Daily brief: Tuesday 3 November 2026
Today is Microsoft's deadline for MemberOf rules in Entra dynamic groups, a ransomware group handed much of its attack work to AI agents, Google shut down a botnet built into TV boxes, and DeepSeek released a coding agent that takes jobs from team chats.
Entra dynamic groups using MemberOf stop updating after today
Microsoft's final reminder (MC1529463) says dynamic groups, dynamic administrative units and entitlement management auto-assignment policies that use the MemberOf operator will stop processing membership changes after 3 November 2026. They are not deleted: membership freezes in its last known state. Microsoft lists risks such as new users missing access or licences, leavers keeping access, and Conditional Access working from out-of-date groups. Entra News and Microsoft 365 for IT Pros report a later deadline of 31 March 2027 for tenants licensed for Entra ID Governance; the final reminder itself doesn't mention this.
Source: Microsoft message centre (MC1529463, via Merill) · Entra News #173 · Microsoft 365 for IT Pros
Ransomware group used AI agents to do much of the hands-on work
Sophos says the group it tracks as GOLD OGRE, linked to Aur0ra ransomware, gave AI agents VPN logins, targets and goals. The agents mapped networks and Active Directory, searched shares, documents and backups for passwords, and moved between systems with little human input. In some networks they reached domain administrator access, and three of those victims later appeared on Aur0ra's leak site. The attackers got past AI safety checks by describing the work as authorised red team testing, while people kept control of breaking in and running the ransomware.
Source: Help Net Security · Sophos
Google shuts down XCPE, a backdoor built into Android TV box firmware
Google shut down the servers behind XCPE, a backdoor hidden in the firmware of Android TV set-top boxes, and took legal action against the domains used to control it. More than 1.3 million boxes were enrolled, and Google says cutting off affiliate command domains removes access to at least 10 million more infected devices. The backdoor runs with system rights, reinstalls itself after a reboot and switches off Google Play Protect, so deleting the app does not remove it. Google banned Videostrong Technology, which it believes made many of the boxes, from building certified Android devices.
Source: Help Net Security
DeepSeek releases a research coding agent that takes jobs from team chats
DeepSeek has published dsh-superagent, a research prototype of a coding agent that works on a GitHub repository when an allowed user asks it to, or when a team-written rule covers the request. By default, requests from people who aren't on the allowed list are logged but not acted on. The host enforces the allowlists, so a message or quoted document can't widen what the agent may do. It is free on GitHub and is not presented as a finished product.
Source: Help Net Security
Weather
Live forecastLoading the forecast…