{"id":3761,"date":"2026-11-01T08:50:03","date_gmt":"2026-11-01T16:50:03","guid":{"rendered":"https:\/\/cyber.mag212.com\/?p=3761"},"modified":"2026-11-01T08:50:03","modified_gmt":"2026-11-01T16:50:03","slug":"broken-trust-mag212-cyber-november-1-2026","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/broken-trust-mag212-cyber-november-1-2026\/","title":{"rendered":"Fi\u00e8vre et confiance bris\u00e9es\u00a0: LXD, Polymarket, Binance et NetamLoader\u00a0: MAG212 CYBER Daily Edition, 1er novembre 2026"},"content":{"rendered":"<div class=\"wp-block-buttons is-content-justification-center is-layout-flex wp-container-core-buttons-is-layout-fe48e5de wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/MAG212-CYBER-2026-11-01-Daily-Edition-A-Broken-Trust.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Lire l&#039;\u00e9dition compl\u00e8te (PDF, 9 pages, 0,2 Mo) \u2192<\/a><\/div>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Trahison de la confiance\u00a0: un certificat client accept\u00e9 comme preuve alors qu\u2019il n\u2019a jamais \u00e9t\u00e9 fourni, un script d\u2019analyse ex\u00e9cut\u00e9 avec les droits d\u2019une plateforme de trading, un ordinateur portable DevOps ayant entra\u00een\u00e9 un retrait de plusieurs milliards de dollars, et des composants Windows sign\u00e9s chargeant du code auquel ils n\u2019\u00e9taient pas cens\u00e9s participer. Cette \u00e9dition analyse chaque incident en d\u00e9tail \u00e0 l\u2019aide de diagrammes de p\u00e9rim\u00e8tre de confiance, d\u2019une chronologie pr\u00e9cise de l\u2019attaque Polymarket, de vues de console, de tableaux d\u2019indicateurs, ainsi que de commandes en lecture seule et de requ\u00eates de recherche pour Linux, Kubernetes, PowerShell et Microsoft Defender. Son pendant, l\u2019\u00e9dition B, traite de PHP2Shell, Ivanti, de l\u2019extension Claude Code compromise, de GitLab et de PAN-OS.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Qu&#039;est-ce qui requiert notre attention aujourd&#039;hui ?<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Histoire<\/th><th>IDENTIFIANT<\/th><th>Gravit\u00e9<\/th><th>Exploit\u00e9<\/th><th>Action<\/th><\/tr><\/thead><tbody><tr><td>Contournement de l&#039;authentification API LXD \/ MicroCloud<\/td><td>CVE-2026-112816<\/td><td>CVSS 10.0 (signal\u00e9)<\/td><td>Non \u00e9tabli<\/td><td>LXD 6.10.1 \/ 5.21.9 \/ 5.0.11 \/ 4.0.15\u00a0; MicroCloud 2.1.5 \/ 3.4.1\u00a0; restreindre l\u2019acc\u00e8s \u00e0 l\u2019API<\/td><\/tr><tr><td>Script de surveillance Polymarket (DebugBear)<\/td><td>Aucun CVE<\/td><td>Haut<\/td><td>Oui, le 29 octobre (environ $2,7M touch\u00e9s)<\/td><td>Supprimer les scripts tiers des flux de signature\u00a0; SRI, CSP\u00a0; r\u00e9voquer les sessions<\/td><\/tr><tr><td>Vol sur Binance<\/td><td>Aucun CVE<\/td><td>Critique<\/td><td>Oui, aux alentours du 29 octobre\u00a0; le FBI attribue cela \u00e0 la Cor\u00e9e du Nord (TraderTraitor).<\/td><td>Isolez les terminaux suspects, r\u00e9\u00e9mettez les identifiants des charges de travail et restaurez-les par \u00e9tapes.<\/td><\/tr><tr><td>NetamLoader (chargeur Windows cibl\u00e9)<\/td><td>Aucun CVE<\/td><td>Cibl\u00e9<\/td><td>Oui, une victime a \u00e9t\u00e9 observ\u00e9e (Kaspersky).<\/td><td>Corr\u00e9ler les binaires sign\u00e9s avec les modifications de configuration, les modules charg\u00e9s et les connexions<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Dans cette \u00e9dition<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Aujourd&#039;hui en bref\u00a0:<\/strong> quatre chiffres cl\u00e9s, ce \u00e0 quoi chaque victime croyait par rapport \u00e0 ce qui s&#039;est r\u00e9ellement pass\u00e9, et un ordre d&#039;action.<\/li>\n\n\n<li><strong>LXD\u00a0: la cha\u00eene de certificats que personne n\u2019a v\u00e9rifi\u00e9e\u00a0:<\/strong> Comment un certificat public emprunt\u00e9 a permis d&#039;obtenir un acc\u00e8s administrateur, versions corrig\u00e9es et commandes pour v\u00e9rifier l&#039;exposition et appliquer des correctifs.<\/li>\n\n\n<li><strong>\u00c0 l&#039;int\u00e9rieur du syst\u00e8me de drainage du Polymarket, minute par minute\u00a0:<\/strong> la chronologie UTC, les quatre \u00e9tapes qui ont vid\u00e9 les portefeuilles et un journal r\u00e9seau du navigateur d&#039;une victime.<\/li>\n\n\n<li><strong>D\u00e9fendez la page qui signe :<\/strong> S\u00e9paration des pages de signature des scripts tiers, exemples SRI et CSP, commandes d&#039;audit et indicateurs.<\/li>\n\n\n<li><strong>Binance : les cl\u00e9s \u00e9taient en s\u00e9curit\u00e9, l&#039;argent est quand m\u00eame parti :<\/strong> le mode d&#039;attaque signal\u00e9, l&#039;ampleur de l&#039;attaque par rapport aux vols pr\u00e9c\u00e9dents, les contr\u00f4les d&#039;acc\u00e8s Kubernetes et le filtrage des adresses par le FBI.<\/li>\n\n\n<li><strong>NetamLoader\u00a0:<\/strong> la cha\u00eene en sept \u00e9tapes, le fichier .config d\u00e9tourn\u00e9 et le correctif AMSI, puis les v\u00e9rifications PowerShell, les requ\u00eates KQL de Defender, les exemples Sysmon et les hachages de fichiers.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Feuilletez l&#039;\u00e9dition<\/h2>\n\n\n<div class=\"_df_book df-lite\" id=\"0\"  data-title=\"\" wpoptions=\"true\" thumbtype=\"\" source=\"https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/MAG212-CYBER-2026-11-01-Daily-Edition-A-Broken-Trust.pdf\" height=\"auto\" webgl=\"true\" ><\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">M\u00e9thodologie de nos rapports\u00a0: les sources ont \u00e9t\u00e9 v\u00e9rifi\u00e9es le 1er novembre 2026 et les dates de publication diff\u00e8rent des dates des incidents. Les chiffres relatifs aux pertes sont des estimations et l\u2019attribution repose sur une \u00e9valuation de l\u2019agence, et non sur une d\u00e9cision de justice. Les sch\u00e9mas repr\u00e9sentent des limites conceptuelles de confiance et non des reconstitutions du r\u00e9seau des victimes. Les \u00e9tapes de v\u00e9rification sont des contr\u00f4les propos\u00e9s et non des tests effectu\u00e9s par MAG212 sur les syst\u00e8mes affect\u00e9s. Corrections et suggestions\u00a0: consultant@mag212.com.<\/p>\n\n\n\n<h2 class=\"wp-block-heading mag212-related\">Articles connexes sur MAG212 CYBER<\/h2>\n\n\n\n<ul class=\"wp-block-list mag212-related-list\">\n<li><a href=\"https:\/\/cyber.mag212.com\/fr\/deadline-day-mag212-cyber-november-1-2026\/\">Date limite : PHP2Shell, Ivanti, une extension empoisonn\u00e9e et GitLab : MAG212 CYBER Daily Edition, 1er novembre 2026<\/a><\/li>\n\n\n<li><a href=\"https:\/\/cyber.mag212.com\/fr\/heists-hijacked-scripts-hostile-regex-mag212-cyber-october-30-2026\/\">Braquages, scripts pirat\u00e9s et expressions r\u00e9guli\u00e8res hostiles\u00a0: MAG212 CYBER Daily Edition, 30 octobre 2026<\/a><\/li>\n\n\n<li><a href=\"https:\/\/cyber.mag212.com\/fr\/borrowed-trust-mag212-cyber-weekly-october-31-2026\/\">Fiducie emprunt\u00e9e : MAG212 CYBER Weekly, 31 octobre 2026<\/a><\/li>\n\n\n<li><a href=\"https:\/\/cyber.mag212.com\/fr\/the-edge-the-cloud-and-the-code-mag212-cyber-october-29-2026\/\">L&#039;Edge, le Cloud et le Code : MAG212 CYBER Daily Edition, 29 octobre 2026<\/a><\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"<p>An LXD\/MicroCloud certificate bypass (CVE-2026-112816), the DebugBear script that drained Polymarket traders, the FBI-attributed Binance theft and Kaspersky&#8217;s NetamLoader: four broken trust boundaries and how to defend each.<\/p>","protected":false},"author":1,"featured_media":3765,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19,13,21,15,14],"tags":[127,130,153,126,154,156,151,152,155,129,131,149,128],"class_list":["post-3761","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-critical-cves","category-cyber-incidents","category-digital-magazine","category-threat-intelligence","category-vulnerabilities","tag-binance","tag-crypto-hack","tag-cve-2026-112816","tag-daily-edition","tag-debugbear","tag-kaspersky","tag-lxd","tag-microcloud","tag-netamloader","tag-north-korea","tag-polymarket","tag-supply-chain","tag-tradertraitor"],"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/3761","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=3761"}],"version-history":[{"count":3,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/3761\/revisions"}],"predecessor-version":[{"id":3859,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/3761\/revisions\/3859"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media\/3765"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=3761"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/categories?post=3761"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/tags?post=3761"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}