Stolen cloud keys let attackers run up $100,000 AI bills in a day, Mandiant says
Google’s threat intelligence group says resellers pool the stolen access and sell it on, and Mandiant published detection guidance for AWS, Azure and Google Cloud.
Daily Brief
Tuesday, November 3, 2026
Added to KEV
No additionsNo additions to the catalog in this edition’s window.
Source: CISA’s Known Exploited Vulnerabilities catalog, version 2026.10.30
Breaches and campaigns
2 itemsBITTER espionage group targets South Asia with new PapRAT trojan, Fortinet says
Fortinet, which published hashes and network indicators, says one of the three infection chains drops no malware file and runs its scripts through Windows’ own ftp.exe.
Worth reading
1 itemMicrosoft
Microsoft on which flaws attackers exploit and how slowly servers get patched
About 2,000 of roughly 383,000 published CVEs have been tied to real attacks, Microsoft says, and the median flaw takes more than a month to patch on Windows servers.
Read: Microsoft on which flaws attackers exploit and how slowly servers get patched