Verify What Is Deployed: Ivanti, a Poisoned Extension, AD CS & SysGoRAT: MAG212 CYBER Technical Edition, 2 November 2026
Nine incidents, one rule: verify what is actually deployed, not what the dashboard says. This technical edition breaks every story into a briefing with a threat card, a field guide with indicators, GUI reconstructions and paired CLI panels, and an attack atlas with a flow diagram, MITRE ATT&CK mapping and a ready-to-adapt detection. Inside: read-only PowerShell, Bash and zsh checks, KQL, Splunk SPL and Sigma detections, and a CI gate that blocks images with a vulnerable Ruby runtime.
What needs attention today
| Story | ID | Exploited | Action |
|---|---|---|---|
| Ivanti Connect Secure attack chain | CVE-2026-111357, CVE-2026-118527 + CVE-2026-104935 | Yes (Rapid7) | Upgrade to 25.1.1.3 / 22.8R2.6; review the VPN bind account and LAPS / BitLocker reads |
| Tampered Cursor extension | anthropic.claude-code 2.1.312 / 2.1.313 | Served 29 Oct via the Cursor marketplace | Remove the svc-telemetry key and persistence, not just the extension; rotate developer secrets |
| Fake IT support to AD CS | ESC1 / ESC8 | Yes, two intrusions (Microsoft) | Fix template enrollment, apply KB5005413, revoke unauthorized certificates |
| SysGoRAT on Linux servers | No CVE | Yes, Oct 2025 to Apr 2026 (Unit 42) | Hunt auto_prepend_file changes and web-worker shells; rebuild if tampered |
| Polymarket script (DebugBear) | No CVE | Yes, about $2.7M stolen directly | SRI on third-party scripts, report-only CSP first, registrar lock |
| Chainalysis intrusion | No CVE | Profile data accessed (vendor notice) | Expect role-aware phishing; enforce strong MFA |
| Binance theft | No CVE | Yes, over $6B; FBI attributes to TraderTraitor | Screen ledgers against the current FBI address list |
| GitLab / Ruby runtime | CVE-2026-97229 | Attempted at Alpine Linux, 20-21 Oct | Prove Ruby 3.3.13 / 3.4.12 / 4.0.9 inside the deployed image digest |
| GMO Onamae.com Desktop Cloud | No CVE | Breach and ransomware reported (AP) | Named owner, deadline and evidence-based closure for every critical finding |
Inside this edition
- 03 Ivanti VPN: close the entire attack chain
- 06 A trusted extension becomes a foothold
- 09 Fake IT support reaches the certificate tier
- 12 SysGoRAT: persistence on Linux infrastructure
- 15 Polymarket: the browser session is the target
- 18 Chainalysis: identity exposure after intrusion
- 21 Binance theft: attribution and asset tracing
- 24 GitLab: patch the runtime, not just the label
- 27 GMO: security warnings need accountable owners
- 30 The first 24 hours: Windows and Linux triage collectors
- 31 Sources and verification
Flip through the edition
How we report: sources were checked on 2 November 2026 and are linked on page 31. Incident facts come from the cited reporting; ATT&CK mappings, queries and checklists are MAG212 defensive analysis. GUI panels and sample outputs use synthetic data, and every command is a read-only example to test in a lab before production use. Editorial pictures are conceptual AI illustrations.