exposure by regularly auditing and sanitizing publicly available data to reduce the attack surface.

Rapid7 and cybersecuritynews.com are the two distinct outlets reporting on CVE-2026-102764. Rapid7 provides the primary technical analysis, including the specific version tested (24.1.2, build 1524046) and the internal document root path. cybersecuritynews.com reports that the vulnerability affects supported BeyondTrust Remote Support versions up to and including 26.2.3. No confirmed disagreements between outlets were identified.

No timeline updates were identified.

• The Pentagon case affected over three million people, but access occurred between October 2025 and July 2026.

The software Langflow has accumulated 18 vulnerabilities since 2024, 14 of which are high-severity and four of which are seeing exploitation.

The LiteLLM supply-chain compromise distributed credential-stealing malware through version 1.107.0 wheels and affected images. The malware uses hxxp[://]www[.]litellm[.]dev/healthcheck as the hard-coded collection endpoint for exfiltration. The stolen data is encrypted using an AES-256-CBC key that is encrypted with an RSA-4096 key and then uploaded to ‘litellm[.]dev/healthcheck’. PHP2Shell involved CVE-2026-109618 and CVE-2026-109619, both scored 9.2, enabling unauthenticated code execution under affected configurations.

GhostAction injected malicious GitHub Actions workflows into 790 repositories, targeting secrets and repository history. A compromise of LiteLLM data would expose a customer’s API keys for all connected commercial LLM services. The number of internet-exposed instances of LiteLLM nearly doubled during Censys’s observation window.

According to Censys, the number of internet-exposed instances of LiteLLM nearly doubled during their observation window. Hackers continue exploiting a pre-authentication SQL injection vulnerability in LiteLLM. Censys detected 169% more instances of the AI agent-building tool Langflow over the past nine months. Censys detected more than 294,000 IP addresses associated with AI services in early 2026, up from 183,000 in October 2025.

The malware uses hxxp[://]www[.]litellm[.]dev/healthcheck as the hard-coded collection endpoint for exfiltration, as reported by opensourcemalware.com. The central network indicator in this artifact is the hard-coded collection endpoint: PC_URL = ' PC_TOKEN = 'XWiA8gZNa7NcX2XRoAEb', according to opensourcemalware.com. The LiteLLM supply-chain compromise distributed credential-stealing malware through version 1.107.0 wheels and affected images, as reported by gbhackers.com on 2026-11-02. PHP2Shell involved CVE-2026-109618 and CVE-2026-109619, both scored 9.2, enabling unauthenticated code execution under affected configurations, as reported by gbhackers.com on 2026-11-02.

Fixed PHP releases included 8.2.35, 8.3.36, 8.4.27, and 8.5.12.

Five distinct outlets reported on the LiteLLM supply-chain compromise, including opensourcemalware.com, therecord.media, bleepingcomputer.com, gbhackers.com, and cybersecuritydive.com. opensourcemalware.com exclusively reported the specific hard-coded collection endpoint hxxp[://]www[.]litellm[.]dev/healthcheck. therecord.media reported that Microsoft stated the malware's execution mechanism was attributed to Python startup, while Wiz attributed the characterization of the activity as “LLMjacking” to itself. The claim that a key accidentally exposed in May was behind the attack was attributed to LiteLLM, as reported by therecord.media.

The warning that users of version 1.107.0 on internet-connected computers should assume their credentials were stolen was attributed to LiteLLM, as reported by therecord.media. bleepingcomputer.com reported on 2026-10-22 that the stolen data is encrypted using an AES-256-CBC key wrapped in an RSA-4096 key. gbhackers.com reported on 2026-11-02 that the Pentagon case affected over three million people and listed fixed PHP releases including 8.2.35, 8.3.36, 8.4.27, and 8.5.12. cybersecuritydive.com reported that Censys observed the number of internet-exposed instances of LiteLLM nearly doubled, and noted that a compromise of LiteLLm data would expose API keys for all connected commercial LLM services.

No confirmed disagreements between outlets were identified. No timeline updates were identified.

• Polymarket suffered a security incident on October 29, 2026, after a compromised third-party provider exposed users of its international platform to wallet theft.
• Researchers linked the theft to malicious code served from DebugBear, a UK-based website performance monitoring firm.
• DebugBear confirmed being impacted by an ongoing security incident and urged users to pull its snippet from their websites.
• CNBC reported that Polymarket’s separate United States platform was not compromised.

No background yet from current sources.

On 2026-10-29, a compromised third-party provider exposed users of Polymarket's international platform to wallet theft. Researchers linked the theft to malicious code served from DebugBear, a UK-based website performance monitoring firm. Security researchers at Hudson Rock identified malicious JavaScript distributed through cdn.debugbear[.]com/C7xcKKrjUnXK.js that was designed to steal cryptocurrency and prediction-market holdings from Polymarket users. The malicious script communicated with data[.]debugbear[.]com to receive instructions and send data about targeted accounts, wallet addresses, balances, and transaction results.

Polymarket halted trading on its international platform on 2026-10-29 after users reported unauthorized withdrawals. According to Betting Intelligence and Polysights, an account on Polymarket withdrew at least $2.7 million across 710 other wallets on 2026-10-29. According to CNBC, Polymarket’s separate United States platform was not compromised. Polymarket pledged to reimburse any affected trader.

According to CNBC, users with less than $10,000 stolen were told their funds would be restored by 2026-10-30. Polymarket is returning $3.9 million to traders following a supply chain attack.

According to the company, a third-party provider was compromised, leading to the incident on Polymarket's international platform. The company stated that it had identified and fixed the issue and promised to reimburse affected users. According to CNBC, some users of Polymarket's international exchange had funds stolen from their accounts due to a hack of an unnamed third-party provider.

No ATT&CK techniques were identified in current sources.

BleepingComputer found that the malicious script communicated with data[.]debugbear[.]com to receive instructions and send data about targeted accounts, wallet addresses, balances, and transaction results.

DebugBear urged users of its real user monitoring (RUM) product to pull its snippet from their websites and stated it brought in specialist incident responders. Polymarket temporarily stopped trading on its international platform, Polymarket[.]com, and stated it had identified and fixed the issue. The platform promised to reimburse affected users and is returning $3.9 million to traders following the supply chain attack.

Four distinct outlets reported on the incident: securityweek.com, cybersecuritynews.com, cnbc.com, and bleepingcomputer.com. SecurityWeek provided the earliest report on 2026-10-29, followed by CNBC and BleepingComputer on the same day, and CybersecurityNews on 2026-10-30. The specific identification of the malicious JavaScript file and its communication with data[.]debugbear[.]com was reported exclusively by BleepingComputer. The attribution of the attack to a supply chain compromise of DebugBear’s RUM script and the specific loss figure of roughly $2.71 million were reported by SecurityWeek citing GoPlus.

The disclosure that DebugBear’s DNS records were compromised through its domain registrar and that its internal systems were not compromised was reported by SecurityWeek on 2026-11-02. The report that Polymarket is returning $3.9 million to traders was published by SecurityWeek on 2026-11-02. The claim that 726 wallets were affected by the incident was attributed to Polymarket and reported by SecurityWeek. The analysis that an account withdrew at least $2.7 million across 710 other wallets was attributed to Betting Intelligence and Polysights and reported by CNBC.

No confirmed disagreements between outlets were identified. No timeline updates were identified.

• The flaw affects all versions before 15.83, including 15.82, the security update TeamViewer released in September.
• The flaw affects the TeamViewer Full Client on Windows, Linux, and macOS, the Windows Portable edition, and the Android Remote Control app, in all versions before 15.83.

No background yet from current sources.

The vulnerability is classified as CWE-190, an integer overflow. The flaw affects the TeamViewer Full Client on Windows, Linux, and macOS, the Windows Portable edition, and the Android Remote Control app. All versions before 15.83 are affected, including 15.82, the security update TeamViewer released in September.

No details yet about who was affected or the impact from current sources.

Remedio attributed to the discovery of a vulnerability in TeamViewer that allows an attacker to execute arbitrary code on a support technician's computer when a session is accepted. According to Remedio, on Windows, the bug was taken further to bypass the operating system's built-in exploit defenses and run code of the attacker's choosing in the viewer. A malicious or compromised host can exploit the flaw to crash the viewer's TeamViewer and, depending on the platform, may also run code on the viewer's computer. TeamViewer stated that when it published the fix, it was unaware of any attacks exploiting the flaw.

No detection or hunting guidance has been published in current sources.

The vulnerability is associated with the Common Weakness Enumeration identifier CWE-190. The IP addresses 15[.]80[.]6[.]0 and 15[.]82[.]6[.]0 are listed as indicators associated with the vulnerability.

• Based on MITRE ATT&CK guidance for Remote Desktop Software (T1219.002): Analysts should monitor for the installation or use of remote management software such as TeamViewer followed by outbound beaconing or the establishment of remote sessions.
• Based on MITRE ATT&CK guidance for Remote Desktop Software (T1219.002): Detection logic should include the execution of known or custom VNC or remote desktop daemons that initiate external communication after launch.
• Based on MITRE ATT&CK guidance for Remote Desktop Software (T1219.002): Hunters should look for the initiation of remote desktop sessions via TeamViewer accompanied by unexpected user logins or system modifications.
• Based on MITRE ATT&CK guidance for Exploitation for Client Execution (T1203): For cross-platform client execution, correlate application crash logs with new file writes in user-writable paths and the spawning of unexpected child processes that establish outbound connections.
• Based on MITRE ATT&CK guidance for Exploitation for Client Execution (T1203): On Windows, investigate cause-and-effect chains where a client application experiences a crash or abnormal exit, drops files in user-writable paths, and spawns unexpected child processes such as powershell or cmd.
• Based on MITRE ATT&CK guidance for Exploitation for Client Execution (T1203): On macOS, correlate application crash logs for Safari, Chrome, or Office with new files in ~/Library or ~/Downloads and the spawning of unexpected child processes like osascript or bash.

TeamViewer fixed the vulnerability in version 15.83. The fix was released on 2026-10-27. The fix is detailed in TeamViewer security bulletin TV-2026-1011. TeamViewer has fixed a flaw that allows the machine being controlled in a remote session to attack the computer that connected to control it.

Three outlets reported on the vulnerability: cybersecuritynews.com, thehackernews.com, and remedio.io. The assignment of a CVSS 3.1 base score of 8.8 (High) by TeamViewer Product Security is reported by both thehackernews.com and remedio.io. The specific detail that the flaw affects the Windows Portable edition and the Android Remote Control app is reported by both thehackernews.com and cybersecuritynews.com. The statement that TeamViewer was unaware of any attacks exploiting the flaw at the time of the fix is reported only by thehackernews.com.

The claim that Remedio bypassed operating system exploit defenses on Windows is reported only by thehackernews.com. The publication of the vulnerability as CVE-2026-111585 is reported by both thehackernews.com and remedio.io. The release of the fix in TeamViewer 15.83 is reported by both cybersecuritynews.com and remedio.io. No confirmed disagreements between outlets were identified.

No timeline updates were identified.

• Several ICA locations and six Coop stores were affected overnight into November 2.

No background yet from current sources.

Claroty Team82 identified CVE-2025-41451, an OS command injection vulnerability that can lead to remote code execution. Claroty Team82 and CISA documented CVE-2026-21718, an authentication bypass that can enable pre-authentication code execution in Copeland XWEB Pro controllers. Additionally, Claroty Team82 identified CVE-2025-41450, an authentication bypass affecting Danfoss AK-SM 8xxA controllers. Claroty Team82 identified CVE-2025-41452, a web server configuration vulnerability that can lead to denial of service.

Hackers reportedly targeted refrigeration systems at Swedish supermarkets, causing freezers to reach temperatures as high as 55°C.

No details yet about the attackers from current sources.

No ATT&CK techniques were identified in current sources.

No indicators have been published in current sources.

No detection or hunting guidance has been published in current sources.

CERT-FR advises operators to remove public internet access and restore remote access through a secure VPN or protected network. CERT-FR advises operators to check controller settings, including defrost schedules.

Three distinct outlets reported on the incident: fortiguard.fortinet.com, theregister.com, and cybersecuritynews.com. The identification of CVE-2025-41451, CVE-2025-41450, and CVE-2025-41452 by Claroty Team82, as well as the documentation of CVE-2026-21718 by Claroty Team82 and CISA, is reported exclusively by fortiguard.fortinet.com. The warning from France's national cybersecurity agency ANSSI regarding widespread compromises involving Danfoss refrigeration controllers, and the subsequent addition of Copeland and Dixell systems to that warning, is reported exclusively by theregister.com. The confirmation by CERT-FR of compromises involving specific Danfoss and Copeland devices, the advice to remove public internet access, and the report that several ICA locations and six Coop stores were affected overnight into November 2, are reported exclusively by cybersecuritynews.com.

The claim that hackers reportedly targeted refrigeration systems at Swedish supermarkets is reported exclusively by cybersecuritynews.com. The reporting on the vulnerabilities and the ANSSI warning is attributed to specific entities, including Claroty Team82, CISA, and CERT-FR, as stated in the respective source reports. No confirmed disagreements between outlets were identified. No timeline updates were identified.