https://kevinthecyberguy.com/ioc-library Indicators of compromise worth hunting for, curated by Kevin Swaney, with the detection angle that matters. Sourced from public advisories and real-world analysis. en-us Sat, 14 Nov 2026 12:00:00 GMT https://kevinthecyberguy.com/ioc-library Block the ARTEX host IP and WISP C2 nodes, and take any exposed ARTEX console offline. Intrusions reached privileged access in under three hours. By Kevin Swaney. Sat, 14 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Hunt for the vmware-vdma service, the cloudvflare domain, and ._wipe artifacts. Treat vCenter as a Tier 0 asset. By Kevin Swaney. Sat, 14 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Block the campaign IPs and hunt for the webshell markers, the TSGA implant, and SSH from the gateway to ESXi hosts. By Kevin Swaney. Sat, 14 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Block the SCKit relay IP and domains, disable the five extensions, and update technician clients to 26.6.5. By Kevin Swaney. Fri, 13 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Hunt N-central servers for the miner: Java spawning a shell or curl, and XMRig activity. Disable the Legacy API now. By Kevin Swaney. Fri, 13 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Block the Xen Orchestra campaign IPs and the Tor onion service, and hunt for the crafted authenticationToken cookie in front of the server. By Kevin Swaney. Thu, 12 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Citrus ransomware hides traffic in VLESS tunnels and escalates with the Certighost flaw. Patch every Enterprise CA and block 91.210.109.118. By Kevin Swaney. Thu, 12 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Watch N-central for anonymous agent sessions and unexpected config pulls after the Able2Shell disclosure. By Kevin Swaney. Thu, 12 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Watch for Defender creating unexpected .cnpf files, the SignDrop privilege escalation signal. By Kevin Swaney. Thu, 12 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Watch for outbound SMB from Outlook clients to external hosts and NTLM auth to unfamiliar servers. Fixed builds 16.0.14334.21048 and 16.0.17932.21140. By Kevin Swaney. Wed, 11 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library ESG before 9.4.0.030 is affected. Check for unexpected config changes, backup restores, and timezone changes. By Kevin Swaney. Wed, 11 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Check the Gateway proxy list first, set gw/acl_mode_proxy to 1, and apply the kernel and Web Dispatcher patches. By Kevin Swaney. Wed, 11 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library BYOD claims it stole more than a million Social Security numbers. Unverified: Vanderbilt has not confirmed any records were taken. By Kevin Swaney. Wed, 11 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Eighth exploited Chrome zero-day of 2026, in the XML parser. Check Settings, About Chrome for 157.0.8103.50 or later, then restart. By Kevin Swaney. Tue, 10 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library OpenSSH 10.6p2, GPUStack 2.2.0, FreeSWITCH 1.11.3, Aspera Faspex 5.0.19 PL1. Forensic triage required for all four. By Kevin Swaney. Tue, 10 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Billing data and incomplete model weights were exposed through a hacked cloud provider. Rotate API keys and review billing and usage. By Kevin Swaney. Tue, 10 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library BYOD claims it stole student and employee records including Social Security numbers. Unverified: Vanderbilt has not confirmed any records were taken. By Kevin Swaney. Tue, 10 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library CVE-2026-98432 was patched within an hour of the alert, but secrets were decrypted hours earlier. Rotate AI and payment keys first, then check billing for abuse. By Kevin Swaney. Mon, 9 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library 1,122 public files hold 1,379 secrets, and 215 slipped past both major scanners. Search your repos and git history, add the file to .gitignore, and rotate everything it ever held. By Kevin Swaney. Mon, 9 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library About 7.7 million people may be exposed through a third-party cloud service, including account passwords. Change the Iris Plaza password and any reuse of it. By Kevin Swaney. Mon, 9 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library N0n claims 1.7 billion consumer rows including SSNs in plaintext. Unverified: no mainstream confirmation and no Infutor statement. Freeze your credit. By Kevin Swaney. Mon, 9 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Eight attempts from 89.116.89.18, with oversized passwords and recon commands, and root on an Alpine honeypot. One vendor's observation, not yet independently confirmed. By Kevin Swaney. Sun, 8 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Up to $133 million moved through the bank's own account after entry through a service provider's platform. No technical IoCs published yet; check what your third-party platforms can move. By Kevin Swaney. Sun, 8 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library WhiteArmor claims 100 GB taken, including 16,093 plaintext driver passwords, and demands $5 million. Unverified: no mainstream confirmation and no Maersk statement. By Kevin Swaney. Sun, 8 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Fixed versions, the November 20 deadline, and how to spot VPN sessions that skipped SAML or MFA. No attacker IoCs have been published yet. By Kevin Swaney. Sat, 7 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library A runaway ARTEX agent breached WorkOS through exposed APIs and a leftover dev credential, and more than 800 ARTEX deployments sit open on the internet. Isolate AI test environments. By Kevin Swaney. Sat, 7 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Four conditions must all hold for the bypass, and Alpine tiny-cloud images ship in the vulnerable state. Check your accounts and upgrade to OpenSSH 10.6p2. By Kevin Swaney. Sat, 7 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Behavioral indicators from two Kaspersky investigations: execInstalledOnly disable, esx encryptor commands, and root@pam VNC websocket sessions, plus Threadlinqs sample domains and hash. By Kevin Swaney. Fri, 6 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library CISA and the FBI warn of ongoing attacks on industrial refrigeration. Take controllers off the public internet, change passwords, patch firmware, and retire unsupported gear. By Kevin Swaney. Fri, 6 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library A 2025 server migration exposed a DigiCert internal system, and an unauthorized account read archived customer data including identity documents for some. Audit for unexpected accounts. By Kevin Swaney. Fri, 6 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Two SHA-1 hashes and two IPs from ESET's Gorbag research, plus the decoy PDF and Startup folder delivery. Update WinRAR to 7.13 or later. By Kevin Swaney. Fri, 6 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Delivery domains, reverse proxies, Plerdy tracker dates, and two SHA-256 samples from Sekoia's Poisoned Source campaign. Fully updated devices are not vulnerable. By Kevin Swaney. Thu, 5 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Attack endpoint, Metabase's compromise check, and the fixed releases for CVE-2026-72898. A public proof of concept is available. By Kevin Swaney. Thu, 5 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library FTP and SFTP credentials exposed for File Manager logins between August and October 23, 2026, plus limited webmail credentials. Change passwords and check forwarding rules. By Kevin Swaney. Thu, 5 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library UNVERIFIED: WhiteArmor claims 79GB and a $15 million demand from Unilever. No confirmation and no published data. Do not repeat the figures as fact. By Kevin Swaney. Thu, 5 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Staged installer paths under wp-content/upgrade, including staged setup-config.php requests. Wordfence counted 12,289 blocked attempts in the 24 hours before November 4. Fix: WordPress 7.1.4 or the fixed release for your branch. By Kevin Swaney. Wed, 4 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library JITTERLY backdoor and SIXZUT rootkit hashes, PyArmor exploit against dispatcher.cgi, and a TFTP collector script. One actor hit 996 switches in 48 countries. Fix: October 22, 2026 firmware or newer. By Kevin Swaney. Wed, 4 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Source 4.201.105.116, loader 85.215.73[.]250, single POST /flows requests, and payload names bot-linux-amd64, wget.sh, and .kworker. Fix: Industrial OS V4.3.4.1 or later. By Kevin Swaney. Wed, 4 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Rogue admins library and svc_bkpmon, scheduled task VEEAMPROBE, and Veeam-Get-Creds.ps1 credential theft on three backup servers. Around 37 machines encrypted. By Kevin Swaney. Wed, 4 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Malicious script cpguard-v58812-i91511.sh, backdoor /var/tmp/.cpg91511_sh, collection directory /var/tmp/.cpg91511, and staged archive /var/tmp/.cpg91511/loot.tgz. Update to cPGuard 5.88.25 or later and rotate all copied credentials. Sources: OPSSHIELD advisory; Cyber Security News, November 3, 2026. By Kevin Swaney. Tue, 3 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Backdoor x.cpe (com.oemservice) in Android TV box firmware, command infrastructure at mqtt.szbboys[.]com on ports 3885 to 3887. More than 1.3 million devices enrolled. Sources: Google Threat Intelligence Group, November 2, 2026. By Kevin Swaney. Tue, 3 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library The FBI published hundreds of Ethereum addresses and 19 Bitcoin addresses holding or having held assets from the $6 billion-plus Binance theft. Block transactions with or derived from the listed addresses. Sources: FBI cyber alert, October 31, 2026. By Kevin Swaney. Sun, 1 Nov 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Hunt welcome.cgi request volumes, wu.cgi and DSCache abuse, LDAP credential theft, LAPS and BitLocker searches, and wiped logs. Fix: 22.8R2.6 or 25.1.1.3. Sources: Volexity; Ivanti; CISA KEV. By Kevin Swaney. Sat, 31 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Hunt /tmp/.cch/svc.py, svc.py startup hooks, syscore.bin as [kworker/u20:1], and reverse shells to 212.32.253.3. Sources: Pluto Security. By Kevin Swaney. Sat, 31 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Hunt crafted CI configurations from newly registered accounts, GitLab worker crashes, 502 errors around CI lint requests, and new accounts since October 12. Fix GitLab and Ruby together. Sources: Alpine Linux; The Hacker News; CISA KEV. By Kevin Swaney. Fri, 30 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Hunt libdssl.so in vdaemon, rsshd and conf_sshd, /tmp/system-vdaemon, /var/tmp/vdaemon.bin, modified runit paths under /etc/sv/sshd/ and /etc/sv/aaamgr/, and the Talos Snort SIDs in the IoC Library. Sources: Cisco Talos. By Kevin Swaney. Thu, 29 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Hunt edge-to-vCenter pivots, BRICKSTORM and SharpStorm malware, gaps in ESX audit logs, stolen Microsoft 365 session tokens, and rogue MFA registrations. Fix: Broadcom July 2026 ESXi builds. Sources: CrowdStrike; CISA KEV. By Kevin Swaney. Thu, 29 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Hunt loader domains deepveindrilling[.]com and additionalver[.]com, accesson.php in assets/images/, PNG webshells in pub/media/custom_options/quote/, injected CMS blocks and pages, and rogue admins. Fix: APSB26-73 2026-jul builds. By Kevin Swaney. Wed, 28 Oct 2026 09:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Hunt external Teams contacts from new onmicrosoft.com tenants with IT or helpdesk names, mail bombing before contact, and rapid moves to Quick Assist or AnyDesk. By Kevin Swaney. Wed, 28 Oct 2026 09:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Hunt C2 at 2[.]26[.]252[.]48:8080, domains dfwioeiofwr[.]info, kkeyyou[.]cc, somelitersofblood[.]pw and others, /gate/handshake, /gate/chunk, /gate/complete URIs, and the clipper SHA-1 in the IoC Library. Sources: Check Point Research. By Kevin Swaney. Tue, 27 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Hunt unauthenticated gRPC to TCP 27918, SendQueryResult traversal or null byte query-ids, writes outside /query/result/, and scheduled scripts with mismatched timestamps. Fix: FortiSIEM 7.5.1 or later. By Kevin Swaney. Mon, 26 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Hunt Apache mod_php logs for unusually large decoded cookie dumps followed within milliseconds by a shell from a PHP worker process. Patch to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. By Kevin Swaney. Mon, 26 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Hunt MeshCentral at mesh[.]buttruyen[.]com, AdaptixC2 at 64[.]94[.]85[.]14:4321, staging at sthyjk[.]com:8443 and alknene[.]shop, forged prof_admin CGIINFO requests to FortiWeb, and rogue eight-character admin accounts with trusted-host 0.0.0.0/0. Sources: Group-IB/NyxLab; The Hacker News. By Kevin Swaney. Sun, 25 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Hunt proxy.php requests with encoded traversal or shell substitution in remote_font_config.url, unexpected PHP web shells on Nextcloud hosts, and post-exploitation searches for credential stores and wallets. Sources: CISA KEV; The Hacker News. By Kevin Swaney. Sat, 24 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Version 1.1.5 backdoors used dc[.]cathaypacifice[.]com and net[.]dpworldto[.]com; version 1.1.7 pulled encrypted configs from GitHub. Hunt signed executables loading adjacent malicious DLLs, config.ini reads followed by in-memory execution, anomalous vssadmin use, and ntds.dit access. Source: Sophos. By Kevin Swaney. Fri, 23 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Arista observed 74[.]82[.]197[.]86 and 38[.]54[.]50[.]151 in attacks on the CVE-2026-114625 zero-day. Block both, and hunt VCO web logs for unusual URL paths, encoded payloads, and unexpected outbound connections. Source: Arista Security Advisory 0199. By Kevin Swaney. Fri, 23 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Any install of litellm==1.107.0 from the October 21 PyPI window (roughly 11:39 to 13:23 UTC) or Docker tags live until about 14:20 UTC is a compromise indicator: the payload activates through Python startup hooks even when never imported. Treat the host or CI runner as burned and rotate every secret. Source: BerriAI; Socket. By Kevin Swaney. Thu, 22 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Eight eMudhra intermediates had trivially recoverable P-384 private keys (one was the number 4), chaining to emSign ECC Root CA - G3. Browsers blocked them October 17 to 20, but non-browser trust stores in containers, runtimes, and appliances may still trust the chain. Source: Cloudflare; Mozilla. By Kevin Swaney. Thu, 22 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library 149.248.47.234, 208.83.239.114, and 66.42.72.14 are tied to active exploitation of the PAN-OS management-interface RCE. Block at the edge and scan firewall and network logs for historical connections. Source: F5 Labs, October 21, 2026. By Kevin Swaney. Thu, 22 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Nine IPs tied to victim intrusions, victim-data hosting, client login panels, exfiltration, and soc.dll command and control, published in the joint CISA/FBI SafePay advisory of October 20, 2026. Investigate before blocking. By Kevin Swaney. Wed, 21 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Hashes for the 1.exe ransomware binary, soc.dll, and SharpShares.exe from the joint SafePay advisory. Feed to EDR blocklists and hunt historical detections. Source: CISA AA26-293A, October 20, 2026. By Kevin Swaney. Wed, 21 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Unit 42 published nine attacker IPs and four suspicious host IDs seen in GlobalProtect gateway-connected events from ransomware exploitation. Hunt GlobalProtect logs for successful logins from these. Source: Palo Alto Networks Unit 42, updated October 19, 2026. By Kevin Swaney. Wed, 21 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library mangoapi.php in the web root, /usr/bin/dbus-authd (SUID /bin/sh copy), the zz-root-persist boot script, the /uidchanarge HAProxy URI path, and /ns/config/sudoers.template modifications. Hunt with on-disk artifacts, not logs, since the actor deletes them. Source: Google Threat Intelligence Group indicators. By Kevin Swaney. Tue, 20 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library TSDS hits a SaaS vendor (Canny, August 28) then pivots into customers through standing integrations, claiming 72+ hours inside Canva's Salesforce. Hunt OAuth grants and API tokens held by feedback, support, and survey tools reaching your CRM. Sources: DataBreaches.net, Cyber Daily. By Kevin Swaney. Mon, 19 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library 108.165.147[.]64 observed as UTA0576-controlled infrastructure in the Connect Secure intrusion investigated by Volexity. Per the OP Innovate writeup of Volexity's research, October 14, 2026. By Kevin Swaney. Sun, 18 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library /dana-na/auth/url_default/welcome.cgi targeted as the public entry point; the X-DSCGI-PATH header manipulated to route requests to arbitrary CGI files and bypass authentication. Per the OP Innovate writeup of Volexity's research, October 14, 2026. By Kevin Swaney. Sun, 18 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library /data/.icscap/ capture directory plus LDAP tooling (/tmp/ml.py, /tmp/rq5.py) and Kerberos tooling (/tmp/mk.py, /tmp/rr.py). Per the OP Innovate writeup of Volexity's research, October 14, 2026. By Kevin Swaney. Sun, 18 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library No malware or web shells: the actor re-exploits per command, manipulates in-memory libraries, reverts config changes, and selectively deletes logs. Evades Ivanti's Integrity Checker Tool; hunts LAPS passwords and BitLocker keys. Per Volexity via OP Innovate, October 14, 2026. By Kevin Swaney. Sun, 18 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library PEERSTITCH infrastructure per Unit 42: 23.240.77[.]233 and 47.18.167[.]159 hosting installers; 45.32.41[.]202 and 198.199.122[.]22 for rogue FortiGate registrations; stager URLs on port 8085; ACME abuse endpoints on port 8084; traffic markers TCP 8550 and IP 169.254.0.1. Sat, 17 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Unit 42 hashes for the PEERSTITCH ARM64 ELF injector, mmap shellcode bootstrap, core hook injection block, staging script, Node.js orchestrator, Emscripten runtime and WebAssembly module, and runtime shared-secret artifact. Sat, 17 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Rogue FortiGate named localhost registered to FortiManager; auto-script object named ../../..//setup; Apache mod_md abused for SSH reverse shells; syslog termination, crash-log clearing, telemetry disruption, and auto-deletion of rogue admins and auto-scripts. Sat, 17 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library SAWFLY PHP web shell, unexpected root SUID shells, passwordless-sudo boot scripts, BARECLAW SOCKS5-over-WebSocket tunnels routed through HAProxy config, Jump Item roles raised to Administrator, and log deletions. Behavior is the detection angle since the actor rotates infrastructure per victim. Sat, 17 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library C2 domain rank1cdn[.]com; three malicious wp_options keys; rogue administrator accounts; PHP-executable .cache files; a fake WordPress core file; and a system cron marker. Tied to trojanized 3.0.123 packages served October 15-16, 2026. Sat, 17 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Hunt angles from the Microsoft-led YAM Store takedown: the phishing kits used device-code phishing to steal tokens and held tenant admin access through app-only auth with stolen client secrets. Hunt Entra ID sign-in logs for device-code flow abuse and audit app consent grants. Fri, 16 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library The COPC attacker posed as a trusted source on a voice call to reach files holding protected health information, with no malware involved. The Chaos ransomware group's claimed credit is UNVERIFIED. Correlate helpdesk voice requests with subsequent data access and require call-back verification. Fri, 16 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Cisco Secure Email Gateway self-check log alerts ("Suspected compromise indicator was found", "Security scan did not complete") from the Oct 14 advisory. The first confirms a compromise indicator; contact TAC and rotate credentials and crypto material. The second is not a clean bill of health. Thu, 15 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Hunt firewall and network logs for unusual uploads or downloads between SEG appliances and external or suspicious IPs. Attackers may wipe on-box evidence after gaining root, so the network trail matters. Shadowserver counts nearly 300 SEG instances exposed online. Thu, 15 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Palo Alto's interim detection for the PAN-OS management-interface RCE: Threat IDs 510046 and 510047 (content 9159-10287+, needs SSL decryption). Also audit management-plane logs for unexplained authenticated sessions, especially from untrusted IPs. Thu, 15 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library UTA0576 operator host for the Ivanti Connect Secure zero-day campaign (Volexity, Oct 13, 2026). Hunt for outbound connections, especially from VPN or edge appliances. Defang when sharing: 108.165.147[.]64. Wed, 14 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library UTA0576 post-exploitation tooling on Ivanti Connect Secure: custom LDAP, Kerberos (Kerberoast-capable), and password-spraying scripts. Sweep /tmp on internet-facing ICS boxes. Wed, 14 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library UTA0576 packet-capture credential harvesting on Ivanti Connect Secure: dsstatmond sniffs LDAP, HTTP, FTP, telnet for credentials and NTLM material. Hunt processes running from hidden directories and BPF socket filters on edge appliances. Wed, 14 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library UTA0576 auth-bypass exploit pattern (CVE-2026-104935): the URL passes the access check while the header routes to a protected script. Monitor for URL/header mismatches and bursts of welcome.cgi requests. Wed, 14 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library UTA0576 root payloads (ics-root-run-inband-*.pl) patch /home/lib/libdsplibs.so in memory only, defeating Ivanti's Integrity Checker Tool. A clean check does not rule out compromise: use memory and network forensics. Wed, 14 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library UTA0576 wipes recent entries from /home/runtime/dlogs/debuglog and /var/log/audit/audit.log. Gaps or truncated audit windows on ICS appliances are themselves a signal. Wed, 14 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Seven domains tied to Flax Typhoon / Integrity Technology Group, seized by the FBI on October 8, 2026 (MicroScan scanner and FishHub phishing infrastructure; several mimic Microsoft, LinkedIn, YouTube branding). Hunt in historical mail, proxy, and DNS logs. Mon, 12 Oct 2026 16:30:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Flax Typhoon / Integrity Technology Group persistence mechanism. Hunt for renamed SoftEther installers on endpoints. Mon, 12 Oct 2026 16:30:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Flax Typhoon / Integrity Technology Group indicator. DiagTrack making outbound HTTP is abnormal; investigate the endpoint. Mon, 12 Oct 2026 16:30:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Flax Typhoon / Integrity Technology Group artifacts. Hunt for DC.exe and office-cli presence across the fleet. Mon, 12 Oct 2026 16:30:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Integrity Technology Group / Flax Typhoon exploitation of CVE-2015-3306. Review FTP logs for these commands. Sun, 11 Oct 2026 16:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Integrity Technology Group / Flax Typhoon exploitation of CVE-2016-3081. Inventory and remediate exposed instances. Sun, 11 Oct 2026 16:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Integrity Technology Group / Flax Typhoon exploitation of CVE-2015-5477. Monitor resolver query patterns. Sun, 11 Oct 2026 16:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevinthecyberguy.com/ioc-library Integrity Technology Group / Flax Typhoon tactic. Alert on anomalous authentication bursts against Exchange. Sun, 11 Oct 2026 16:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney)