Out of office, out of service.

Microsoft 365 recovers from a global outage. StingyBasilisk pivots through Windows named pipes to infiltrate isolated networks. The FBI freezes billions after North Korea's Binance heist, while Pyongyang's Sapphire Sleet steals $400 million via spoofed video calls. Cupertino details Secure Exclaves for ambient sensor privacy. Operation TorNado nets 354 arrests in a global dark web crackdown. Check Point patches an actively exploited zero-day tied to wiper attacks. The wfx-loot campaign hijacks thousands of GitHub accounts to harvest cloud secrets. And civil liberties groups warn Congress against slipping Section 702 renewal into the defense bill. Our guests are Lauren Zabierek and Bob Lord, discussing the launch of the Software Safety Institute. United grounds personal AI agents over credential and compliance risks.

Today is Friday November 13th 2026. I’m Dave Bittner. And this is your CyberWire Intel Briefing.

Microsoft 365 recovers from a global outage. 

If you rely on services from Microsoft, I’m betting you are already aware of today’s top story. 

A major global outage disrupted Microsoft 365 services for more than twenty hours, and Redmond says a cyberattack is not to blame. 

According to BBC, connectivity problems hit Outlook, Teams, and Copilot after a large number of servers became unexpectedly unavailable, shifting heavy traffic onto remaining infrastructure. Downdetector logged 140 thousand user reports across seventy-four countries, though total impact among Microsoft's more than 430 million users remains unclear. Knock-on disruptions have affected OpenAI, Anthropic, US courts, a Toronto hospital network, and Japanese government systems. Microsoft reports encouraging recovery progress in Europe and North America, noting earlier fixes were not taking as expected.

Prolonged cloud outages create cascading operational friction across critical infrastructure and AI dependencies, even without a threat actor at the keyboard. As Professor James Ferryman of the University of Reading notes, bringing swamped authentication servers back online requires a cautious, gradual approach to avoid triggering a fresh reconnection surge.

StingyBasilisk abuses Windows named pipes and SMB to infiltrate isolated networks. 

An espionage group tracked as StingyBasilisk is abusing Windows named pipes and the Server Message Block protocol to move malware across isolated government networks, according to research from Positive Technologies.

According to incident response findings published by Positive Technologies, the group has operated since at least April 2022, masquerading as legitimate security tools. Beginning in February 2026, the attackers spread laterally over SMB and executed memory-resident payloads using Impacket's atexec tool and DLL side-loading via signed SafeNet libraries. To maintain persistence, the threat actors abused Component Object Model hijacking and modified Windows Time service providers, deploying custom implants like SilentCOM, TediousLoader, and CunningDoor. By chaining infected hosts through named pipes, the attackers reach air-gapped or segmented systems lacking direct internet access.

Abusing native Windows inter-process communication allows espionage campaigns to blend into routine administrative traffic and bypass traditional perimeter defenses. Defenders can counter this activity by restricting inter-segment SMB traffic, auditing scheduled task creation, and hunting for anomalous registry modifications.

The FBI freezes billions following the North Korean heist at Binance. 

The US Federal Bureau of Investigation has frozen over $2.7 billion and obtained court authorization to seize another $1.2 billion following a massive cryptocurrency theft at Binance.

According to the FBI, the October 29 cyberattack resulted in the theft of approximately $6.3 billion, most of it drained within twenty minutes. While the exact intrusion vector remains under investigation, blockchain analysts assess that attackers compromised Binance's transaction-signing infrastructure, enabling unauthorized approvals without stealing private keys. Co-CEO Richard Teng assured users that customer losses will be covered through Binance's Secure Asset Fund for Users and corporate reserves. Investigators linked the stolen funds to a prior Bitget breach, attributing the heist to the North Korean state-sponsored group TraderTraitor.

The rapid freeze demonstrates how coordinated public-private action and centralized stablecoin controls can blunt massive cryptocurrency heists intended to fund Pyongyang's prohibited weapons programs.

Pyongyang's Sapphire Sleet steals $400 million using spoofed video calls. 

North Korean state-backed hackers have stolen over $400 million in cryptocurrency across eighteen months by secretly recording victims on fake video calls, according to the US Federal Bureau of Investigation.

In a campaign tracked as FaceStealer, the threat cluster known as Sapphire Sleet, or UNC1069, lures targets onto imposter versions of Zoom, Microsoft Teams, and Google Meet using invitations sent from compromised contacts. During the call, a fabricated technical error prompts victims to click a malicious link, infecting their devices and hijacking their accounts to repeat the cycle. Investigators seized more than nine hundred stolen webcam videos and note the group is increasingly generating artificial intelligence deepfakes of prominent cryptocurrency figures.

Weaponizing trusted social graphs alongside synthetic video bypasses traditional perimeter defenses through pure human deception.

Cupertino details Secure Exclaves architecture for ambient sensor privacy. 

Apple has published technical details on Secure Exclaves, a hardware-enforced security architecture designed to isolate background camera and microphone processing from the main operating system, third-party apps, and Apple itself.

According to Apple, Secure Exclaves supports features like person recognition on HomeView, Siri Recap, and Live Rewind across new iPhone, MacBook Neo, and HomeView devices. Built on a customized L4 microkernel and enforced by the Secure Page Table Monitor, the architecture processes raw audio and video in an independent execution context before discarding the data. During ambient sensing, only strictly audited metadata—such as an enrolled user's identifier or confidence score—crosses into the main operating system. Full sensor streams are released only in active mode after an Exclave Indicator Controller verifies that on-screen pixels or hardware LEDs meet visibility thresholds.

Enforcing hardware-backed isolation and tamper-resistant indicators helps mitigate silent surveillance risks inherent in always-on ambient artificial intelligence features.

Operation TorNado nets 354 arrests across fourteen countries in dark web crackdown. 

Law enforcement agencies across fourteen countries have arrested 354 dark web vendors and buyers in Operation TorNado, a coordinated crackdown spanning May 2025 through October 2026.

According to Europol, investigators targeted users linked to five previously shuttered marketplaces—Archetyp, Bohemia, Nemesis, Kingdom, and Tor2Door—alongside encrypted messaging services and single-vendor shops. The United States led with 132 arrests, followed by the UK with fifty-nine, Hungary with forty-five, and Germany with forty-one. Authorities executed hundreds of searches, seizing over €210 million in combined cash and cryptocurrency, more than two hundred firearms, and nearly six metric tonnes of illicit drugs across the US and Europe, aided by Europol blockchain analysts tracing transactions.

Law enforcement's ability to exploit residual data from defunct sites demonstrates that marketplace takedowns increasingly serve as the starting point for long-term user identification, even as criminals migrate toward specialized platforms.

Check Point patches zero-day flaw exploited for root access and wiper attacks. 

Check Point Software has released emergency hotfixes for an actively exploited zero-day vulnerability allowing attackers to gain root privileges on vulnerable appliances.

Tracked as CVE-2026-123039, the flaw stems from an unauthenticated local socket in the Gaia OS DynamicCLI daemon. According to Check Point, threat actors compromised Mobile Access portals via the PHP2Shell bug, escalated privileges using this zero-day, deployed backdoors, and pivoted to VMware ESXi hosts to run destructive wiper malware across roughly two dozen customers.

Unauthenticated local inter-process communication exposes perimeter gateways to rapid privilege escalation and lateral destruction.

Campaign dubbed wfx-loot compromises 4,837 GitHub accounts to harvest cloud secrets. 

A widespread supply-chain campaign dubbed wfx-loot has compromised 4,837 GitHub accounts to probe more than sixty-one thousand repositories and steal cloud credentials from at least 1,835 targets.

According to application security firm Aikido, the operation began November 10, targeting accounts linked to Fortune 100 firms, the US General Services Administration, and the French government. Attackers opened fake dependency audit pull requests to test write permissions, then injected a credential-harvesting shell script via GitHub Actions workflows or npm install hooks. The malware exfiltrated cloud tokens, artificial intelligence keys, and developer secrets—and even escalated privileges across Amazon Web Services, Azure, and Google Cloud—before reverting changes and deleting workflow logs in under a minute.

Automating secret theft across continuous integration pipelines turns compromised developer tokens into rapid, multi-cloud privilege escalation.

A Civil liberties coalition warns Congress against attaching Section 702 renewal to defense bill. 

A coalition of twenty-seven civil liberties groups is warning congressional leaders against attaching a renewal of Section 702 of the Foreign Intelligence Surveillance Act to the annual National Defense Authorization Act without adding a warrant requirement for searches involving Americans.

According to a letter led by Demand Progress and first reported by CyberScoop, the groups argued that slipping an unamended extension into the must-pass defense bill would circumvent bipartisan debate over constitutional rights, noting that existing court authorization allows intelligence operations to continue through March despite the law's summer lapse. Conversely, House Intelligence Committee ranking member Representative Jim Himes told The Hill that Congress should pass a reauthorization during the current lame-duck session before an incoming Democratic majority potentially imposes stricter limits next year.

The debate highlights the recurring tension between preserving rapid foreign intelligence collection capabilities and enforcing Fourth Amendment privacy safeguards through legislative reform.

 

 

United grounds personal AI agents over credential and compliance risks. 

United Airlines is grounding artificial intelligence agents, blocking the digital assistants from booking flights or managing reservations on behalf of customers.

In a Wednesday press release, the carrier warned that handing account logins to third-party assistants exposes sensitive data and invites unintended purchases or rogue MileagePlus redemptions. Anyhoo, it turns out that even the smartest algorithm still cannot legally swear to the Federal Aviation Administration that your checked bag is free of explosives. United is updating its ticketing and distribution policies across its own platforms and third-party aggregators, echoing a similar password warning from Bank of America last week.

As enterprises struggle to distinguish legitimate bots from human travelers, Trua CEO Raj Ananthanpillai notes that outright bans merely delay the inevitable shift toward verified identity tokens.

And that’s the CyberWire.

For links to all of today’s stories, check out our Daily Briefing at the cyberwire dot com.

 

We’d love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like the show, please share a rating and review in your podcast app. Please also fill out the survey in the show notes or send an email to cyberwire@n2k.com

 

N2K’s lead producer is Liz Stokes. We’re mixed by  Tré Hester, with original music by and sound design Elliott Peltzman. Our contributing host is Maria Varmazis. Our executive producer is Jennifer Eiben. Peter Kilpe is our publisher. And I’m Dave Bittner. Thanks for listening.