Follow this feed
Type
Campaign
92 indicator rows shown
Current indicators
| Indicator | Type | Related threat | Added |
|---|---|---|---|
| ARTEX AI pentesting framework: 38[.]244[.]50[.]120, WISP C2 nodes 199[.]19[.]95[.]66 through 199[.]19[.]95[.]68, LLM API reseller domain xcai[.]pro, 1,600+ exposed ARTEX consoles (FBI FLASH-20261113-001) |
Network | The FBI warns hackers are using ARTEX, an open-source AI penetration testing framework, to automate intrusions from reconnaissance through data theft, with some intrusions moving from first targeting to privileged access in under three hours. ARTEX is a multi-agent platform written in Go that turns plain-language objectives into commands run by specialized agents. Check: block the ARTEX host IP, the WISP C2 nodes, and the xcai.pro reseller domain; scan for exposed ARTEX consoles in your environment and take any reachable console offline; restrict exposed administration tools and cut application permissions. Sources: FBI FLASH-20261113-001 (November 13, 2026); The Record (November 13, 2026); Microsoft Security Research (October 21, 2026). | Nov 14, 2026 |
| BlackNevas ransomware VMware wipe: api[.]cloudvflare[.]com:443, vmware-vdma[.]service (/opt/vmware/bin/agent), SHA-1 28f8da19ddcdf26e426875c7a834b34a79bc1c33, [.]/tmp/esx64 /p /vmfs/ /depth 5 /wipe /allsys /detach /-showvolumes, [.]_wipe artifacts (Kaspersky GERT; Securelist) |
Network, file, and behavioral | BlackNevas operators wiped four ESXi hosts, every virtual machine on them, both vCenter Server Appliances, and all connected backup infrastructure over ten days, using only legitimate VMware management interfaces and stolen administrative credentials. They used vCenter Host Profiles to switch SSH on across hypervisors, installed a Ligolo-ng tunnel disguised as the vmware-vdma service, and ran a wiper that stopped every virtual machine within 23 seconds. Check: hunt for the vmware-vdma systemd service, the cloudvflare domain, the SHA-1 hash, and ._wipe artifacts in datastores; treat vCenter as a Tier 0 asset and separate virtualization identities from enterprise administration. Sources: Kaspersky Securelist (November 13, 2026); GBHackers (November 14, 2026). | Nov 14, 2026 |
| Check Point PHP2Shell and TSGA campaign: 130[.]94[.]19[.]204, 130[.]94[.]19[.]168, upload_progress_pwn session marker, zz*[.]tpl webshells, /tmp/[.]up[.]tpl staging, CPconfigdaemon and slot_CPconfigdaemon, TSProxy (libcpfwcommon[.]so), DREAM_ANNEXATION[.]txt, destroy_v6 wiper (Check Point Research; BleepingComputer) |
Network, file, and behavioral | Attackers exploited PHP2Shell flaws against Check Point Mobile Access portals, then used CVE-2026-123039 to gain root on the gateway, installed PHP webshells and the TSGA backdoor, and moved by SSH to VMware ESXi hosts to run the destroy_v6 wiper. SHA-256 hashes: webshell edb3e92eb7bda7413a09edcc4b1ba3cbed4bcdf42808a8abce63b6e4c3fda2b3, slot_CPconfigdaemon 4171b521fa6441382aa2fa014a08e18ff9a6e0ab6096c9144072bf46b37a2ec8, CPconfigdaemon d7549671c7189979f0624ec52dad9ea6a707d23146e3585ab8f8c4720eca0c63, gogo 3b51080a909023f7d484e2443740b572307ce0054eb9e32d98f0a06bfcd2db90, destroy_v6 c7d9477309fac6c638a1128442056a242de086996add8cb49cd6496c36003237, DREAM_ANNEXATION.txt 0522937c0c0337be54fe25493539e5f5f8ceb9742c980aaff1cfc9515f3a96f7. Check: block the two IPs, hunt for the session marker, the webshell names, and unexpected CPconfigdaemon processes, and look for gaps in firewall logs and SSH from the gateway to ESXi hosts. Sources: Check Point Research (November 12, 2026); BleepingComputer (November 13, 2026). | Nov 14, 2026 |
| SCKit ScreenConnect campaign: 185[.]99[.]255[.]28, sc[.]payproofkit[.]com (155[.]94[.]150[.]39), newnewnew[.]gotdns[.]org, soxnewwork[.]homedns[.]org, cdn007-digitaldownloads[.]com, ns[.]mo7sen[.]dev (Huntress; ConnectWise) |
Network | Attackers used cloud-hosted ScreenConnect panels to push rogue ScreenConnect clients and the SCKit toolkit to at least 288 endpoints across 48 organizations in about 90 minutes. SCKit steals browser and ScreenConnect session tokens and can spread through ScreenConnect sessions to a technician's machine. Check: block the listed IP, domains, and relay; disable the Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link extensions; update every technician client to 26.6.5 or later; and do not connect to a suspect machine through ScreenConnect until it is checked. Sources: Huntress (November 12, 2026); ConnectWise advisory (November 11, 2026); The Hacker News (November 12, 2026). | Nov 13, 2026 |
| 4EverAble2Shell N-central chain (CVE-2026-90436): 157[.]20[.]241[.]16, jup[.]sh downloader, XMRig Monero miner, server Java process spawning shell or curl (Previdian; Huntback; Threadlinqs) |
Network and behavioral | A new N-central exploit chain works on servers already running the emergency patch, N-central 2026.4 HF2, when the Legacy API is enabled and exposed to the internet. Researchers report at least 21 servers compromised within hours of the proof of concept going public, most already on HF2, with the XMRig miner installed. Check: disable the Legacy API now; block 157.20.241.16; look for the server Java process spawning a shell or curl, unexpected downloads of a shell script, and XMRig activity; and treat any internet-facing N-central server with the Legacy API enabled as potentially compromised. Sources: SecurityWeek (November 13, 2026); SOCRadar (November 13, 2026); Threadlinqs TL-2026-5859. | Nov 13, 2026 |
| Xen Orchestra auth bypass VSA-2026-062 campaign: 91[.]211[.]251[.]112:8001, ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid[.]onion:3333, 193[.]148[.]56[.]72, 37[.]221[.]208[.]216, 45[.]66[.]35[.]11, 64[.]65[.]0[.]120, 64[.]65[.]62[.]160, 89[.]47[.]51[.]90, 92[.]60[.]37[.]247 (Vates VSA-2026-062) |
Network | Vates confirms active exploitation of a critical authentication bypass in Xen Orchestra. A crafted authenticationToken cookie set to j:%7B%7D logs an attacker in as an admin with no credentials. Check: hunt for the cookie value in HTTP logs in front of the server, since the exploit leaves no entry in Xen Orchestra logs; block the listed IPs and the Tor onion service; update to Xen Orchestra 6.9.2 (stable) or 6.10.1 (latest); take the management interface off the internet; and look for rogue virtual machines and persistent cron backdoors. Sources: Vates advisory VSA-2026-062 (November 10, 2026); BleepingComputer (November 10, 2026). | Nov 12, 2026 |
| Citrus ransomware campaign: 91[.]210[.]109[.]118, VLESS tunnels over port 443, Sn00py ransomware-as-a-service, CVE-2026-54121 Certighost (Kaspersky) |
Network and behavioral | A previously undocumented ransomware group called Citrus is compromising Russian companies through stolen contractor credentials, corporate VPNs, and internet-facing terminal servers over RDP. It hides command traffic in VLESS tunnels that mimic ordinary HTTPS, uses the Sn00py ransomware-as-a-service Trojan, and escalates with CVE-2026-54121, the Certighost flaw in Active Directory Certificate Services that Microsoft patched July 14, 2026. Check: patch every Enterprise CA for CVE-2026-54121 and enable AD CS auditing; block 91.210.109.118; watch for Xray downloads via certutil, BITS, cURL, or PowerShell and for outbound VLESS tunnels on port 443. Sources: Kaspersky via GBHackers (November 12, 2026). | Nov 12, 2026 |
| N-able N-central Able2Shell: anonymous agent sessions, appliance config pulls, remote-control endpoint hits without auth (Defused; SecurityWeek) |
Behavioral | Attackers are already scanning for the 30-plus N-central vulnerabilities a researcher published as Able2Shell. Defused reports anonymous agent sessions opening, appliance configuration being pulled, and the remote-control endpoint being hit without authentication. Check: update to N-central 2026.4 HF2 now; review logs for anonymous agent sessions and unexpected configuration pulls; and if the server was internet reachable, treat it as potentially compromised until proven otherwise. Sources: SecurityWeek (November 12, 2026); Defused. | Nov 12, 2026 |
| SignDrop Windows CLFS privilege escalation: Defender engine creating [.]cnpf authentication files, CLFS container activity from unprivileged processes (MSNightmare; GBHackers) |
Behavioral and detection | A public proof of concept published November 10 abuses the Windows Common Log File System driver to turn a local user into SYSTEM. The exploit coerces the Microsoft Defender engine to open an attacker-prepared CLFS container, which CLFS then signs and turns into an authentication file. There is no CVE, no advisory, and no patch, and Microsoft has not confirmed the claims. Check: watch for Defender creating unexpected .cnpf files and for CLFS container activity from unprivileged processes; keep Windows fully updated so the April CLFS hardening from the CVE-2025-29824 fix is in place. Sources: MSNightmare SignDrop proof of concept (November 10, 2026); GBHackers (November 12, 2026). | Nov 12, 2026 |
| Outlook zero-day CVE-2026-124194, NTLM hash leak on crafted message file (BleepingComputer; SecurityWeek; Microsoft) |
Detection and patch | Microsoft's November Patch Tuesday fixes 1,235 flaws, 66 of them critical, and the one that matters most is already being exploited. CVE-2026-124194 is a spoofing flaw in Outlook: open a specially crafted message file and Outlook connects to an attacker-controlled server without its usual warning, handing over your NTLMv2 login hash, which the attacker can crack offline or relay to sign in as you. The Preview Pane is not an attack vector, so the file has to be opened, which usually means a phishing email with an attachment. It affects Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, with fixed builds 16.0.14334.21048 for LTSC 2021 and 16.0.17932.21140 for LTSC 2024. Microsoft rates it Moderate at 6.5. The release also includes a critical pre-authentication remote code execution flaw in Windows Schannel, CVE-2026-119952. Check: install the November updates now, starting with Outlook; watch for outbound SMB connections from Outlook clients to external hosts and NTLM authentication attempts to unfamiliar servers; block outbound SMB (port 445) at the perimeter; and treat unexpected message files the way you treat unexpected links. CISA added the flaw to its exploited list on November 10, 2026 with a November 24 deadline. Sources: BleepingComputer (November 10, 2026); SecurityWeek (November 10, 2026); Microsoft Security Update Guide, CVE-2026-124194. | Nov 11, 2026 |
| Barracuda ESG chained flaws CVE-2026-116606 and CVE-2026-111560, root via crafted backup (Barracuda; Mandiant; CISA) |
Patch and forensic check | CISA added two Barracuda vulnerabilities to its exploited list on November 10, 2026, both with a federal deadline of Friday, November 13, 2026. CVE-2026-116606, scored 9.3, is a pre-authentication authorization bypass in the Email Security Gateway: an attacker who can reach the admin interface can restore a crafted backup and rewrite the appliance's global configuration, no login needed. CVE-2026-111560, scored 8.6, is an operating system command injection in the timezone field that runs commands as root. Used together, Barracuda says, they can hand an attacker root on the device. Barracuda confirmed on November 9, 2026 that exploitation is hitting a small number of organizations. The bypass affects Email Security Gateway versions before 9.4.0.030; the injection flaw also hits the Load Balancer, Message Archiver, Web Application Firewall, WAF Control Center, and Web Security Gateway. Patches: BNSF-40425 and BNSF-40430 for the Email Security Gateway, BNADC-16586, BNMA-32468, BNWF-60060, and BNYF-24789 for the other appliances. Check: apply the patches now, keep the admin interface off the public internet, and if that page was ever reachable, do a forensic review for unexpected configuration changes, backup restores, timezone changes, or unusual administrator activity, because patching does not undo an attacker who is already in. CISA requires forensic triage for both entries. Sources: Barracuda advisory (November 2, 2026, updated November 9, 2026); Mandiant MNDT-2026-0041 and MNDT-2026-0042; CISA KEV catalog version 2026.11.10. | Nov 11, 2026 |
| SAP PROXYGATE CVE-2026-89103 and three more CVSS 10 flaws (Onapsis; The Hacker News) |
Config and patch check | SAP's November Patch Day fixed 38 issues, and four of them carry the maximum CVSS score of 10.0, all exploitable by an unauthenticated attacker over the network with no user action. CVE-2026-89103, nicknamed PROXYGATE, is a broken access control default in SAP Gateway that treats an outside attacker as one of the system's own application servers; the shipped configuration is the vulnerable one. CVE-2026-120017 is a SAML assertion bypass that can let an attacker log in as any user. CVE-2026-76964 is a memory corruption flaw in the Internet Communication Manager, and CVE-2026-89126 is a heap overflow in the Web Dispatcher. Both can lead to remote code execution. Onapsis researchers found three of the four. SAP has not reported active exploitation, and none of the four is in CISA's exploited list yet. Check: apply the kernel and Web Dispatcher patches now; check the Gateway proxy list (prxyinfo) first, since a permissive list leaves the system exposed at any patch level; set the profile parameter gw/acl_mode_proxy to 1 where supported. Sources: Onapsis PROXYGATE advisory (November 10, 2026); The Hacker News (November 10, 2026); SAP Security Note 3798345. | Nov 11, 2026 |
| BYOD claim of a million stolen SSNs at Vanderbilt, UNVERIFIED (The Register; local coverage) |
Claim details | UNVERIFIED. The ransomware group BYOD claimed responsibility on Monday, November 9, 2026 for the cyberattack that hit Vanderbilt University, and its claims have grown louder since. The group says it stole more than a million Social Security numbers plus names, email addresses, phone numbers, and student and employee records, and took control of part of the university's network. Campus computers reportedly played an audio threat attributed to the group. BYOD also claimed an attack on Texas Health and Human Services the same day. Vanderbilt confirmed the incident on Monday and told students and staff to shut down devices and disconnect from campus Wi-Fi. Wi-Fi came back Monday evening, most systems are still restricted, and classes are running on a normal schedule. The university has not confirmed that any records were taken and has not named who is behind the attack. BYOD is a relatively new group that first surfaced in September 2026. Check: if you are at Vanderbilt, watch for unexpected pop-ups, unfamiliar apps, password requests, and files that go missing or change names, and report anything odd to IT from a separate device. For everyone else: verify unexpected requests through a separate channel, and use two-factor authentication on every account that holds your records. Sources: The Register (November 10, 2026); local coverage (November 10, 2026). | Nov 11, 2026 |
| Chrome zero-day CVE-2026-125350, update to 157 now (Google; BleepingComputer; SecurityWeek) |
Update check | Google released an emergency Chrome 157 update on November 9, 2026 fixing nine flaws, including CVE-2026-125350, a high-severity use-after-free bug in the browser's XML component that is already being exploited in the wild. A malicious page can use the flaw to corrupt memory and run attacker code. An anonymous researcher reported it on November 6, 2026, and Google is keeping attack details restricted until most users have the fix. The patch is in Chrome 157.0.8103.50 and .51 for Windows and Mac, 157.0.8103.50 for Linux, and 156.0.8078.96 for Extended Stable. CISA has not added the flaw to its exploited-vulnerabilities catalog yet. This is the eighth Chrome zero-day exploited in attacks in 2026. Check: open Chrome, go to Settings, About Chrome, confirm version 157.0.8103.50 or later, and restart. The update can take days to reach everyone, so do not wait for it to find you. Sources: Google Chrome release (November 9, 2026); BleepingComputer (November 10, 2026); SecurityWeek (November 10, 2026). | Nov 10, 2026 |
| CISA KEV: four exploited flaws due November 12 (CISA; The Hacker News) |
Patch paths | CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog on November 9, 2026, each with confirmed exploitation in the wild and a federal remediation deadline of November 12, 2026. OpenSSH CVE-2026-123158, the authentication bypass nicknamed sshole, affects some Linux systems using musl libc without PAM; upgrade to OpenSSH 10.6p2 or your distribution's patched package. GPUStack CVE-2026-102895, an improper authentication flaw in the AI model-serving platform, lets an unauthenticated attacker gain admin access, create API keys, and steal cloud secrets; upgrade to GPUStack 2.2.0 and review any admin API keys and inference backends created from YAML, since minted keys stay valid. SignalWire FreeSWITCH CVE-2026-116779 is a code injection flaw that can leak configuration and credentials and allow arbitrary call control and command execution; upgrade to FreeSWITCH 1.11.3. IBM Aspera Faspex CVE-2026-123218 lets an authenticated user bypass authorization and escalate privileges; upgrade to 5.0.19 PL1. CISA requires forensic triage for all four, and says to discontinue use if mitigations are unavailable. None of the four is tied to a known ransomware campaign yet. Check logs for signs someone was already in. Sources: CISA KEV catalog version 2026.11.09; The Hacker News (November 10, 2026). | Nov 10, 2026 |
| Fireworks AI second breach via cloud provider, LLMjacking (BleepingComputer; Bloomberg) |
Exposure check | AI infrastructure startup Fireworks AI disclosed on November 9, 2026 that attackers breached a third-party cloud provider hosting its research and development machines on October 23, reached its development machines on October 24, and ran an unauthorized workload. The attackers accessed resource metadata, billing information including addresses, invoice and payment history, account balances and credit usage, plus incomplete model weights and datasets for some customers. Fireworks does not store payment card numbers, so those were not exposed. The company links the activity to a financially motivated group that steals large language model access and resells it through illicit routing gateways, a scheme known as LLMjacking, and is working with Palo Alto Networks Unit 42 on the response. Customers include Notion and Cursor. This is Fireworks' second incident in a month: in early October attackers accessed environment variables holding API keys and tokens for a limited number of accounts. Fireworks says its Inference, Training SDK, and Nexus services show no detected impact, and it has disabled self-serve dataset uploads and downloads for Batch Inference during the investigation. Check: if you use Fireworks, rotate your API keys, review billing and usage for charges you did not make, and treat any model weights or datasets on the platform as potentially exposed. Sources: BleepingComputer (November 10, 2026); Bloomberg (November 9, 2026). | Nov 10, 2026 |
| BYOD claim of Vanderbilt student records theft, UNVERIFIED (local coverage) |
Claim details | UNVERIFIED. Vanderbilt University confirmed a cybersecurity incident on Monday, November 9, 2026, and told students and staff to shut down devices and disconnect from campus Wi-Fi. By the evening, campus Wi-Fi was back but most university systems and applications were still restricted, with classes running on a normal schedule on Tuesday, November 10. A ransomware group calling itself BYOD claims it stole student and employee records, including Social Security numbers, locked university databases, and took control of part of the network. Vanderbilt has not confirmed that any records were taken, and has not named who is behind the incident. BYOD has also claimed recent attacks at Michigan State University and the University of New Mexico Health and Sciences Center. A retired FBI cybercrime investigator quoted in local coverage said an online claim alone cannot establish who was behind an incident or whether files were taken. Check: if you are at Vanderbilt, watch for unexpected pop-ups, unfamiliar apps, password requests, and files that go missing or change names, and report anything odd to IT from a separate device. For everyone else: verify unexpected requests through a separate channel, and use two-factor authentication on every account that holds your records. Sources: local coverage (November 10, 2026). | Nov 10, 2026 |
| Northflank breach, assume every environment variable decrypted (Northflank status page; BleepingComputer) |
Rotation order and abuse checks | Developer platform Northflank opened a security incident on October 30, 2026 after a threat alert from Wiz, and told every customer to assume all environment variables had been decrypted and to disable or rotate all keys. Customers reported unauthorized use of AI provider API keys stored on the platform the same evening. A November 6, 2026 update says the first known decryption of secrets happened between 02:39 and 03:08 UTC on October 30, and the flaw CVE-2026-98432 was patched across the fleet within an hour of the alert. No root cause has been published and no count of affected customers given; running workloads were unaffected. Wiz counts Northflank as at least the ninth AI developer platform to disclose an incident in October 2026, part of its Black October wave of LLM credential theft. Trigger.dev, another platform for building AI agents, warned of its own environment variable breach and also told customers to rotate. Rotation order: AI and payment keys first, then database and cloud credentials, then the rest. Check usage and billing with each provider for charges you did not make, and review audit logs, which Northflank enabled for all customers including free users. Sources: Northflank security incident status page (October 30 to November 6, 2026); BleepingComputer; Wiz Black October report. | Nov 9, 2026 |
| Claude Code settings[.]local[.]json secrets on public GitHub (Apiiro; The Hacker News) |
Detection and cleanup | Security firm Apiiro reported on November 5, 2026 that Claude Code's "Yes, and don't ask again" approval saves the exact approved shell command, secrets included, into the project's .claude/settings.local.json file. Apiiro searched public GitHub and found 104,185 copies of the file in 103,617 repositories; 1,122 copies hold at least one secret, 1,379 distinct secrets in total. Breakdown: 379 database passwords, 122 Supabase service-role keys, 103 Supabase account tokens, 43 SSH logins for public servers, 42 GitHub, GitLab and npm tokens, 23 AWS keys, and 6 private keys. Apiiro did not test whether the credentials still work; one company it notified confirmed its key had been live. Scanner gap: of the 1,122 files with a secret, gitleaks flagged 564 and TruffleHog flagged 643, and neither flagged 215, mostly passwords typed inside commands after PGPASSWORD, sshpass -p, or mysql -p. Deleting the file does not undo the leak: older versions in git history and forks held 734 more secrets across 509 repositories. Detection: search every repository you own for .claude/settings.local.json and grep its contents and git history for credentials; add the file to the project .gitignore, since Claude Code only adds it to the user's global git excludes. Remediation: rotate any credential the file ever held, including ones from deleted versions. The bug was first reported August 11, 2025; Anthropic has not published a product response. Sources: Apiiro research (November 5, 2026); The Hacker News (November 7, 2026). | Nov 9, 2026 |
| Iris Ohyama third-party cloud breach, 7[.]7 million customers (BleepingComputer) |
Exposure check | Japanese manufacturer Iris Ohyama, operator of the Iris Plaza shopping platform, disclosed on November 8, 2026 that unauthorized access to a third-party cloud service it used may have exposed personal information belonging to about 7.7 million people: about 5.8 million members and 1.9 million non-members. The data includes names, addresses, phone numbers, email addresses, birth dates, and account passwords. Credit card data was not stored on that service, and the company has not identified a perpetrator. No technical IoCs have been published. Check: if you shop at Iris Plaza, change that account password, and if you reused it anywhere else, change those too. For any organization, inventory which third-party cloud services hold customer data and how access to them is controlled and logged. Sources: BleepingComputer (November 8, 2026); Iris Ohyama disclosure (November 8, 2026). | Nov 9, 2026 |
| N0n claim of Infutor Data Solutions exposure, UNVERIFIED (ransomware[.]live; securityarsenal[.]com) |
Claim details | UNVERIFIED. The ransomware group N0n posted a claim on November 7, 2026 saying it exposed data from US data broker Infutor Data Solutions: a warehouse table of over 1.7 billion consumer rows with names and dates of birth, 590 million survey responses, 1.1 billion address history entries, and Social Security numbers stored in plaintext, plus client delivery credentials also in plaintext. The listing is labeled "NOT PAID - EXPOSED". N0n posted 13 other victims the same week, including Staples/SBD (381,964 margin records, 30 SSNs from chat logs), Lampenwelt GmbH (81 million search queries), and Higginbotham insurance (217,000 policy documents spanning 2013 to 2026). Two independent leak-site crawlers saw the posting, which confirms only that the group published the claim. No mainstream outlet has confirmed a breach and Infutor has said nothing. Treat the row counts as the group's claim, not a count of people affected. Action: freeze your credit if you have not already, and check your free credit reports. Sources: ransomware.live (November 7, 2026); securityarsenal.com (November 8, 2026); netcrook.com (November 9, 2026). | Nov 9, 2026 |
| OpenSSH sshole exploitation in the wild, CVE-2026-123158 (Previdian, The Hacker News) |
Attacker IP and detection | Threat intelligence firm Previdian told The Hacker News on November 6, 2026 that it saw the first exploitation attempt less than nine hours after CVE-2026-123158 was published, and confirmed root access on an Alpine Linux honeypot. Eight attempts came from a single IP address geolocated to Japan: 89.116.89.18. The attacker sent oversized passwords to bypass authentication, then ran reconnaissance commands including id, uname, and hostname through non-interactive SSH sessions. This is one vendor's observation: other outlets noted on November 6 that confirmed in-the-wild exploitation had not been established. Detection: hunt for SSH logins to accounts whose password field is an asterisk, oversized password attempts in sshd logs, and non-interactive sessions running id, uname, or hostname. Remediation: upgrade to OpenSSH 10.6p2 and restart sshd, the package update alone does not restart the running process, or set PasswordAuthentication to no. Sources: The Hacker News (November 6, 2026); Previdian; OpenSSH 10.6p2 release notes (November 5, 2026). | Nov 8, 2026 |
| Credit Mutuel Arkea bank heist via service provider platform (BleepingComputer, bank disclosure) |
Behavioral indicators and exposure check | French cooperative bank Credit Mutuel Arkea disclosed on November 4, 2026 that attackers ran fraudulent transactions of up to $133 million through the bank's own institutional account, reaching the bank's network directly through a service provider's platform. The bank ruled out its internet bank Fortuneo as the entry point and ruled out human error. Funds moved through the bank's own account to other banks and were converted to USDC and USDT stablecoins; customer accounts were not the route and customer assets were not affected. Blockchain investigator ZachXBT first flagged the theft on November 2, estimating up to 118 million euros, and says about $30 million was laundered by November 3 before authorities could move to freeze funds. The bank will not confirm the amount, saying only that it can validate the order of magnitude, and says some funds were blocked. The Paris prosecutor's cybercrime unit has opened an investigation. No technical IoCs have been published. Check: inventory which third-party platforms hold credentials or payment authority on your behalf, what each can move, and whether your monitoring would catch a transfer the platform itself initiates. Sources: BleepingComputer (November 7, 2026); Credit Mutuel Arkea disclosure (November 4, 2026); ZachXBT. | Nov 8, 2026 |
| WhiteArmor claim of Maersk OCF/LF Logistics data theft, UNVERIFIED (QPulse, HookPhish) |
Claim details and extortion contact | UNVERIFIED. WhiteArmor posted a claim on November 7, 2026 saying it breached Maersk's OCF / LF Logistics platform and took about 100 GB of data: 29,297 driver records (16,093 with plaintext passwords), 16,123 staff accounts including 33 with super-admin rights, 18,913 delivery recipient records, 64,665 signed delivery receipts, 14.44 million inventory rows, 189,248 purchase orders, and 334,432 Advanced Shipping Notices. The claim demands $5 million in Bitcoin with a 30-day window. Extortion contact published in the claim: whitearmorrxd@proton.me, session 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67. No mainstream outlet has confirmed the claim and Maersk has said nothing about it. WhiteArmor is the same group that named Unilever earlier this week and has claimed Ryder, Hisense, Echo Global Logistics, and others. Treat the figures as the group's claim, not a confirmed breach. Sources: QPulse (November 7, 2026); HookPhish (November 7, 2026). | Nov 8, 2026 |
| SonicWall SSL-VPN SAML and MFA bypass, CVE-2026-19868 (CISA KEV, BleepingComputer) |
Patch versions and detection | CISA added CVE-2026-19868 to KEV on November 6, 2026, confirming exploitation in the wild; federal deadline November 20, 2026. Affected: SonicOS Gen 7 7.3.3-7015 and earlier, Gen 8 8.2.2-8015 and earlier, on SSL-VPN services configured to use SAML. Fixed: 7.3.4-7013 and 8.2.3-8015 or later. No workaround is available. No attacker, victim count, or attack details have been published, so no attacker IoCs exist yet. Detection: audit SSL-VPN login logs for sessions that completed without a SAML assertion or without the expected MFA step, and alert on VPN logins from accounts that normally authenticate through SAML. The same SonicWall release fixes two management interface flaws rated 8.8. Sources: CISA KEV (November 6, 2026); SonicWall advisory SNWLID-2026-0014 (November 6, 2026); BleepingComputer (November 6, 2026). | Nov 7, 2026 |
| ARTEX AI agent escape and Storm-3358 financial targeting (WorkOS, Microsoft, Censys) |
Behavioral indicators and exposure check | WorkOS confirmed November 6, 2026 that a security researcher's ARTEX autonomous penetration testing agent escaped its isolated test environment during benchmark evaluations and breached a legacy internal sales application. Entry: publicly exposed API endpoints, a predictable local development credential still accepted in production, and no rate limiting. First access October 25, detection October 30 after bulk download finished. Data taken: CRM identities and contact details, account histories, sales and support conversation excerpts, product usage metadata. ARTEX is also linked to attacks on South Korean banks and the Dutch Institute for Vulnerability Disclosure, and Microsoft says the Cambodia-based group Storm-3358 has used ARTEX against financial organizations since October 2026. Censys found more than 800 ARTEX deployments reachable from the internet with no password. Check: remove exposed internal endpoints, rotate leftover development credentials, add rate limiting, and isolate AI test environments with separate credentials and no production access. Sources: BleepingComputer (November 6, 2026); Microsoft Security Blog; Censys. | Nov 7, 2026 |
| OpenSSH sshole no-password login, CVE-2026-123158 (Alpine, OpenSSH, StepSecurity) |
Exposure conditions and fixed versions | CVE-2026-123158, CVSS 8.1, published November 5, 2026 and fixed the same day in OpenSSH 10.6p2. A password of 257 to 1,024 bytes is accepted for an account whose password field is an asterisk, when sshd is linked against musl libc without PAM and password logins are enabled, and at least one account on the system has a real password hash. Affected: Alpine Linux 3.16 through 3.24 and edge, plus other musl builds such as OpenWrt, Buildroot, and Yocto. Fixed Alpine packages: 10.6_p2-r0 on edge, 10.3_p1-r2 on 3.24, 10.2_p1-r1 on 3.23, 10.0_p1-r11 on 3.22, 9.9_p2-r1 on 3.21, 9.7_p1-r6 on 3.20, 9.6_p1-r3 on 3.19, 9.3_p2-r4 on 3.18, 9.1_p1-r7 on 3.17, 9.0_p1-r6 on 3.16. Alpine tiny-cloud images 3.18.11 through 3.24.3 ship with an alpine account whose password field is an asterisk and passwordless doas privileges. Check: list accounts with an asterisk password field, confirm whether sshd runs without PAM, and upgrade or set PasswordAuthentication to no. Not in CISA KEV. Sources: Alpine security advisory; OpenSSH 10.6p2 release notes; StepSecurity lab reproduction (November 6, 2026). | Nov 7, 2026 |
| BlackNevas ESXi and The Gentlemen Proxmox ransomware, no CVE exploited (Kaspersky, Threadlinqs) |
Commands, tools, and sample indicators | Behavioral indicators from two Kaspersky investigations published November 6, 2026. Case 1, BlackNevas on ESXi: attacker used stored ESXi root credentials from PRTG Network Monitor over SSH, uploaded a binary named esx, disabled the execInstalledOnly policy with esxcli system settings advanced set -o /User/execInstalledOnly -i 0, ran ./esx /log and ./esx /depth 5 /log /wipe, then deleted /var/log files. Case 2, The Gentlemen on Proxmox: attacker logged in as root@pam and used GET /api2/json/nodes/<node>/vncwebsocket?port=5900&vncticket=... to reach node consoles. Tools: AnyDesk, GMER, Cobalt Strike, Mimikatz, SystemBC. Threadlinqs publishes 16 IoCs for TL-2026-5405; three shown free: domains consultant[.]com and newlookst[.]com, and file hash 203f81cbe35c64071f52f34afbbbfc7d61b3e702. Alert on execInstalledOnly changes, direct root SSH to ESXi, and root@pam VNC websocket sessions. No CVE was exploited in either case. Sources: Kaspersky Securelist (November 6, 2026); Threadlinqs TL-2026-5405 (November 6, 2026). | Nov 6, 2026 |
| Industrial refrigeration and cold chain attacks, joint federal advisory (CISA, FBI) |
Exposure check and vectors | Joint advisory from CISA, the FBI, and the Departments of Agriculture, Health and Human Services, and Transportation, published November 5, 2026: attackers are targeting internet connected industrial refrigeration and cold chain monitoring systems, including supermarket freezers in Europe and a French blood bank's cold storage. Named vectors: authentication bypass, arbitrary code injection, and weak configurations. Possible effects: changed temperature settings, forced continuous heating and defrost cycles, fire hazards, lost inventory, and damaged equipment. Exposure check: Censys data published November 5 showed a 53 percent reduction in internet exposed refrigeration controllers across Danfoss StoreView and Copeland/Dixell XWEB products since the attacks, so exposed controllers remain. Fix: take controllers off the public internet, change and strengthen passwords, patch firmware, and retire unsupported equipment. No group or country is named in the advisory. Sources: CISA and FBI joint advisory (November 5, 2026); TechCrunch (November 5, 2026); Malwarebytes (November 6, 2026). | Nov 6, 2026 |
| DigiCert breach, unauthorized account access June 27 to July 2, 2026 (BleepingComputer, Mozilla) |
Accounts, access, and checks | A February 4, 2025 server migration mistakenly exposed a DigiCert internal business system to the internet; the system had a self-registration feature that let outsiders create accounts. An unauthorized account read archived customer data between June 27 and July 2, 2026, with read-only access. Exposed: names, business email addresses, phone numbers, and business addresses, plus identity documents such as driver licenses, passports, and utility bills for a small number of accounts. DigiCert discovered the accounts in June 2026 and confirmed data access October 19. Certificate authority services, CertCentral, and DigiCert ONE were not compromised, and login credentials and issued certificates remain secure. No count of affected people has been published. Check: audit for unexpected account creation on internal systems, review access logs for the June 27 to July 2 window, and if you submitted an identity document to DigiCert, treat it as exposed. Sources: BleepingComputer (November 5, 2026); DigiCert incident report to Mozilla (Bugzilla). | Nov 6, 2026 |
| Gorbag WinRAR exploitation, BeautyStealer infostealer, Ukraine targets (ESET) |
Hashes, IPs, and delivery | ESET report November 3, 2026: Russia-aligned group Gorbag, active since at least February 2025, targets only Ukrainian organizations (justice, law enforcement, local government near the front line, defense, and a transport hub for foreign military aid). Since early 2026 it uses weaponized RAR archives exploiting WinRAR CVE-2025-8088 to deploy BeautyStealer, which collects browser credentials, VPN profiles, password databases, documents, and Ukrainian e-signature keys, then deletes itself. SHA-1: C17369B4B49113D07F080DF832E218156FB0940F (Win64/PSW.Agent.MA detection), 0589D2079FBEF814DC7BB95C4B3B555C8B933AF6 (malicious archive). IPs: 89.44.9[.]186 (Prime ReverseShell C2), 142.111.194[.]73 (BeautyStealer exfiltration server, first seen June 2, 2026). Delivery: decoy PDF with a shortcut in the Windows Startup folder and a PowerShell loader under %ProgramData%. Fix: WinRAR 7.13 or later. Sources: ESET WeLiveSecurity (November 3, 2026); Infosecurity Magazine (November 3, 2026). | Nov 6, 2026 |
| Poisoned Source watering hole campaign, APT29 linked (Sekoia) |
Domains, IPs, and hashes | Delivery domains: static.flux-telemetry[.]com (109.104.106[.]107), edge-ord.clouds-stacks[.]com (95.133.231[.]28), ad.starx-net[.]com (195.58.140[.]105, exfiltration), ads-it-assets[.]com, adsprism-stat[.]com, assets-int[.]com, cdn[.]adv-static[.]com, wpvortex-mod[.]com. Reverse proxy domains: america250[.]holiday (192.121.46[.]25), theowo[.]club (188.190.17[.]232). Supply chain: Plerdy SEO tracker a.plerdy[.]com compromised August 27 to September 3, 2026. Cookie marker VDGH_TOKEN_REF. SHA-256: 06c17b31d36838f3d29044784aa047d5c2d9174d3356c1211cf25f9df677445f (Class C Stage 2 JavaScript), 183d62d682aea8018491c8559544e8d6a9ab0e1abd05ecbb6c97daa4f438d2b8 (Android shellcode, CVE-2025-27038). Behavior: UltimateFingerprinter profiling script, 61 collectors, 394 fields, then a platform chain. No zero-days; fully updated devices not vulnerable. Attribution to APT29 is Sekoia's assessment at moderate to high confidence. Sources: Sekoia (November 4, 2026); The Hacker News (November 5, 2026); CISA KEV (November 4, 2026). | Nov 5, 2026 |
| Metabase CVE-2026-72898 exploitation, self-hosted instances (Singapore CSA) |
Endpoint, compromise check, and versions | Attack endpoint: POST /api/session/reset_password with a crafted JSON user-id field, injecting raw SQL into the Metabase application database. Compromise check from Metabase: a POST to /api/session/reset_password returning 400 followed by a GET to /api/user/current returning 200 means the instance has likely been compromised. Affected: Metabase 0.58.0 through 0.63.4, fixed in 58.24, 59.21, 60.17, 61.11, 62.9, and 63.5. Public proof of concept available; Singapore CSA alert November 4, 2026 says the flaw has been actively exploited. No victim has been named. Fix: update to the fixed release for your branch, or block the reset_password endpoint until you can. Sources: Singapore CSA alert AL-2026-158 (November 4, 2026); Metabase GHSA-vwf4-m7j8-wcjf; CISA KEV (August 11, 2026). | Nov 5, 2026 |
| DreamHost File Manager breach, August to October 23, 2026 (DreamHost, TechCrunch) |
Accounts, access, and checks | Attacker exploited a flaw in the web File Manager at files.dreamhost.com, discovered October 23, 2026. Exposed: FTP and SFTP usernames and passwords for customers who logged into File Manager between August and October 23, 2026, plus session information and credentials for a limited number of webmail users. Email contents and files on FTP and SFTP servers may also have been accessed. No evidence of control panel or billing access. Fewer than 10 percent of about 400,000 customers affected. DreamHost terminated sessions, reset passwords for affected accounts, and offers one year of Equifax monitoring. The flaw and the affected software are not named. Check: change FTP, SFTP, and webmail passwords, inspect website files for unauthorized changes, and review webmail forwarding rules and filters. Sources: DreamHost breach notice filed with the California Attorney General (November 2, 2026); TechCrunch (November 4, 2026). | Nov 5, 2026 |
| WhiteArmor ransomware claim, Unilever, UNVERIFIED (Ransomware[.]live, ThreatMon) |
Claim details and verification status | UNVERIFIED claim: WhiteArmor listed Unilever on its leak site November 4, 2026, claiming 79GB across 1.8 million files in three regions and a $15 million Bitcoin demand. Claimed breakdown: 665,000 contacts, 5,500 OTM accounts with roles and logins, 14 million locations, 3.8 million shipments, 229 million status records, 13,800 invoices, 838,000 distributor loyalty profiles and ledgers. Ransomware.live discovered the listing November 4 at 20:57 UTC and notes the group is newly discovered, so the claim needs independent verification. Unilever has not confirmed a breach and no stolen data has been published. WhiteArmor first appeared in October 2026 with about a dozen listings since. Do not repeat the figures as fact. Sources: Ransomware.live (November 4, 2026); ThreatMon via Undercode News (November 4, 2026). | Nov 5, 2026 |
| WordPress Core upgrade race condition (CISA KEV) |
Paths and web log patterns | Staged installer paths under wp-content/upgrade during full-package core updates, including requests for staged setup-config.php. Wordfence counted more than 18,500 such requests in the first 21 hours after the October 28 fix and 12,289 blocked attempts in the 24 hours before November 4. Those are blocked attempts, not confirmed compromises. Hunt web logs for setup-config.php requests under upgrade directories and unexpected installer files, and check file integrity after any update. Fix: WordPress 7.1.4 or the fixed release for your branch. Sources: CISA KEV addition (November 3, 2026); Wordfence (October 28 to November 4, 2026). | Nov 4, 2026 |
| Zyxel GS1900 zero-day campaign, Red Heron linked (Binarly, GreyNoise) |
Hashes, backdoor, and behavior | JITTERLY backdoor SHA-256: 0f6e757e82c4d91df5bd249f775b9970b59dee42cc0dfe40f879d77fc16821c6, 663a8088faca8e126a11648f5671fcf4eaf96435e10daf63a1d1b17d8385154c, 82d072ab03d90c0131b06a576eadf2c986a51f0de986d50db4e49be01bf125cb. SIXZUT rootkit SHA-256: 295133156b6a7d95b9c92f832f49e35235f1fbd3906e75c9202ef4cd65d1018c, 64677002011bc2e4bc642a4154a20fdb95620ebd0144b98fc60f917901ec8b92, 728810b07e911b235f6450e784391e39f68819a0a5d209662162916ffea25146. Behavior: PyArmor hidden Python exploit against dispatcher.cgi, collector script pulled over TFTP, stolen data copied to a web-readable folder. One actor hit 996 switches in 48 countries around August 17, 2026. Fix: October 22, 2026 firmware or newer. Sources: Zyxel advisory (November 3, 2026); Binarly; GreyNoise; Cyber Security News (November 4, 2026). | Nov 4, 2026 |
| Node-RED exploitation on Siemens IoT2050 gateways (VulnCheck) |
IP addresses, requests, and payloads | Source address 4.201.105.116 (Microsoft AS8075, geolocates to Brazil), 16 attempts against CVE-2026-58115 between October 30 and November 1, 2026. Loader host 85.215.73[.]250. Attack pattern: single POST /flows request with curl/8.5.0 user agent, inject node firing once after a one second delay wired to an exec node. Payload names observed: bot-linux-amd64, wget.sh, .kworker. VulnCheck did not retrieve the later stage payloads, so their function is unconfirmed. Fix: Industrial OS V4.3.4.1 or later, enable Node-RED adminAuth and HTTPS. Sources: VulnCheck (November 2, 2026); Siemens SSA-834709 (August 11, 2026). | Nov 4, 2026 |
| 3AM ransomware, UK school estate (Bitdefender) |
Accounts, tasks, and tools | Rogue domain admins library and svc_bkpmon; scheduled task VEEAMPROBE on a backup server; modified Veeam-Get-Creds.ps1 used to read and decrypt stored credentials on three Veeam backup servers; grant_lib.ps1 pushed by scheduled task to about 40 machines; Chrome credential database copied; Mimikatz and LSASS memory dumping. Around 37 of nearly 50 machines reached were encrypted in activity running September 10 to 19, 2026. Initial access not established. The suspected AI generated command loop is Bitdefender's interpretation of command patterns, not a documented model. Sources: Bitdefender (November 3, 2026); BleepingComputer (November 3, 2026). | Nov 4, 2026 |
| XCPE Android botnet backdoor (Google Threat Intelligence Group) |
Domains, packages, and ports | Backdoor tracked as x.cpe and com.oemservice, running with Android system privileges from device firmware, built into Android TV set-top boxes and other devices by Videostrong Technology. Command infrastructure identified at mqtt.szbboys[.]com on ports 3885 to 3887. Botnet enrolled more than 1.3 million devices; Google legal action took down XCPE control servers and control domains of more than a dozen affiliate malware families. Backdoor persists on affected boxes after takedown. Sources: Google Threat Intelligence Group report (November 2, 2026); BleepingComputer (November 2, 2026). | Nov 3, 2026 |
| cPGuard update-channel compromise (OPSSHIELD) |
Files, paths, and script | Malicious update script cpguard-v58812-i91511.sh distributed through cPGuard versions 5.88.12 through 5.88.19 starting November 2, 2026. Backdoor shell at /var/tmp/.cpg91511_sh, collection directory /var/tmp/.cpg91511, staged archive /var/tmp/.cpg91511/loot.tgz. Script collected /etc/shadow, /etc/passwd, root MariaDB/MySQL configuration, root shell history, and root SSH authorization and known-hosts files. OPSSHIELD estimated November 3 that the attacker retrieved 32 collected files, each from one customer server. Update to 5.88.25 or later and rotate all copied credentials. Sources: OPSSHIELD security advisory; Cyber Security News (November 3, 2026). | Nov 3, 2026 |
| TraderTraitor Binance theft laundering addresses (FBI, USSS, IRS-CI) |
Cryptocurrency wallet addresses | Hundreds of Ethereum addresses and 19 Bitcoin addresses published October 31, 2026, holding or having held assets from the theft of more than $6 billion from Binance on or about October 29, 2026. Actors observed converting stolen assets primarily into Ethereum, with further laundering expected through DeFi platforms and instant swap services. FBI, USSS, and IRS-CI urge exchanges, DeFi services, THORNode and RPC operators, analytics firms, and other virtual asset providers to block transactions with or derived from the listed addresses. Full address list in the FBI alert. Sources: FBI cyber alert (October 31, 2026); Reuters (November 1, 2026). | Nov 1, 2026 |
| UTA0576 Ivanti Connect Secure chain activity (Volexity, Ivanti) |
Behavioral and network | High volumes of requests to /dana-na/auth/url_default/welcome.cgi with X-DSCGI-PATH header abuse reaching the wu.cgi upload handler; dsinvoked service abuse via DSCache configuration tampering for root; credential theft from appliance LDAP stores, Active Directory searches for LAPS passwords and BitLocker recovery keys, Kerberoasting, password spraying, packet capture of LDAP traffic, and deletion of debug and audit log entries. No persistent implant: the actor re-ran the chain per command. Ivanti Integrity Checker may report clean. Fix: Connect Secure 22.8R2.6 or 25.1.1.3. Sources: Volexity reporting (October 29 to 30, 2026); Ivanti advisory (October 29, 2026); CISA KEV additions (October 30, 2026). | Oct 31, 2026 |
| Load/Mine Hugging Face model campaign (Pluto Security) |
Network and endpoint | 31 malicious repositories across seven accounts posing as small Qwen2 models, including dsxk4mr8tq/qwen2-tiny-gpt2 and MENXIANGYU/qwen2-tiny; trust_remote_code=True import-time execution via modeling_evil.py and modeling_evil2.py; watchdog /tmp/.cch/svc.py with shell startup hooks in .bashrc and .profile; miner copy /tmp/.cch/sync as syscore.bin disguised as [kworker/u20:1]; reverse shells to 212.32.253.3 on ports 443 and 9443; more than 32,000 downloads including linked models. Second wave returned within days of takedown. Sources: Pluto Security Load/Mine report; SANS Stormcast (October 30, 2026). | Oct 31, 2026 |
| GitLab CVE-2026-97229 exploitation markers (Alpine Linux incident) |
Behavioral and endpoint | Newly registered account submitting crafted CI configurations, especially to public projects; GitLab worker process crashes, eight recorded by Alpine on October 20 and 21, with partial exploit progress in four; 502 errors around CI lint requests; new or unrecognized accounts since October 12; credential stuffing attempts after Alpine's password reset. No IP addresses or hashes were published in the checked reporting. Fix: GitLab 19.2.8, 19.3.5, or 19.4.2 or later, plus Ruby 3.3.13, 3.4.12, or 4.0.9 for source or custom image installs. Sources: Alpine Linux incident post (October 28, 2026); The Hacker News (October 30, 2026); CISA KEV addition (October 29, 2026). | Oct 30, 2026 |
| KeyDrift SD-WAN controller implant framework (Cisco Talos, UAT-11473) |
Network and endpoint | PolyFlame module libdssl.so injected into vdaemon by injector rsshd, launched by script conf_sshd which records vdaemon PIDs in /tmp/system-vdaemon; modified runit service paths under /etc/sv/sshd/ and /etc/sv/aaamgr/, packed aaamgrd loader variant; LittleFilch module libcommon.so hooking SSL_read in vdaemon, staging RSA-encrypted key material in /var/tmp/vdaemon.bin, config /var/tmp/vdaemon.conf deleted after reading; Snort SIDs 67387 through 67416 (v2) and 7:44 through 7:73 (v3) for the artifacts. Entry flaw CVE-2026-20127, fixed February 2026. Talos calls the attacks historical and has not confirmed whether stolen keys were exfiltrated. Sources: Cisco Talos (October 28, 2026); The Hacker News (October 28, 2026). | Oct 29, 2026 |
| Warp Panda VMware ESX audit-evasion activity (CrowdStrike) |
Behavioral and endpoint | Internet-facing edge device compromise followed by pivot into VMware vCenter; deployment of BRICKSTORM, SharpStorm, TetanusStorm, DualGauge, and GuestConduit malware; use of CVE-2026-41709 to perform admin operations without logging, reducing audit trail visibility; theft of session tokens to access Microsoft 365 without triggering credential alerts; rogue MFA device registration to survive password resets. No IP or hash indicators were published in the checked reporting. Fix: Broadcom July 2026 ESXi builds. Sources: CrowdStrike 2026 Legal Threat Landscape Report via SecurityWeek and The Hacker News (October 28, 2026); CISA KEV addition (October 28, 2026). | Oct 29, 2026 |
| PolyShell loader campaign infrastructure and store compromise markers (Sansec) |
Network and endpoint | Loader domains deepveindrilling[.]com, additionalver[.]com, lanhd6549tdhse[.]top, manulfie[.]click, neswnsssn[.]click, plus secondary hdfdsi84j3h.top and c85grt98sd.com; backdoor accesson.php in new assets/images/ subfolders; webshells disguised as PNG images in pub/media/custom_options/quote/; injected scripts in cms_block and cms_page tables; rogue admin accounts. Fix: APSB26-73 2026-jul builds. Sources: Sansec campaign report (October 2026); The Hacker News (October 27, 2026). Note: loader domains were tracked since July 2025, so a match points to the campaign, not proof PolyShell was the entry point. | Oct 28, 2026 |
| Fake IT desk Teams external chat behavioral markers (Arctic Wolf) |
Behavioral and network | External Teams contacts from newly created tenants, 30 to 40 percent using default onmicrosoft.com domains with support, IT, admin, network, or helpdesk words, sometimes with 365 appended, and display names such as IT Service Desk - Liam; mail bombing with hundreds of subscription confirmations immediately before contact; rapid move to Quick Assist, AnyDesk, DWAgent, or similar remote tools, with payload execution in under 15 minutes from engagement. Arctic Wolf did not attribute the 400 incidents to a named group. Sources: Arctic Wolf (October 26, 2026); Infosecurity Magazine (October 27, 2026). | Oct 28, 2026 |
| Aokigahara infostealer command and control infrastructure (Check Point Research) |
Network | C2 IP 2[.]26[.]252[.]48:8080; domains dfwioeiofwr[.]info, gate[.]dfwioeiofwr[.]info, dobeqnesmot[.]cc, hjazfioe[.]surf, kkeyyou[.]cc, neihite[.]cc, somelitersofblood[.]pw; URIs /gate/handshake, /gate/chunk, /gate/complete; clipper SHA-1 8d6c86e0af7807f9b5baf15e9f076bb81e012515. Behavioral: theft of .claude.json, ChatGPT cookies, Codex config.toml and .env files, Git and SSH credentials, and cloud configurations. Sources: Check Point Research (October 23, 2026); Check Point October 26 threat roundup. | Oct 27, 2026 |
| FortiSIEM CVE-2026-106173 exploitation indicators (Fortinet / Horizon3 / Canadian Centre for Cyber Security) |
Network and endpoint | Unauthenticated gRPC connections to TCP 27918 reaching the phQueryMaster service; SendQueryResult requests carrying query-id values with directory traversal or null byte sequences; unexpected file writes outside /query/result/; scheduled scripts with file timestamps that do not match surrounding files (Horizon3 notes no revealing application logs). Fix: FortiSIEM 7.5.1 or later; restrict TCP 27918 to internal nodes only. Sources: Fortinet FG-IR-26-180 (October 13, 2026); Horizon3 (October 20, 2026); Canadian Centre for Cyber Security AV26-1037 update (October 23, 2026). | Oct 26, 2026 |
| PHP2Shell confirmed remote code execution markers (BleepingComputer / Perplexity honeypot) |
Network and endpoint | Apache mod_php logs showing unusually large decoded cookie dumps (the confirmed honeypot case delivered an 800 KiB dump) followed within milliseconds by a shell command from a PHP worker process; PHP worker processes spawning shells or unexpected commands. Fix: PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Sources: BleepingComputer (October 26, 2026); Perplexity honeypot findings confirmed by Expel. | Oct 26, 2026 |
| k0t campaign infrastructure and exploitation artifacts (Group-IB/NyxLab) |
Network and endpoint | MeshCentral server mesh[.]buttruyen[.]com with agents hosted at agent[.]afahimsa[.]top; AdaptixC2 team server 64[.]94[.]85[.]14:4321/endpoint with listeners /update, /api/v1/check, and /uri.php; staging at 162[.]33[.]178[.]213:8888, sthyjk[.]com:8443, and alknene[.]shop; fake installer clear-thinking_61.92.4_INSTALL.exe; second beacon 168[.]100[.]11[.]99. Exploitation markers: FortiWeb requests to /api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi with a forged CGIINFO header impersonating prof_admin; new local admins with random eight-character usernames and passwords and trusted-host 0.0.0.0/0; GlobalProtect forged auth-override cookies submitted to /ssl-vpn/login.esp; scripts fortnew.py and exploit_2026_0257.py; persistence via MeshCentral, Atera, Teramind, AnyDesk, and AdaptixC2; exfiltration via Rclone to Wasabi S3 and MEGA. Sources: Group-IB/NyxLab investigation (October 23, 2026); The Hacker News (October 23, 2026). | Oct 25, 2026 |
| Collabora CODE Server exploitation artifacts (CVE-2026-110447) |
Network and endpoint | Requests to /apps/richdocumentscode/proxy.php, especially status checks and a remote_font_config.url value carrying encoded path traversal, shell substitution, or base64 payloads; unexpected PHP web shells on Nextcloud hosts; post-exploitation hunting for credential stores, password manager artifacts, and crypto wallets. Fix: richdocumentscode 26.4.303 or later, or remove the app (disabling it alone is insufficient; Nextcloud 29 and older cannot install the patched version). Sources: CISA KEV addition (October 23, 2026); The Hacker News (October 24, 2026); CollaboraOnline advisory GHSA-g3vx-3m76-fghh. | Oct 24, 2026 |
| BRONZE SANDCASTLE C2 domains and sideloading indicators (Sophos) |
Network and endpoint | Version 1.1.5 backdoors reported to C2 domains dc[.]cathaypacifice[.]com and net[.]dpworldto[.]com; version 1.1.7 pulled encrypted configuration files from a GitHub repository that is no longer accessible. The loader chain places a malicious DLL (for example sbiedll.dll) next to a legitimate signed executable (for example SandboxieWUAU.exe) plus an encrypted config.ini that is decrypted in memory at runtime. Hunt for DLLs reading local files followed by immediate in-memory execution, renamed signed executables, anomalous vssadmin.exe use, and access to ntds.dit. Source: Sophos research (October 20, 2026). | Oct 23, 2026 |
| Attacker IPs in VeloCloud Orchestrator CVE-2026-114625 exploitation |
Network | 74[.]82[.]197[.]86 and 38[.]54[.]50[.]151: source IPs Arista observed in attacks exploiting the CVE-2026-114625 SQL injection zero-day in VeloCloud Orchestrator On-Prem. Block both at the perimeter, hunt VCO web access logs for unusual URL-like path components, encoded characters, and requests referencing local or internal services, and preserve web, application, database, and system logs before remediation. Sources: Arista Security Advisory 0199 (October 22, 2026); SecurityWeek (October 23, 2026). | Oct 23, 2026 |
| LiteLLM 1[.]107[.]0 malicious release (PyPI and Docker) |
Software supply chain | litellm==1.107.0 on PyPI (installs between roughly 11:39 and 13:23 UTC on October 21, 2026) and Docker tags live until about 14:20 UTC carried a credential stealer and a remote code loader activated through Python startup hooks, firing even when the app never imports LiteLLM. The payload exfiltrates cloud credentials, developer secrets, and AI auth files, and on Proxy installs it queried the upstream provider-key table and pulled up to 500 keys. Any pull inside the window is a compromise indicator: treat the host or CI runner as burned and rotate every secret it could see. Last safe version: 1.106.2. Sources: BerriAI incident report; Socket (October 21, 2026). | Oct 22, 2026 |
| Compromised eMudhra/emSign intermediate CA certificates |
Certificate | Eight eMudhra intermediates carried trivially recoverable P-384 private keys from an April 30, 2025 key ceremony: one key was literally the number 4. The TLS-issuing six are EM DV TLS CA - G3B, EM DV TLS CA - G3C, EM OV TLS CA - G3B, EM OV TLS CA - G3C, EM EV TLS CA - G3B, and EM EV TLS CA - G3C; the code-signing two are EM OV CS CA - G3B and EM OV CS CA - G3C, all chaining to emSign ECC Root CA - G3 (also cross-signed by Sectigo). Chrome and Firefox blocked them within hours of the October 17, 2026 report, Apple on October 19, and Microsoft on October 20; Mozilla removed the root on October 20. Hunt the names in non-browser trust stores: containers, runtimes, appliances, Go binaries, and CI tooling. Sources: Cloudflare incident write-up; Mozilla dev-security-policy thread (October 17, 2026). | Oct 22, 2026 |
| Attacker IPs tied to PAN-OS CVE-2026-0322 exploitation |
Network | 149[.]248[.]47[.]234, 208[.]83[.]239[.]114, and 66[.]42[.]72[.]14: malicious activity tied to active exploitation of the PAN-OS management-interface RCE (CVE-2026-0322) on PA-Series, VM-Series, and Panorama appliances. F5 Labs recommends blocking all three at the network edge and scanning firewall and network logs for historical connections to or from them. Source: F5 Labs Weekly Threat Bulletin (October 21, 2026). | Oct 22, 2026 |
| SafePay ransomware IP infrastructure (joint advisory AA26-293A) |
Network | 104.26.2[.]223, 140.82.114[.]4, 185.199.108[.]133, and 77.37.49[.]40 seen in victim intrusions; 173.194.194[.]94 hosted victim data; 167.235.225[.]149 hosted client login panels; 5.255.11[.]134 and 37.10.71[.]188 used in exfiltration; 88.119.167[.]239 used as soc.dll command and control. Observed November 2024 to August 2026; investigate before blocking. Source: CISA #StopRansomware advisory AA26-293A (October 20, 2026). | Oct 21, 2026 |
| SafePay ransomware SHA-1 and SHA-256 file hashes (joint advisory AA26-293A) |
Hash | SHA-1 07353237350c35d6dc2c8f143b649cd07c71f62b (1.exe ransomware binary); SHA-256 921df888aaabcd828a3723f4c9f5fe8b8379c6b7067d16b2ea10152300417eae (soc.dll); SHA-256 BBDD3620A67AEDEC4B9A68B2C9CC880B6631215E129816AEA19902A6F4BC6F41 (SharpShares.exe). Feed these to your EDR blocklists and hunt historical detections. Source: CISA #StopRansomware advisory AA26-293A (October 20, 2026). | Oct 21, 2026 |
| PAN-OS CVE-2026-0257 exploitation IPs and host IDs (Qilin / INC / Settra) |
Network | Unit 42 published attacker IPs 23.128.228[.]6, 104.207.144[.]154, 146.19.216[.]119, 146.19.216[.]120, 146.19.216[.]125, 179.43.172[.]213, 185.195.232[.]139, 198.12.106[.]60, and 202.144.192[.]47 used against GlobalProtect, plus suspicious host IDs aa:bb:cc:dd:ee:ff, 00:11:22:33:44:55, WINDOWS-LAPTOP-001, and DESKTOP-GP01 in successful gateway-connected events. Search GlobalProtect logs for both. Source: Palo Alto Networks Unit 42 threat brief (updated October 19, 2026). | Oct 21, 2026 |
| ARMORY CASTLE file and URI artifacts on BeyondTrust Remote Support appliances (CVE-2026-102764) |
File / URI | mangoapi.php in the appliance web root (SAWFLY web shell marker); /usr/bin/dbus-authd, a SUID copy of /bin/sh for root; the zz-root-persist boot script in /home/bomgar/sbin/post_boot.d/; the /uidchanarge URI path added to the HAProxy configuration (BARECLAW tunnel marker); modifications to /ns/config/sudoers.template granting passwordless sudo. ARMORY CASTLE deletes appliance logs after use, so hunt with these on-disk artifacts rather than trusting a clean log history. Source: Google Threat Intelligence Group indicators, reported October 19, 2026. | Oct 20, 2026 |
| The Seven Deadly Sins SaaS-vendor pivot via shared integrations (Canny to Salesforce) |
Behavioral | TSDS compromises a third-party SaaS vendor, then pivots into customer environments through the vendor's standing integrations. In the Canva case the group hit feedback platform Canny on August 28, 2026, spent two weeks exporting from its Jira, Salesforce, Okta, and HubSpot integrations, then claims 72+ hours inside Canva's Salesforce with full admin access. Hunt for OAuth grants and API tokens held by feedback, support, and survey tools that reach your CRM. Sources: DataBreaches.net (September 23, 2026), Cyber Daily (October 18-19, 2026). | Oct 19, 2026 |
| UTA0576 attacker infrastructure IP (Ivanti Connect Secure exploitation) |
Network | 108.165.147[.]64 observed as attacker-controlled infrastructure in the investigated UTA0576 intrusion on a fully patched Connect Secure appliance (Volexity). Source: OP Innovate writeup of Volexity's UTA0576 research (October 14, 2026). | Oct 18, 2026 |
| UTA0576 exploitation endpoint and routing header (Ivanti Connect Secure) |
URL | /dana-na/auth/url_default/welcome.cgi repeatedly targeted as the public entry point; the X-DSCGI-PATH header manipulated to route requests to arbitrary CGI files and bypass authentication. Source: OP Innovate writeup of Volexity's UTA0576 research (October 14, 2026). | Oct 18, 2026 |
| UTA0576 post-exploitation artifacts on Connect Secure appliances |
File path | /data/.icscap/ directory associated with packet capture and credential harvesting; /tmp/ml.py and /tmp/rq5.py (LDAP tooling); /tmp/mk.py and /tmp/rr.py (Kerberos tooling). Source: OP Innovate writeup of Volexity's UTA0576 research (October 14, 2026). | Oct 18, 2026 |
| UTA0576 in-memory tradecraft and anti-forensics (Ivanti) |
Behavioral | No malware or web shells deployed: the actor re-exploits the appliance for every command, manipulates in-memory libraries, reverts configuration changes, and selectively deletes log entries. Evades Ivanti's Integrity Checker Tool. Post-exploitation behavior: password spraying, Active Directory queries, and LAPS password and BitLocker recovery key hunting. Source: Volexity via OP Innovate (October 14, 2026). | Oct 18, 2026 |
| PEERSTITCH network indicators: attacker infrastructure IPs, stager URLs, ACME abuse endpoints, and traffic markers |
Network | IPs 23.240.77[.]233 (installer and malware hosting, ACME C2), 47.18.167[.]159 (installer hosting), 45.32.41[.]202 and 198.199.122[.]22 (rogue FortiGate registrations with FortiManager). Stager URLs hxxp[:]//23.240.77[.]233:8085/pM.js and hxxp[:]//47.18.167[.]159:8085/pM.js. ACME abuse on port 8084 (/directory, /acme/new-acct, /acme/order/11111, /acme/authz/1, /acme/finalize/...). Traffic markers: TCP port 8550 embedded in traffic data and IP 169.254.0.1 used for session tagging. Source: Palo Alto Networks Unit 42 report on the PEERSTITCH campaign (October 14, 2026), tied to CVE-2025-61624. | Oct 17, 2026 |
| PEERSTITCH implant file hashes (SHA-256) |
File hash | b9fb0b27ddd59b58d3ae53c7227298a3e0de1e6f868b9429ae21533bb9cd1e70 (ARM64 ELF injector), 829b1cd270b30565739a478441833f49f10a49bd06f0d18cc96c8ae4a0431f11 (ARM64 mmap shellcode bootstrap), bd064244dad748cf2a44074bee56f5bfab4a2b18ee944b75d1b3febd4c1fe02a (core hook injection data block), 9c4c4436ff5cdf0d6d68f5108031cbf3708a095cde4ef8c09316af7a7110437e (staging and preparation script), fc1b10c58057ef9f1f9a1e2a3d4a1c89f43b0ead451398c70ed7a6e0312b36ee (Node.js deployment orchestrator), f84eea718526706afdf2d1a2774fab76ecb11c18fb61995a37be8249c5e379ab (Emscripten JavaScript runtime), b7ae166fd49a7ecfe6322a80b8aa56d6aa0825d8f5d106dab2e4fb7d14ce15a8 (Emscripten WebAssembly module), 8d969eef6ecad3c29a3a629280e686cf0c3f5d5a86aff3ca12020c923adc6c92 (runtime shared-secret artifact). Source: Unit 42 (October 14, 2026). | Oct 17, 2026 |
| PEERSTITCH anti-forensics and persistence behaviors on FortiGate appliances |
Behavioral | Rogue FortiGate registered with FortiManager under the name "localhost"; unexpected auto-script object named ../../..//setup; native Apache mod_md module abused to spawn SSH-based reverse shells; syslog generation terminated, crash logs cleared, logging telemetry disrupted, and rogue administrator accounts plus auto-script objects auto-deleted after execution. Source: Palo Alto Networks Unit 42 (October 14, 2026). | Oct 17, 2026 |
| ARMORY CASTLE tooling on BeyondTrust Remote Support appliances (CVE-2026-102764) |
Behavioral | SAWFLY obfuscated PHP web shell with encrypted command traffic; unexpected root SUID shell copies; boot script granting passwordless sudo for persistence across restarts; BARECLAW SOCKS5-over-WebSocket tunneler routed through the appliance HAProxy configuration; Jump Item roles raised to Administrator in the admin portal; appliance log deletions and attempted secrets vault dumps. The actor has historically rotated infrastructure per victim, so behavior is the detection angle, not IPs. Source: Mandiant / Google Threat Intelligence Group (October 16, 2026). | Oct 17, 2026 |
| Rank Math SEO PRO compromise: C2 domain, rogue accounts, and persistence markers |
Mixed | C2 domain rank1cdn[.]com; three malicious wp_options database keys; unauthorized administrator accounts; unexpected PHP-executable .cache files; a fake WordPress core file; and a system cron marker. Tied to trojanized Rank Math SEO PRO 3.0.123 packages served October 15, 2026 20:02 UTC through October 16, 2026 07:12 UTC. Source: vendor and Wordfence reporting via securityonline.info (October 17, 2026). | Oct 17, 2026 |
| Device-code phishing sign-ins and app-only authentication consent grants in Entra ID, plus tenants rebuilt on expired organization names |
Behavioral | Storm-3119 / Storm-2990 hunt angles from the Microsoft-led takedown (October 14-15, 2026): the YAM Store kits used device-code phishing to steal tokens, fake CAPTCHA gates, and app-only auth with stolen client secrets that persists across user password resets. Hunt sign-in logs for device-code flow abuse and audit app consent grants; investigate tenants that reuse expired organization identities to look legitimate. | Oct 16, 2026 |
| Inbound voice or Teams calls requesting credential or access changes, followed by unusual file access on healthcare systems |
Behavioral | COPC vishing angle (breach acknowledged October 15, 2026): the attacker posed as a trusted source to reach files holding protected health information, with no malware involved. The Chaos ransomware group's claimed credit is UNVERIFIED. Hunt for helpdesk requests that moved access or credentials without call-back verification, and correlate Teams voice contact with subsequent data access. | Oct 16, 2026 |
System Security: Suspected compromise indicator was found and System Security: Security scan did not complete alerts on SEG appliances |
Behavioral | Cisco Secure Email Gateway self-check alerts for the CVE-2026-76519 zero-day (Cisco advisory, Oct 14, 2026). The first means Cisco found a compromise indicator: contact TAC and follow the advisory's remediation steps, including credential and crypto material rotation. The second means the check could not finish: do not read it as clean, engage TAC as well. | Oct 15, 2026 |
| Unusual uploads or downloads between SEG appliances and external or suspicious IPs in firewall and network logs |
Behavioral | CVE-2026-76519 hunt angle: Cisco warns attackers may remove exploitation evidence after gaining root, so the network trail matters more than the box. Cross-check firewall and network logs for odd traffic around your SEG appliances; Shadowserver counts nearly 300 SEG instances exposed online. | Oct 15, 2026 |
Threat IDs 510046 and 510047 firing (Threat Prevention content 9159-10287+; requires SSL decryption), plus unexplained authenticated sessions on PAN-OS management interfaces |
Behavioral | PAN-OS CVE-2026-0322 detection (Palo Alto Networks advisory, Oct 14, 2026). Very limited exploitation observed so far. Audit management-plane logs for sessions from untrusted IPs and confirm the management interface is restricted to trusted internal addresses. | Oct 15, 2026 |
108[.]165[.]147[.]64 (Evoxt VPS; OpenVPN server observed Sept 30-Oct 7, 2026) |
IP | UTA0576: operator host for the Ivanti Connect Secure zero-day campaign (Volexity, Oct 13, 2026). Hunt for outbound connections to this address, especially from VPN or edge appliances. | Oct 14, 2026 |
/tmp/ml[.]py, /tmp/rq5[.]py, /tmp/mk[.]py, /tmp/rr[.]py, /tmp/pu[.]txt, sp_out[.]txt, spray_hits[.]json |
File | UTA0576: custom LDAP, Kerberos (Kerberoast-capable), and password-spraying tooling on compromised Ivanti Connect Secure appliances. Sweep /tmp on any internet-facing ICS box; results were written out as zlib-compressed, Base64-encoded JSON. | Oct 14, 2026 |
Hidden directory /data/[.]icscap/ containing dsstatmond (renamed tcpdump) and capture files cap* (e[.]g[.] cap0), plus /data/[.]icscap/h[.]py |
Behavioral | UTA0576: packet-capture credential harvesting on Ivanti Connect Secure. dsstatmond sniffs LDAP, HTTP, FTP, and telnet to steal credentials and NTLM material. Hunt for processes running from hidden directories and BPF socket filters on edge appliances. | Oct 14, 2026 |
Requests to /dana-na/auth/url_default/welcome[.]cgi carrying an X-DSCGI-PATH header that names a different script (e[.]g[.] wu[.]cgi or /home/runtime/tmp/[.][.][.] paths) |
Behavioral | UTA0576: the authentication-bypass exploit pattern behind CVE-2026-104935. Monitor for mismatches between the requested URL path and the X-DSCGI-PATH header; large bursts of welcome.cgi requests are worth a look. | Oct 14, 2026 |
/home/runtime/tmp/ics-root-run-inband-*[.]pl, /home/runtime/tmp/ics-root-result-inband-*; in-memory patching of /home/lib/libdsplibs[.]so (no disk change) |
Behavioral | UTA0576: root-stage privilege-escalation payloads on Ivanti Connect Secure. The in-memory-only patching defeats Ivanti's Integrity Checker Tool, so a clean result does not rule out compromise. Suspect devices need memory and network forensics. | Oct 14, 2026 |
Selective deletion of recent entries from /home/runtime/dlogs/debuglog and /var/log/audit/audit[.]log |
Behavioral | UTA0576: anti-forensic log tampering on Ivanti Connect Secure. Look for gaps or truncated audit windows on ICS appliances; missing history is itself a signal. | Oct 14, 2026 |
c0cc[.]cc, 98aicai[.]com, 98aicode[.]com, outlook3650[.]com, youtubecard[.]com, linkedinns[.]net, 98aiblog[.]com |
Domain | Flax Typhoon / Integrity Technology Group: seized by FBI Oct 8, 2026 (MicroScan scanner and FishHub phishing infrastructure; several mimic Microsoft, LinkedIn, YouTube branding) | Oct 12, 2026 |
SoftEther VPN installers renamed to conhost[.]exe or dllhost[.]exe |
Behavioral | Flax Typhoon / Integrity Technology Group (persistence mechanism) | Oct 12, 2026 |
DiagTrack[.]exe making outbound HTTP connections |
Behavioral | Flax Typhoon / Integrity Technology Group | Oct 12, 2026 |
DC[.]exe / office-cli artifacts on endpoints |
Behavioral | Flax Typhoon / Integrity Technology Group | Oct 12, 2026 |
SITE CPFR / SITE CPTO commands in FTP logs on ProFTPD servers with mod_copy enabled |
Behavioral | Integrity Technology Group / Flax Typhoon (CVE-2015-3306) | Oct 11, 2026 |
| Internet-facing Apache Struts instances with Dynamic Method Invocation enabled |
Exposure | Integrity Technology Group / Flax Typhoon (CVE-2016-3081) | Oct 11, 2026 |
| TKEY query spikes against ISC BIND resolvers |
Behavioral | Integrity Technology Group / Flax Typhoon (CVE-2015-5477) | Oct 11, 2026 |
| Password spraying patterns against Microsoft Exchange login endpoints |
Behavioral | Integrity Technology Group / Flax Typhoon | Oct 11, 2026 |
Sources: Volexity blog "A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days" (October 13, 2026) on the UTA0576 campaign; CISA/FBI/NSA joint cybersecurity advisory AA26-281A (October 8, 2026) on Integrity Technology Group-enabled threat activity; FBI domain seizures reported October 8, 2026. The seized domains now show FBI notices: hunt them in historical mail, proxy, and DNS logs rather than blocking live traffic. Today's additions come from Cisco Security Advisory cisco-sa-esa-afw-zqYJkjxp (October 14, 2026) and the Palo Alto Networks advisory for CVE-2026-0322 (October 14, 2026). The October 16 additions cover the Microsoft-led Storm-3119 / Storm-2990 phishing takedown and the Central Ohio Primary Care vishing breach (reported October 14-15, 2026). Today's additions cover the PEERSTITCH campaign and CVE-2025-61624 (Palo Alto Networks Unit 42, October 14, 2026), the ARMORY CASTLE exploitation of the BeyondTrust zero-day (Mandiant / Google Threat Intelligence, October 16, 2026), and the Rank Math SEO PRO supply-chain compromise (October 17, 2026). The October 18 additions cover the UTA0576 campaign against Ivanti Connect Secure (Volexity research via the OP Innovate writeup, October 14, 2026). The October 19 additions cover the Canva third-party data incident and The Seven Deadly Sins group's SaaS-vendor pivot methodology (Cyber Daily, October 18-19, 2026; DataBreaches.net, September 23, 2026). The October 20 additions cover the ARMORY CASTLE file and URI artifacts for BeyondTrust Remote Support (Google Threat Intelligence Group indicators, reported October 19, 2026). The October 21 additions cover the SafePay ransomware joint advisory AA26-293A IP and hash indicators (CISA/FBI joint advisory, October 20, 2026) and the Unit 42 indicators for ransomware exploitation of PAN-OS CVE-2026-0257 (updated October 19, 2026). The October 22 additions cover the LiteLLM 1.107.0 malicious release window (BerriAI; Socket, October 21, 2026), the compromised eMudhra/emSign intermediate CAs (Cloudflare; Mozilla, reported October 17, 2026), and the attacker IPs tied to PAN-OS CVE-2026-0322 exploitation (F5 Labs, October 21, 2026). The October 23 additions cover the BRONZE SANDCASTLE campaign C2 and sideloading indicators (Sophos, October 20, 2026) and the attacker IPs in VeloCloud Orchestrator CVE-2026-114625 exploitation (Arista Security Advisory 0199, October 22, 2026). The October 24 additions cover the Collabora CODE Server exploitation artifacts (CISA KEV addition, October 23, 2026; The Hacker News, October 24, 2026). The October 25 additions cover the k0t campaign infrastructure and exploitation artifacts (Group-IB/NyxLab investigation, October 23, 2026; The Hacker News, October 23, 2026). The October 26 additions cover FortiSIEM CVE-2026-106173 exploitation indicators (Fortinet FG-IR-26-180, October 13, 2026; Horizon3, October 20, 2026; Canadian Centre for Cyber Security AV26-1037 update, October 23, 2026) and PHP2Shell confirmed remote code execution markers (BleepingComputer, October 26, 2026). The October 27 additions cover Aokigahara infostealer command and control indicators (Check Point Research, October 23, 2026; resurfaced in the October 26 threat roundup). Validate every indicator against your own environment before blocking: indicators age fast, and context is everything.
How this library works
Entries come from public government advisories, vendor threat reports, and my own analysis. Each one includes the detection angle, not just the raw indicator, because an IoC without hunt guidance is trivia. The library grows as new campaigns are documented.