Microsoft Maps North Korean AI Ops as Cisco Flags KeyDrift Malware

Security researchers, state regulators, and platform operators across Global Enterprise Security, Connected Vehicles & Web Platforms issued major disclosures on October 29, 2026 spanning AI-augmented nation-state tradecraft, SD-WAN control-plane malware, connected-vehicle telemetry settlements, and exchange and archive incidents.

1. Microsoft Maps North Korean 'Sleet' AI Tradecraft and Earns IDC Endpoint Security Leadership

In twin reports published on the Microsoft Security Blog and by Rob Lefferts (IDC MarketScape assessment), 8 Sleet groups mapped (Jade, Coral, Jasper operationalized; Onyx >100 PDF lures & ARTEX); Defender stops QNET ransomware in 128 sec (>15% rise):

• Four Stages of North Korean AI Adoption: Microsoft Threat Intelligence categorized 8 Democratic People's Republic of Korea threat actors across four maturity tiers: Operationalized (Jade Sleet, which ran job-themed campaigns through 3 front companies between June 8 and June 12, 2026; Coral Sleet, which trojanized private GitHub repositories starting April 2026; and Jasper Sleet), Accelerating (Diamond Sleet, which resumed oil and gas targeting in August 2026 for the first time since 2023; Onyx Sleet, which generated >100 tailored PDF lures in August and September 2026; Pearl Sleet; and Sapphire Sleet, which used AI-assisted dynamic .NET compilation in the August 2026 Rust compromise Trojan:Cargo/ProcmacSteal), and Expanding (Emerald Sleet, linked to synthetic voice/video). Both Onyx Sleet and Pearl Sleet adopted the open-source agentic AI penetration-testing framework ARTEX in late October 2026, while defenders use Microsoft Security Dashboard for AI and Microsoft Agent 365.
• IDC MarketScape Endpoint Leader (Doc #US54123526, September 2026): Following the September 23, 2026 launch of the Integrated Security Operations Center (ISOC) in Microsoft Defender (>200 native endpoint event types and >500 Microsoft Sentinel connectors) and general availability of agentic AI via Security Copilot, Defender discovers >50 local agents and Model Context Protocol (MCP) servers (including OpenClaw) and halted a QNET second-stage ransomware payload within 128 seconds amid a >15% enterprise ransomware detonation increase between 2025 and 2026.

2. Cisco Talos Uncovers UAT-11473 'KeyDrift' SD-WAN Malware and GM Pays $220M in 36-State Privacy Settlement

As reported by BleepingComputer journalist Bill Toulas and The Record reporter Suzanne Smalley:

• Cisco Catalyst SD-WAN KeyDrift Framework: UAT-11473 exploits CVE-2026-20127 (patched Feb. 2026) with PolyFlame and LittleFilch to steal 32-byte AES-256 IPsec keys to /var/tmp/vdaemon.bin across space and satellite services, defense and aerospace technology, and policy research organizations. Cisco Talos noted that CVE-2026-20127 (exploited as a zero-day since at least 2023 by UAT-8616 and linked in a Lumen report to Volt Typhoon's "Silent Train" network) allows PolyFlame to inject a TinyShell C2 relay into vdaemon while LittleFilch hooks SSL_read to RSA-encrypt and exfiltrate 32-byte AES-256 IPsec keys over UDP (while The Blue Report 2026 across 338 million simulations found only 37% of attacker actions are blocked once valid credentials are used).
• General Motors $220M Smart Driver Settlement: GM agreed to a $220 million fine + affirmative consent over 2016–2024 Smart Driver / OnStar data sales (>370,000 customers misinformed; TX seeks $10,000/offense) to settle a 36-state coalition lawsuit co-led by Washington Attorney General Nick Brown (while Texas AG Ken Paxton's 2024 suit remains ongoing).

3. Polymarket DebugBear Outage, $2.3B Frozen in Binance Probe & AO3's Up-to-4-Week Maintenance

Three platform security and infrastructure incidents also unfolded Thursday, as reported by KCBS Radio / AP (Binance report) and 404 Media writer Samantha Cole:

• Polymarket, Binance & Archive of Our Own: Polymarket 1-hr pause (DebugBear); Tether freezes >$1.5B & Circle >$800M in Binance probe (BTC -3.2% under $79,000); AO3 (18.4M+ works, 82,900+ fandoms) down 2–4 wks. Polymarket pledged full trader reimbursement and notified UK law enforcement after a third-party incident at UK performance monitor DebugBear. Binance (founded in 2017 by Changpeng Zhao, who pleaded guilty in 2023 and was pardoned in 2025) said "user funds are completely safe" while investigating reports of a potential hack as Tether CEO Paolo Ardoino froze >$1.5 billion and Circle CEO Jeremy Allaire froze >$800 million. Meanwhile, the Organization for Transformative Works (OTW) announced that open-source fanfiction repository Archive of Our Own (AO3), which initially estimated a 12-hour outage Thursday morning, faces 2 to 4 weeks of maintenance restoration.