{"id":3861,"date":"2026-11-02T10:17:04","date_gmt":"2026-11-02T18:17:04","guid":{"rendered":"https:\/\/cyber.mag212.com\/verify-what-is-deployed-ivanti-a-poisoned-extension-ad-cs-sysgorat-mag212-cyber-technical-edition-2-november-2026\/"},"modified":"2026-11-02T10:17:04","modified_gmt":"2026-11-02T18:17:04","slug":"verify-what-is-deployed-ivanti-a-poisoned-extension-ad-cs-sysgorat-mag212-cyber-technical-edition-2-november-2026","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/verify-what-is-deployed-ivanti-a-poisoned-extension-ad-cs-sysgorat-mag212-cyber-technical-edition-2-november-2026\/","title":{"rendered":"Verify What Is Deployed: Ivanti, a Poisoned Extension, AD CS &#038; SysGoRAT: MAG212 CYBER Technical Edition, 2 November 2026"},"content":{"rendered":"<div class=\"wp-block-buttons is-content-justification-center is-layout-flex wp-container-core-buttons-is-layout-fe48e5de wp-block-buttons-is-layout-flex\"><div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/MAG212_CYBER_2026-11-02_Technical_Edition_v2.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Read the full edition (PDF, 31 pages, 6.4 MB) \u2192<\/a><\/div><\/div>\n\n<p class=\"wp-block-paragraph\">Nine incidents, one rule: verify what is actually deployed, not what the dashboard says. This technical edition breaks every story into a <strong>briefing<\/strong> with a threat card, a <strong>field guide<\/strong> with indicators, GUI reconstructions and paired CLI panels, and an <strong>attack atlas<\/strong> with a flow diagram, MITRE ATT&amp;CK mapping and a ready-to-adapt detection. Inside: read-only PowerShell, Bash and zsh checks, KQL, Splunk SPL and Sigma detections, and a CI gate that blocks images with a vulnerable Ruby runtime.<\/p>\n\n<h2 class=\"wp-block-heading\">Qu&#039;est-ce qui requiert notre attention aujourd&#039;hui ?<\/h2>\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Histoire<\/th><th>IDENTIFIANT<\/th><th>Exploit\u00e9<\/th><th>Action<\/th><\/tr><\/thead><tbody><tr><td>Ivanti Connect Secure attack chain<\/td><td>CVE-2026-111357, CVE-2026-118527 + CVE-2026-104935<\/td><td>Yes (Rapid7)<\/td><td>Upgrade to 25.1.1.3 \/ 22.8R2.6; review the VPN bind account and LAPS \/ BitLocker reads<\/td><\/tr><tr><td>Tampered Cursor extension<\/td><td>anthropic.claude-code 2.1.312 \/ 2.1.313<\/td><td>Served 29 Oct via the Cursor marketplace<\/td><td>Remove the svc-telemetry key and persistence, not just the extension; rotate developer secrets<\/td><\/tr><tr><td>Fake IT support to AD CS<\/td><td>ESC1 \/ ESC8<\/td><td>Yes, two intrusions (Microsoft)<\/td><td>Fix template enrollment, apply KB5005413, revoke unauthorized certificates<\/td><\/tr><tr><td>SysGoRAT on Linux servers<\/td><td>Aucun CVE<\/td><td>Yes, Oct 2025 to Apr 2026 (Unit 42)<\/td><td>Hunt auto_prepend_file changes and web-worker shells; rebuild if tampered<\/td><\/tr><tr><td>Polymarket script (DebugBear)<\/td><td>Aucun CVE<\/td><td>Yes, about $2.7M stolen directly<\/td><td>SRI on third-party scripts, report-only CSP first, registrar lock<\/td><\/tr><tr><td>Chainalysis intrusion<\/td><td>Aucun CVE<\/td><td>Profile data accessed (vendor notice)<\/td><td>Expect role-aware phishing; enforce strong MFA<\/td><\/tr><tr><td>Vol sur Binance<\/td><td>Aucun CVE<\/td><td>Yes, over $6B; FBI attributes to TraderTraitor<\/td><td>Screen ledgers against the current FBI address list<\/td><\/tr><tr><td>GitLab \/ Ruby runtime<\/td><td>CVE-2026-97229<\/td><td>Attempted at Alpine Linux, 20-21 Oct<\/td><td>Prove Ruby 3.3.13 \/ 3.4.12 \/ 4.0.9 inside the deployed image digest<\/td><\/tr><tr><td>GMO Onamae.com Desktop Cloud<\/td><td>Aucun CVE<\/td><td>Breach and ransomware reported (AP)<\/td><td>Named owner, deadline and evidence-based closure for every critical finding<\/td><\/tr><\/tbody><\/table><\/figure>\n\n<h2 class=\"wp-block-heading\">Dans cette \u00e9dition<\/h2>\n\n<ul class=\"wp-block-list\"><li><strong>03<\/strong> Ivanti VPN: close the entire attack chain<\/li><li><strong>06<\/strong> A trusted extension becomes a foothold<\/li><li><strong>09<\/strong> Fake IT support reaches the certificate tier<\/li><li><strong>12<\/strong> SysGoRAT: persistence on Linux infrastructure<\/li><li><strong>15<\/strong> Polymarket: the browser session is the target<\/li><li><strong>18<\/strong> Chainalysis: identity exposure after intrusion<\/li><li><strong>21<\/strong> Binance theft: attribution and asset tracing<\/li><li><strong>24<\/strong> GitLab: patch the runtime, not just the label<\/li><li><strong>27<\/strong> GMO: security warnings need accountable owners<\/li><li><strong>30<\/strong> The first 24 hours: Windows and Linux triage collectors<\/li><li><strong>31<\/strong> Sources and verification<\/li><\/ul>\n\n<h2 class=\"wp-block-heading\">Feuilletez l&#039;\u00e9dition<\/h2>\n\n<div class=\"_df_book df-lite\" id=\"0\"  data-title=\"\" wpoptions=\"true\" thumbtype=\"\" source=\"https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/MAG212_CYBER_2026-11-02_Technical_Edition_v2.pdf\" height=\"auto\" webgl=\"true\" ><\/div>\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n<p class=\"wp-block-paragraph\"><em>How we report: sources were checked on 2 November 2026 and are linked on page 31. Incident facts come from the cited reporting; ATT&amp;CK mappings, queries and checklists are MAG212 defensive analysis. GUI panels and sample outputs use synthetic data, and every command is a read-only example to test in a lab before production use. Editorial pictures are conceptual AI illustrations.<\/em><\/p>\n\n<h2 class=\"wp-block-heading\">Articles connexes sur MAG212 CYBER<\/h2>\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/cyber.mag212.com\/fr\/deadline-day-mag212-cyber-november-1-2026\/\">Date limite : PHP2Shell, Ivanti, une extension empoisonn\u00e9e et GitLab : MAG212 CYBER Daily Edition, 1er novembre 2026<\/a><\/li><li><a href=\"https:\/\/cyber.mag212.com\/fr\/broken-trust-mag212-cyber-november-1-2026\/\">Fi\u00e8vre et confiance bris\u00e9es\u00a0: LXD, Polymarket, Binance et NetamLoader\u00a0: MAG212 CYBER Daily Edition, 1er novembre 2026<\/a><\/li><li><a href=\"https:\/\/cyber.mag212.com\/fr\/gitlab-cve-2026-97229-investigation-guide\/\">Au c\u0153ur de la faille GitLab\u00a0: de la configuration CI \u00e0 l\u2019ex\u00e9cution sur le serveur (CVE-2026-97229)<\/a><\/li><\/ul>","protected":false},"excerpt":{"rendered":"<p>Nine investigations rebuilt for responders: the Ivanti Connect Secure chain, a tampered Cursor extension, help-desk impersonation reaching AD CS, SysGoRAT on Linux, and five more, with PowerShell, Bash, KQL and Sigma you can adapt today.<\/p>","protected":false},"author":1,"featured_media":3860,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19,13,21,15,14],"tags":[157,127,137,141,142,148,146,147,122,126,154,66,102,145,162,160,158,85,129,131,161,149,159,128],"class_list":["post-3861","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-critical-cves","category-cyber-incidents","category-digital-magazine","category-threat-intelligence","category-vulnerabilities","tag-ad-cs","tag-binance","tag-chainalysis","tag-claude-code","tag-cursor","tag-cve-2026-104935","tag-cve-2026-111357","tag-cve-2026-118527","tag-cve-2026-97229","tag-daily-edition","tag-debugbear","tag-gitlab","tag-gmo","tag-ivanti-connect-secure","tag-kql","tag-linux","tag-microsoft-teams","tag-mitre-attck","tag-north-korea","tag-polymarket","tag-powershell","tag-supply-chain","tag-sysgorat","tag-tradertraitor"],"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/3861","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=3861"}],"version-history":[{"count":0,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/3861\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media\/3860"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=3861"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/categories?post=3861"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/tags?post=3861"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}