2026-11-10

Huntress analyzed three Windows AhsayCBS servers breached Oct 8-11, 2026 via an auth bypass and unauthenticated SYSTEM RCE through /rps/api/json/UpdateReceivers.do. The operator planted five JSP webshell families (including a PNG-steganography loader and a signed-API shell), an XMRig miner relaunched by a SYSTEM scheduled task every minute, a MachineGuid-keyed Python implant launched from a Run key, tunneling tools (gost, chisel), RMM tools, Defender exclusions, and a NetExec-style Veeam credential query. Hunt for cbssvcX64.exe spawning cmd.exe, new .jsp files in webapps\cbs and webapps\rps, ahsay_* and Linux-style folders at the drive root, the kvm task, and python.exe under the SYSTEM profile.

Why it matters: Actively exploited internet-facing backup console with concrete huntable behaviors and backup-credential targeting.

Between Oct 14-26, 2026, an unknown actor used IAM credentials from Qubole's AWS account 805246085872 to assume trusted cross-account integration roles (with valid External IDs) in multiple customer AWS accounts, then enumerated resources, harvested secrets from Lambda env vars, Secrets Manager and SSM, validated found AWS/Entra ID/Okta credentials with TruffleHog, and exfiltrated S3 data. Wiz, Sentra and Mandiant confirm compromise of multiple victim environments. Hunt CloudTrail from Oct 1 for AssumeRole from 805246085872 with non-AWS sourceIPAddress, principal AIDA3W7DIFLYOLTK63SFS, session names starting quiam-, and TruffleHog user agents on GetCallerIdentity and IdP sign-ins.

Why it matters: Confirmed supply-chain compromise via trusted vendor role with concrete CloudTrail hunt guidance; affects any Qubole-integrated AWS account, even unused ones.

Google confirmed an exploit for CVE-2026-125350 exists in the wild, a use-after-free in Chrome's XML component that is the eighth Chrome zero-day exploited this year. Fixed in Stable 157.0.8103.50/.51 on desktop; Google has not shared attack details or victim information. Hunting guidance is not published in the sources, so defenders should prioritize ensuring Chrome desktop auto-updates are applied.

Why it matters: Actively exploited zero-day in a ubiquitous browser; no huntable behaviors published yet.

CISA added four vulnerabilities to the KEV catalog on 2026-11-09 with a 2026-11-12 due date: OpenSSH CVE-2026-123158 (authentication bypass on Linux builds, with Alpine/musl hosts named for update), GPUStack CVE-2026-102895 (unauthenticated admin access and secret disclosure), SignalWire FreeSwitch CVE-2026-116779 (code injection), and IBM Aspera Faspex CVE-2026-123218 (authenticated privilege escalation). The brief states GreyNoise observed a first confirmed successful exploitation of the OpenSSH flaw on Nov 7, but the CISA entries themselves print no exploitation details. Hunters should prioritize patch verification and review of OpenSSH authentication logs and GPUStack API activity.

Why it matters: Actively exploited, KEV-listed internet-facing components with a stated exploitation observation for OpenSSH; no concrete huntable behaviors printed in the sources provided.

Barracuda updated its advisory to confirm that two patched Email Security Gateway flaws are being exploited against a limited number of customers. Per BleepingComputer, CVE-2026-116606 is an authentication weakness allowing modification of global configuration, and CVE-2026-111560 allows unauthenticated OS command injection running as root; combined, they allow authorization bypass and root access, but require access to the Admin UI. Hunters should review Admin UI access logs and look for unexpected OS command execution from the appliance and unauthorized global configuration changes, and confirm patch status (BNSF-40425 for 9.4.017+, BNSF-40430 for earlier versions).

Why it matters: Vendor-confirmed active exploitation of internet-manageable email gateway appliances with root impact; patch and admin-interface lockdown are immediate.

QNAP warns that threat actors are exploiting Plex2Shell, a four-flaw chain in Plex Media Server, to compromise QNAP NAS devices; exploitation reportedly began in mid-October after PoC code was published, and QNAP says some users report their Plex servers appear compromised. Exploitation requires no valid credentials and grants code execution with the privileges of the Plex service, and QNAP's OS itself is not affected. Hunters should review internet-exposed Plex Media Server instances on QNAP for unexpected code execution by the Plex process, and remediate by updating to Plex Media Server 1.43.3 or later and rotating Plex and NAS passwords.

Why it matters: Actively exploited internet-facing media server software on widely deployed NAS devices with public PoC; no credentials needed.

Apple released security updates fixing two iMessage flaws (CVE-2026-113961 lets a remote attacker join a group chat and receive messages; CVE-2026-113960 exposes earlier messages to someone added to a group) and nine Bluetooth/AirPlay issues, with iOS/iPadOS 27.2.1 describing all three flaws. The sources state neither iMessage flaw has been confirmed exploited, and the notes do not say which devices are affected or offer workarounds. The updates also include a Google Brotli decoder fix (CVE-2026-111497) that is on CISA's KEV catalog, though the notes mention no attacks using it. No behavioral telemetry or hunting guidance is published, so the main action is patching.

Why it matters: Patch-driven story with no published exploitation or huntable behavior; the Brotli fix is KEV-listed, which keeps it above awareness-only. (raised to P1: exploited + behaviors/KEV)

Attackers using stolen CI credentials (bee-worker account) published bee-js 13.3.0 to npm and Swarm Desktop 0.56.2 via the project's signed build workflows. A loader fetches code from api.frameworkmetrics[.]xyz that exfiltrates config.yaml and swarm.key, installs a Go remote shell (evjawbreaker) on Linux/macOS under ~/.solidity with systemd/LaunchAgent persistence, and on Windows uses a UAC bypass, adds a Defender exclusion and installs a ScreenConnect client. No infection count or fund theft reported; hunt for npm postinstall network calls, ~/.solidity, the persistence units, and unexpected ScreenConnect services.

Why it matters: Supply-chain compromise with concrete huntable persistence/behaviors, but niche package with ~10 npm downloads.

Mittwald CM Service disclosed that attackers exploited a flaw in its Model Context Protocol (MCP) server, used to connect customer AI assistants to its mStudio hosting platform, and compromised 56 customer projects after eight days undetected. The source says it is unclear whether the flaw lies in Mittwald's own code or in open-source MCP libraries, and the claim of AI-assisted attacking is alleged and unconfirmed. The source does not print specific commands, IoCs, or detection queries; hunters should review MCP server access and logs for rapid multi-step activity and any access to customer projects.

Why it matters: Internet-facing MCP endpoint compromise with no published technical detail; worth a hunt this week, not a confirmed mass-exploitation campaign.

France's foreign ministry and C4 coordination center attributed October 11–12 attacks that remotely altered defrost settings on Danfoss refrigeration controllers at retail sites to the IRGC-affiliated Shahid Kaveh unit, with at least 15 fires reported. The sources describe the attribution, linked hacktivist personas (CyberAveng3rs, Soldiers of Solomon, Mr. Soul, Cyber Isnaad Front), and reconnaissance of Schneider Electric industrial systems using FOFA. The sources provide no technical detection content or indicators for the intrusion path, so hunters should focus on exposed industrial controller management interfaces and FOFA-style internet-exposed device reconnaissance.

Why it matters: Attributed state-backed OT/ICS sabotage against Danfoss refrigeration controllers, but sources give no concrete technical behaviors or indicators.

Russian state-linked group Turla deployed a modular .NET toolset called Cereal against government Exchange servers, documented by ESET in Kazakhstan and Romania. CerealBox injects into EdgeTransport.exe to hijack transport agent handlers and harvest selected email, while CerealNeuron receives encrypted web requests on Exchange-like paths and executes CerealRunner programs. ESET observed no external C2, so the compromised Exchange server served as the control point; hunters should look for unusual code in EdgeTransport.exe, encrypted web requests to Exchange-like paths, and the CerealRunner/CerealNeuron artifacts listed in ESET's GitHub IoCs.

Why it matters: Concrete huntable behaviors in Exchange, but targeting is government-focused and no CVE or mass exploitation is stated.

A researcher published more than 30 unpatched N-able N-central flaws, dubbed Able2Shell, with public exploit chains, and N-able took hosted instances offline. Per the brief, no CVEs have been assigned and no exploitation has been observed. Defenders should keep on-prem N-central servers off exposed networks until a hotfix ships and review authentication logs from November 8.

Why it matters: Unpatched management-platform flaws with public exploit chains warrant a hunt, but the brief reports no exploitation and no CVEs or technical sources were available.

SAP's November 2026 Security Patch Day fixed four flaws rated CVSS 10.0 that can be exploited without authentication, affecting the ICM, Web Dispatcher, Gateway and the SAML2 service provider in NetWeaver AS ABAP. Onapsis reports that the ICM and Web Dispatcher flaws (CVE-2026-76964 and CVE-2026-89126) stem from one WebSocket split-message bug it calls ICM2SHELL, with a working exploit running OS commands as <sid>adm, and that the Gateway flaw (CVE-2026-89103, PROXYGATE) can be abused through a permissive proxy list. The sources state that none of the flaws has been seen exploited in attacks. Hunters should review Web Dispatcher and gateway proxy configuration and look for SAML logons by privileged users from unexpected sources.

Why it matters: Unauthenticated CVSS 10.0 flaws in widely deployed SAP components with a public working exploit, but no confirmed exploitation and no concrete in-the-wild behaviors yet.

SANS ISC observed a campaign against SAP NetWeaver in honeypot data, with requests for /irj/servlet_jsp/irj/root/ant.jsp and many other upload and webshell paths from a single source, 82.26.72.21. The diary says the campaign exploits or searches for webshells left by CVE-2025-31324, an unauthenticated file upload flaw the diary describes as CVSS 10, and that webshells usually end up under /irj/servlet_jsp/irj/root/. Hunters should look for requests to ant.jsp or upload paths on SAP web servers and for unexpected files in that webroot; the source does not confirm any successful compromise.

Why it matters: Probing for webshells on a known exploited SAP flaw with concrete request paths, but the source reports only scanning and no confirmed compromise.

Fortinet FortiGuard Labs reports Bitter (TA397) targeting South Asian organizations with PapRAT, a new C++ and Rust RAT, via three infection chains: LNK abusing ftp.exe to run scripts and create scheduled tasks, VHDX containing an LNK that opens a decoy Excel file while installing an MSI, and URL files fetching an LNK over WebDAV that leads to an MSI. The LotL stage collects directory, task, AV, and drive information, saves it as abc.pdf, and exfiltrates it with curl. Hunt for ftp.exe launched from LNK files, schtasks creation, curl uploads, msiexec launched from LNK or mounted VHDX images, and WebDAV-fetched LNKs.

Why it matters: Regionally focused espionage campaign outside the financial sector; its LotL behaviors are still reusable for hunting.