Vanderbilt Ransomware, Outlook Zero-Day, and APT Activity Dominate Cybersecurity News

Critical Vulnerabilities Under Active Exploitation:

• Microsoft Patches Actively Exploited Outlook Zero-Day (CVE-2026-124194): Microsoft released a massive update addressing over 1,200 vulnerabilities, including a critical zero-day in Outlook that is being actively exploited. This flaw allows attackers to steal NTLM authentication hashes by tricking users into opening malicious message files, and CISA has added it to its KEV catalog, mandating federal agencies to patch.
• CISA Adds Six Actively Exploited Flaws to 'Must-Patch' KEV Catalog: CISA added six new vulnerabilities to its Known Exploited Vulnerabilities catalog on November 10, 2026, indicating they are under active attack. These critical flaws affect products from Microsoft, Cisco, Barracuda, Google, and Openwave, with federal agencies required to patch them by specified deadlines.

Major Incidents and Threat Actor Activity:

• [UPDATE] Vanderbilt University Hit by 'BYOD' Ransomware: Vanderbilt University is restoring services following a BYOD ransomware attack that began on November 9, 2026. The BYOD group claimed responsibility, alleging massive data theft including over one million SSNs, and a deep network compromise.
• Blind Eagle APT Uses HTML Smuggling to Target Latin American Entities: The APT group Blind Eagle is conducting an espionage campaign against government, judicial, and financial entities in Latin America, particularly Colombia. The operation uses spear-phishing emails with judicial themes and HTML smuggling to deliver a malicious ZIP archive containing a custom RAT.
• North Korean APT Kimsuky Linked to "Trigram" Espionage Campaign: The 'Trigram' campaign, targeting organizations in the AI, blockchain, and logistics sectors in Europe and the U.S., has been attributed to North Korean threat group Kimsuky. Attackers use fake job offers to lure software developers into a multi-stage infection process delivering information-stealing malware.

Supply Chain and Software Vulnerabilities:

• N-able Takes N-central RMM Offline After 30+ Zero-Days Publicly Disclosed: IT software provider N-able took its hosted N-central RMM platform offline globally after a security researcher publicly disclosed over 30 zero-day vulnerabilities, dubbed 'Able2Shell.' The flaws, including critical remote code execution bugs, pose a severe supply chain risk to managed service providers.