Cyber Frogy

14-day Threat Intelligence Briefing

4 - 18 Oct 2026Technical editionPublished 18 Oct 2026
30Developments tracked
17Rated critical or high
46Vulnerabilities exploited in the wild
35Vulnerabilities to patch first
418Ransomware victims posted
60Ransomware groups active

Top stories

Developments rated critical or high, or that call for action soon: actively exploited, ransomware-linked, close fix deadlines, fast-rising coverage.

HighUrgency: ImmediateExploited in the wild

BeyondTrust zero-day tied to Chinese spies puts Remote Support users on alert

Exploitation itw: BeyondTrust zero-day tied to Chinese spies puts Remote Support users on alert. Names UNC5221, WARP PANDA, SAWFLY, BARECLAW, CVE-2024-47575, CVE-2025-61624. 7 articles from 6 publishers.
Full details →
CriticalUrgency: ImmediateVulnerability

CVE-2026-104935: Exploited Zero-Day in Ivanti Connect Secure

CISA and Volexity have reported active exploitation of a newly disclosed zero-day vulnerability, CVE-2026-104935, affecting Ivanti Connect Secure versions prior to 22.8R2.4. The vulnerability allows unauthenticated remote code execution, enabling attackers to steal credentials and exfiltrate data 12.
What to do
  • Patch all affected Ivanti Connect Secure devices immediately.
  • Review network logs for signs of compromise from compromised ICS appliances.
Full details →
CriticalUrgency: HighExploited in the wild

AhsayCBS Backup Flaws Exploited for Crypto Mining

Attackers are exploiting two newly disclosed vulnerabilities in AhsayCBS to deploy crypto miners, targeting managed service providers and system integrators 1.
What to do
  • Patch AhsayCBS instances immediately to address CVE-2026-105133 and CVE-2026-105134.
  • Hunt for signs of unauthorized access or crypto mining activity on managed service provider networks.
Full details →
CriticalUrgency: ImmediateExploited in the wild

PaperCut Pre-Auth RCE Chain Exploited

WatchTowr Labs reported a pre-authentication Remote Code Execution (RCE) chain exploiting multiple vulnerabilities, including CVE-2026-81578, CVE-2026-82077, and CVE-2026-82078. The initial report 1 detailed the exploitation of these vulnerabilities in-the-wild before PaperCut patched them.
What to do
  • Review PaperCut systems for CVE-2026-81578, CVE-2026-82077, and CVE-2026-82078 patches.
  • Implement additional security measures to detect and block pre-authentication RCE attempts.
Full details →
HighUrgency: ImmediateExploited in the wild

Chinese Government-linked Actors Exploit CVE-2016-3081 for Data Theft

CISA warns of ongoing exploitation by Chinese government-linked actors using CVE-2016-3081, an Apache Struts command injection vulnerability. These actors combine automated and hands-on techniques to target sensitive data in critical infrastructure sectors 13.
What to do
  • Patch Apache Struts instances to address CVE-2016-3081 immediately.
  • Conduct forensic triage on affected systems even after applying patches.
Full details →
CriticalUrgency: HighExploited in the wild

Cisco Secure Email Gateway CVE-2026-76519 Exploited

A critical vulnerability (CVE-2026-76519) in Cisco Secure Email Gateway's Advanced Malware Protection feature, allowing unauthenticated attackers to write arbitrary files and execute commands with root privileges, has been exploited. Cisco confirmed the issue and released patches 234.
What to do
  • Patch Cisco Secure Email Gateway appliances immediately.
  • Review and update Advanced Malware Protection settings.
Full details →
CriticalUrgency: HighData breach

NetScaler C2 Exploitation with CVE-2026-88771

A new autonomous C2 framework, NetScaler C2, is exploiting CVE-2026-88771 to target Citrix NetScaler ADC and Gateway devices. This vulnerability has been actively used in the wild 2. A breach at Arizona's state court system and a data leak at Times Car sharing service highlight the potential impact of such attacks 13.
What to do
  • Patch all exposed Citrix NetScaler ADC and Gateway appliances with the latest security updates.
  • Monitor network traffic for signs of NetScaler C2 activity.
Full details →
HighUrgency: ImmediateVulnerability

CVE-2026-88771 and -88772: Pre-Disclosure Exploitation of Critical Citrix NetScaler Vulnerabilities

Citrix disclosed eight critical vulnerabilities in its NetScaler ADC and Gateway products, including CVE-2026-88771 and -88772, which were exploited before the release of emergency security updates. The affected versions include NetScaler ADC / Gateway 14.1 and 13.1, with patches available for each 1. Attackers deployed web shells and tunneling malware post-exploitation 25.
What to do
  • Patch all affected NetScaler ADC and Gateway versions to the latest build [A1]
  • Hunt for signs of exploitation using techniques T1047 and T1505.003 [A6]
Full details →
HighUrgency: HighExploited in the wild

CVE-2026-96951: Actively Exploited Windows Shell Zero-Day

Microsoft's October Patch Tuesday addresses a high-severity zero-day vulnerability (CVE-2026-96951) in the Windows Shell, which is already being exploited. The vulnerability allows unauthenticated attackers to bypass Mark of the Web protections by convincing victims to interact with specially crafted files 4 5.
What to do
  • Patch all affected Windows systems immediately.
  • Review and update security policies to mitigate the risk of Mark of the Web bypasses.
Full details →
HighUrgency: HighVulnerability

CVE-2026-21589: Atlassian Arbitrary File Access Vulnerability

Initial report. On October 5th, Atlassian disclosed CVE-2026-21589, a critical unauthenticated arbitrary file-access vulnerability affecting eight self-hosted products 1. Exploitation began shortly after the public proof-of-concept code release on October 7th 3, with threat actors actively targeting affected systems. CISA added CVE-2026-21589 to its Known Exploited Vulnerabilities (KEV) Catalog, highlighting its risk 5.
What to do
  • Patch affected Atlassian products immediately.
  • Review and tighten file access controls.
Full details →
HighUrgency: ModerateExploited in the wild

CVE-2026-104286: FortiMail Path Traversal Vulnerability Exploited

The path traversal vulnerability CVE-2026-104286 in FortiMail, combined with improper handling of NULL characters, is actively exploited by APT41 to write arbitrary files. Initial report.1 The flaw allows unauthenticated attackers to bypass security checks and gain access to the underlying system via crafted HTTP or HTTPS requests.2
What to do
  • Patch all affected FortiMail appliances with the latest updates
  • Review network configurations for exposed FortiMail instances
Full details →
HighUrgency: ImmediateDetection & DFIR

GuardDuty Extended Threat Detection Adds New Indicators

Amazon GuardDuty Extended Threat Detection now includes five new indicators: MALICIOUS_PACKAGE, MISCONFIGURATION, REACHABILITY, SENSITIVE_DATA, and VULNERABILITY 1. These additions help correlate weak signals into critical attack sequences 2.
What to do
  • Review Amazon GuardDuty Extended Threat Detection configurations to ensure all new indicators are enabled.
Full details →
HighUrgency: HighThreat actor

UAT-6275 Targets CIS Government Organizations

Cisco Talos and Recorded Future identified UAT-6275, a Kazakhstan-nexus threat actor, targeting government organizations in the Commonwealth of Independent States (CIS) since June 2025. The group uses various techniques including macro-enabled documents and PS2EXE downloaders 1.
What to do
  • Patch systems against known vulnerabilities such as CVE-2025-8088
  • Hunt for custom reverse shells like PickleShell, Chvost, and Laplas
Full details →
HighUrgency: ModerateExploited in the wild

Longlegs Group Still Exploiting Warlock Ransomware via Year-Old SharePoint Flaws

The Longlegs group (also known as Storm-2603) continues to use the Warlock ransomware, exploiting year-old SharePoint zero-days collectively called ToolShell. In the past two months, they have targeted four organizations in Europe, Africa, and Latin America 1.
What to do
  • Patch any remaining SharePoint zero-days related to ToolShell
  • Hunt for signs of Warlock ransomware activity
Full details →
HighUrgency: ModerateExploited in the wild

CVE-2026-88779: Citrix NetScaler Zero-Day Exploited Against SAML Deployments

A newly disclosed vulnerability (CVE-2026-88779) has been exploited in targeted attacks against customer-managed NetScaler ADC and Gateway appliances configured for SAML authentication. The memory overflow issue can cause Denial of Service conditions 1. Citrix rates the vulnerability as high severity with a CVSS v4.0 score of 8.7, and CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on October 4, 2026, with an October 7 remediation deadline for covered federal agencies 2.
What to do
  • Patch all affected Citrix NetScaler ADC and Gateway appliances
  • Review SAML authentication configurations for potential vulnerabilities
Full details →
HighUrgency: ModerateExploited in the wild

MyReport Updater Vulnerabilities (CVE-2026-110632, CVE-2026-110633)

Two critical vulnerabilities were disclosed in MyReport Updater 2.1.1: a privilege escalation vulnerability and a remote code execution flaw 1. These issues can be exploited to gain SYSTEM privileges on the target system through its update configuration and gRPC service.
What to do
  • Patch MyReport Updater to the latest version immediately.
  • Review and update any third-party applications on your network.
Full details →
HighUrgency: ModerateExploited in the wild

CVE-2025-64393: Critical Veeam Backup & Replication RCE Vulnerability

Veeam has disclosed CVE-2025-64393, a critical remote code execution vulnerability in their Backup & Replication software. The flaw allows low-privileged users with the Backup Viewer role to execute arbitrary code on the Veeam Backup Server 1.
What to do
  • Patch Veeam Backup & Replication to address CVE-2025-64393.
  • Review and update access controls for the Backup Viewer role.
Full details →
MediumUrgency: HighExploited in the wild

CVE-2026-110447 Exploited in Collabora Online Flaw

Hackers are exploiting a critical vulnerability (CVE-2026-110447) in the Collabora Online Built-in CODE Server app for Nextcloud, allowing remote attackers to run OS commands and place web shells on servers. This flaw affects versions before 26.4.303 1.
What to do
  • Patch Collabora Online Built-in CODE Server app to version 26.4.303 or later.
  • Hunt for web shells and unauthorized commands on affected Nextcloud servers.
Full details →

This week's actions

One checklist drawn from the top stories.

  • Patch all affected Ivanti Connect Secure devices immediately. · CVE-2026-104935: Exploited Zero-Day in Ivanti Connect Secure
  • Review network logs for signs of compromise from compromised ICS appliances. · CVE-2026-104935: Exploited Zero-Day in Ivanti Connect Secure
  • Patch AhsayCBS instances immediately to address CVE-2026-105133 and CVE-2026-105134. · AhsayCBS Backup Flaws Exploited for Crypto Mining
  • Hunt for signs of unauthorized access or crypto mining activity on managed service provider networks. · AhsayCBS Backup Flaws Exploited for Crypto Mining
  • Review PaperCut systems for CVE-2026-81578, CVE-2026-82077, and CVE-2026-82078 patches. · PaperCut Pre-Auth RCE Chain Exploited
  • Implement additional security measures to detect and block pre-authentication RCE attempts. · PaperCut Pre-Auth RCE Chain Exploited
  • Patch Apache Struts instances to address CVE-2016-3081 immediately. · Chinese Government-linked Actors Exploit CVE-2016-3081 for Data Theft
  • Conduct forensic triage on affected systems even after applying patches. · Chinese Government-linked Actors Exploit CVE-2016-3081 for Data Theft
  • Patch Cisco Secure Email Gateway appliances immediately. · Cisco Secure Email Gateway CVE-2026-76519 Exploited
  • Review and update Advanced Malware Protection settings. · Cisco Secure Email Gateway CVE-2026-76519 Exploited
  • Patch all exposed Citrix NetScaler ADC and Gateway appliances with the latest security updates. · NetScaler C2 Exploitation with CVE-2026-88771
  • Monitor network traffic for signs of NetScaler C2 activity. · NetScaler C2 Exploitation with CVE-2026-88771

Patch first

Vulnerabilities with evidence of exploitation, ordered by how urgently they need fixing. "Fix due" is the CISA remediation deadline where one exists.

CVERatingProductExploitedFix dueEPSSCVSSWhy now
CVE-2024-47575EmergencyFortinet FortiManagerYes2024-11-130.959.8The vulnerability has been exploited in the wild (ITW) as reported by Security Affairs on 2026-10-16, and is now included in the CISA KEV list since 2024-10-23. The EPSS score of 0.948 indicates a high likelihood of exploitation.
CVE-2016-3081EmergencyApache StrutsYes2026-10-110.968.1CISA has added CVE-2016-3081 to its Known Exploited Vulnerabilities (KEV) list on 2026-10-08, indicating active exploitation. Additionally, the vulnerability is weaponized in Metasploit and nuclei, suggesting it is being actively used by attackers.
CVE-2023-46604EmergencyApache ActiveMQYes (ransomware)2023-11-231.0010.0This vulnerability has been exploited in ransomware campaigns as reported by CISA, and it is included in the CISA KEV list. The high score of 98 indicates a critical risk level.
CVE-2025-7775EmergencyCitrix NetScalerYes2025-08-280.209.2The vulnerability has been actively exploited as evidenced by FortiGuard Labs observing active network telemetry related to CVE-2025-7775. Additionally, the CISA KEV listing and a public proof-of-concept on GitHub indicate that this is an urgent issue.
CVE-2026-104935EmergencyIvanti Connect SecureYes2026-10-160.268.6CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog on 2026-10-13, and there are reports of active exploitation via nuclei. The EPSS score is high at 0.260 (98% probability), indicating a significant risk.
CVE-2026-82078EmergencyPaperCut NG/MFYes2026-09-140.649.4The addition of this vulnerability to the CISA KEV list on 2026-08-31 and the existence of a post-authentication remote code execution exploit (metasploit) make it imperative for immediate attention.
CVE-2026-71362EmergencyAdobe Commerce and MagentoYes2026-09-270.889.1This vulnerability has been added to the CISA Known Exploited Vulnerabilities (KEV) list on September 24, 2026, and has an EPSS score of 0.875, indicating a high likelihood of exploitation in the wild.
CVE-2026-76504EmergencyCisco Catalyst SD-WAN ManagerYes2026-10-030.029.8This vulnerability has been added to the CISA KEV list on 2026-09-30 and there is a public proof-of-concept available on GitHub, indicating active exploitation.
CVE-2026-73570EmergencySynacor Zimbra Collaboration Suite (ZCS)Yes2026-08-240.728.9The vulnerability has been added to the CISA KEV list on 2026-08-21 and is currently being weaponized by threat actors as evidenced by a report from Microsoft Threat Intelligence on 2026-09-30.
CVE-2026-87902EmergencyWordPress CoreYes2026-09-280.408.1The vulnerability has been added to the CISA Known Exploited Vulnerabilities (KEV) list on September 25, 2026, and has an EPSS score of 0.455, indicating a high likelihood of exploitation.
CVE-2026-20079EmergencyCisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall ManagementYes2026-09-120.8810.0This vulnerability has been added to the CISA KEV list on 2026-09-09, indicating its critical nature and active exploitation. The EPSS score of 0.882 further underscores the high risk associated with this vulnerability.
CVE-2026-85102EmergencyCheck Point Multiple ProductsYes2026-09-250.509.8The vulnerability has been added to the CISA KEV list on 2026-09-22, and has an EPSS score of 0.504 indicating a high likelihood of exploitation.
CVE-2026-93616EmergencyCheck Point Multiple ProductsYes2026-09-250.769.8This vulnerability has been added to the CISA KEV list on 2026-09-22, and has an EPSS score of 0.759 indicating a high likelihood of exploitation in the wild.
CVE-2015-3306EmergencyProFTPD ProFTPDYes2026-10-110.9910.0The inclusion of CVE-2015-3306 in the CISA KEV list on 2026-10-08 and its EPSS score of 0.995 (indicating a high likelihood of exploitation) make this vulnerability worth immediate attention.
CVE-2026-85706EmergencyGitLab Community Edition and Enterprise EditionYes2026-09-140.9310.0The vulnerability has been added to the CISA Known Exploited Vulnerabilities (KEV) list on September 11, 2026, and has an EPSS score of 0.930, indicating a high likelihood of exploitation in the wild.
CVE-2026-102764StandardBeyondTrust Remote SupportYes2026-10-190.019.3CISA KEV added 2026-10-16; https://github.com/Worthes/CVE-2026-102764-Proof-of-concept; CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVE-2015-5477StandardISC BINDYes2026-10-110.997.5CISA KEV added 2026-10-08; metasploit; EPSS 0.994 (pct 1.00)
CVE-2026-88771StandardCitrix NetScalerYes2026-09-300.019.5CISA KEV added 2026-09-27; https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771; CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVE-2026-105134StandardAhsay AhsayCBSYes2026-10-170.059.3CISA KEV added 2026-10-14; https://github.com/RayanAlmulhim/CVE-2026-105134-lab; CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVE-2026-94127StandardF5 BIG-IP APMYes2026-09-250.029.3CISA KEV added 2026-09-22; https://github.com/FurkanKAYAPINAR/CVE-2026-94127; CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVE-2026-104286StandardFortinet FortiMailYes2026-10-040.029.8CISA KEV added 2026-10-01; https://github.com/ShadowForge-Cyber/CVE-2026-104286-POC; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2025-8088StandardRARLAB WinRARYes (ransomware)2025-09-020.958.4CISA KEV, ransomware use Known (2025-08-12); https://github.com/aldisakti2/CVE-2025-8088-BUILDER-Winrar-Tool; EPSS 0.945 (pct 1.00)
CVE-2026-88779StandardCitrix NetScalerYes2026-10-070.018.7CISA KEV added 2026-10-04; CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X; CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVE-2026-76519StandardCisco Secure Email GatewayYes2026-10-170.029.8CISA KEV added 2026-10-14; https://github.com/Mickysalivan/CVE-2026-76519-Proof-of-concept; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-88772StandardCitrix NetScalerYes2026-09-300.019.5CISA KEV added 2026-09-27; https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88772; CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVE-2026-105133StandardAhsay AhsayCBSYes2026-10-170.015.5CISA KEV added 2026-10-14; https://github.com/horizon3ai/AhsayCBS-Auth-Bypass-RCE; CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVE-2026-19490EmergencyCitrix NetScalerYes2026-09-120.239.3This vulnerability has been added to the CISA Known Exploited Vulnerabilities (KEV) list on September 9, 2026, and has a high EPSS score of 0.232, indicating widespread use by threat actors.
CVE-2026-76461EmergencyCisco Secure Email GatewayYes2026-09-170.309.8This vulnerability has been added to the CISA KEV list on 2026-09-14, and an exploit is available on GitHub. The EPSS score of 0.283 indicates a high likelihood of exploitation.
CVE-2026-81578StandardPaperCut NG/MFYes2026-09-140.868.8CISA KEV added 2026-08-31; nuclei, metasploit; EPSS 0.856 (pct 1.00)
CVE-2026-86060StandardMikroTik RouterOSYes2026-09-130.069.2CISA KEV added 2026-09-10; https://www.exploit-db.com/exploits/52683; CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVE-2025-39682StandardLinux KernelYes2026-09-210.039.8CISA KEV added 2026-09-18; https://github.com/khoatran107/cve-2025-39682; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-86218StandardN-able N-centralYes2026-09-110.1310.0CISA KEV added 2026-09-08; nuclei; CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVE-2026-67279StandardMikroTik RouterOSYes2026-09-280.016.9CISA KEV added 2026-09-25; https://github.com/HackSpeak/CVE-2026-67279; CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVE-2026-102489StandardZammad GmbH ZammadYes2026-10-050.019.4CISA KEV added 2026-10-02; https://github.com/horizon3ai/CVE-2026-102489; CVSS 9.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:X
CVE-2026-65660StandardMicrosoft SharePointYes2026-09-280.028.8CISA KEV added 2026-09-25; https://github.com/HORKimhab/CVE-2026-65660; inferred from the product type ('SharePoint'), not from scanning your assets
CVE-2026-75650WatchlistAdobe Commerce and MagentoYes2026-09-110.0410.0CISA KEV added 2026-09-08; https://github.com/jithinkrishnanrs/stylesmuggler-ioc-toolkit; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVE-2026-42018WatchlistJFrog ArtifactoryYes2026-09-250.107.5CISA KEV added 2026-09-11; nuclei; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE-2026-76460WatchlistCisco Identity Services EngineYes2026-09-190.1410.0CISA KEV added 2026-09-16; https://github.com/S3v3n-JG/CVE-2026-76460; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVE-2026-85046WatchlistGoogle Chromium V8Yes2026-09-180.498.8CISA KEV added 2026-09-04; https://github.com/HORKimhab/CVE-2026-85046; EPSS 0.489 (pct 0.99)
CVE-2025-25249WatchlistFortinet Multiple ProductsYes2026-09-120.048.1CISA KEV added 2026-09-09; CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H; CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Hunting hypotheses (37)

What to go hunt for, drawn from this period's developments, best first.

BeyondTrust zero-day tied to Chinese spies puts Remote Support users on alert

Exploited in the wild High · 12 existing public rules
Web server hosting SAWFLY webshell
Detection of POST requests to /mangoapi.php with the _c94mfe parameter, indicating execution of a web shell.
Logs: web server access logs
More detail
Prerequisites: Enable logging for all HTTP requests and responses.
Logic: Monitor for POST requests to /mangoapi.php with the obfuscated parameter _c94mfe.
  • Catches initial foothold establishment by UNC5820 or ARMORY CASTLE
  • Identifies active web shell usage
False positives: Legitimate application of _c94mfe for non-malicious purposes, such as testing or configuration.
When it fires: Verify the legitimacy of the request by checking the source IP and user agent. Confirm if the parameter is used in a known legitimate context.
Web server spawning sh after PeopleSoft exploitation
Detection of /usr/bin/dbus-authd being spawned by web server processes, indicating persistence via SUID bit.
Logs: web server access logsprocess creation events
More detail
Prerequisites: Enable process creation logging and ensure web server logs are retained for a sufficient period.
Logic: Monitor for /usr/bin/dbus-authd spawned by web server processes with SUID bit set.
  • Identifies persistence mechanism post-exploitation
  • Detects initial compromise via PeopleSoft vulnerability
False positives: Legitimate use of dbus-authd in a non-malicious context, such as system maintenance or testing.
When it fires: Check the parent process and confirm if /usr/bin/dbus-authd is being used for legitimate purposes. Verify the SUID bit status.

CVE-2026-104935: Exploited Zero-Day in Ivanti Connect Secure

Vulnerability Critical
Ivanti Connect Secure spawning reverse shell
Detection of a process spawned by Ivanti Connect Secure that connects back to an external IP address, indicating exploitation.
Logs: FirewallWeb server access logs
More detail
Prerequisites: Retain network logs for at least 30 days and ensure Ivanti Connect Secure versions are up-to-date or known to be affected.
Logic: Monitor for processes spawned by Ivanti Connect Secure that connect back to external IPs within 5 minutes of the initial connection attempt.
  • Catches the first hours after exploitation before the reverse shell is obfuscated
False positives: Legitimate remote connections from known business partners or third-party services.
When it fires: Verify the version of Ivanti Connect Secure and check if it's affected. Confirm the external IP address and its legitimacy.

AhsayCBS Backup Flaws Exploited for Crypto Mining

Exploited in the wild Critical
Web servers communicating with known C2 IPs
Web servers communicating with the identified C2 IP addresses (66.42.72.14, 208.83.239.114, 149.248.47.234) within a short time frame after AhsayCBS installation.
Logs: web server access logs
More detail
Prerequisites: Ensure web server access logs are retained for at least 30 days and include detailed IP information.
Logic: Monitor for HTTP/HTTPS requests from internal web servers to the C2 IPs within 72 hours of AhsayCBS installation.
  • Detects initial compromise and lateral movement
False positives: Legitimate external monitoring or testing traffic, which can be distinguished by context and timing.
When it fires: Verify if the web server is part of the internal network and confirm AhsayCBS installation time.

PaperCut Pre-Auth RCE Chain Exploited

Exploited in the wild Critical · 2 existing public rules
Web servers executing shell commands after PaperCut exploitation
Detection of web server processes spawning command-line shells or other reverse shells post-exploitation.
Logs: web server access logsEDR process events
More detail
Prerequisites: Command-line logging enabled on web servers and EDR integration with the SOC.
Logic: Monitor for IIS or Apache processes spawning cmd.exe or powershell.exe after PaperCut version affected by CVEs.
  • Catches initial post-exploitation activity where attackers establish a foothold.
  • Identifies lateral movement attempts via web servers.
False positives: Web server maintenance scripts that spawn command-line tools for legitimate purposes, check script paths and timing against known good baseline.
When it fires: Verify the version of PaperCut on affected servers. Check if the parent process is related to exploitation activity.

Chinese Government-linked Actors Exploit CVE-2016-3081 for Data Theft

Exploited in the wild High · 12 existing public rules
Web servers executing shell scripts after Apache Struts exploitation
Apache Struts web servers spawning processes like sh or python to execute commands.
Logs: web server access logsEDR process events
More detail
Prerequisites: Command-line logging enabled on web servers.
Logic: Web servers with Apache Struts version vulnerable to CVE-2016-3081 spawning sh or python processes.
  • Catches the first hours after exploitation before the web shell is renamed.
False positives: Legitimate use of sh and python for administrative tasks, check process parent and command line arguments.
When it fires: Confirm Apache Struts version and exposure. Check if the process was spawned by a legitimate application or service.
Registry run keys for persistence via VPN software
Processes creating registry entries in Run Keys or Startup folder related to known threat actors' tools.
Logs: registry eventsEDR process events
More detail
Prerequisites: Full registry access and EDR logging enabled.
Logic: Registry keys created under Run or Startup folders by processes with suspicious names like live700_v1.exe, EBurst.
  • Identifies persistence mechanisms used by threat actors.
False positives: Legitimate software updates and administrative tasks creating registry entries.
When it fires: Verify the authenticity of the process that created the registry key. Check for known good versions of the software.

Cisco Secure Email Gateway CVE-2026-76519 Exploited

Exploited in the wild Critical
Email gateway writing files after CVE-2026-76519 exploitation
The email gateway writes new files or modifies existing ones, indicating potential exploitation of the vulnerability.
Logs: Cisco Secure Email Gateway logs
More detail
Prerequisites: Enable detailed file system monitoring and logging on the email gateway.
Logic: Monitor for unusual file creation or modification events post-exploitation time window.
  • Detects initial compromise by identifying unauthorized changes to files.
False positives: Legitimate updates or maintenance activities may trigger this alert. Check the context and timing of the event.
When it fires: Verify if the file operations are part of a known update or patch process. Confirm the version of the email gateway software.

NetScaler C2 Exploitation with CVE-2026-88771

Data breach Critical · 12 existing public rules
NetScaler C2 Exploitation via admautoregd
Detection of the admautoregd process executing a malicious command with root privileges, likely part of the NetScaler C2 exploitation.
Logs: EDR process eventscommand-line logging
More detail
Prerequisites: Enable command-line logging and ensure EDR is collecting detailed process information.
Logic: Monitor for admautoregd executing a command with root privileges, containing the string 'curl -sk 45.143.130[.]195:8899/s/' followed by a bid identifier.
  • Catches initial compromise and lateral movement attempts via NetScaler C2 exploitation.
False positives: Legitimate administrative tasks using admautoregd, which may include similar command patterns for network diagnostics or configuration changes.
When it fires: Verify the version of admautoregd and confirm if it is part of a known vulnerable NetScaler device. Check the parent process to ensure no legitimate context exists.
DNS OOB Command Injection
Detection of DNS queries or responses containing out-of-band (OOB) commands, indicative of NetScaler C2 exploitation.
Logs: DNS logs
More detail
Prerequisites: Ensure DNS logs are being collected and retained for a sufficient period.
Logic: Monitor for DNS queries or responses that contain the string 'admautoregd' or similar patterns associated with NetScaler C2 exploitation.
  • Identifies initial compromise attempts through DNS-based command injection.
False positives: Legitimate internal network diagnostics or testing using OOB commands in DNS queries.
When it fires: Check the source and destination IP addresses, as well as the domain names involved. Confirm if these are part of a known vulnerable NetScaler device.

CVE-2026-88771 and -88772: Pre-Disclosure Exploitation of Critical Citrix NetScaler Vulnerabilities

Vulnerability High · 12 existing public rules
NetScaler web shell creation
Detection of modified httpd.conf files with unexpected PHP handler configurations, indicating post-exploitation activity.
Logs: web server access logsfile integrity monitoring
More detail
Prerequisites: Retain file system and configuration changes for at least 30 days.
Logic: Monitor for changes to /etc/httpd.conf with unexpected AddHandler or php_flag directives.
  • Catches the initial post-exploitation activity where web shells are deployed.
False positives: Configuration changes made by legitimate system administrators, check timestamps and commit messages.
When it fires: Verify if the change is recent and associated with known NetScaler versions. Check for related process activity.
Process injection into NSPPE service
Detection of unexpected processes or command execution within the NSPPE service, indicative of post-exploitation activity.
Logs: process monitoringevent logs
More detail
Prerequisites: Enable process creation and network event logging for critical services like NSPPE.
Logic: Look for NSPPE-<##> processes with unusual parent processes or command execution.
  • Identifies the initial post-exploitation activity where malware is injected into a legitimate service.
False positives: Legitimate updates or maintenance activities, check process names and paths.
When it fires: Check the parent process of NSPPE-<##> for known good processes. Confirm if the command execution is expected.
Web server spawning shells
Detection of shell spawning commands executed by web servers, indicating post-exploitation activity.
Logs: web server access logsprocess monitoring
More detail
Prerequisites: Enable command-line logging for web servers and retain logs for at least 30 days.
Logic: Monitor for shell spawning commands like 'chmod u+s /bin/sh' or similar in web server logs.
  • Catches the first hours after exploitation before the web shell is renamed.
False positives: Legitimate administrative actions, check timestamps and context.
When it fires: Verify if the command execution is recent. Check for related process activity and network connections.

CVE-2026-96951: Actively Exploited Windows Shell Zero-Day

Exploited in the wild High · 12 existing public rules
Web servers hosting malicious files
Web servers serving files from domains like 'affecting.NET' or 'malicious.NET'. This indicates exploitation attempts targeting the Windows Shell vulnerability.
Logs: web server access logs
More detail
Prerequisites: Enable logging of all web server requests and responses, including file paths and domain names.
Logic: Monitor for HTTP/HTTPS requests to 'affecting.NET' or 'malicious.NET'.
  • Catches the initial phase where attackers attempt to deliver malicious content via web servers.
False positives: Legitimate use of these domains by internal testing or third-party services.
When it fires: Verify if the files served are legitimate and check for any recent changes in the server configuration.
Process injection via .NET assembly
Processes injecting malicious .NET assemblies, often seen as process injection or code execution after exploitation of the Windows Shell vulnerability.
Logs: EDR process events
More detail
Prerequisites: Enable EDR to capture detailed process creation and injection events, including parent-child relationships and file paths.
Logic: Look for processes injecting .NET assemblies from suspicious domains like 'Snort.org'.
  • Identifies the moment when attackers leverage the vulnerability to inject malicious code into legitimate processes.
False positives: Legitimate use of .NET assemblies in development environments or software updates.
When it fires: Check the parent process and the account used for any signs of compromise. Confirm if the assembly is known good or bad.

CVE-2026-21589: Atlassian Arbitrary File Access Vulnerability

Vulnerability High
Web servers accessing Atlassian product directories after CVE-2026-21589 disclosure
Unusual access patterns to Atlassian product directories on web servers, especially from external IPs.
Logs: web server access logs
More detail
Prerequisites: Enable logging of all incoming requests and directory access attempts.
Logic: Monitor for HTTP GET/POST requests targeting known Atlassian product directories within 48 hours after October 7th, from external IPs.
  • Identify initial exploitation attempts before attackers obfuscate their actions.
False positives: Legitimate users accessing documentation or support resources. Check for user-agent strings and request content to distinguish legitimate access.
When it fires: Verify the version of Atlassian products in use, check if they are affected by CVE-2026-21589, and review parent processes for suspicious activity.

CVE-2026-104286: FortiMail Path Traversal Vulnerability Exploited

Exploited in the wild High · 12 existing public rules
FortiMail receiving malicious HTTP requests
Detection of FortiMail receiving HTTP or HTTPS requests with crafted paths, potentially leading to arbitrary file writes.
Logs: web server access logs
More detail
Prerequisites: Enable logging for all incoming web traffic on the FortiMail server.
Logic: Monitor for requests containing null characters or unusual paths directed at the FortiMail service.
  • Identify initial exploitation attempts before any file writes occur.
False positives: Legitimate testing of security controls, misconfigured services, and benign network traffic.
When it fires: Check the source IP address and user agent for known malicious activity. Confirm FortiMail version to ensure it is vulnerable.
Unusual file writes on FortiMail server
Detection of unexpected file creation or modification events, especially by processes related to the FortiMail service.
Logs: file integrity monitoringprocess monitoring
More detail
Prerequisites: Enable detailed logging and file integrity monitoring for critical directories used by FortiMail.
Logic: Look for new files created or modified with suspicious names, especially those matching the provided SHA256 hashes.
  • Identify potential post-exploitation activities after initial compromise.
False positives: Scheduled backups, legitimate software updates, and routine maintenance tasks.
When it fires: Verify the process that created or modified the file. Check for any known vulnerabilities in FortiMail versions used on the system.

GuardDuty Extended Threat Detection Adds New Indicators

Detection & DFIR High · 12 existing public rules
EC2 instances with internet-reachable IMDSv1
Detect EC2 instances exposing IMDSv1 over the internet, indicating a potential misconfiguration.
Logs: CloudTrailEC2 metadata service logs
More detail
Prerequisites: Enable detailed CloudTrail logging and ensure EC2 instance metadata service (IMDS) access is logged.
Logic: Check for EC2 instances with IMDSv1 enabled and internet reachability within the last 30 days.
  • Identify misconfigurations that could be exploited by attackers
False positives: Instances launched in public subnets or during initial setup before security hardening.
When it fires: Verify if instances are part of a legitimate public API and confirm the need for IMDSv1 exposure.
Malicious package detected in EC2 and EKS
Detect the presence of a malicious package (MAL-2022-4933) in both Amazon EC2 and Amazon EKS environments.
Logs: Amazon InspectorEC2 instance metadata service logs
More detail
Prerequisites: Enable Amazon Inspector for security assessments on EC2 and EKS instances.
Logic: Look for the presence of the malicious package indicator MAL-2022-4933 in both EC2 and EKS environments within the last 7 days.
  • Identify potential supply chain compromise
False positives: False positives from benign software updates or mislabeled packages.
When it fires: Review the package details, version, and context of its presence on both EC2 and EKS instances.

UAT-6275 Targets CIS Government Organizations

Threat actor High · 12 existing public rules
GitHub-hosted PowerShell scripts executed for C2
Detection of PowerShell processes executing GitHub URLs to retrieve and execute remote scripts.
Logs: EDR process eventsweb server access logs
More detail
Prerequisites: Enable command-line logging and script block logging on affected systems.
Logic: Monitor for PowerShell processes with network activity to GitHub domains, specifically downloading and executing scripts.
  • Catches the initial compromise where attackers use GitHub-hosted scripts for remote access.
False positives: Legitimate script execution from trusted repositories or internal development activities.
When it fires: Verify the source of the PowerShell process, confirm if it is part of a known legitimate operation, and check the network activity details.
Scheduled tasks created by threat actor
Detection of scheduled task creation with unusual names or paths indicative of persistence mechanisms.
Logs: EDR process eventsWindows Event Logs
More detail
Prerequisites: Enable script block logging and ensure Windows Event Log retention is sufficient.
Logic: Look for new scheduled tasks created by processes with known malicious indicators, such as unusual names or paths.
  • Identifies the initial foothold where attackers establish persistence on the network.
False positives: Legitimate administrative actions to create scheduled tasks for maintenance or updates.
When it fires: Check the parent process of the task creation, confirm if it is part of a known legitimate operation, and review the task details.

Longlegs Group Still Exploiting Warlock Ransomware via Year-Old SharePoint Flaws

Exploited in the wild High
Web servers hosting malicious payload
Detection of a web server serving files from wasabisys.com, indicative of Warlock ransomware deployment.
Logs: web server access logs
More detail
Prerequisites: Retain logs for at least 90 days and ensure URL filtering is enabled.
Logic: Monitor HTTP requests to web servers for URLs containing wasabisys.com within the last month.
  • Identifies initial compromise when Warlock ransomware is deployed via a malicious payload hosted on a web server.
False positives: Legitimate business use of wasabisys.com or other third-party content delivery networks (CDNs).
When it fires: Verify the legitimacy of the domain and check for recent changes in web server configurations.

CVE-2026-88779: Citrix NetScaler Zero-Day Exploited Against SAML Deployments

Exploited in the wild High
NetScaler processes spawning unusual child processes
Detection of NetScaler processes spawning new processes with suspicious command-line arguments or network connections.
Logs: EDR process eventsfirewall
More detail
Prerequisites: Command-line logging enabled for NetScaler processes.
Logic: Monitor for NetScaler processes (nscli.exe, nshttpd.exe) spawning new processes with unusual command-line arguments or network connections outside of normal operations.
  • Catches the first hours after exploitation before the attacker attempts to hide their presence.
False positives: Legitimate process restarts and maintenance activities may trigger this alert. Check for known good command-line arguments and network destinations.
When it fires: Verify if the parent NetScaler process is legitimate, check the version of the NetScaler appliance, and review the command-line arguments and network connections.

MyReport Updater Vulnerabilities (CVE-2026-110632, CVE-2026-110633)

Exploited in the wild High
Web servers executing remote code after MyReport Updater exploit
Detection of a process spawning a shell or command execution on web servers after an update request to the malicious domain.
Logs: web server access logsEDR process events
More detail
Prerequisites: Command-line logging enabled for web servers and EDR processes.
Logic: Web server requests to updater.myreport.fr followed by shell spawning or command execution within 5 minutes.
  • Catches the first hours after exploitation before the web shell is renamed.
False positives: Scheduled maintenance scripts that execute commands on web servers.
When it fires: Verify if the update request was legitimate and check for known good versions of MyReport Updater.

CVE-2025-64393: Critical Veeam Backup & Replication RCE Vulnerability

Exploited in the wild High
Veeam Backup Server spawning shell after exploitation
Detection of a process spawning a shell or command prompt after a Veeam Backup & Replication server is exploited.
Logs: EDR process eventsweb server access logs
More detail
Prerequisites: Command-line logging enabled on the Veeam Backup Server.
Logic: Look for processes spawned by known Veeam services that execute shell commands or start command prompt after a short time window following exploitation.
  • Catches the first hours after exploitation before the web shell is renamed.
  • Identifies post-exploitation activity on the server.
False positives: Legitimate administrative tasks using shells or command prompts, especially during maintenance windows. Check for known good processes and times of day.
When it fires: Confirm version of Veeam Backup & Replication, check if it is vulnerable to CVE-2025-64393. Verify the parent process and account used.

CVE-2026-97229: Critical GitLab RCE Flaw

Exploited in the wild Medium
Web servers spawning shells after GitLab exploitation
Detection of shell spawning processes on web servers following a GitLab exploit attempt.
Logs: web server access logsEDR process events
More detail
Prerequisites: Command-line logging enabled for web servers and EDR integration with the web server environment.
Logic: Processes spawned by web server processes, checking for shell execution within 5 minutes of a GitLab-related request.
  • Catches the first hours after exploitation before the web shell is renamed.
False positives: Web servers running automated scripts or updates. Check for known good times and versions.
When it fires: Confirm version of GitLab, check parent process for legitimate activity, verify account credentials.

CVE-2026-110447 Exploited in Collabora Online Flaw

Exploited in the wild Medium
Web servers spawning shells after Collabora Online exploitation
Detection of shell creation on web servers following Collabora Online app exploitation.
Logs: web server access logsEDR process events
More detail
Prerequisites: Command-line logging enabled for web servers and EDR processes.
Logic: Processes spawned by Collabora Online with unusual command-line arguments indicative of shell creation within 15 minutes of the app's last update.
  • Catches the first hours after exploitation before the web shell is renamed.
  • Identifies malicious activity post-exploitation.
False positives: Legitimate server maintenance and updates may trigger similar behavior. Check for known good command-line arguments and recent app version history.
When it fires: Verify the Collabora Online version on the affected server. Confirm if any recent updates or patches were applied.

Cisco NX-OS Flaws Disclosed

Exploited in the wild Medium
NX-OS switch spawning shell after exploitation
NX-OS switches spawning a new process with elevated privileges post-exploitation.
Logs: EDR process eventsfirewall
More detail
Prerequisites: Command-line logging enabled on NX-OS switches.
Logic: Monitor for processes spawned by known NX-OS switch processes with elevated privileges within 5 minutes of the initial exploit attempt.
  • Catches the first hours after exploitation before the shell is renamed or obfuscated.
False positives: Legitimate administrative actions, such as scheduled maintenance scripts running with elevated privileges.
When it fires: Verify the version of NX-OS and check if the switch was exposed to the internet. Confirm the parent process and account details.

CVE-2026-59346: Critical VMware Workstation and Fusion Flaw Enables Guest-to-Host Code Execution

Exploited in the wild Medium
VMware Workstation/Fusion processes spawning unknown executables
VMware Workstation or Fusion processes spawning new executables that are not known to the system, indicating potential exploitation.
Logs: EDR process events
More detail
Prerequisites: Command-line logging enabled for VMware Workstation and Fusion processes.
Logic: Monitor VMware Workstation/Fusion processes for any unknown executables spawned within 5 minutes of their start time.
  • Catches the first hours after exploitation before the malicious executable is obfuscated or renamed.
False positives: Legitimate software updates or installations by VMware products.
When it fires: Verify the version and check if the spawned process is known to be part of a legitimate update or installation.

CVE-2026-96940: High-Severity Exchange Server Vulnerability

Exploited in the wild Medium
Exchange Server process spawning unknown binaries
An Exchange Server process spawns an unknown binary with elevated privileges.
Logs: EDR process events
More detail
Prerequisites: Command-line logging enabled on Exchange servers.
Logic: Monitor for Exchange processes (e.g., MSExchangeTransport.exe) spawning new binaries not in the baseline of known good executables.
  • Catches initial post-exploitation activity where attackers may use a custom binary.
  • Helps identify lateral movement or data exfiltration tools.
False positives: Legitimate updates or patches being installed by Exchange Server administrators.
When it fires: Verify the new binary’s origin and purpose. Check if it is part of an approved update or patch.

GitLab AI Gateway RCE

Exploited in the wild Medium
Web servers spawning shells after GitLab AI Gateway exploitation
Web servers executing shell commands post-exploitation, indicative of a successful CVE-2026-90970 exploit.
Logs: web server access logsEDR process events
More detail
Prerequisites: Command-line logging enabled on web servers and EDR processes configured to capture parent-child relationships.
Logic: Detect shell commands executed by web server processes with a recent login from Duo Agent Platform.
  • Catches the first hours after exploitation before the web shell is renamed.
False positives: Scheduled maintenance scripts that execute shell commands, check for specific command patterns and time of day.
When it fires: Verify if the parent process is related to GitLab AI Gateway or Duo Agent Platform. Confirm version of GitLab installed.

CVE-2026-85097 Exploited in Wild

Exploited in the wild Medium
WordPress sites with Bricksforge plugin spawning shells
Detection of processes spawned by Bricksforge plugin that are likely shell scripts or command-line tools.
Logs: Web server access logsEDR process events
More detail
Prerequisites: Enable detailed logging for web servers and EDR tools, including command-line activity.
Logic: Processes spawned by Bricksforge plugin with unusual parent processes or paths pointing to shell scripts.
  • Identifies initial compromise after exploitation of the vulnerability
False positives: Web server process spawning legitimate maintenance scripts during scheduled tasks.
When it fires: Verify if the Bricksforge version is outdated and check for recent plugin updates. Confirm the parent process and account used.

Investigating Ephemeral Supply Chain Tampering

Campaign Medium · 12 existing public rules
Web server downloading malicious ZIP from attacker-controlled domain
A web server process initiating an HTTPS request to a known C2 domain (e.g., account.aomeitech.com) and downloading a file with a suspicious name.
Logs: web server access logs
More detail
Prerequisites: Enable logging of all HTTP requests from web servers.
Logic: Monitor for processes on web servers that initiate HTTPS requests to known C2 domains and download files named 'upgrade-now.zip'.
  • Catches the initial compromise when the web server is instructed to download a malicious payload.
False positives: Legitimate software updates or scheduled maintenance tasks.
When it fires: Verify if the process initiating the request is part of a known legitimate update mechanism. Check for recent changes in the version number and MD5 checksums.
Registry key modified with unusual binary data
A registry key under HKLM\system egistration containing unexpected binary data, indicative of obfuscation or malicious code injection.
Logs: registry events
More detail
Prerequisites: Enable detailed auditing for registry modifications.
Logic: Monitor for changes in the egistry oot egistry key 'AggregateResults' with unusual binary blobs.
  • Detects obfuscation techniques used to hide malicious code within legitimate software.
False positives: Legitimate updates or maintenance activities that modify registry keys.
When it fires: Check the parent process and account associated with the registry change. Confirm if this is part of a known update cycle.
Scheduled task named NitroRuntime or RadminComponentRuntime
The presence of scheduled tasks with names 'NitroRuntime' or 'RadminComponentRuntime', which are indicative of persistence mechanisms.
Logs: task scheduler logs
More detail
Prerequisites: Enable detailed auditing for task creation and modification events.
Logic: Look for scheduled tasks named 'NitroRuntime' or 'RadminComponentRuntime'.
  • Identifies the establishment of persistence mechanisms by the threat actor.
False positives: Legitimate software updates or maintenance activities that create new scheduled tasks.
When it fires: Verify if these tasks are part of a known legitimate update cycle. Check for unusual command-line arguments or parent processes.

SonicWall SMA1000 Critical SSRF Vulnerability

Vulnerability Low
Web servers accessing internal network via SMA1000
Detection of web server requests to internal IP addresses or domains through SMA1000 Appliance Management Console.
Logs: web server access logsfirewall
More detail
Prerequisites: Enable logging for all web server access and firewall events.
Logic: Web servers with internal IPs/domains in the request URL or destination, within 24 hours of SMA1000 login attempts.
  • Identify exploitation attempts targeting the SMA1000 vulnerability
False positives: Internal web server requests to known public services like DNS or NTP.
When it fires: Verify if the internal IPs/domains are legitimate and check for recent SMA1000 login attempts.

All developments

Everything reported in this period, best first. Open a card for the details, sources and the reasoning behind its ratings.

30 of 30

BeyondTrust zero-day tied to Chinese spies puts Remote Support users on alert

Exploited in the wildNew this weekOfficial sourceSources disagree6 publishers
RiskHigh
ConfidenceLikely
UrgencyImmediate

Exploitation itw: BeyondTrust zero-day tied to Chinese spies puts Remote Support users on alert. Names UNC5221, WARP PANDA, SAWFLY, BARECLAW, CVE-2024-47575, CVE-2025-61624. 7 articles from 6 publishers.

Details
What changed
new update from Google Cloud Threat Intelligence (Mandiant/GTIG); new echo from The Hacker News; new origin from Security Affairs; new origin from CSO Online; new official from CISA US-CERT Alerts; new update from SOC Prime; new update from CyberScoop; CVE-2024-47575 added to CISA KEV; advisory emergency for CVE-2024-47575; CVE-2025-61624 added to CISA KEV; CVE-2026-102764 added to CISA KEV; advisory standard for CVE-2026-102764; official confirmation; +5 actors; +3 malware; +3 cves; +21 procedu
Vulnerabilities
CVE-2024-47575 · CISA KEV, fix due 2024-11-13, EPSS 0.95, CVSS 9.8, exploited itwCVE-2025-61624 · CISA KEV, fix due 2026-10-19, EPSS 0.01, CVSS 6.0, exploited itwCVE-2026-102764 · CISA KEV, fix due 2026-10-19, EPSS 0.01, CVSS 9.3, exploited itw
Threat actors
UNC5221WARP PANDAUNC5820ARMORY CASTLE
Malware
SAWFLYBARECLAWPEERSTITCH
ATT&CK techniques
T1003.001 LSASS MemoryT1053.005 Scheduled TaskT1059.001 PowerShellT1068 Exploitation for Privilege EscalationT1078 Valid AccountsT1190 Exploit Public-Facing ApplicationT1219 Remote Access ToolsT1505.003 Web ShellT1539 Steal Web Session CookieT1547.001 Registry Run Keys / Startup FolderT1567.002 Exfiltration to Cloud Storage
Indicators (defanged)
sha256: dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fbsha256: 1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462
Why it is rated this way
Listed in CISA Known Exploited VulnerabilitiesMass exploitation reportedZero-day or no patch availableCritical infrastructure affectedCISA remediation deadline closeVery high exploit probability (EPSS)No patch availableCoverage is rising fastReported in the last 48 hoursOfficial advisory issuedEmergency-tier vulnerabilityIndependent publishers agreeReliable sourcesOfficially confirmedSpecific, checkable details
For defenders
12 existing public detection rules:
HackTool - Default PowerSploit/Empire Scheduled Task Creation (sigmahq)Microsoft Exchange Worker Spawning Suspicious Processes (elastic)Outbound Scheduled Task Activity via PowerShell (elastic)Potential Persistence Via Powershell Search Order Hijacking - Task (sigmahq)Potential PowerShell HackTool Script by Function Names (elastic)Potential SAP NetWeaver Exploitation (elastic)Scheduled Task Executing Encoded Payload from Registry (sigmahq)ScreenConnect Server Spawning Suspicious Processes (elastic)
Hunt: Web server hosting SAWFLY webshell
Detection of POST requests to /mangoapi.php with the _c94mfe parameter, indicating execution of a web shell.
Logs: web server access logs
Prerequisites: Enable logging for all HTTP requests and responses.
Logic: Monitor for POST requests to /mangoapi.php with the obfuscated parameter _c94mfe.
  • Catches initial foothold establishment by UNC5820 or ARMORY CASTLE
  • Identifies active web shell usage
False positives: Legitimate application of _c94mfe for non-malicious purposes, such as testing or configuration.
When it fires: Verify the legitimacy of the request by checking the source IP and user agent. Confirm if the parameter is used in a known legitimate context.
Hunt: Web server spawning sh after PeopleSoft exploitation
Detection of /usr/bin/dbus-authd being spawned by web server processes, indicating persistence via SUID bit.
Logs: web server access logs, process creation events
Prerequisites: Enable process creation logging and ensure web server logs are retained for a sufficient period.
Logic: Monitor for /usr/bin/dbus-authd spawned by web server processes with SUID bit set.
  • Identifies persistence mechanism post-exploitation
  • Detects initial compromise via PeopleSoft vulnerability
False positives: Legitimate use of dbus-authd in a non-malicious context, such as system maintenance or testing.
When it fires: Check the parent process and confirm if /usr/bin/dbus-authd is being used for legitimate purposes. Verify the SUID bit status.
Sources

CVE-2026-104935: Exploited Zero-Day in Ivanti Connect Secure

VulnerabilityNew this weekOfficial source7 publishers
RiskCritical
ConfidenceLikely
UrgencyImmediate

CISA and Volexity have reported active exploitation of a newly disclosed zero-day vulnerability, CVE-2026-104935, affecting Ivanti Connect Secure versions prior to 22.8R2.4. The vulnerability allows unauthenticated remote code execution, enabling attackers to steal credentials and exfiltrate data 12.

Why it mattersDefenders should prioritize patching Ivanti Connect Secure appliances to mitigate the risk of unauthorized access and data breaches, as the vulnerability has already been exploited in real-world attacks 146.
What to do
  • Patch all affected Ivanti Connect Secure devices immediately.
  • Review network logs for signs of compromise from compromised ICS appliances.
Details
What changed
The latest reports confirm active in-the-wild exploitation of the zero-day by a previously unknown threat actor, UTA0576, who chained it with another privilege-escalation vulnerability [A2][A6].
Vulnerabilities
CVE-2026-104935 · CISA KEV, fix due 2026-10-16, EPSS 0.26, CVSS 8.6, exploited itwCVE-2026-106034 · EPSS 0.00, disclosedCVE-2026-106035 · EPSS 0.00, disclosedCVE-2026-106042 · EPSS 0.01, CVSS 9.9, disclosedCVE-2026-106043 · EPSS 0.01, disclosedCVE-2026-106047 · EPSS 0.01, disclosedCVE-2026-109412 · EPSS 0.01, disclosed
Why it is rated this way
Listed in CISA Known Exploited VulnerabilitiesZero-day or no patch availableSupply-chain, wormable or pre-auth RCEWidely deployed productCritical infrastructure affectedCISA remediation deadline closeElevated exploit probability (EPSS)Coverage is rising fastReported this weekOfficial advisory issuedEmergency-tier vulnerabilityIndependent publishers agreeReliable sourcesOfficially confirmedSpecific, checkable details
For defenders
Hunt: Ivanti Connect Secure spawning reverse shell
Detection of a process spawned by Ivanti Connect Secure that connects back to an external IP address, indicating exploitation.
Logs: Firewall, Web server access logs
Prerequisites: Retain network logs for at least 30 days and ensure Ivanti Connect Secure versions are up-to-date or known to be affected.
Logic: Monitor for processes spawned by Ivanti Connect Secure that connect back to external IPs within 5 minutes of the initial connection attempt.
  • Catches the first hours after exploitation before the reverse shell is obfuscated
False positives: Legitimate remote connections from known business partners or third-party services.
When it fires: Verify the version of Ivanti Connect Secure and check if it's affected. Confirm the external IP address and its legitimacy.
Sources

AhsayCBS Backup Flaws Exploited for Crypto Mining

Exploited in the wildNew this weekOfficial source4 publishers
RiskCritical
ConfidenceLikely
UrgencyHigh

Attackers are exploiting two newly disclosed vulnerabilities in AhsayCBS to deploy crypto miners, targeting managed service providers and system integrators 1.

Why it mattersDefenders should care as these flaws were quickly exploited post-disclosure, highlighting the urgency of patching known vulnerabilities 1.
What to do
  • Patch AhsayCBS instances immediately to address CVE-2026-105133 and CVE-2026-105134.
  • Hunt for signs of unauthorized access or crypto mining activity on managed service provider networks.
Details
What changed
new official from CISA US-CERT Alerts; new origin from SOC Prime; new echo from The Hacker News; new corroboration from CSO Online; new echo from Security Affairs; CVE-2026-0322 added to CISA KEV; CVE-2026-105133 added to CISA KEV; advisory standard for CVE-2026-105133; CVE-2026-105134 added to CISA KEV; advisory standard for CVE-2026-105134; CVE-2026-76519 added to CISA KEV; advisory standard for CVE-2026-76519; official confirmation; +2 cves; +3 iocs
Vulnerabilities
CVE-2026-0322 · CISA KEV, fix due 2026-10-17, EPSS 0.01, CVSS 8.6, exploited itwCVE-2026-105133 · CISA KEV, fix due 2026-10-17, EPSS 0.01, CVSS 5.5, exploited itwCVE-2026-105134 · CISA KEV, fix due 2026-10-17, EPSS 0.05, CVSS 9.3, exploited itwCVE-2026-76519 · CISA KEV, fix due 2026-10-17, EPSS 0.02, CVSS 9.8, exploited itw
Indicators (defanged)
ipv4: 66[.]42[.]72[.]14ipv4: 208[.]83[.]239[.]114ipv4: 149[.]248[.]47[.]234
Why it is rated this way
Listed in CISA Known Exploited VulnerabilitiesZero-day or no patch availableSupply-chain, wormable or pre-auth RCEWidely deployed productCritical infrastructure affectedCISA remediation deadline closeNo patch availableReported in the last 48 hoursOfficial advisory issuedIndependent publishers agreeReliable sourcesOfficially confirmedSpecific, checkable details
For defenders
Hunt: Web servers communicating with known C2 IPs
Web servers communicating with the identified C2 IP addresses (66.42.72.14, 208.83.239.114, 149.248.47.234) within a short time frame after AhsayCBS installation.
Logs: web server access logs
Prerequisites: Ensure web server access logs are retained for at least 30 days and include detailed IP information.
Logic: Monitor for HTTP/HTTPS requests from internal web servers to the C2 IPs within 72 hours of AhsayCBS installation.
  • Detects initial compromise and lateral movement
False positives: Legitimate external monitoring or testing traffic, which can be distinguished by context and timing.
When it fires: Verify if the web server is part of the internal network and confirm AhsayCBS installation time.
Sources

PaperCut Pre-Auth RCE Chain Exploited

Exploited in the wildNew this week2 publishers
RiskCritical
ConfidenceRoughly even chance
UrgencyImmediate

WatchTowr Labs reported a pre-authentication Remote Code Execution (RCE) chain exploiting multiple vulnerabilities, including CVE-2026-81578, CVE-2026-82077, and CVE-2026-82078. The initial report 1 detailed the exploitation of these vulnerabilities in-the-wild before PaperCut patched them.

Why it mattersDefenders should review their systems for these specific vulnerabilities and ensure they are fully patched to prevent potential exploitation 1.
What to do
  • Review PaperCut systems for CVE-2026-81578, CVE-2026-82077, and CVE-2026-82078 patches.
  • Implement additional security measures to detect and block pre-authentication RCE attempts.
Details
What changed
new update from CybersecurityNews; advisory standard for CVE-2026-81578; +2 victims
Vulnerabilities
CVE-2026-81578 · CISA KEV, fix due 2026-09-14, EPSS 0.86, CVSS 8.8, exploited itwCVE-2026-82077 · EPSS 0.01, CVSS 7.3, exploited itwCVE-2026-82078 · CISA KEV, fix due 2026-09-14, EPSS 0.64, CVSS 9.4, exploited itw
Affected
PaperCutPaperCut NG/MF print-management servers
Why it is rated this way
Listed in CISA Known Exploited VulnerabilitiesZero-day or no patch availableRansomware involvementSupply-chain, wormable or pre-auth RCECritical infrastructure affectedVery high exploit probability (EPSS)No patch availableReported in the last 48 hoursEmergency-tier vulnerabilityIndependent publishers agreeReliable sourcesSpecific, checkable details
For defenders
2 existing public detection rules:
Suspicious Child Process of PaperCut Server Component (elastic)Suspicious Java Class File Created in PaperCut Server Library (elastic)
Hunt: Web servers executing shell commands after PaperCut exploitation
Detection of web server processes spawning command-line shells or other reverse shells post-exploitation.
Logs: web server access logs, EDR process events
Prerequisites: Command-line logging enabled on web servers and EDR integration with the SOC.
Logic: Monitor for IIS or Apache processes spawning cmd.exe or powershell.exe after PaperCut version affected by CVEs.
  • Catches initial post-exploitation activity where attackers establish a foothold.
  • Identifies lateral movement attempts via web servers.
False positives: Web server maintenance scripts that spawn command-line tools for legitimate purposes, check script paths and timing against known good baseline.
When it fires: Verify the version of PaperCut on affected servers. Check if the parent process is related to exploitation activity.

Chinese Government-linked Actors Exploit CVE-2016-3081 for Data Theft

Exploited in the wildNew this weekOfficial source3 publishers
RiskHigh
ConfidenceLikely
UrgencyImmediate

CISA warns of ongoing exploitation by Chinese government-linked actors using CVE-2016-3081, an Apache Struts command injection vulnerability. These actors combine automated and hands-on techniques to target sensitive data in critical infrastructure sectors 13.

Why it mattersDefenders should care as this vulnerability is actively being exploited in real-world attacks, requiring immediate attention to patching and forensic triage 3.
What to do
  • Patch Apache Struts instances to address CVE-2016-3081 immediately.
  • Conduct forensic triage on affected systems even after applying patches.
Details
What changed
The initial report now includes specific details on the exploitation of CVE-2016-3081 by Chinese government-linked actors, emphasizing both automated and manual methods [A1][A3].
Vulnerabilities
CVE-2016-3081 · CISA KEV, fix due 2026-10-11, EPSS 0.96, CVSS 8.1, exploited itw
Malware
live700_v1.exeEBurst
ATT&CK techniques
T1068 Exploitation for Privilege EscalationT1190 Exploit Public-Facing ApplicationT1204.001 Malicious LinkT1547.001 Registry Run Keys / Startup FolderT1595.002 Vulnerability Scanning
Indicators (defanged)
domain: dns[.]studiocloud[.]xyzdomain: 98aiblog[.]comdomain: hmbcloud[.]comdomain: hmbcloud[.]netdomain: hmbiplc-01[.]comdomain: javacheck[.]ooguy[.]comdomain: javaupdate[.]giize[.]comdomain: sexytube0[.]comdomain: twimg[.]co[.]uk
Why it is rated this way
Listed in CISA Known Exploited VulnerabilitiesZero-day or no patch availableWidely deployed productCritical infrastructure affectedCISA remediation deadline closeVery high exploit probability (EPSS)No patch availableReported this weekOfficial advisory issuedEmergency-tier vulnerabilityIndependent publishers agreeReliable sourcesOfficially confirmedSpecific, checkable details
For defenders
12 existing public detection rules:
DNS Query to External Service Interaction Domains (sigmahq)OMIGOD HTTP No Authentication RCE - CVE-2021-38647 (sigmahq)OMIGOD SCX RunAsProvider ExecuteScript (sigmahq)OMIGOD SCX RunAsProvider ExecuteShellCommand (sigmahq)Potential Buffer Overflow Attack Detected (elastic)Potential Linux Hack Tool Launched (elastic)Potential Telnet Authentication Bypass (CVE-2026-24061) (elastic)SSFileCopySender Executed as Root (elastic)
Hunt: Web servers executing shell scripts after Apache Struts exploitation
Apache Struts web servers spawning processes like sh or python to execute commands.
Logs: web server access logs, EDR process events
Prerequisites: Command-line logging enabled on web servers.
Logic: Web servers with Apache Struts version vulnerable to CVE-2016-3081 spawning sh or python processes.
  • Catches the first hours after exploitation before the web shell is renamed.
False positives: Legitimate use of sh and python for administrative tasks, check process parent and command line arguments.
When it fires: Confirm Apache Struts version and exposure. Check if the process was spawned by a legitimate application or service.
Hunt: Registry run keys for persistence via VPN software
Processes creating registry entries in Run Keys or Startup folder related to known threat actors' tools.
Logs: registry events, EDR process events
Prerequisites: Full registry access and EDR logging enabled.
Logic: Registry keys created under Run or Startup folders by processes with suspicious names like live700_v1.exe, EBurst.
  • Identifies persistence mechanisms used by threat actors.
False positives: Legitimate software updates and administrative tasks creating registry entries.
When it fires: Verify the authenticity of the process that created the registry key. Check for known good versions of the software.

Cisco Secure Email Gateway CVE-2026-76519 Exploited

Exploited in the wildNew this week4 publishers
RiskCritical
ConfidenceRoughly even chance
UrgencyHigh

A critical vulnerability (CVE-2026-76519) in Cisco Secure Email Gateway's Advanced Malware Protection feature, allowing unauthenticated attackers to write arbitrary files and execute commands with root privileges, has been exploited. Cisco confirmed the issue and released patches 234.

Why it mattersDefenders should prioritize patching affected systems and reviewing email gateway configurations to mitigate risk of exploitation 234.
What to do
  • Patch Cisco Secure Email Gateway appliances immediately.
  • Review and update Advanced Malware Protection settings.
Details
What changed
The initial report indicated unknown criminals were exploiting the vulnerability as a 0-day, but subsequent reports confirm it is already being actively used in real-world attacks [A3][A4].
Vulnerabilities
CVE-2026-76519 · CISA KEV, fix due 2026-10-17, EPSS 0.02, CVSS 9.8, exploited itw
Why it is rated this way
Listed in CISA Known Exploited VulnerabilitiesZero-day or no patch availableRansomware involvementWidely deployed productCritical infrastructure affectedCISA remediation deadline closeReported in the last 48 hoursIndependent publishers agreeReliable sourcesSpecific, checkable details
For defenders
Hunt: Email gateway writing files after CVE-2026-76519 exploitation
The email gateway writes new files or modifies existing ones, indicating potential exploitation of the vulnerability.
Logs: Cisco Secure Email Gateway logs
Prerequisites: Enable detailed file system monitoring and logging on the email gateway.
Logic: Monitor for unusual file creation or modification events post-exploitation time window.
  • Detects initial compromise by identifying unauthorized changes to files.
False positives: Legitimate updates or maintenance activities may trigger this alert. Check the context and timing of the event.
When it fires: Verify if the file operations are part of a known update or patch process. Confirm the version of the email gateway software.

NetScaler C2 Exploitation with CVE-2026-88771

Data breachNew this weekOfficial sourceSources disagree3 publishers
RiskCritical
ConfidenceRoughly even chance
UrgencyHigh

A new autonomous C2 framework, NetScaler C2, is exploiting CVE-2026-88771 to target Citrix NetScaler ADC and Gateway devices. This vulnerability has been actively used in the wild 2. A breach at Arizona's state court system and a data leak at Times Car sharing service highlight the potential impact of such attacks 13.

Why it mattersDefenders should prioritize patching affected Citrix NetScaler devices and monitoring for signs of exploitation by the NetScaler C2 framework to mitigate risks 3.
What to do
  • Patch all exposed Citrix NetScaler ADC and Gateway appliances with the latest security updates.
  • Monitor network traffic for signs of NetScaler C2 activity.
Details
What changed
The latest reports indicate active exploitation by an autonomous C2 framework, NetScaler C2, targeting Citrix NetScaler devices with CVE-2026-88771, which was previously disclosed but now shows real-world usage [A2].
Vulnerabilities
CVE-2026-107406 · EPSS 0.00, disclosedCVE-2026-88771 · CISA KEV, fix due 2026-09-30, EPSS 0.01, CVSS 9.5, exploited itw
Threat actors
UAT-11587TA419NetScaler C2
Malware
AntinoCosmicPulse
ATT&CK techniques
T1190 Exploit Public-Facing ApplicationT1204.001 Malicious LinkT1204.002 Malicious FileT1567.002 Exfiltration to Cloud Storage
Affected
Arizona's state court systemFakturowniaSouth Africa's air navigation providerTimes CarUS AI policy experts at think tanks, universities, and law firmsvarious government and policy organizations in Asia
Indicators (defanged)
ipv4: 45[.]143[.]130[.]195
Why it is rated this way
Listed in CISA Known Exploited VulnerabilitiesMass exploitation reportedZero-day or no patch availableRansomware involvementCritical infrastructure affectedNo patch availableOfficial advisory issuedIndependent publishers agreeReliable sourcesOfficially confirmedSpecific, checkable details
For defenders
12 existing public detection rules:
Base64 Decoded Payload Piped to Interpreter (elastic)Droppers Exploiting CVE-2017-11882 (sigmahq)Elastic Defend Alert Followed by Telemetry Loss (elastic)Gatekeeper Override and Execution (elastic)Google Workspace Object Copied from External Drive with App Consent (elastic)Network Traffic to Rare Destination Country (elastic)Potential NetScaler Log Poisoning Command Injection Attempt (elastic)Potential Widespread Malware Infection Across Multiple Hosts (elastic)
Hunt: NetScaler C2 Exploitation via admautoregd
Detection of the admautoregd process executing a malicious command with root privileges, likely part of the NetScaler C2 exploitation.
Logs: EDR process events, command-line logging
Prerequisites: Enable command-line logging and ensure EDR is collecting detailed process information.
Logic: Monitor for admautoregd executing a command with root privileges, containing the string 'curl -sk 45.143.130[.]195:8899/s/' followed by a bid identifier.
  • Catches initial compromise and lateral movement attempts via NetScaler C2 exploitation.
False positives: Legitimate administrative tasks using admautoregd, which may include similar command patterns for network diagnostics or configuration changes.
When it fires: Verify the version of admautoregd and confirm if it is part of a known vulnerable NetScaler device. Check the parent process to ensure no legitimate context exists.
Hunt: DNS OOB Command Injection
Detection of DNS queries or responses containing out-of-band (OOB) commands, indicative of NetScaler C2 exploitation.
Logs: DNS logs
Prerequisites: Ensure DNS logs are being collected and retained for a sufficient period.
Logic: Monitor for DNS queries or responses that contain the string 'admautoregd' or similar patterns associated with NetScaler C2 exploitation.
  • Identifies initial compromise attempts through DNS-based command injection.
False positives: Legitimate internal network diagnostics or testing using OOB commands in DNS queries.
When it fires: Check the source and destination IP addresses, as well as the domain names involved. Confirm if these are part of a known vulnerable NetScaler device.
Sources

CVE-2026-88771 and -88772: Pre-Disclosure Exploitation of Critical Citrix NetScaler Vulnerabilities

VulnerabilityOngoing since 2026-09-287 publishers
RiskHigh
ConfidenceRoughly even chance
UrgencyImmediate

Citrix disclosed eight critical vulnerabilities in its NetScaler ADC and Gateway products, including CVE-2026-88771 and -88772, which were exploited before the release of emergency security updates. The affected versions include NetScaler ADC / Gateway 14.1 and 13.1, with patches available for each 1. Attackers deployed web shells and tunneling malware post-exploitation 25.

Why it mattersDefenders should prioritize patching affected NetScaler appliances immediately as these vulnerabilities were exploited before disclosure, posing a significant risk to organizations 23.
What to do
  • Patch all affected NetScaler ADC and Gateway versions to the latest build [A1]
  • Hunt for signs of exploitation using techniques T1047 and T1505.003 [A6]
Details
What changed
The latest reports indicate active exploitation of CVE-2026-88772 in the wild since early September 2026, with evidence pointing to targeted attacks on government, financial services, and technology sectors [A5].
Vulnerabilities
CVE-2025-7775 · CISA KEV, fix due 2025-08-28, EPSS 0.20, CVSS 9.2, exploited itwCVE-2025-7776 · EPSS 0.08, disclosedCVE-2025-8424 · EPSS 0.03, disclosedCVE-2026-107406 · EPSS 0.00, disclosedCVE-2026-88771 · CISA KEV, fix due 2026-09-30, EPSS 0.01, CVSS 9.5, exploited itwCVE-2026-88772 · CISA KEV, fix due 2026-09-30, EPSS 0.01, CVSS 9.5, exploited itwCVE-2026-88774 · EPSS 0.00, disclosedCVE-2026-88775 · EPSS 0.00, disclosedCVE-2026-88776 · EPSS 0.00, disclosedCVE-2026-88777 · EPSS 0.00, disclosedCVE-2026-88778 · EPSS 0.00, disclosed
Malware
FreeBSD x64 implant
ATT&CK techniques
T1047 Windows Management InstrumentationT1055 Process InjectionT1190 Exploit Public-Facing ApplicationT1204.002 Malicious FileT1505.003 Web Shell
Why it is rated this way
Listed in CISA Known Exploited VulnerabilitiesZero-day or no patch availableSupply-chain, wormable or pre-auth RCEWidely deployed productElevated exploit probability (EPSS)No patch availableReported in the last 48 hoursEmergency-tier vulnerabilityIndependent publishers agreeReliable sourcesSpecific, checkable details
For defenders
12 existing public detection rules:
File with High Entropy Created by Web Server (elastic)File with Suspicious Double Extension Created by Web Server (elastic)Microsoft Exchange Worker Spawning Suspicious Processes (elastic)Potential NetScaler Log Poisoning Command Injection Attempt (elastic)Potential Polyglot Bypass File Created by Web Server (elastic)Potential SAP NetWeaver Exploitation (elastic)Potential Webshell Deployed via Apache Struts CVE-2023-50164 Exploitation (elastic)Suspicious Microsoft Office Child Process (sigmahq)
Hunt: NetScaler web shell creation
Detection of modified httpd.conf files with unexpected PHP handler configurations, indicating post-exploitation activity.
Logs: web server access logs, file integrity monitoring
Prerequisites: Retain file system and configuration changes for at least 30 days.
Logic: Monitor for changes to /etc/httpd.conf with unexpected AddHandler or php_flag directives.
  • Catches the initial post-exploitation activity where web shells are deployed.
False positives: Configuration changes made by legitimate system administrators, check timestamps and commit messages.
When it fires: Verify if the change is recent and associated with known NetScaler versions. Check for related process activity.
Hunt: Process injection into NSPPE service
Detection of unexpected processes or command execution within the NSPPE service, indicative of post-exploitation activity.
Logs: process monitoring, event logs
Prerequisites: Enable process creation and network event logging for critical services like NSPPE.
Logic: Look for NSPPE-<##> processes with unusual parent processes or command execution.
  • Identifies the initial post-exploitation activity where malware is injected into a legitimate service.
False positives: Legitimate updates or maintenance activities, check process names and paths.
When it fires: Check the parent process of NSPPE-<##> for known good processes. Confirm if the command execution is expected.
Hunt: Web server spawning shells
Detection of shell spawning commands executed by web servers, indicating post-exploitation activity.
Logs: web server access logs, process monitoring
Prerequisites: Enable command-line logging for web servers and retain logs for at least 30 days.
Logic: Monitor for shell spawning commands like 'chmod u+s /bin/sh' or similar in web server logs.
  • Catches the first hours after exploitation before the web shell is renamed.
False positives: Legitimate administrative actions, check timestamps and context.
When it fires: Verify if the command execution is recent. Check for related process activity and network connections.
Sources

CVE-2026-96951: Actively Exploited Windows Shell Zero-Day

Exploited in the wildNew this week4 publishers
RiskHigh
ConfidenceLikely
UrgencyHigh

Microsoft's October Patch Tuesday addresses a high-severity zero-day vulnerability (CVE-2026-96951) in the Windows Shell, which is already being exploited. The vulnerability allows unauthenticated attackers to bypass Mark of the Web protections by convincing victims to interact with specially crafted files 4 5.

Why it mattersDefenders should care because this zero-day is actively being used by attackers to bypass security features and gain unauthorized access 4 5.
What to do
  • Patch all affected Windows systems immediately.
  • Review and update security policies to mitigate the risk of Mark of the Web bypasses.
Details
What changed
The latest reports confirm active exploitation of CVE-2026-96951 in real-world attacks, while initial reports only mentioned it as a critical vulnerability that was exploited in the wild [A1][A3].
Vulnerabilities
CVE-2026-100202 · EPSS 0.01, disclosedCVE-2026-100209 · EPSS 0.01, disclosedCVE-2026-100210 · EPSS 0.01, disclosedCVE-2026-100211 · EPSS 0.01, disclosedCVE-2026-100215 · EPSS 0.00, disclosedCVE-2026-100219 · EPSS 0.01, disclosedCVE-2026-100220 · EPSS 0.01, disclosedCVE-2026-102211 · EPSS 0.00, disclosedCVE-2026-102214 · EPSS 0.00, disclosedCVE-2026-102225 · EPSS 0.01, disclosedCVE-2026-102855 · EPSS 0.01, disclosedCVE-2026-102856 · EPSS 0.01, disclosed
Malware
EliseBroomstick
ATT&CK techniques
T1055 Process InjectionT1190 Exploit Public-Facing ApplicationT1566.001 Spearphishing Attachment
Indicators (defanged)
domain: malicious[.]NETdomain: Snort[.]orgdomain: affecting[.]NET
Why it is rated this way
Listed in CISA Known Exploited VulnerabilitiesZero-day or no patch availableWidely deployed productCritical infrastructure affectedCISA remediation deadline closeCoverage is rising fastReported this weekIndependent publishers agreeReliable sourcesSpecific, checkable details
For defenders
12 existing public detection rules:
Droppers Exploiting CVE-2017-11882 (sigmahq)Execution of File Written or Modified by Microsoft Office (elastic)Potential CVE-2025-33053 Exploitation (elastic)Potential Execution via FileFix Phishing Attack (elastic)Potential Fake CAPTCHA Phishing Attack (elastic)Potential FileFix Command via Windows Explorer Address Bar (elastic)Potential Foxmail Exploitation (elastic)Suspicious Execution from INET Cache (elastic)
Hunt: Web servers hosting malicious files
Web servers serving files from domains like 'affecting.NET' or 'malicious.NET'. This indicates exploitation attempts targeting the Windows Shell vulnerability.
Logs: web server access logs
Prerequisites: Enable logging of all web server requests and responses, including file paths and domain names.
Logic: Monitor for HTTP/HTTPS requests to 'affecting.NET' or 'malicious.NET'.
  • Catches the initial phase where attackers attempt to deliver malicious content via web servers.
False positives: Legitimate use of these domains by internal testing or third-party services.
When it fires: Verify if the files served are legitimate and check for any recent changes in the server configuration.
Hunt: Process injection via .NET assembly
Processes injecting malicious .NET assemblies, often seen as process injection or code execution after exploitation of the Windows Shell vulnerability.
Logs: EDR process events
Prerequisites: Enable EDR to capture detailed process creation and injection events, including parent-child relationships and file paths.
Logic: Look for processes injecting .NET assemblies from suspicious domains like 'Snort.org'.
  • Identifies the moment when attackers leverage the vulnerability to inject malicious code into legitimate processes.
False positives: Legitimate use of .NET assemblies in development environments or software updates.
When it fires: Check the parent process and the account used for any signs of compromise. Confirm if the assembly is known good or bad.
Sources

CVE-2026-21589: Atlassian Arbitrary File Access Vulnerability

VulnerabilityNew this weekOfficial source6 publishers
RiskHigh
ConfidenceAlmost certainly
UrgencyHigh

Initial report. On October 5th, Atlassian disclosed CVE-2026-21589, a critical unauthenticated arbitrary file-access vulnerability affecting eight self-hosted products 1. Exploitation began shortly after the public proof-of-concept code release on October 7th 3, with threat actors actively targeting affected systems. CISA added CVE-2026-21589 to its Known Exploited Vulnerabilities (KEV) Catalog, highlighting its risk 5.

Why it mattersDefenders should prioritize patching Atlassian products and reviewing access controls due to the critical nature of this vulnerability and active exploitation 35.
What to do
  • Patch affected Atlassian products immediately.
  • Review and tighten file access controls.
Details
Vulnerabilities
CVE-2026-21589 · CISA KEV, fix due 2026-10-18, EPSS 0.13, exploited itw
Threat actors
UAC-0099
Malware
MATCHBOIL
Affected
ASOSATB丹麦政府大阪府立大学
Why it is rated this way
Listed in CISA Known Exploited VulnerabilitiesLarge breach (1M+ records)Critical infrastructure affectedCISA remediation deadline closeRising exploit probability (EPSS)Reported in the last 48 hoursOfficial advisory issuedIndependent publishers agreeReliable sourcesOfficially confirmedSpecific, checkable details
For defenders
Hunt: Web servers accessing Atlassian product directories after CVE-2026-21589 disclosure
Unusual access patterns to Atlassian product directories on web servers, especially from external IPs.
Logs: web server access logs
Prerequisites: Enable logging of all incoming requests and directory access attempts.
Logic: Monitor for HTTP GET/POST requests targeting known Atlassian product directories within 48 hours after October 7th, from external IPs.
  • Identify initial exploitation attempts before attackers obfuscate their actions.
False positives: Legitimate users accessing documentation or support resources. Check for user-agent strings and request content to distinguish legitimate access.
When it fires: Verify the version of Atlassian products in use, check if they are affected by CVE-2026-21589, and review parent processes for suspicious activity.
Sources

CVE-2026-104286: FortiMail Path Traversal Vulnerability Exploited

Exploited in the wildOngoing since 2026-10-023 publishers
RiskHigh
ConfidenceRoughly even chance
UrgencyModerate

The path traversal vulnerability CVE-2026-104286 in FortiMail, combined with improper handling of NULL characters, is actively exploited by APT41 to write arbitrary files. Initial report.1 The flaw allows unauthenticated attackers to bypass security checks and gain access to the underlying system via crafted HTTP or HTTPS requests.2

Why it mattersDefenders should patch FortiMail appliances immediately as this vulnerability is being actively exploited and could lead to unauthorized file writes and potential system compromise.2 Evidence from one source; additional verification recommended.
What to do
  • Patch all affected FortiMail appliances with the latest updates
  • Review network configurations for exposed FortiMail instances
Details
What changed
+1 actors
Vulnerabilities
CVE-2026-104286 · CISA KEV, fix due 2026-10-04, EPSS 0.02, CVSS 9.8, exploited itw
Threat actors
APT41unknown
Malware
cmdElise
Indicators (defanged)
sha256: 8015f34dc84922b03688399d7f9fe7a00361789f7e420c7e2a2cdb23e75cef84sha256: 77324ac428bde86d351fc5fc06f6d64a6bfe737dfb2743df1d4c5ac2418a5b6asha256: 7a6cea9f5c9e2e9994d4e3c4da73f86cf5acd05ea5d312c066c9d1dafd69ee38sha256: 4000276a150a165d3c2537d1e19fb393c4de8333076a16655e28059cae82157bsha256: 703e97c64e61e41dc3aaba580d82bb2aa7b6a11b54ee6fb467ed5d5a3bffdef5sha256: 8953ec7960b09f544a880b072ad4e6cfda7a8303f486251d3478dcfdfbac23b6sha256: d6fe51c22b91776f4c961ea58bcac5917f15d560a619d7ce726d3d51795609d3md5: 64c90a00c7fda4d5c7973ed64c25783amd5: 5241738a3e9988404239e12243f6d35bmd5: ae0ea6502d3fa5f0664bceb73189eb54md5: f90fa81a5f521d785f2b2f765e3ab897md5: 61af1c4bce1c2eebc8ff689ca5337791
Why it is rated this way
Listed in CISA Known Exploited VulnerabilitiesZero-day or no patch availableRansomware involvementWidely deployed productCoverage is rising fastIndependent publishers agreeReliable sourcesSpecific, checkable details
For defenders
12 existing public detection rules:
Cassandra JavaScript UDF Creation (elastic)First-Time Destructive MongoDB Command from a Client IP (elastic)Long Base64 Encoded Command via Scripting Interpreter (elastic)Multiple SonicWall Login Failures Followed by Successful Login (elastic)MySQL User-Defined Function Injection (elastic)PostgreSQL COPY PROGRAM Command Execution (elastic)Potential Privilege Escalation via unshare Followed by Root Process (elastic)Potential Redis CONFIG SET Cron Directory Persistence (RedisRaider) (elastic)
Hunt: FortiMail receiving malicious HTTP requests
Detection of FortiMail receiving HTTP or HTTPS requests with crafted paths, potentially leading to arbitrary file writes.
Logs: web server access logs
Prerequisites: Enable logging for all incoming web traffic on the FortiMail server.
Logic: Monitor for requests containing null characters or unusual paths directed at the FortiMail service.
  • Identify initial exploitation attempts before any file writes occur.
False positives: Legitimate testing of security controls, misconfigured services, and benign network traffic.
When it fires: Check the source IP address and user agent for known malicious activity. Confirm FortiMail version to ensure it is vulnerable.
Hunt: Unusual file writes on FortiMail server
Detection of unexpected file creation or modification events, especially by processes related to the FortiMail service.
Logs: file integrity monitoring, process monitoring
Prerequisites: Enable detailed logging and file integrity monitoring for critical directories used by FortiMail.
Logic: Look for new files created or modified with suspicious names, especially those matching the provided SHA256 hashes.
  • Identify potential post-exploitation activities after initial compromise.
False positives: Scheduled backups, legitimate software updates, and routine maintenance tasks.
When it fires: Verify the process that created or modified the file. Check for any known vulnerabilities in FortiMail versions used on the system.

GuardDuty Extended Threat Detection Adds New Indicators

Detection & DFIRNew this week2 publishers
RiskHigh
ConfidenceUnlikely / unverified
UrgencyImmediate

Amazon GuardDuty Extended Threat Detection now includes five new indicators: MALICIOUS_PACKAGE, MISCONFIGURATION, REACHABILITY, SENSITIVE_DATA, and VULNERABILITY 1. These additions help correlate weak signals into critical attack sequences 2.

Why it mattersDefenders should review these new indicators as they enhance the detection of critical attack sequences 1.
What to do
  • Review Amazon GuardDuty Extended Threat Detection configurations to ensure all new indicators are enabled.
Details
What changed
GuardDuty Extended Threat Detection has added five new indicator types to surface attack sequences: MALICIOUS_PACKAGE, MISCONFIGURATION, REACHABILITY, SENSITIVE_DATA, and VULNERABILITY.
Vulnerabilities
CVE-2023-46604 · CISA KEV, used by ransomware groups, fix due 2023-11-23, EPSS 1.00, CVSS 10.0, exploited itwCVE-2026-100291 · EPSS 0.00, CVSS 9.3, disclosedCVE-2026-22755 · EPSS 0.20, CVSS 9.3, disclosedCVE-2026-95102 · EPSS 0.00, CVSS 9.3, disclosedCVE-2026-96587 · EPSS 0.00, CVSS 10.0, disclosed
ATT&CK techniques
T1068 Exploitation for Privilege EscalationT1071.001 Web ProtocolsT1078 Valid AccountsT1110.003 Password SprayingT1195.002 Compromise Software Supply ChainT1204.002 Malicious FileT1219 Remote Access ToolsT1566.002 Spearphishing Link
Indicators (defanged)
domain: monta[.]app
Why it is rated this way
Listed in CISA Known Exploited VulnerabilitiesZero-day or no patch availableSupply-chain, wormable or pre-auth RCEUsed in ransomware campaignsVery high exploit probability (EPSS)No patch availableReported this weekEmergency-tier vulnerabilityIndependent publishers agreeReliable sourcesSpecific, checkable details
For defenders
12 existing public detection rules:
Downloaded Shortcut Files (elastic)Downloaded URL Files (elastic)Execution of File Written or Modified by Microsoft Office (elastic)Malware User Agent (sigmahq)Potential Execution via FileFix Phishing Attack (elastic)Potential FileFix Command via Windows Explorer Address Bar (elastic)Suspicious Execution from VS Code Extension (elastic)Suspicious Execution from a WebDav Share (elastic)
Hunt: EC2 instances with internet-reachable IMDSv1
Detect EC2 instances exposing IMDSv1 over the internet, indicating a potential misconfiguration.
Logs: CloudTrail, EC2 metadata service logs
Prerequisites: Enable detailed CloudTrail logging and ensure EC2 instance metadata service (IMDS) access is logged.
Logic: Check for EC2 instances with IMDSv1 enabled and internet reachability within the last 30 days.
  • Identify misconfigurations that could be exploited by attackers
False positives: Instances launched in public subnets or during initial setup before security hardening.
When it fires: Verify if instances are part of a legitimate public API and confirm the need for IMDSv1 exposure.
Hunt: Malicious package detected in EC2 and EKS
Detect the presence of a malicious package (MAL-2022-4933) in both Amazon EC2 and Amazon EKS environments.
Logs: Amazon Inspector, EC2 instance metadata service logs
Prerequisites: Enable Amazon Inspector for security assessments on EC2 and EKS instances.
Logic: Look for the presence of the malicious package indicator MAL-2022-4933 in both EC2 and EKS environments within the last 7 days.
  • Identify potential supply chain compromise
False positives: False positives from benign software updates or mislabeled packages.
When it fires: Review the package details, version, and context of its presence on both EC2 and EKS instances.

UAT-6275 Targets CIS Government Organizations

Threat actorNew this week2 publishers
RiskHigh
ConfidenceRoughly even chance
UrgencyHigh

Cisco Talos and Recorded Future identified UAT-6275, a Kazakhstan-nexus threat actor, targeting government organizations in the Commonwealth of Independent States (CIS) since June 2025. The group uses various techniques including macro-enabled documents and PS2EXE downloaders 1.

Why it mattersDefenders should be aware of this persistent threat as it may pose a risk to critical infrastructure and intelligence collection efforts. Evidence is strong but based on one source 1 for some techniques.
What to do
  • Patch systems against known vulnerabilities such as CVE-2025-8088
  • Hunt for custom reverse shells like PickleShell, Chvost, and Laplas
  • Block malicious domains and IP addresses associated with the group
Details
What changed
The latest reports confirm UAT-6275's ongoing activity with new targets, expanding from government organizations to water resources and energy sectors in the CIS region [A2].
Vulnerabilities
CVE-2025-8088 · CISA KEV, used by ransomware groups, fix due 2025-09-02, EPSS 0.95, CVSS 8.4, exploited itw
Threat actors
UAT-6275
Malware
custom reverse shellsPickleShellChvostLaplas
ATT&CK techniques
T1041 Exfiltration Over C2 ChannelT1053.005 Scheduled TaskT1059.002 AppleScriptT1068 Exploitation for Privilege EscalationT1105 Ingress Tool TransferT1204.002 Malicious FileT1219 Remote Access ToolsT1566.001 Spearphishing Attachment
Why it is rated this way
Listed in CISA Known Exploited VulnerabilitiesState-linked or espionage actorCritical infrastructure affectedUsed in ransomware campaignsVery high exploit probability (EPSS)Reported in the last 48 hoursIndependent publishers agreeReliable sourcesSpecific, checkable details
For defenders
12 existing public detection rules:
Droppers Exploiting CVE-2017-11882 (sigmahq)Execution of File Written or Modified by Microsoft Office (elastic)Network Traffic to Rare Destination Country (elastic)Potential Execution via FileFix Phishing Attack (elastic)Potential FileFix Command via Windows Explorer Address Bar (elastic)Suspicious Execution from INET Cache (elastic)Suspicious Microsoft Office Child Process - MacOS (sigmahq)Suspicious ScreenConnect Client Child Process (elastic)
Hunt: GitHub-hosted PowerShell scripts executed for C2
Detection of PowerShell processes executing GitHub URLs to retrieve and execute remote scripts.
Logs: EDR process events, web server access logs
Prerequisites: Enable command-line logging and script block logging on affected systems.
Logic: Monitor for PowerShell processes with network activity to GitHub domains, specifically downloading and executing scripts.
  • Catches the initial compromise where attackers use GitHub-hosted scripts for remote access.
False positives: Legitimate script execution from trusted repositories or internal development activities.
When it fires: Verify the source of the PowerShell process, confirm if it is part of a known legitimate operation, and check the network activity details.
Hunt: Scheduled tasks created by threat actor
Detection of scheduled task creation with unusual names or paths indicative of persistence mechanisms.
Logs: EDR process events, Windows Event Logs
Prerequisites: Enable script block logging and ensure Windows Event Log retention is sufficient.
Logic: Look for new scheduled tasks created by processes with known malicious indicators, such as unusual names or paths.
  • Identifies the initial foothold where attackers establish persistence on the network.
False positives: Legitimate administrative actions to create scheduled tasks for maintenance or updates.
When it fires: Check the parent process of the task creation, confirm if it is part of a known legitimate operation, and review the task details.
Sources

Longlegs Group Still Exploiting Warlock Ransomware via Year-Old SharePoint Flaws

Exploited in the wildNew this weekSingle-source report1 publisher
RiskHigh
ConfidenceUnconfirmed claim
UrgencyModerate

The Longlegs group (also known as Storm-2603) continues to use the Warlock ransomware, exploiting year-old SharePoint zero-days collectively called ToolShell. In the past two months, they have targeted four organizations in Europe, Africa, and Latin America 1.

Why it mattersDefenders should be vigilant as this group continues to exploit known vulnerabilities, potentially leaving their networks exposed 1.
What to do
  • Patch any remaining SharePoint zero-days related to ToolShell
  • Hunt for signs of Warlock ransomware activity
Details
What changed
The latest reports indicate that Longlegs is still using the same exploits from over a year ago, targeting critical infrastructure across multiple continents [A1].
Malware
Warlock ransomwareVisual Studio Code's tunneling feature
Indicators (defanged)
domain: wasabisys[.]com
Why it is rated this way
Exploited in the wildZero-day or no patch availableRansomware involvementWidely deployed productCritical infrastructure affectedReliable sourcesSpecific, checkable details
For defenders
Hunt: Web servers hosting malicious payload
Detection of a web server serving files from wasabisys.com, indicative of Warlock ransomware deployment.
Logs: web server access logs
Prerequisites: Retain logs for at least 90 days and ensure URL filtering is enabled.
Logic: Monitor HTTP requests to web servers for URLs containing wasabisys.com within the last month.
  • Identifies initial compromise when Warlock ransomware is deployed via a malicious payload hosted on a web server.
False positives: Legitimate business use of wasabisys.com or other third-party content delivery networks (CDNs).
When it fires: Verify the legitimacy of the domain and check for recent changes in web server configurations.

CVE-2026-88779: Citrix NetScaler Zero-Day Exploited Against SAML Deployments

Exploited in the wildNew this week3 publishers
RiskHigh
ConfidenceRoughly even chance
UrgencyModerate

A newly disclosed vulnerability (CVE-2026-88779) has been exploited in targeted attacks against customer-managed NetScaler ADC and Gateway appliances configured for SAML authentication. The memory overflow issue can cause Denial of Service conditions 1. Citrix rates the vulnerability as high severity with a CVSS v4.0 score of 8.7, and CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on October 4, 2026, with an October 7 remediation deadline for covered federal agencies 2.

Why it mattersDefenders should prioritize patching NetScaler appliances to mitigate operational risks associated with Denial of Service conditions 12.
What to do
  • Patch all affected Citrix NetScaler ADC and Gateway appliances
  • Review SAML authentication configurations for potential vulnerabilities
Details
What changed
The latest reports confirm the vulnerability has been exploited in targeted attacks, while initial reports focused on the disclosure and severity of the issue.
Vulnerabilities
CVE-2026-88779 · CISA KEV, fix due 2026-10-07, EPSS 0.01, CVSS 8.7, exploited itw
Why it is rated this way
Listed in CISA Known Exploited VulnerabilitiesZero-day or no patch availableWidely deployed productNo patch availableIndependent publishers agreeReliable sourcesSpecific, checkable details
For defenders
Hunt: NetScaler processes spawning unusual child processes
Detection of NetScaler processes spawning new processes with suspicious command-line arguments or network connections.
Logs: EDR process events, firewall
Prerequisites: Command-line logging enabled for NetScaler processes.
Logic: Monitor for NetScaler processes (nscli.exe, nshttpd.exe) spawning new processes with unusual command-line arguments or network connections outside of normal operations.
  • Catches the first hours after exploitation before the attacker attempts to hide their presence.
False positives: Legitimate process restarts and maintenance activities may trigger this alert. Check for known good command-line arguments and network destinations.
When it fires: Verify if the parent NetScaler process is legitimate, check the version of the NetScaler appliance, and review the command-line arguments and network connections.
Sources

MyReport Updater Vulnerabilities (CVE-2026-110632, CVE-2026-110633)

Exploited in the wildNew this weekSingle-source report1 publisher
RiskHigh
ConfidenceUnconfirmed claim
UrgencyModerate

Two critical vulnerabilities were disclosed in MyReport Updater 2.1.1: a privilege escalation vulnerability and a remote code execution flaw 1. These issues can be exploited to gain SYSTEM privileges on the target system through its update configuration and gRPC service.

Why it mattersDefenders should care as these vulnerabilities could allow attackers to escalate privileges and execute arbitrary code, posing a significant risk to systems running MyReport Updater 1.
What to do
  • Patch MyReport Updater to the latest version immediately.
  • Review and update any third-party applications on your network.
Details
What changed
Initial report.
Vulnerabilities
CVE-2026-110632 · EPSS 0.01, CVSS 9.2, disclosedCVE-2026-110633 · EPSS 0.00, CVSS 8.5, disclosed
Indicators (defanged)
domain: updater[.]myreport[.]fr
Why it is rated this way
Exploited in the wildZero-day or no patch availableSupply-chain, wormable or pre-auth RCEWidely deployed productReported this weekReliable sourcesSpecific, checkable details
For defenders
Hunt: Web servers executing remote code after MyReport Updater exploit
Detection of a process spawning a shell or command execution on web servers after an update request to the malicious domain.
Logs: web server access logs, EDR process events
Prerequisites: Command-line logging enabled for web servers and EDR processes.
Logic: Web server requests to updater.myreport.fr followed by shell spawning or command execution within 5 minutes.
  • Catches the first hours after exploitation before the web shell is renamed.
False positives: Scheduled maintenance scripts that execute commands on web servers.
When it fires: Verify if the update request was legitimate and check for known good versions of MyReport Updater.
Sources

CVE-2025-64393: Critical Veeam Backup & Replication RCE Vulnerability

Exploited in the wildNew this weekSingle-source report1 publisher
RiskHigh
ConfidenceUnconfirmed claim
UrgencyModerate

Veeam has disclosed CVE-2025-64393, a critical remote code execution vulnerability in their Backup & Replication software. The flaw allows low-privileged users with the Backup Viewer role to execute arbitrary code on the Veeam Backup Server 1.

Why it mattersDefenders should care as this vulnerability could provide attackers with a powerful foothold for accessing critical enterprise resources, given the sensitive nature of backup infrastructure 1.
What to do
  • Patch Veeam Backup & Replication to address CVE-2025-64393.
  • Review and update access controls for the Backup Viewer role.
Details
What changed
Initial report.
Vulnerabilities
CVE-2025-64393 · EPSS 0.00, CVSS 9.4, disclosed
Why it is rated this way
Exploited in the wildZero-day or no patch availableRansomware involvementReliable sourcesSpecific, checkable details
For defenders
Hunt: Veeam Backup Server spawning shell after exploitation
Detection of a process spawning a shell or command prompt after a Veeam Backup & Replication server is exploited.
Logs: EDR process events, web server access logs
Prerequisites: Command-line logging enabled on the Veeam Backup Server.
Logic: Look for processes spawned by known Veeam services that execute shell commands or start command prompt after a short time window following exploitation.
  • Catches the first hours after exploitation before the web shell is renamed.
  • Identifies post-exploitation activity on the server.
False positives: Legitimate administrative tasks using shells or command prompts, especially during maintenance windows. Check for known good processes and times of day.
When it fires: Confirm version of Veeam Backup & Replication, check if it is vulnerable to CVE-2025-64393. Verify the parent process and account used.
Sources

CVE-2026-97229: Critical GitLab RCE Flaw

Exploited in the wildNew this weekSingle-source report1 publisher
RiskMedium
ConfidenceUnconfirmed claim
UrgencyModerate

GitLab has released emergency security updates addressing CVE-2026-97229, a maximum-severity remote code execution vulnerability in their Community Edition (CE) and Enterprise Edition (EE). The flaw affects the CI/CD Regular Expression Compiler due to insufficient validation of specially crafted regular expressions 1.

Why it mattersDefenders should care as this unauthenticated RCE could compromise GitLab environments, requiring immediate action 1.
What to do
  • Patch GitLab Community Edition (CE) and Enterprise Edition (EE)
  • Review and update CI/CD pipelines for potential vulnerabilities
Details
What changed
Initial report.
Vulnerabilities
CVE-2026-97229 · EPSS 0.01, CVSS 10.0, poc
Indicators (defanged)
domain: GitLab[.]com
Why it is rated this way
Exploited in the wildSupply-chain, wormable or pre-auth RCECritical infrastructure affectedReported this weekReliable sourcesSpecific, checkable details
For defenders
Hunt: Web servers spawning shells after GitLab exploitation
Detection of shell spawning processes on web servers following a GitLab exploit attempt.
Logs: web server access logs, EDR process events
Prerequisites: Command-line logging enabled for web servers and EDR integration with the web server environment.
Logic: Processes spawned by web server processes, checking for shell execution within 5 minutes of a GitLab-related request.
  • Catches the first hours after exploitation before the web shell is renamed.
False positives: Web servers running automated scripts or updates. Check for known good times and versions.
When it fires: Confirm version of GitLab, check parent process for legitimate activity, verify account credentials.

CVE-2026-110447 Exploited in Collabora Online Flaw

Exploited in the wildNew this weekSingle-source report1 publisher
RiskMedium
ConfidenceUnconfirmed claim
UrgencyHigh

Hackers are exploiting a critical vulnerability (CVE-2026-110447) in the Collabora Online Built-in CODE Server app for Nextcloud, allowing remote attackers to run OS commands and place web shells on servers. This flaw affects versions before 26.4.303 1.

Why it mattersDefenders should care as this vulnerability could allow persistent access to their Nextcloud servers, posing a significant risk 1.
What to do
  • Patch Collabora Online Built-in CODE Server app to version 26.4.303 or later.
  • Hunt for web shells and unauthorized commands on affected Nextcloud servers.
Details
What changed
Initial report.
Vulnerabilities
CVE-2026-110447 · EPSS 0.01, CVSS 9.2, exploited itw
Why it is rated this way
Exploited in the wildZero-day or no patch availableNo patch availableReported in the last 48 hoursSpecific, checkable details
For defenders
Hunt: Web servers spawning shells after Collabora Online exploitation
Detection of shell creation on web servers following Collabora Online app exploitation.
Logs: web server access logs, EDR process events
Prerequisites: Command-line logging enabled for web servers and EDR processes.
Logic: Processes spawned by Collabora Online with unusual command-line arguments indicative of shell creation within 15 minutes of the app's last update.
  • Catches the first hours after exploitation before the web shell is renamed.
  • Identifies malicious activity post-exploitation.
False positives: Legitimate server maintenance and updates may trigger similar behavior. Check for known good command-line arguments and recent app version history.
When it fires: Verify the Collabora Online version on the affected server. Confirm if any recent updates or patches were applied.
Sources

Cisco NX-OS Flaws Disclosed

Exploited in the wildNew this weekSingle-source report1 publisher
RiskMedium
ConfidenceUnconfirmed claim
UrgencyModerate

Cisco has disclosed five critical vulnerabilities affecting Nexus 3000 and Nexus 9000 switches, including heap-based buffer overflows in NX-API (CVE-2026-76471) and NGOAM features. These flaws can allow unauthenticated remote attackers to execute code with root privileges or trigger DoS conditions 1.

Why it mattersDefenders should review their Nexus switch configurations for these vulnerabilities, as they pose a significant risk if exploited 1.
What to do
  • Review Nexus switch configurations for the affected features.
Details
What changed
Initial report.
Vulnerabilities
CVE-2026-76465 · EPSS 0.00, disclosedCVE-2026-76471 · EPSS 0.01, disclosedCVE-2026-76485 · EPSS 0.01, disclosedCVE-2026-76486 · EPSS 0.01, disclosedCVE-2026-76501 · EPSS 0.01, disclosed
Why it is rated this way
Exploited in the wildWidely deployed productCritical infrastructure affectedReliable sourcesSpecific, checkable details
For defenders
Hunt: NX-OS switch spawning shell after exploitation
NX-OS switches spawning a new process with elevated privileges post-exploitation.
Logs: EDR process events, firewall
Prerequisites: Command-line logging enabled on NX-OS switches.
Logic: Monitor for processes spawned by known NX-OS switch processes with elevated privileges within 5 minutes of the initial exploit attempt.
  • Catches the first hours after exploitation before the shell is renamed or obfuscated.
False positives: Legitimate administrative actions, such as scheduled maintenance scripts running with elevated privileges.
When it fires: Verify the version of NX-OS and check if the switch was exposed to the internet. Confirm the parent process and account details.
Sources

CVE-2026-59346: Critical VMware Workstation and Fusion Flaw Enables Guest-to-Host Code Execution

Exploited in the wildNew this weekSingle-source report1 publisher
RiskMedium
ConfidenceUnconfirmed claim
UrgencyModerate

Exploitation itw: CVE-2026-59346: Critical VMware Workstation and Fusion Flaw Enables Guest-to-Host Code Execution. Names CVE-2026-59346. 1 article from 1 publisher.

Details
What changed
new origin from SOC Prime; +1 cves
Vulnerabilities
CVE-2026-59346 · EPSS 0.00, CVSS 9.3, poc
Why it is rated this way
Exploited in the wildWidely deployed productReliable sourcesSpecific, checkable details
For defenders
Hunt: VMware Workstation/Fusion processes spawning unknown executables
VMware Workstation or Fusion processes spawning new executables that are not known to the system, indicating potential exploitation.
Logs: EDR process events
Prerequisites: Command-line logging enabled for VMware Workstation and Fusion processes.
Logic: Monitor VMware Workstation/Fusion processes for any unknown executables spawned within 5 minutes of their start time.
  • Catches the first hours after exploitation before the malicious executable is obfuscated or renamed.
False positives: Legitimate software updates or installations by VMware products.
When it fires: Verify the version and check if the spawned process is known to be part of a legitimate update or installation.

CVE-2026-96940: High-Severity Exchange Server Vulnerability

Exploited in the wildNew this weekSingle-source report1 publisher
RiskMedium
ConfidenceUnconfirmed claim
UrgencyModerate

Microsoft has released an out-of-band security update for CVE-2026-96940, a high-severity vulnerability in Microsoft Exchange Server that could allow authenticated attackers to access other users' mailboxes. The flaw affects multiple on-premises Exchange Server versions and carries a CVSS score of 8.8 1.

Why it mattersDefenders should patch affected systems immediately to mitigate potential unauthorized access risks 1.
What to do
  • Patch all on-premises Exchange Server versions affected by CVE-2026-96940.
Details
What changed
The initial report did not mention active exploitation, but Microsoft now emphasizes the likelihood of such activity.
Vulnerabilities
CVE-2026-96940 · EPSS 0.00, poc
Why it is rated this way
Exploited in the wildWidely deployed productReliable sourcesSpecific, checkable details
For defenders
Hunt: Exchange Server process spawning unknown binaries
An Exchange Server process spawns an unknown binary with elevated privileges.
Logs: EDR process events
Prerequisites: Command-line logging enabled on Exchange servers.
Logic: Monitor for Exchange processes (e.g., MSExchangeTransport.exe) spawning new binaries not in the baseline of known good executables.
  • Catches initial post-exploitation activity where attackers may use a custom binary.
  • Helps identify lateral movement or data exfiltration tools.
False positives: Legitimate updates or patches being installed by Exchange Server administrators.
When it fires: Verify the new binary’s origin and purpose. Check if it is part of an approved update or patch.

GitLab AI Gateway RCE

Exploited in the wildOngoing since 2026-10-032 publishers
RiskMedium
ConfidenceRoughly even chance
UrgencyModerate

CVE-2026-90970 is a critical vulnerability allowing arbitrary command execution on the GitLab AI Gateway for users with Duo Agent Platform access. GitLab has released patches in versions 19.2.4, 19.3.2, and 19.4.1 12.

Why it mattersDefenders should care as this vulnerability could be exploited by authenticated users with Duo Agent Platform access to execute arbitrary commands on the AI Gateway, posing a significant risk 12.
What to do
  • Patch GitLab AI Gateway to version 19.2.4, 19.3.2, or 19.4.1.
  • Review and update access controls for Duo Agent Platform.
Details
What changed
Initial report.
Vulnerabilities
CVE-2026-90970 · EPSS 0.01, poc
Why it is rated this way
Exploited in the wildIndependent publishers agreeReliable sourcesSpecific, checkable details
For defenders
Hunt: Web servers spawning shells after GitLab AI Gateway exploitation
Web servers executing shell commands post-exploitation, indicative of a successful CVE-2026-90970 exploit.
Logs: web server access logs, EDR process events
Prerequisites: Command-line logging enabled on web servers and EDR processes configured to capture parent-child relationships.
Logic: Detect shell commands executed by web server processes with a recent login from Duo Agent Platform.
  • Catches the first hours after exploitation before the web shell is renamed.
False positives: Scheduled maintenance scripts that execute shell commands, check for specific command patterns and time of day.
When it fires: Verify if the parent process is related to GitLab AI Gateway or Duo Agent Platform. Confirm version of GitLab installed.
Sources

CVE-2026-85097 Exploited in Wild

Exploited in the wildNew this weekSingle-source report1 publisher
RiskMedium
ConfidenceUnconfirmed claim
UrgencyModerate

Attackers are exploiting the critical CVE-2026-85097 (CVSS 10.0) flaw in Bricksforge WordPress plugin versions up to 3.1.8.9, allowing unauthenticated RCE 1.

Why it mattersDefenders should care as this flaw is being actively exploited and could lead to remote code execution on vulnerable sites 1.
What to do
  • Patch Bricksforge to version 3.1.8.10 or later.
Details
What changed
Initial report.
Vulnerabilities
CVE-2026-85097 · EPSS 0.00, CVSS 9.8, exploited itw
Why it is rated this way
Exploited in the wildReported this weekSpecific, checkable details
For defenders
Hunt: WordPress sites with Bricksforge plugin spawning shells
Detection of processes spawned by Bricksforge plugin that are likely shell scripts or command-line tools.
Logs: Web server access logs, EDR process events
Prerequisites: Enable detailed logging for web servers and EDR tools, including command-line activity.
Logic: Processes spawned by Bricksforge plugin with unusual parent processes or paths pointing to shell scripts.
  • Identifies initial compromise after exploitation of the vulnerability
False positives: Web server process spawning legitimate maintenance scripts during scheduled tasks.
When it fires: Verify if the Bricksforge version is outdated and check for recent plugin updates. Confirm the parent process and account used.
Sources

ShinyHunters

Law enforcementOngoing since 2026-09-283 publishers
RiskMedium
ConfidenceRoughly even chance
UrgencyLow

The Dutch police arrested Pepijn van der Stap, a convicted cybercriminal suspected of aiding ShinyHunters. Following his arrest, ShinyHunters escalated their attacks, targeting the FBI and extorting Cl0p 2. Additionally, a teenager from Jordan, known as 'Rey,' was detained for leading ShinyHunters, who recently extorted Boeing's Jeppesen ForeFlight business unit 3.

Why it mattersDefenders should be vigilant as ShinyHunters remain active post-arrest, potentially increasing risk to critical infrastructure and businesses 23.
What to do
  • Review recent attack vectors used by ShinyHunters.
  • Enhance monitoring for suspicious activities related to extortion attempts.
Details
What changed
Following the arrest of Pepijn van der Stap, ShinyHunters escalated their attacks, targeting high-profile entities like the FBI and Cl0p [A2].
Threat actors
ShinyHunters
Why it is rated this way
Mass exploitation reportedRansomware involvementSupply-chain, wormable or pre-auth RCEIndependent publishers agreeReliable sourcesSpecific, checkable details
Sources

Investigating Ephemeral Supply Chain Tampering

CampaignNew this weekSingle-source report1 publisher
RiskMedium
ConfidenceUnlikely / unverified
UrgencyLow

Campaign: Investigating Ephemeral Supply Chain Tampering. Names UNC7017, CROSSROAD, SHINYROAD. 1 article from 1 publisher.

Details
What changed
new origin from Google Cloud Threat Intelligence (Mandiant/GTIG); +1 actors; +2 malware; +10 procedures; +9 iocs; +3 detections
Threat actors
UNC7017
Malware
CROSSROADSHINYROAD
ATT&CK techniques
T1027 Obfuscated Files or InformationT1036 MasqueradingT1053.005 Scheduled TaskT1059.001 PowerShellT1190 Exploit Public-Facing ApplicationT1195.002 Compromise Software Supply ChainT1574.001 DLL
Indicators (defanged)
sha256: d2f9ef2429312667f0512504b6a19ba4a9cc5514f1b2933923dd42f75a1c5934domain: account[.]aomeitech[.]comdomain: aomei[.]storage-data[.]comurl: hxxps://promotion[.]storage-data[.]com/download/abpopup/upgrade-now[.]zipipv4: 8[.]210[.]84[.]56ipv4: 8[.]218[.]65[.]184ipv4: 47[.]239[.]60[.]117domain: serv[.]oss-cn-hongkong[.]aliyuncs[.]comdomain: endpointserv[.]oss-cn-hongkong[.]aliyuncs[.]com
Why it is rated this way
Supply-chain, wormable or pre-auth RCEWidely deployed productCritical infrastructure affectedReported this weekReliable sourcesSpecific, checkable details
For defenders
12 existing public detection rules:
HackTool - Default PowerSploit/Empire Scheduled Task Creation (sigmahq)Outbound Scheduled Task Activity via PowerShell (elastic)Potential Persistence Via Powershell Search Order Hijacking - Task (sigmahq)Potential PowerShell HackTool Script by Function Names (elastic)Scheduled Task Created by a Windows Script (elastic)Scheduled Task Executing Encoded Payload from Registry (sigmahq)Scheduled Task Executing Payload from Registry (sigmahq)Suspicious Schtasks Execution AppData Folder (sigmahq)
Hunt: Web server downloading malicious ZIP from attacker-controlled domain
A web server process initiating an HTTPS request to a known C2 domain (e.g., account.aomeitech.com) and downloading a file with a suspicious name.
Logs: web server access logs
Prerequisites: Enable logging of all HTTP requests from web servers.
Logic: Monitor for processes on web servers that initiate HTTPS requests to known C2 domains and download files named 'upgrade-now.zip'.
  • Catches the initial compromise when the web server is instructed to download a malicious payload.
False positives: Legitimate software updates or scheduled maintenance tasks.
When it fires: Verify if the process initiating the request is part of a known legitimate update mechanism. Check for recent changes in the version number and MD5 checksums.
Hunt: Registry key modified with unusual binary data
A registry key under HKLM\system egistration containing unexpected binary data, indicative of obfuscation or malicious code injection.
Logs: registry events
Prerequisites: Enable detailed auditing for registry modifications.
Logic: Monitor for changes in the egistry oot egistry key 'AggregateResults' with unusual binary blobs.
  • Detects obfuscation techniques used to hide malicious code within legitimate software.
False positives: Legitimate updates or maintenance activities that modify registry keys.
When it fires: Check the parent process and account associated with the registry change. Confirm if this is part of a known update cycle.
Hunt: Scheduled task named NitroRuntime or RadminComponentRuntime
The presence of scheduled tasks with names 'NitroRuntime' or 'RadminComponentRuntime', which are indicative of persistence mechanisms.
Logs: task scheduler logs
Prerequisites: Enable detailed auditing for task creation and modification events.
Logic: Look for scheduled tasks named 'NitroRuntime' or 'RadminComponentRuntime'.
  • Identifies the establishment of persistence mechanisms by the threat actor.
False positives: Legitimate software updates or maintenance activities that create new scheduled tasks.
When it fires: Verify if these tasks are part of a known legitimate update cycle. Check for unusual command-line arguments or parent processes.
Sources

SonicWall SMA1000 Critical SSRF Vulnerability

VulnerabilityNew this week2 publishers
RiskLow
ConfidenceUnlikely / unverified
UrgencyLow

SonicWall has disclosed a critical Server-Side Request Forgery (SSRF) vulnerability in its SMA1000 Appliance Work Place interface, tracked as CVE-2026-102255. Additionally, three other post-authentication vulnerabilities were reported for the Appliance Management Console 12.

Why it mattersDefenders should care as these vulnerabilities could allow remote attackers to perform unauthorized actions and gain access to internal functions 12.
What to do
  • Patch all affected SonicWall SMA1000 appliances immediately
  • Review and update configurations for the Appliance Management Console
Details
What changed
The latest articles include four new vulnerabilities disclosed by SonicWall, expanding on the initial report of a critical SSRF flaw.
Vulnerabilities
CVE-2026-102255 · EPSS 0.00, CVSS 10.0, pocCVE-2026-102256 · EPSS 0.00, disclosedCVE-2026-102257 · EPSS 0.01, disclosedCVE-2026-102258 · EPSS 0.00, disclosed
Indicators (defanged)
domain: mysonicwall[.]com
Why it is rated this way
Zero-day or no patch availableSupply-chain, wormable or pre-auth RCENo patch availableIndependent publishers agreeReliable sourcesSpecific, checkable details
For defenders
Hunt: Web servers accessing internal network via SMA1000
Detection of web server requests to internal IP addresses or domains through SMA1000 Appliance Management Console.
Logs: web server access logs, firewall
Prerequisites: Enable logging for all web server access and firewall events.
Logic: Web servers with internal IPs/domains in the request URL or destination, within 24 hours of SMA1000 login attempts.
  • Identify exploitation attempts targeting the SMA1000 vulnerability
False positives: Internal web server requests to known public services like DNS or NTP.
When it fires: Verify if the internal IPs/domains are legitimate and check for recent SMA1000 login attempts.

IronChain Ransomware Threatens Businesses with Permanent Data Loss and Costly Downtime

MalwareNew this week2 publishers
RiskLow
ConfidenceUnlikely / unverified
UrgencyNone

Malware analysis: IronChain Ransomware Threatens Businesses with Permanent Data Loss and Costly Downtime. Names IronChain. 2 articles from 2 publishers.

Details
What changed
new origin from ANY.RUN; new corroboration from AnyRun (Medium); +1 malware; +8 procedures; +6 iocs
Malware
IronChain
ATT&CK techniques
T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1055 Process InjectionT1078 Valid AccountsT1190 Exploit Public-Facing ApplicationT1547.001 Registry Run Keys / Startup FolderT1685 Disable or Modify Tools
Indicators (defanged)
sha256: 09b550d66b7ce269fa577edcac54d6ba3e0f3cb5b660a2921b9372d37d52e254sha256: d8ce0a5866178495a66d23c9587822164966111fcd34764011e907951c599711sha256: 5b4f59236a9b950bcd5191b35d19125f60cfb9e1a1e1aa2e4f914b6745dde9dfsha256: 977d3b78bdf5723430e2e21cf1eb515a2335a0e370c76fa2dda4315ba062f429md5: 2ac6ca0dd3cc83f5a12d12742d539fc9domain: ironchaindecrypt7xfzq5tclm9jzpwq72uofgy2znkdsxm54zbcu2yid[.]onion
Why it is rated this way
Ransomware involvementWidely deployed productIndependent publishers agreeReliable sourcesSpecific, checkable details

DarkSword/Coruna Open Directory Finding Report

UndergroundNew this weekSources disagree2 publishers
RiskInfo
ConfidenceUnlikely / unverified
UrgencyNone

Underground: DarkSword/Coruna Open Directory Finding Report. Names CyberXero, wp2shell, Cobalt Strike. 2 articles from 2 publishers.

Details
What changed
new update from SOCRadar; new origin from Censys; +2 actors; +5 malware
Threat actors
CyberXero
Malware
wp2shellCobalt StrikeDarkSword/CorunaSpringBoard coordinatorexploit_server.py
Why it is rated this way
Critical infrastructure affectedIndependent publishers agreeReliable sourcesSpecific, checkable details

golang-github-prometheus-prometheus: CVSS (Max): 7.5

VulnerabilityNew this weekOfficial source1 publisher
RiskInfo
ConfidenceUnlikely / unverified
UrgencyLow

Vulnerability: golang-github-prometheus-prometheus: CVSS (Max): 7.5. 1 article from 1 publisher.

Details
What changed
new official from AusCERT Bulletins; official confirmation; +1 iocs
Indicators (defanged)
domain: suse[.]com
Why it is rated this way
Reported this weekOfficial advisory issuedReliable sourcesOfficially confirmedSpecific, checkable details
Sources

Threat landscape

How this period's developments spread across risk, confidence, urgency and category. Click a number to list exactly those developments.

Risk × confidence
Almost certainLikelyEven chanceUnlikelyUnconfirmed
Critical···
High
Medium··
Low····
Info····
Urgency × risk
CriticalHighMediumLowInfo
Immediate···
High··
Moderate···
Low··
None···
Category × risk
CriticalHighMediumLowInfo
Exploited in the wild··
Vulnerability·
Data breach····
Detection & DFIR····
Threat actor····
Law enforcement····
Campaign····
Malware····
Underground····

Ransomware watch

418 victims were named on leak sites in this period.

Most active groups
Thegentlemen
76
N0n
48
Qilin
34
Nightspire
26
Majinahanashi
19
Incransom
16
Wallstreet
15
Lockbit5
14
UmBra
10
Akira
9
THE SEVEN DEADLY SINS
8
Hyflock
8
Sectors hit
Not Found
40
Technology
27
Healthcare
25
Manufacturing
23
Professional Services
19
Education
13
Other
12
Financial Services
8
Retail & E-Commerce
7
Transportation
6
Agriculture and Food Production
6
Energy & Utilities
6
Countries hit
US
72
BR
13
GB
5
DE
5
EG
5
JP
4
CA
4
IN
4
MX
4
ES
4
TW
3
IT
3
Victims named
DateGroupVictimSectorCountry
2026-10-17BravoxMinkon 🇩🇪
2026-10-17PlayWSBI-ESBG
2026-10-17EverestKissei ShojiManufacturingJP
2026-10-17EverestBrenner Base TunnelTransportationAT
2026-10-17EverestTaekwang NetworkTechnologyKR
2026-10-17EverestChugoku BendManufacturing
2026-10-17N0nCompany #84Not FoundUS
2026-10-17N0nCompany #85Not FoundUS
2026-10-17N0nCompany #86Not FoundUS
2026-10-16THE SEVEN DEADLY SINSCureMetrix, Inc.
2026-10-16StormTech Electronics
2026-10-16StormR. A. Wood Associates
2026-10-16ThegentlemenSt Peters Anglican Primary School
2026-10-16ThegentlemenCAS Paper Mill
2026-10-16ThegentlemenAxle Logistics
2026-10-16ThegentlemenPetroleum Telcom Communications
2026-10-16ThegentlemenSONGWOOI
2026-10-16ThegentlemenNorth Bridge Venture Partners
2026-10-16ThegentlemenEngineers Ireland
2026-10-16ThegentlemenInovar Packaging Group
2026-10-16ThegentlemenThai Ha PCL KASET
2026-10-16ThegentlemenSkin Center
2026-10-16ThegentlemenMuseum Siam
2026-10-16ThegentlemenREGiO Nord
2026-10-16ThegentlemenNetcore Unbxd
2026-10-16ThegentlemenSaga University
2026-10-16ThegentlemenSBI Audiovisual Medinbox
2026-10-16ThegentlemenSuhai Segurana Pessoal
2026-10-16ThegentlemenMAP SA
2026-10-16ThegentlemenMartin LLP
2026-10-16pearCaretaker Landscape and Tree Management
2026-10-16pearSolar Communications International
2026-10-16pearMacfarlan Capital Partners
2026-10-16ThegentlemenPantanal AgricolaAgriculture and Food ProductionBR
2026-10-16ThegentlemenSladek PartnersProfessional ServicesCZ
2026-10-16ThegentlemenJJS JusticeGovernment & DefenseGB
2026-10-16ThegentlemenServiceMaster of OttawaProfessional ServicesCA
2026-10-16ThegentlemenEntry Systems Garage Doors GatesOtherUS
2026-10-16ThegentlemenEurop Assistance South AfricaFinancial ServicesZA
2026-10-16ThegentlemenTaiwan Otsuka PharmaceuticalHealthcareTW
2026-10-16ThegentlemenCLIMEDIHealthcareBR
2026-10-16ThegentlemenUniversidade de Passo FundoEducationBR
2026-10-16ThegentlemenCampbell RheaNot FoundUS
2026-10-16ThegentlemenNewport Beach DentistryHealthcareUS
2026-10-16ThegentlemenTulsatTechnologyKZ
2026-10-16ThegentlemenShared Medical TechnologyHealthcareUS
2026-10-16ThegentlemenSanta Barbara EndodonticsHealthcareUS
2026-10-16ThegentlemenEcuadors National PoliceGovernment & DefenseEC
2026-10-16auroraAdams Warehouse & Delivery, Inc.TransportationUS
2026-10-16N0nEvolution Spine / All LabsHealthcare
2026-10-16N0nCompany #74Not FoundUS
2026-10-16N0nCompany #75Not FoundUS
2026-10-16QilinVia Credit UnionFinancial ServicesUS
2026-10-16THE SEVEN DEADLY SINSiHeartJaneHealthcareUS
2026-10-16THE SEVEN DEADLY SINSHarness Inc.TechnologyUS
2026-10-16THE SEVEN DEADLY SINSVerano HoldingsRetail & E-CommerceUS
2026-10-16THE SEVEN DEADLY SINSHospital Sírio-LibanêsHealthcareBR
2026-10-16THE SEVEN DEADLY SINSCanvaTechnologyAU
2026-10-16THE SEVEN DEADLY SINSGlobeia Inc.Not FoundUS
2026-10-16THE SEVEN DEADLY SINSCradlewise Inc.TechnologyUS
2026-10-16BravoxMinkonNot FoundDE
2026-10-16N0nEnVision Eye CareHealthcare
2026-10-16WallstreetGirl Scouts of Eastern MassachusettsEducationUS
2026-10-16VexyData-Core SystemsTechnology
2026-10-16N0nBladeTech IncManufacturingUS
2026-10-16N0nXinos Construction Corp and its accounting groupManufacturing
2026-10-16N0nCompany #83Not Found
2026-10-16N0nCompany #81Not Found
2026-10-16N0nCompany #82Not FoundUS
2026-10-16RedactParker-Hannifin CorporationManufacturingUS
2026-10-16N0nCompany #71Not FoundUS
2026-10-16N0nCompany #72Not Found
2026-10-16N0nCompany #76Not FoundUS
2026-10-16N0nCompany #77Not FoundUS
2026-10-16N0nCompany #78Not Found
2026-10-16N0nCompany #79Not FoundUS
2026-10-16N0nCompany #80Not Found
2026-10-16RedactONEOK, Inc.Energy & UtilitiesUS
2026-10-16PlayPure OptionsFinancial Services
2026-10-16PlayMicroSearch CorporationTechnology
2026-10-16PlayNew Tec Tool LimitedManufacturingHK
2026-10-16PlayWSBI-ESBGFinancial ServicesBE
2026-10-16N0nPrafesta Ind. e Com. de Embalagens LtdaManufacturingBR
2026-10-15blacknevasAmity University Dubai
2026-10-15NightspireS*o**n* Public Schools
2026-10-15QilinCommune Du Tampon
2026-10-15AkiraSvd (Sun Valley Dairy)Agriculture and Food ProductionUS
2026-10-15AkiraBoyle, Pecharich, Cline, Whittington and StallingsProfessional Services
2026-10-15AkiraVidekTechnologyGB
2026-10-15QilinShield Wall Systems of FloridaGovernment & DefenseUS
2026-10-15QilinKemlows Diecasting Products LimitedManufacturingGB
2026-10-15N0nCompany #66Not Found
2026-10-15N0nCompany #67Not FoundNL
2026-10-15N0nCompany #68Not FoundUS
2026-10-15iah6477aleraProfessional Services
2026-10-15N0nCompany #69Not Found
2026-10-15spacebearsHolistic Health Group, Inc. (d/b/a Suncrafted)HealthcareUS
2026-10-15spacebearsAlma Center Servizi Medicali S.r.l.HealthcareIT
2026-10-15EmperadorMPI LTDAOtherBR
2026-10-15VexyEnchanted Fine JewelleryRetail & E-CommerceIN
2026-10-15iah6477camden-livingHospitalityGB
2026-10-15iah6477buckleRetail & E-Commerce
2026-10-15iah6477hensleyOther
2026-10-15QilinBrame TelecomTechnologyBR
2026-10-15QilinChattanooga Shooting SuppliesRetail & E-CommerceUS
2026-10-15QilinHyperGenTechnologyUS
2026-10-15QilinHocon GasEnergy & UtilitiesNG
2026-10-15iah6477sunshine-millsAgriculture and Food Production
2026-10-15iah6477middlebyManufacturingUS
2026-10-150x00bienestarempresarialProfessional ServicesMX
2026-10-15Lockbit5torcivialaw.comProfessional ServicesIT
2026-10-15Lockbit5kidzrkooldental.comHealthcareUS
2026-10-15Lockbit5lcww.com.egNot FoundEG
2026-10-15Lockbit5neweramachines.comManufacturingUS
2026-10-15Lockbit5grupoabg.comManufacturingMX
2026-10-15QilinKD CorpNot FoundKR
2026-10-15N0nCompany #73Not Found
2026-10-15N0nCompany #70Not FoundEG
2026-10-15iah6477hilmar-cheeseAgriculture and Food ProductionUS
2026-10-15QilinThe Excalibur GroupOtherUS
2026-10-15QilinSegres SystecTechnologyES
2026-10-15WallstreetTGM Manufacturing, IncManufacturingUS
2026-10-15QilinTelcoe Federal Credit UnionFinancial ServicesUS
2026-10-15QilinKeio CorporationTransportationJP
2026-10-15Incransomwww.coopecaja.fi.crFinancial ServicesCR
2026-10-15Incransomnowaszkola.comEducationPL
2026-10-15Incransomfairfeelegalservices.comProfessional ServicesUS
2026-10-15Incransomverveba.com \ www.att.comTechnologyUS
2026-10-14DragonForceLane Equipment
2026-10-14Nightspire***o* **s**e** Solutions
2026-10-14NightspireColorado Texas
2026-10-14auroraEstrategias BigMat S.L.U.
2026-10-14EmperadorMyM ODONTOCLINICA S.A
2026-10-14Lockbit5kordhotels.gr
2026-10-14Lockbit5skycc.co.th
2026-10-14Lockbit5saintpierredescorps.fr
2026-10-14Lockbit5poolegroup.com.au
2026-10-14WallstreetGreen Clinic
2026-10-14WallstreetE-Z Pack Trucks
2026-10-14N0nTrieschmann Dumala Architectural Group
2026-10-14QilinJoliet Public Schools District 86
2026-10-14QilinMOA Architecture
2026-10-14IncransomFINANCIAMENTO LTDA
2026-10-14kairosOceania Digital Communications
2026-10-14AkiraTorns Enterprises
2026-10-14AkiraShediac Lobster Shop
2026-10-14AkiraFOODMatch
2026-10-14Eclipsejapantimes.co.jp
2026-10-14EclipseTaiwan Otsuka Pharmaceutical
2026-10-14N0nInterior TechnologiesTechnology
2026-10-13PlayDFK Group
2026-10-13PlayThe Innovation Group
2026-10-13auroraThe Buckner Company, Inc.
2026-10-13BYODDecorolala
2026-10-13EmperadorCMC AUDITORES SRL
2026-10-13N0nPG Group (Pure Options)
2026-10-13N0nMarieBelle New York
2026-10-13PanzerZenidoc
2026-10-13PanzerValode & Pistre
2026-10-13AuditTeamSa***ge
2026-10-13AuditTeamZe***ce
2026-10-13AuditTeamAD***ed
2026-10-13AuditTeamAdmirals Trading
2026-10-13VexyGuarufilme
2026-10-13IncransomWolf & Sofsky GmbH
2026-10-13ransomhouseExcess Baggage
2026-10-13direwolfInterseguro
2026-10-13QilinComisión Municipal de Agua Potable y Alcantarillado de Victoria
2026-10-13QilinMilstein Siegel, LLC
2026-10-13N0nHunter Neurology
2026-10-13N0nCompany #64
2026-10-13N0nCompany #63
2026-10-13OrovaAlfameli Group
2026-10-13OrovaCodar (Pte) Ltd
2026-10-13OrovaDurga Bearings
2026-10-13IncransomGreat Lakes
2026-10-13QilinIliff, Meredith, Wildberger & Brennan, P.C
2026-10-13Sarcomavictim
2026-10-13EverestTopcon Healthcare
2026-10-13EverestLaerdal
2026-10-13EverestKVH
2026-10-13WallstreetLambertinum Seniorenwohnanlage
2026-10-13WallstreetMantum Holding AB
2026-10-13WallstreetBrunnberg & Forshed Arkitektkontor
2026-10-13WallstreetDanvikshem (Stiftelsen Danviks Hospital)
2026-10-13WallstreetBriab Group AB
2026-10-13WallstreetByrån för Arkitektur och Urbanism
2026-10-13WallstreetFab Support AB
2026-10-13WallstreetVendus Sweden AB
2026-10-13WallstreetSpectrum Arkitekter AB
2026-10-13WallstreetEnglunds Konsultbyrå AB
2026-10-13WallstreetAhlqvist & Almqvist Arkitekter AB
2026-10-13Hyflockmerkezilac_archives
2026-10-13HyflockEcuador police headquarters
2026-10-13Hyflocktdotnet
2026-10-13Hyflockocean beverages
2026-10-13HyflockIGPL
2026-10-13Hyflocknodhom.com
2026-10-13HyflockCooper Tec Solutions
2026-10-13HyflockYYC Advisors
2026-10-13QilinThe Golden Legacy Financing
2026-10-13N0nCompany #65
2026-10-12NightspireKP Industries
2026-10-12ThegentlemenMoneyGram
2026-10-12DragonForceCanadian Mennonite University (CMU)
2026-10-12N0nCompany #24
2026-10-12NightspireMGT Lojistik AŞ
2026-10-12ThegentlemenKFCRetail & E-CommerceUS
2026-10-12ThegentlemenConfluentTechnologyUS
2026-10-12ThegentlemenBigIDTechnologyUS
2026-10-12ThegentlemenPlacer AITechnologyUS
2026-10-12RedactEversource EnergyEnergy & UtilitiesUS
2026-10-11Incransomhsc.mb.ca
2026-10-11The GentlemenBigID
2026-10-11Shibamaltest
2026-10-11PanzerSupreme Energy
2026-10-11INC Ransomhsc.mb.ca
2026-10-11VexyKookabarra Juice
2026-10-11N0nCompany #25HealthcareUS
2026-10-11N0nCompany #26HealthcareUS
2026-10-11N0nCompany #27HealthcareAU
2026-10-11N0nCompany #28Professional ServicesUS
2026-10-11N0nCompany #29TechnologyUS
2026-10-11QilinConfipetrolEnergy & UtilitiesCO
2026-10-11DragonForceTQC S.A.ManufacturingPE
2026-10-11RhysidaCharles E. Tabor AAL LLCOtherUS
2026-10-11QilinFriendship Christian SchoolEducationUS
2026-10-11QilinCNESTENGovernment & DefenseMA
2026-10-11RhysidaReed & Giordano PAProfessional ServicesUS
2026-10-11N0nCompany #14Not FoundCA
2026-10-11N0nCompany #19Not Found
2026-10-11N0nCompany #20Not Found
2026-10-11N0nCompany #21Not Found
2026-10-11N0nCompany #22Not Found
2026-10-11N0nCompany #23Not Found
2026-10-11BrainCipherhuntcompanies.comNot FoundUS
2026-10-11N0nCompany #24Not Found
2026-10-11EmperadorSpelman LogisticsTransportation
2026-10-10QilinSecretaría de Modernización e Innovación del Municipio
2026-10-10MajinahanashiHYSYTECH S.r.l.
2026-10-10MajinahanashiTERRACOM & MONTCAU
2026-10-10MajinahanashiPCA Group Sdn. Bhd.
2026-10-10MajinahanashiThe Margo Hotel
2026-10-10MajinahanashiGrand Ion Delemen Hotel
2026-10-10MajinahanashiCALICHE
2026-10-10MajinahanashiETICOD
2026-10-10MajinahanashiUAB Biotecha
2026-10-10MajinahanashiCamandona SA
2026-10-10MajinahanashiGoccia S.p.A.
2026-10-10MajinahanashiSCHMITZ & NITTENWILM
2026-10-10MajinahanashiCARIBE / SUBRA
2026-10-10MajinahanashiWONDR DIAMONDS & D GEM MOUNT
2026-10-10MajinahanashiCDA
2026-10-10MajinahanashiGRUPO STARFOODS
2026-10-10MajinahanashiSON-VIDEO
2026-10-10MajinahanashiKT RESTAURANT
2026-10-10MajinahanashiBONJOUR GROUP
2026-10-10MajinahanashiPIO PIO
2026-10-10Chaosastranahealth.com
2026-10-10SafePayhoteldelfinolugano.ch
2026-10-10DeadlockSaber1
2026-10-10Lockbit5poolegroup.com.au
2026-10-10QilinLD ConstructoraManufacturingCL
2026-10-10QilinGlenhardie Country ClubHospitalityUS
2026-10-10RhysidaGress Clark Young & SchoepperProfessional ServicesUS
2026-10-10ExitiumKOIKE Sanso Kogoyo Co. Ltd.ManufacturingJP
2026-10-10QilinACI Proyectos SASOtherCO
2026-10-10RedactDexComHealthcareUS
2026-10-10UmBraHelwan University (HITU)EducationEG
2026-10-10ThegentlemenRoyal Thai Air ForceGovernment & DefenseTH
2026-10-10DragonForceTEXMA International Co., LtdManufacturingTW
2026-10-09NightspireKC Pharmaceuticals, Inc
2026-10-09NightspireValvorobica Industirale S.p.A
2026-10-09NightspireVietnam SuperPort
2026-10-09NightspireSangre de Cristo Arts and Conference Center
2026-10-09NightspireHeidi's Events & Catering, Inc.
2026-10-09NightspireWAGA Enterprises Architects LLC
2026-10-09NightspireMedcom Tech Information
2026-10-09NightspireINAPI
2026-10-09NightspireMäntelhaus Kaiser GmbH & Co. KG
2026-10-09NightspireThe Bernard Osher Foundation
2026-10-09NightspireFondy Food Pantry
2026-10-09Cry0Anaergia | World-Leading Anaerobic Digestion Solutions
2026-10-09PayoutskingWatermark Retirement Communities
2026-10-09PayoutskingMerrill Iron & Steel
2026-10-09ThegentlemenMercyMed of Columbus
2026-10-09ThegentlemenPalma
2026-10-09ThegentlemenHabbas Associates
2026-10-09ThegentlemenMajestic Holidays India Private Limited
2026-10-09ThegentlemenAll Smiles Dental of Falls Church
2026-10-09ThegentlemenThe Law Office of James R Walsh
2026-10-09ThegentlemenPotomac Animal Hospital
2026-10-09ThegentlemenMabris
2026-10-09ThegentlemenAlcoholics Anonymous
2026-10-09ThegentlemenAbility Enterprise
2026-10-09ThegentlemenMachine sro
2026-10-09ThegentlemenNorthwestern Polytechnic
2026-10-09ThegentlemenPolishing Proz
2026-10-09ThegentlemenMaverick Desk
2026-10-09ThegentlemenRag Electric
2026-10-09ThegentlemenAll Souls St Gabriels School
2026-10-09ThegentlemenAnsonia Public Schools
2026-10-09ThegentlemenUniversity of Buraimi
2026-10-09ThegentlemenSantee School District Foundation
2026-10-09ThegentlemenJentech Precision Industrial
2026-10-09ThegentlemenPIR Sales
2026-10-09ThegentlemenAsessippi Ski Resort
2026-10-09ThegentlemenHusky Ltee
2026-10-09ThegentlemenSAS H2O MICHEL
2026-10-09ThegentlemenRefako Autodele
2026-10-09ThegentlemenSkyplan Services
2026-10-09ThegentlemenKooltronic
2026-10-09ThegentlemenSmart Value
2026-10-09ThegentlemenGalil Engineering
2026-10-09ThegentlemenTGN
2026-10-09ThegentlemenGreenbrook Engineering
2026-10-09ThegentlemenAnyTech365
2026-10-09ThegentlemenAquatech
2026-10-09ThegentlemenSaskatoon Tribal Council
2026-10-09ThegentlemenDW McMillan Memorial Hospital
2026-10-09RhysidaAnne Arundel County
2026-10-09Settranorthshoresun.timesreview.com
2026-10-09Chaosastranahealth.com
2026-10-09ThegentlemenNorth Philadelphia Health SystemHealthcareUS
2026-10-09NightspirePMG Project Management GroupProfessional ServicesAE
2026-10-09AkiraTigerPress (DCC)Other
2026-10-09AkiraDesign ElectricManufacturing
2026-10-09AkiraYaremaOther
2026-10-09ThegentlemenDeloitteProfessional ServicesUS
2026-10-09BarracudaMinistarstvo poljoprivrede, šumarstva i ribarstvaAgriculture and Food ProductionHR
2026-10-09QilinHagiva YhNot FoundIL
2026-10-09RhysidaRealManageProfessional ServicesUS
2026-10-09TermiteiDentalSoftHealthcareBR
2026-10-09Black XbayerHealthcareDE
2026-10-09BravoxDudley Land CompanyOtherUS
2026-10-09ArcusmediaAETHOSNot FoundBR
2026-10-09ArcusmediamblllpNot FoundCA
2026-10-09ArcusmediaLadrillera MecanizadaManufacturingMX
2026-10-09Black XenTouchTechnologyJP
2026-10-09QilinMelchioni SpaManufacturingIT
2026-10-09EmperadorImperial Diamond JewelleryRetail & E-Commerce
2026-10-09Black XlopayFinancial ServicesGB
2026-10-09AnubisMyndHealthcare
2026-10-09InterlockShalom Christian AcademyEducationUS
2026-10-09QilinTepcompTechnologyFI
2026-10-09Threeamfleetworksinc.comTransportationUS
2026-10-09QilinVadeto GroupNot FoundSE
2026-10-09PanzersolutendTechnology
2026-10-09PanzerSupreme EnergyEnergy & UtilitiesSG
2026-10-09SafePaydwi-bau.deOtherDE
2026-10-09SafePayhoteldelfinolugano.chHospitalityCH
2026-10-09Deadlockidi pharmaHealthcareES
2026-10-09DeadlockSaber1Not FoundUS
2026-10-08SilentRansomGroupAndersen Group Inc.
2026-10-08SilentRansomGroupBaker McKenzie
2026-10-08SilentRansomGroupO'Hagan Meyer
2026-10-08NightspireKSL Dirtworks
2026-10-08NightspireDeese and Locklear Chiropractic Center
2026-10-08NightspireRoyal EGT
2026-10-08NightspireLumabuilt
2026-10-08NightspireINI Fiocruz
2026-10-08NightspireSinae Phuket Luxury Hotel
2026-10-08NightspireSociedad Portuaria Mardique S.A.
2026-10-08NightspireAsociación de Escribanos del Uruguay
2026-10-08Lockbit5avsa.com.ar
2026-10-08Lockbit5grunenwald.com
2026-10-08Lockbit5capitalbankhaiti.biz
2026-10-08Lockbit5consilio.com
2026-10-08Scarlettgroupyalebooks.yale.edu
2026-10-08StormTheraCare
2026-10-08NightspireNantou Shiuhkuang Senior High School.EducationTW
2026-10-08StormCooperative Des Techniciens Ambulanciers De La MonteHealthcareCA
2026-10-08EclipseGlobal AirFreight InternationalTransportationSG
2026-10-08EclipseDIPECARROtherBR
2026-10-08Eclipsesanjoseattorneys.comProfessional ServicesUS
2026-10-08Eclipsesimplexengg.inManufacturingIN
2026-10-08Eclipsedipecarr.com.brManufacturingBR
2026-10-08RunSomeWaresMorton LTC PharmacyHealthcareUS
2026-10-08Luna MothAndersen Group Inc.Professional Services
2026-10-08PayloadBoullard MusiqueRetail & E-CommerceCH
2026-10-08UmBraFSE, Cairo UniversityEducationEG
2026-10-08UmBraIIT RoorkeeEducationIN
2026-10-08UmBraManipal Academy of Higher EduEducationIN
2026-10-08Luna MothBaker McKenzieProfessional ServicesUS
2026-10-08QilinMCM TelecomTechnologyMX
2026-10-08UmBraSOCOCOTechnologyBR
2026-10-08NetrunnerMid Atlantic Gynecologic Oncology and Pelvic Surgery AssociatesHealthcareUS
2026-10-08Luna MothO'Hagan MeyerProfessional Services
2026-10-07SilentRansomGroupK...
2026-10-07TermiteAon
2026-10-07Incransomarchitekt-vondanwitz.de
2026-10-07Incransomharborpacific.com
2026-10-07Incransomacmestamping.com
2026-10-07IncransomCity of Cloverdale
2026-10-07IncransomUAE Pro League
2026-10-07IncransomTec Imports
2026-10-07IncransomWavecrest HFA
2026-10-07BYODGate | Crypto ExchangeFinancial ServicesSG
2026-10-07BYODTMobileTechnologyUS
2026-10-07QilinEPTISAProfessional ServicesES
Showing the 400 most recent of 418.

Detection coverage

34 attacker techniques were observed; 34 have at least one public detection rule.

TechniqueMentionsAlert rulesHunt rules
T1190 Exploit Public-Facing Application15108116
T1204.002 Malicious File107320
T1219 Remote Access Tools8264
T1547.001 Registry Run Keys / Startup Folder74012
T1053.005 Scheduled Task64527
T1059.001 PowerShell628946
T1078 Valid Accounts52539
T1505.003 Web Shell54424
T1068 Exploitation for Privilege Escalation47522
T1003.001 LSASS Memory38713
T1047 Windows Management Instrumentation36016
T1566.002 Spearphishing Link3364
T1567.002 Exfiltration to Cloud Storage3253
T1041 Exfiltration Over C2 Channel2203
T1055 Process Injection25218
T1059.002 AppleScript2252
T1059.003 Windows Command Shell26523
T1195.002 Compromise Software Supply Chain21521
T1204.001 Malicious Link252
T1566.001 Spearphishing Attachment2417
T1027 Obfuscated Files or Information113114
T1036 Masquerading11079
T1057 Process Discovery1195
T1071.001 Web Protocols16312
T1105 Ingress Tool Transfer113425
T1110.003 Password Spraying1303
T1486 Data Encrypted for Impact1267
T1539 Steal Web Session Cookie1190
T1565 Data Manipulation1200
T1566 Phishing1635
T1567 Exfiltration Over Web Service1411
T1574.001 DLL18820
T1595.002 Vulnerability Scanning180
T1685 Disable or Modify Tools112935

About this briefing

  • Risk: how bad it is if true (e.g. actively exploited, ransomware-linked, no patch, critical infrastructure).
  • Confidence: how sure we are: independent publishers agreeing, source reliability, official confirmation.
  • Urgency: how soon to act or read: CISA KEV listing and fix deadlines, exploitation in the wild, exploit probability (EPSS), missing patches, fast-rising coverage, freshness.
  • Priority orders the list from those three; it is not a score of its own.
  • A development is one real-world story merged from every report about it. Ransomware leak-site posts are shown in the Ransomware section.
  • Underground and law-enforcement items come from public reporting, not direct access. Indicators are defanged. Draft detections are experimental: test them before use.
  • Numbers in [brackets] and superscripts refer to the sources listed under each item.

Compiled from open-source reporting (vendor research, national CERTs, law enforcement, news) and public vulnerability data (CISA KEV, FIRST EPSS, NVD, MITRE ATT&CK).