Cybersecurity Threat Roundup: AI Infrastructure and Espionage

The November 2026 threat landscape is dominated by a major China-nexus espionage ecosystem codenamed CopperDragon. This digital quartermaster provides the 'Sparrow' malware framework to multiple clusters (SilentDelivery, OceanGate, DarkWire), targeting telecommunications and critical infrastructure across Latin America, Asia, and Europe. Simultaneously, Blind Eagle (APT-C-36) continues its persistent targeting of Latin American judicial and administrative sectors using commodity Remote Access Trojans (RATs) delivered via localized phishing lures.

AI security has emerged as a critical vulnerability vector, evidenced by massive data exposures on the Grok-built app platform and breaches at Railway, NEAR AI, and Fireworks AI resulting in stolen API keys and unauthorized resource usage totaling hundreds of thousands of dollars. The exploitation of an RCE flaw in the SGLang inference engine highlights that even Trusted Execution Environments (TEEs) are susceptible to software-level vulnerabilities.

In the vulnerability landscape, Microsoft addressed over 1,000 flaws for the second consecutive month, including an actively exploited Outlook spoofing bug (CVE-2026-124194). Critical updates were also released for Git to prevent code execution during recursive clones (CVE-2026-111760) and for AhsayCBS backup software to mitigate zero-day exploitation that leads to Python-based backdoors and crypto-miners.