Cybersecurity Weekly News (November 2–8): DDoS surges, Binance Lloses $6.3 billion, and AI expands attack scale
The week of November 2–8, 2026 brought several significant cybersecurity developments, from more than 1.9 million DDoS attacks recorded in Vietnam during Q3 and renewed discussions around data security and biometric risks, to Binance disclosing the intrusion chain behind approximately $6.3 billion in digital-asset losses. At the same time, AI agents, zero-days in remote-access appliances, IoT weaknesses, and software supply-chain compromises continued to expand the enterprise attack surface.
The defining theme cybersecurity weekly news November 2–8 was not one particular attack vector. Instead, the incidents showed how attackers are combining Social Engineering, credential theft, endpoint compromise, AI automation, remote-access infrastructure, and trusted software update mechanisms to deepen access and scale operations.
For businesses, this means security can no longer depend on a single product or control layer. Asset visibility, identity security, vulnerability management, supply-chain monitoring, and rapid incident response increasingly need to operate together.
Organizations can continue following new developments through the IPSIP Vietnam's Cybersecurity News section.
I. Cybersecurity news in Vietnam
1. Vietnam records more than 1.9 million DDoS attacks and over 481 million exposed records in Q3 2026
On November 4, new figures on Vietnam’s cybersecurity landscape for Q3 2026 showed more than 1.95 million DDoS attacks, 15 ransomware incidents, 34,223 newly identified vulnerabilities, and more than 481.4 million sensitive data records associated with leaks or data sales.
More than 5.48 million personal account records were also exposed, while 4,793 phishing domains were detected. The figures suggest that risk is not concentrated in one attack category, but spans ransomware, DDoS, phishing, credential exposure, and Internet-facing vulnerabilities.
IPSIP examined these figures in greater depth in “Vietnam Cybersecurity in Q3 2026: DDoS Surges and Ransomware Escalates”, highlighting a broader shift toward attackers abusing legitimate software, supply chains, and components that enterprises already trust.
This creates a significant challenge for businesses. If attackers gain access using valid credentials, compromised software libraries, or trusted administration tools, security models based mainly on distinguishing “good traffic” from “bad traffic” become less effective.
Organizations need to move beyond perimeter-centric defense toward continuous control of identity, behavior, and exposure.
2. Vietnam’s Data Security Law discussions continue to emphasize risk-based governance
On November 4, discussions around Vietnam’s proposed Data Security Law continued, with risk-based data management remaining one of the key principles.
The approach reflects a practical reality: not all data requires the same level of protection.
A marketing email list should not be protected in the same way as:
financial data;
health information;
administrator accounts;
encryption keys;
customer records;
critical operational data.
IPSIP Vietnam’s analysis of the draft Data Security Law and what businesses should prepare for shows that risk-based classification could make data inventory, data classification, third-party controls, and cross-border data governance increasingly important for enterprises.
Businesses do not need to wait for the legislation to be finalized before taking action. Basic questions should already be answered:
Where is data stored?
Who has access?
Which data is sensitive or critical?
Which vendors receive or process it?
Does the data move through overseas cloud or SaaS services?
Is obsolete data deleted according to an appropriate lifecycle?
3. Thanh Hoa: number of arrests in cross-border fraud investigation rises to 94
On November 4, Vietnam’s Ministry of Public Security provided an update on the investigation into a cross-border fraud operation based in Thanh Hoa.
Authorities had detained 94 people, five more than previously reported, including 90 foreign nationals and four Vietnamese citizens. The suspects were investigated for allegedly using computers, telecommunications networks, and electronic devices to fraudulently obtain assets.
Notably, the operation did not resemble a small, informal scam ring. Participants were reportedly divided into groups and used social media, improperly registered SIM cards, fake investment platforms, and payment mechanisms to approach and manipulate victims.
The case is a clear example of industrialized cyber fraud.
When fraud is organized like a business operation — with personnel, infrastructure, scripts, and processes - organizations need a similarly structured defensive approach.
Identity protection, transaction verification, brand monitoring, and Security Awareness should therefore operate together rather than as isolated controls.
4. Facial data can become a “key hanging outside the door”
On November 4, discussions around data security again highlighted the risks associated with biometric information.
One concern is that facial images publicly available on social media can be collected, processed, or reused by attackers in impersonation scenarios or against weak identity-verification systems.
Unlike passwords, biometric data cannot easily be changed once exposed.
If a password is compromised, a user can reset it. A person cannot reset their face or fingerprints.
This is why biometric information should be treated as highly sensitive data, with stronger controls around:
storage;
encryption;
access control;
retention;
third-party sharing.
The risk becomes even more significant as AI and Deepfake technologies make it cheaper to recreate faces, voices, and digital identities.
II. Binance discloses intrusion chain behind approximately $6.3 billion in losses
On November 3, Binance released additional details about the intrusion chain behind approximately $6.3 billion in digital-asset losses.
According to initial investigation details, devices belonging to multiple engineers had been compromised. One case involved modified software, while another reportedly began with a fake job interview, which allowed attackers to deliver malware to an endpoint.
After gaining device access, the attackers continued exploiting stolen credentials and permissions associated with wallet infrastructure.
IPSIP Vietnam traced the attack path in “How Binance Was Hacked: From a Fake Recruitment Trap to Wallet Infrastructure Risk”, showing why developer endpoint security and privileged-account controls need to be treated as part of the same defensive chain.
For businesses, the lesson is straightforward: Security Awareness is not only for general office staff. Developers, administrators, finance teams, and anyone with privileged access can become priority Social Engineering targets.
2. European freezer systems continue to be hacked as IoT risk becomes physical
In early November, several European supermarkets continued reporting unauthorized access to refrigeration systems and remote manipulation of temperatures.
At some locations, freezer temperatures were reportedly raised to unusually high levels, damaging goods and creating direct operational losses.
What makes these incidents important is that the impact no longer exists only on a screen. When OT and IoT systems control physical equipment, a cyberattack can lead to:
damaged inventory;
downtime;
supply-chain disruption;
direct financial losses;
operational safety concerns.
In its analysis of the wave of refrigeration-system attacks across Europe, IPSIP Vietnam highlighted how Internet-exposed management interfaces, outdated firmware, and weak remote-access controls can turn seemingly simple IoT systems into meaningful attack surfaces.
Retailers, manufacturers, logistics providers, and smart-building operators should therefore include OT and IoT systems in asset inventories, segment operational networks from corporate environments, and remove unnecessary Internet-facing management interfaces.
3. ARTEX AI used in campaigns targeting more than 200 organizations
On November 2, CrowdStrike reported that hackers had used ARTEX, a multi-agent AI penetration-testing framework, in campaigns targeting more than 200 organizations across 14 countries.
Targets included government, telecommunications, pharmaceutical, semiconductor, defense, nuclear, and financial organizations. CrowdStrike confirmed that at least nine organizations had been compromised.
According to CrowdStrike, the campaign represents a shift from using AI agents in individual intrusions toward multiple simultaneous engagements coordinated by a human operator.
This changes the economics of cyberattacks. A single attacker can scale the number of targets without increasing the number of human operators at the same rate.
For SOC and Blue Teams, the challenge is therefore no longer just detection accuracy — it is also responding fast enough.
4. Ivanti patches two Connect Secure zero-days chained in real-world attacks
During the week, Ivanti released patches for two new vulnerabilities affecting Connect Secure, tracked as CVE-2026-111357 and CVE-2026-118527.
Attackers reportedly chained the two flaws with another authentication bypass to achieve root-level execution on affected devices. More than 5,000 Connect Secure instances were still observed exposed to the Internet.
When a zero-day has already been exploited in the wild, organizations should:
update affected versions;
review logs;
hunt for signs of compromise;
reset relevant credentials;
review configurations;
monitor privileged activity.
5. cPGuard auto-update infrastructure hijacked to distribute backdoors to nearly 3,000 servers
On November 3, cPGuard confirmed that attackers had compromised its update distribution infrastructure and used the legitimate auto-update channel to deploy a backdoor and data-stealing scripts to customers.
Approximately 2,946 servers were identified as affected. Targeted data reportedly included Linux password hashes, database credentials, shell history, and SSH keys.
This is a textbook software supply-chain attack.
The malicious payload did not arrive from an unfamiliar website or a suspicious attachment. It came through an update channel that systems were designed to trust.
This is also why Zero Trust should not apply only to users. Software, vendors, devices, and update infrastructure should all be treated as components that can potentially be compromised.
III. What should businesses prioritize after cybersecurity weekly news November 2–8?
The developments from November 2–8 point to four major priorities.
1. People can still open the first door
The Binance case shows how a fake job interview can become the first step in a breach worth billions of dollars.
Security Awareness therefore needs to be tailored to roles and privilege levels, especially for developers, administrators, and privileged users.
2. AI is changing the economics of cyberattacks
ARTEX shows how a human operator can use AI agents to scale reconnaissance and exploitation across hundreds of targets.
On November 5, Reuters also reported that nearly 37,000 software and system vulnerabilities were disclosed during Q3 2026, roughly three times the number recorded during the same period a year earlier, as both attackers and defenders increasingly use AI.
This volume makes fully manual processes increasingly difficult to sustain.
3. Trusted infrastructure is becoming an attack surface
Ivanti and cPGuard share one important characteristic: both occupy trusted positions inside enterprise environments.
One is a remote-access gateway. The other is a security software update channel.
When attackers compromise trusted systems, many traditional controls can be bypassed.
4. Cybersecurity increasingly creates physical and business impact
The refrigeration attacks show that weakly secured IoT systems can translate directly into physical losses. Similarly, DDoS, data exposure, and privileged-access compromise can quickly result in:
downtime;
fraud;
data loss;
recovery costs;
customer churn;
regulatory pressure.
IPSIP expert perspective
Organizations should prioritize:
phishing-resistant MFA for critical accounts;
privileged-access management;
hardening developer and administrator devices;
maintaining an inventory of Internet-facing assets;
prioritizing vulnerabilities based on exploitability;
monitoring software supply chains and update infrastructure;
segmenting OT and IoT from corporate networks;
implementing data classification;
monitoring anomalous behavior 24/7;
building Incident Response playbooks;
checking for compromise after patching rather than stopping at the patch itself.
For critical environments, organizations can combine IPSIP Vietnam’s SOC 24/7, Vulnerability Assessment, and Pentest capabilities to improve early detection, identify attack surfaces, and validate the real-world exploitability of important security gaps.
The week of November 2–8 showed that cyberattacks are increasingly exploiting the very things organizations are designed to trust: employees, credentials, remote-access gateways, software updates, and IoT systems.
AI is increasing the speed and scale of attacks, but many underlying root causes remain familiar — weak access controls, Internet-exposed assets, unclassified data, and limited visibility.
Organizations therefore need to move beyond protecting individual tools and toward managing the entire attack surface, reducing detection time, and preparing containment capabilities before a small point of compromise develops into a major incident.
References
VnExpress - Ministry of Public Security: Foreign Nationals Are Protected, but Criminal Acts Will Not Be Tolerated
Reuters - Binance Says Hackers Used Fake Job Interview to Compromise Computer Before $6.3 Billion Attack
BleepingComputer - Chinese Hackers Use ARTEX AI in Automated Attacks Against 200 Orgs
BleepingComputer - Ivanti Patches Two More Connect Secure Zero-Days Chained in Attacks
BleepingComputer - Hackers Hijack cPGuard Autoupdate to Deploy Backdoor, Steal Data
