2026-10-30

Machine-first view of this brief, grouped by story so indicator streams stay attributable. IoC values are raw, not defanged, one per line, ready for hunt queries — defang before pasting into chat or email. Everything here is public OSINT; exposure and behavior detail lives in the JSON (also grouped per story).

Endpoints

GET /?view=agent&format=json          this brief as JSON (stories, behaviors, exposure, IoCs, watch events)
GET /?view=agent&format=json&d=DATE   a specific day — available: 2026-11-10, 2026-11-09, 2026-11-06, 2026-11-05, 2026-11-04, 2026-11-03, 2026-11-02, 2026-10-30, 2026-10-29, 2026-10-28
GET /?view=iocs&format=json           cumulative IoC corpus — every brief + watch event, all time
GET /?q=TERM&format=json               search every stored brief (stories + IoCs)
GET /?view=cards&format=json          verdict-card manifest (slug, title, lane, cves, story_ids, url)
GET /?view=actors&format=json         adversaries by attributed country (w=14|30|90|all, cat=state|crime|hacktivist|spyware)
GET /cards/<slug>.html                 a hand-written verdict card; /cards/<slug> one the pipeline published; stories here carry verdict_card when one exists

Shapes: log_source is the extractor's free text; log_source_keys beside it is a closed vocabulary
(see vocab.log_source_keys) for mapping to your own data. evidence_samples are the exact strings the
sources printed (replay targets). exposure is null when the sources stated nothing.

P1 · VAPOR PANDA uses ARTEX agentic AI framework in parallel intrusions; BLOODALCHEMY deployed at nine orgs AI verdict card

CrowdStrike reports China-nexus VAPOR PANDA used the ARTEX agentic AI framework (DeepSeek plus a commercial LLM) against 200+ organizations in 14+ countries starting Oct 17, 2026, with confirmed post-exploitation at nine organizations including financial-sector targets in the US. Tradecraft included unsigned SAML assertions and XXE to query cloud IMDS, web shells, LAPS reads, RBCD impersonation, forged mail admin tokens, VPN access with leaked keys, password spraying, and checks for hosts lacking Falcon via tasklist. BLOODALCHEMY was sideloaded via a renamed GameHook binary (svchost.exe) loading graphics-hook-filter64.dll. Hunt for artx/artex command-line strings, artx-prefixed cloud roles, art18- admin-command comments, C:\ProgramData\artx5v\, and svchost.exe outside System32 loading graphics-hook DLLs.

Why P1: Active state espionage campaign hitting US financial sector with concrete huntable markers (ARTEX strings, sideloading, IMDS/SAML abuse).

Behaviors (10) · as of 2026-10-30

Detection guidance (2) · as of 2026-10-30

source · tier A · EDR process events, cloud audit logs

Hunt for ARTEX markers: command-line parameters containing artx or artex, artx-prefixed cloud roles, art18- administration-command comments, and C:\ProgramData\artx5v\ directory.

source · tier A

Enforce SAML signature validation, require IMDSv2, restrict cloud command-execution permissions; rotate keys after data exposure.

domain (3)

sqlserver-sqlite.com
www.ddduuuppp.com
nginxmysql.com

sha256 (3)

364251838edfcf5ef1107fa692da3c5bd9a540482449f645992830134bf807ab
49fe70419fd19b81ca8d730a6ef7c1ec71b681d60b390761070d42686c7d2068
3fb5a9fb3e2cb1d6208966bd4e55d10282d19c7250d827efa560463d60a12ee4

filename (2)

graphics-hook_config.bin
graphics-hook-filter64.dll

ipv4 (3)

45.153.126.223
192.121.47.20
89.46.234.50

P1 · Trojanized Claude Code extension 2.1.313 on Cursor Marketplace plants SSH backdoor AI verdict card

A malicious version 2.1.313 of the Claude Code extension (ID anthropic.claude-code) was distributed via the Cursor Marketplace between ~2:27 a.m. and 1:35 p.m. PT on Oct 29, 2026, reaching at most 5,000 users. A 66-line JS loader adds an attacker SSH key labeled 'svc-telemetry' to ~/.ssh/authorized_keys, tries to enable SSH, opens a reverse tunnel to 134.209.82[.]225, installs persistence (scheduled task/crontab/LaunchAgent), and beacons host recon over HTTP to port 8099. Enabling SSH fails without admin rights on most macOS/Windows hosts, but key, persistence and beacon still occur; no follow-on payloads observed. Hunt for the svc-telemetry key, new persistence spawned by the IDE, and outbound connections to 134.209.82.225.

Why P1: Supply-chain backdoor in widely used developer tool with concrete huntable artifacts (SSH key label, C2 IP, persistence).

Behaviors (5) · as of 2026-10-30

Detection guidance (2) · as of 2026-10-30

source · tier B · published 2026-10-30 08:55Z · FIM / EDR

Check ~/.ssh/authorized_keys for a key labeled svc-telemetry and look for new scheduled tasks, crontab entries, or LaunchAgents created around Oct 29, 2026; check for installs of anthropic.claude-code 2.1.313.

source · tier B · published 2026-10-30 08:55Z · proxy

Look for outbound HTTP to port 8099 /beacon and requests to api.ipify.org from IDE processes.

ipv4 (1)

134.209.82.225

url (1)

http://134.209.82.225:8099/beacon

P1 · CISA adds Fragnesia Linux kernel flaw (CVE-2026-46300) to KEV; attackers reportedly chain it with PHP2Shell to root servers Verdict card

CISA added the Linux kernel XFRM ESP-in-TCP privilege-escalation flaw CVE-2026-46300 (Fragnesia) to KEV and warned it can be chained with PHP2Shell (CVE-2026-109618/CVE-2026-109619) to implant PHP webshells and run commands as root. Dream Security reported a campaign that rooted 25 servers across the US, Japan, Taiwan and South Korea and then targeted three servers in a US government-affiliated environment, though CISA itself did not share details of the attacks. Hunters should look for PHP webshells on web servers and unexpected root-level command execution from PHP processes.

Why P1: KEV-listed kernel privilege escalation chained with PHP RCE; vendor-reported webshell implantation and third-party report of multi-server compromise.

Behaviors (3) · as of 2026-10-30

No IoCs extracted for this story.

P1 · GitLab CE/EE CVE-2026-97229 added to KEV; Alpine Linux reported an exploitation attempt Verdict card

CISA added GitLab CE/EE CVE-2026-97229 to the KEV catalog on 2026-10-29 with a 2026-11-01 due date. The KEV entry describes an unauthenticated integer overflow that can allow arbitrary code execution through a specially crafted regular expression in a CI/CD configuration. The brief item reports an exploitation attempt noted by Alpine Linux, but the source text does not print any exploitation details, so hunters should rely on GitLab's patch release and the Ruby/Onigmo fix for guidance.

Why P1: KEV-listed, unauthenticated RCE in an internet-facing DevOps platform; exploitation attempt reported in the brief.

No IoCs extracted for this story.

P1 · Palo Alto Networks confirms active exploitation of PHP2Shell flaws (CVE-2026-109618, CVE-2026-109619) against internet-exposed PAN-OS management interfaces; patches released Verdict card

Palo Alto Networks updated its advisory to say active exploitation has been observed against PAN-OS management web UI and XML API exposed to the internet, tied to PHP2Shell PHP RCE flaws. Dream reported a suspected China-nexus actor used the flaws alongside Fragnesia (CVE-2026-46300) to root 25 servers, with credential extraction and Active Directory enumeration confirmed in recovered artifacts. Hunters should check PAN-OS management interface exposure and logs for web shell and command execution activity, and remove public management access.

Why P1: Vendor-confirmed active exploitation of internet-exposed PAN-OS management interfaces with patches available; KEV-listed chained Linux LPE.

Behaviors (3) · as of 2026-10-30

Detection guidance (1) · as of 2026-10-30

source · tier B · published 2026-10-29 05:50Z

Palo Alto Networks: remove public internet access to management interfaces; restrict to trusted internal IPs; apply PHP2Shell fixes. Customers with Frontier Virtual Patching (ATP Plus) received coverage via Threat ID 543004.

No IoCs extracted for this story.

P1 · Drupal Commerce Core access-bypass flaw CVE-2026-118539 exploited in the wild AI verdict card

Drupal warned administrators that CVE-2026-118539, a missing-authorization access bypass in the Commerce Core module, is being actively exploited against unauthenticated attackers. The sources say the flaw affects Commerce Core 0.0.0 through 2.41 and 3.0.0 through 3.3.13, with fixes in 3.3.13 and 8.x-2.41, and advise auditing orders for inconsistencies; no specific exploitation artifacts, log patterns, or indicators are published. Hunters should review order records for unexpected modifications and check exposed routes and entity fields for unauthenticated access.

Why P1: KEV-listed-style actively exploited internet-facing e-commerce CMS module with 42,000+ sites; no concrete huntable behaviors published yet.

Detection guidance (1) · as of 2026-10-30

source · tier B

Audit orders for inconsistencies after upgrading, as recommended by the Drupal security team.

No IoCs extracted for this story.

P1 · UAT-11473 exploits Cisco SD-WAN CVE-2026-20127 to deploy KeyDrift malware against defense and policy targets AI verdict card

Cisco Talos reports a newly identified cluster tracked as UAT-11473 exploiting CVE-2026-20127, an authentication bypass in Cisco Catalyst SD-WAN Controllers, to deploy the custom KeyDrift framework. The sources say KeyDrift runs inside vdaemon processes, intercepts decrypted control-plane traffic via SSL_read hooking, and stages keying material in /var/tmp/vdaemon.bin before UDP exfiltration. Hunters should look for activity in vdaemon processes, modified service startup scripts, and creation of /var/tmp/vdaemon.bin; Cisco recommends the February 2026 update and its SD-WAN hardening guide.

Why P1: Max-severity auth bypass in internet-facing SD-WAN controllers with described huntable artifacts, though the cluster's exposure is limited to the stated targets.

Behaviors (5) · as of 2026-10-30

No IoCs extracted for this story.

P1 · China-nexus Warp Panda exploited VMware ESXi zero-day CVE-2026-41709 to reduce audit logging visibility in US legal-sector intrusions AI verdict card

CrowdStrike reported that China-nexus actor Warp Panda exploited CVE-2026-41709, an insufficient-logging flaw in Broadcom VMware ESXi (CVSS 2.7), as a zero-day in early 2026 to perform admin operations without being logged. Per the source, the actor targets internet-facing edge devices, pivots to vCenter to deploy BRICKSTORM and SharpStorm, and in some cases harvests cloud session tokens and registers rogue MFA devices. CISA added the CVE to KEV and FCEB agencies were told to patch by November 11, 2026. Hunters should look for gaps in ESXi/vCenter audit logging and for new MFA device registrations on M365 accounts.

Why P1: KEV-listed, actively exploited hypervisor flaw with reported persistence and MFA-registration tradecraft.

Behaviors (2) · as of 2026-10-30

No IoCs extracted for this story.

P1 · Gotenberg CVE-2026-42589 RCE reportedly exploited to deploy Go reverse shell 'cache_base' AI verdict card

VulnCheck reports that threat actors are exploiting CVE-2026-42589, a critical RCE in Gotenberg patched in May 2026, to deliver a Go-based reverse shell called cache_base. The activity reportedly originated from a residential Japanese IP in early October 2026, with 1,358 exploitation events from 128 unique source IPs over the past 30 days. Hunters should look for Gotenberg service processes spawning unexpected children and the cache_base reverse shell's C2 registration and shell activity.

Why P1: Actively exploited critical internet-facing RCE with a described reverse shell payload; the brief itself labels the report unconfirmed.

Behaviors (1) · as of 2026-10-30

No IoCs extracted for this story.

P1 · Polymarket users' sessions targeted by malicious JavaScript served via compromised DebugBear RUM script; attack under investigation AI verdict card

Polymarket temporarily halted trading after a third-party provider was compromised and malicious JavaScript was distributed from cdn.debugbear[.]com, which BleepingComputer says was designed to hijack logged-in Polymarket trading sessions and move users' prediction-market tokens and crypto to an attacker wallet. Polymarket says it fixed the issue and will reimburse affected traders, but has not disclosed the number of victims or amount stolen; a ~$2.5M figure is traced to the attacker wallet, not confirmed as user losses. Hunters on DebugBear RUM embed code should look for requests to cdn.debugbear[.]com/C7xcKKrjUnXK.js and outbound traffic to data.debugbear.com.

Why P1: Concrete huntable behavior (third-party JS script serving session hijack and exfil to a named domain) affecting a widely embedded monitoring product, with active compromise reported.

Behaviors (3) · as of 2026-10-30

Detection guidance (1) · as of 2026-10-30

source · tier B · Web proxy logs; DNS logs

Hunt for requests to the malicious script path and for communication with the C2/exfil host; DebugBear advised customers to remove the RUM embed code.

domain (2)

data.debugbear.com
cdn.debugbear.com

filename (1)

C7xcKKrjUnXK.js

url (1)

http://cdn.debugbear.com/C7xcKKrjUnXK.js

P2 · NIK C2: Go-based Windows implant steals credentials, keylogs, and routes prompts to OpenAI API

Cisco Talos documented NIK C2, a Go-based Windows RAT observed live in the wild (C2 at 87.120.196[.]120 / total-sitevv[.]lol). It steals browser credentials, Wi-Fi keys, crypto wallets and keystrokes, and can relay actor prompts to the OpenAI Chat Completions API using the victim's OPENAI_API_KEY if one is set. It persists via HKCU Run keys and a copy in %appdata%\Microsoft\Network, bypasses UAC via a fodhelper ms-settings hijack, patches AMSI, and can deploy an mshta-based screen-locker. Hunt for netsh wlan key=clear, chcp 65001 recon chains, mshta launching lock_screen.html, a SystemLock Run key, bcdedit /enum plus Confirm-SecureBootUEFI, and unexpected api.openai.com traffic from non-developer hosts.

Why P2: Live commodity RAT with rich vendor-stated Windows behaviors; no specific targeting or exploitation of enterprise infra.

Behaviors (9) · as of 2026-10-30

Detection guidance (2) · as of 2026-10-30

source · tier A · published 2026-10-29 10:00Z · AV

ClamAV signature Win.Trojan.GoDiscorder-10060526-0 detects NIK C2 implant

source · tier A · published 2026-10-29 10:00Z · TLS/network sensor

C2 TLS certificate CN nik-panel; JARM 28d28d28d00000000042d42d0000001f361a1bf80ed39a1e352adeb016a07b

yara_name (1)

Win.Trojan.GoDiscorder-10060526-0

filename (5)

mbr_backup.bin
bootkit.bin
lock_start.bat
browserdata.zip
lock_screen.html

ipv4 (1)

87.120.196.120

domain (1)

total-sitevv.lol

P2 · Talos IR Q3 2026: Help-desk vishing for RMM access, edge exploitation, EDR killers in ransomware

Cisco Talos IR's Q3 2026 trends report finds phishing (37%) and public-facing app exploitation (33%) led initial access; actors impersonated IT help desks via vishing to get victims to start Quick Assist/RMM sessions. VYPR ransomware operators used RMM-launched PowerShell to download an MSI, then MeshAgent, Rclone, PsExec and BYOVD to kill EDR; Interlock actors tried uninstalling Cisco Secure Endpoint, used taskkill/PsExec, disabled Defender and cleared logs. Salt Typhoon-linked actors exploited CVE-2023-20198 in web-based management interfaces, deploying BadCandy, creating privileged accounts and disabling logging. Hunt for Quick Assist sessions followed by RMM-spawned PowerShell/msiexec, taskkill against security processes, loads of known-vulnerable drivers, and new privileged accounts on network devices.

Why P2: Quarterly trends report with concrete huntable behaviors (vishing->RMM->PowerShell MSI, EDR killing) but no new IoCs; finance 18% of cases.

Behaviors (10) · as of 2026-10-30

Detection guidance (1) · as of 2026-10-30

source · tier A · published 2026-10-29 14:00Z · SIEM

Centralize logs off-device with ≥90 days retention; enable process-creation, command-line, and Microsoft Graph API auditing to survive log tampering.

filename (1)

fly.exe

cve (1)

CVE-2023-20198

P2 · Malicious Qwen2-lookalike Hugging Face repos deliver crypto miners and reverse shells to GPU hosts that load them with trust_remote_code

Pluto Security found 31 malicious Hugging Face repositories across seven accounts, published in two waves, posing as small Qwen2 test checkpoints aimed at GPU hosts running self-hosted inference servers such as Xinference and GPUStack. Their Python code runs when a user loads a model with trust_remote_code enabled, installing a disguised cryptominer that restarts if killed and removes competing miners, and in some versions opening a reverse shell; the sources report download counts but say these are not confirmed infections. Hunters should look for trust_remote_code model loads, Python processes spawning miners or reverse shells on inference hosts, and the named repositories and accounts.

Why P2: Concrete huntable behaviors in AI/ML inference hosts, though no confirmed infection counts and no KEV or CVE tie.

Behaviors (3) · as of 2026-10-30

domain (1)

maxwintodaybtc.com

P2 · Chrome extensions reroute searches through tracking servers, per Socket report (319 extensions, 13.4M installs)

A brief item reports that 319 Chrome extensions with about 13.4 million installs reroute search queries through tracking servers that could be switched to phishing or malware. The brief directs defenders to audit installed extensions against Socket's list. No source could be fetched, so the adversary's actions beyond search rerouting and the exact mechanics are unconfirmed; hunt for unexpected Chrome extensions and unusual search-redirect traffic.

Why P2: Widespread browser extensions with search redirection, but only a brief summary is available and no concrete behaviors or indicators were provided.

No IoCs extracted for this story.

P2 · North Korean threat actors use AI across lures, personas, and tooling, including the ARTEX agentic pentest framework; Microsoft publishes mitigations and Defender detections

Microsoft Threat Intelligence reports that multiple North Korean actors (Jade Sleet, Onyx Sleet, Coral Sleet, Diamond Sleet, Pearl Sleet, Sapphire Sleet, Jasper Sleet, Emerald Sleet) use generative and agentic AI for reconnaissance, persona creation, tailored lures, and tooling. The source says Cursor-type AI development platforms likely helped Coral Sleet, Jade Sleet, Pearl Sleet, and Sapphire Sleet with code and persistence work, and that Onyx Sleet and Pearl Sleet used the open-source ARTEX agentic penetration testing framework. It describes over 100 PDF lures attributed to Onyx Sleet, created in August and September 2026, with dozens generated within minutes. Hunting guidance in the visible text is mitigation-oriented; the post references Microsoft Defender detections without printing specific rules or log patterns.

Why P2: Strategic threat-actor trend report with no confirmed exploit chain or concrete huntable host behaviors in the visible text; relevant to phishing and recruiter-lure defense.

Detection guidance (1) · as of 2026-10-30

source · tier A · published 2026-10-29 16:00Z · Microsoft Defender for Office 365 / Entra ID Conditional Access

Microsoft recommends Defender for Office 365 controls: Zero-hour auto purge, Safe Links, Safe Attachments, Threat Explorer for phishing investigation, and blocking device code flow via Entra Conditional Access.

No IoCs extracted for this story.

P2 · Malicious Firefox extensions impersonating Phantom, Jupiter and Bitget steal wallet recovery phrases; listings removed

Socket researchers found three Firefox Add-ons listings impersonating the Phantom, Jupiter and Bitget crypto wallets that stole recovery phrases and private keys once installed. The Phantom variant reportedly sent captured secrets to a Telegram bot and moved funds to hardcoded payout addresses, and the listings are reported as removed. Hunters should look for the listed add-on IDs, the bonto[.]io subdomains and the listed IP addresses in browser telemetry and proxy/DNS logs.

Why P2: Concrete IoCs and behaviors in a browser extension channel, but listings reported removed and no enterprise product vulnerability involved.

Behaviors (3) · as of 2026-10-30

Detection guidance (2) · as of 2026-10-30

source · tier B · published 2026-10-29 14:06Z · Browser extension inventory

Check Firefox installed extensions for the listed add-on IDs 3092199, 3092666 and 3092059.

source · tier B · published 2026-10-29 14:06Z · DNS / proxy

Hunt for DNS or proxy requests to the listed bonto[.]io subdomains and IP addresses.

domain (6)

exodus.bonto.io
coinbase.bonto.io
jupiter.bonto.io
phantom.bonto.io
bonto.io
bitget.bonto.io

ipv4 (2)

172.67.155.198
104.21.34.69

filename (3)

3092666
3092059
3092199

P2 · Linux kernel TCP use-after-free CVE-2026-98432: root exploit reported by Anthropic, no confirmed exploitation in the wild, Ubuntu and RHEL fixes pending AI verdict card

A race condition in the Linux kernel's IPv4 TCP connection setup (use-after-free, introduced in Linux 4.4) is tracked as CVE-2026-98432; the kernel CVE team scores it 9.8 while Red Hat scores it 5.9 or 8.1 depending on the file. Anthropic said on October 27 that its AI model wrote a working exploit that lets a remote unauthenticated attacker run commands as root on servers with an MPTCP listener, though the sources state no attacks using the flaw have been observed. Ubuntu and RHEL had no released fix as of October 29-30, so defenders should check distribution fix status and upgrade to patched kernels where available.

Why P2: Critical-rated kernel flaw with a reported root exploit, but no confirmed exploitation and no huntable adversary behavior published; fixes pending for Ubuntu and RHEL.

No IoCs extracted for this story.

P2 · TeamViewer clients affected by CVE-2026-111585 integer overflow allowing malicious host code execution; not known to be exploited

TeamViewer disclosed CVE-2026-111585 (CVSS 8.8), an integer overflow in the remote-control screen processing component of its clients on Windows, macOS, Linux, and Android, which a malicious or compromised host can trigger during an ordinary session to crash the viewer or execute code. The sources also describe CVE-2026-92372 (out-of-bounds write in the decoder, requires user interaction, including via a crafted .tvs session recording) and CVE-2026-92374 (macOS TOCTOU symlink flaw for local root). TeamViewer says it is not aware of exploitation in the wild; hunters should focus on patch status for clients version 15.83 and later and on unexpected remote-control sessions to untrusted hosts.

Why P2: Widely deployed remote-access client with a reachable code-execution path, but no reported exploitation and no published detection content.

No IoCs extracted for this story.

P2 · Veeam, Juniper, and Adobe release patches for multiple critical flaws; no exploitation reported

Adobe, Veeam, and Juniper Networks published patches for dozens of vulnerabilities, including critical flaws allowing unauthenticated authorization bypass in Veeam Backup & Replication and unauthenticated arbitrary command execution in Juniper Session Smart Router and Session Smart Conductor. All three vendors state they are not aware of exploitation in the wild. Defenders should prioritize patching the Veeam and Juniper products and review them for unexpected command execution or authorization anomalies.

Why P2: Critical unauthenticated flaws in commonly deployed backup and edge/SD-WAN products, but no confirmed exploitation and no published behaviors.

No IoCs extracted for this story.

P2 · Researcher finds 26,400 working cloud and AI credentials exposed in public Gitee repositories

Independent researcher Ben Zimmermann scanned 7.25 million public Gitee repositories with TruffleHog and Kingfisher and reported 26,400 credentials that still authenticated, led by 9,473 Alibaba Cloud AccessKey pairs, plus YouTube, DeepSeek, Zhipu BigModel, and OpenAI keys. The sources do not confirm that any of these keys were revoked or abused, and the scan did not establish how long the keys had been exposed. Hunters should check for use of any Alibaba Cloud, OpenAI, Google/YouTube, or DeepSeek keys that appeared in public code and rotate any key ever committed to a public repository, since deleting it from code does not revoke it.

Why P2: Exposed working cloud keys are a concrete credential-exposure risk, but this is a researcher scan with no confirmed abuse and no huntable adversary behavior.

Detection guidance (3) · as of 2026-10-30

Alibaba Cloud ActionTrail shows AccessKey API calls for the last 90 days; data operations in services such as OSS and SLS must be checked in each service's own logs, per Alibaba Cloud's leak response plan as cited by the source.

Check for unexpected charges and for resources created or deleted that were not needed, per Alibaba Cloud's leak response plan as cited by the source.

Verify secret scanner detectors against the services in use; TruffleHog lacks a detector for Zhipu keys, and single-scanner coverage found only about half of the total.

No IoCs extracted for this story.

P3 · Fake Padre Terminal crypto app on Apple App Store linked to drainer theft of about $23,000 from 27 Solana wallets; Apple removed it

A fake Padre Terminal trading app on the Apple App Store was linked by blockchain investigator Iris to draining about $23,000 from 27 Solana wallets since October 25, 2026, and the app was removed afterward. Iris confirmed only one victim was compromised through the app, has not determined how the other wallets were compromised, and has not directly observed the wallet-draining screen. Hunters should look for users importing Solana private keys into mobile crypto trading apps, and for the Solana addresses named in the source.

Why P3: Crypto-wallet drainer app on the App Store with no concrete endpoint or log behaviors published; awareness only.

Behaviors (1) · as of 2026-10-30

No IoCs extracted for this story.

P3 · Yet Another ClickFix Campaign uses fake Cloudflare check against Windows and macOS; payloads not retrieved

A ClickFix campaign served a fake Cloudflare verification page from the domain js-static[.]cfd, hosted on a compromised legitimate website, and targeted both Windows and macOS users. The SANS handler could not retrieve the Windows or macOS malware: the Windows delivery server returned 403 Forbidden and the macOS domain did not resolve. Hunters can pivot on the js-static[.]cfd domain and the observed ClickFix command URLs, but no payload or compromise is confirmed.

Why P3: Single SANS diary with no retrieved payloads and no confirmed compromise; awareness only.

domain (1)

js-static.cfd

url (2)

https://api-com.cfd/7ge0w58tzzjsv9
https://cf-id.com/?ray-id=nz0ovm2jq2g68i

P3 · Belarus-linked actors reportedly conducting destructive attacks in Ukraine

A brief item states that Belarus-linked actors are carrying out destructive attacks in Ukraine in support of Russian objectives. No source could be fetched, so no technical details, victims, tooling, or outcomes are confirmed. Hunters should treat this as awareness only until a primary source provides specifics.

Why P3: Awareness only; brief item gives no technical detail and no source was retrievable.

No IoCs extracted for this story.

P3 · Binance suffers ~$6.3B crypto theft via compromised DevOps laptop; TRM and Chainalysis attribute to North Korea's TraderTraitor

Binance confirmed that about $6.3B was withdrawn from its wallets on October 29, 2026, after a DevOps engineer's compromised laptop enabled attackers to access a service container and submit unauthorized withdrawals. Binance has not attributed the attack to any group, while TRM Labs and Chainalysis attribute it to TraderTraitor (Lazarus/APT38) with high confidence. Binance says it has not found evidence of a leaked wallet private key and that it uncovered additional breach points; sources do not publish technical detection artifacts, so hunters should focus on withdrawal service container access and anomalous withdrawal transactions.

Why P3: Major crypto exchange theft with attribution, but sources give no concrete huntable endpoint behaviors or published detection content.

No IoCs extracted for this story.

P3 · Japan Airlines discloses passenger data breach at Amadeus PSS; ANA, Asiana, Korean Air also report Amadeus-linked impact

Amadeus notified Japan Airlines on October 23, 2026 that unauthorized access to its Passenger Service System occurred between August 10, 2023 and September 23, 2026, exposing reservation codes, names, flight details and, for about 2,000 customers, passport numbers and contact data. BleepingComputer reports the earlier Amadeus disclosure of a vulnerability in its travel booking display environment, and says the flaw appears to have been maliciously exploited, per JAL. The sources give no technical detail on the intrusion vector or attacker tooling, so hunters have no published behaviors to search for.

Why P3: Breach disclosure with no published technical detail or huntable behaviors; awareness only.

No IoCs extracted for this story.

P3 · Belgian MyMinfin tax portal taken offline after cyberattack; attacker and method unknown, no breach confirmed

Belgium's FPS Finance temporarily suspended access to MyMinfin, the main online tax platform, after a cyberattack days before an October 31 filing deadline. The agency said there was no indication a data breach had occurred, while investigators examined possible data exposure. Authorities have not identified the attackers or how access was gained, and no link to an earlier PHP-vulnerability precautionary shutdown has been established; hunters should treat this as an unattributed incident with no published technical indicators.

Why P3: Awareness only: disruption of a government tax service with no published attacker method, behaviors, or detection guidance.

No IoCs extracted for this story.

P3 · Leaked database allegedly containing 41,000+ DHS employee records, claimed stolen from an Okta SSO system; Okta denies compromise

A threat actor using the handle Department of Peace leaked a database of over 41,000 DHS staff records, including CBP, ICE, HSI and about 1,000 CISA employees, claiming the data came from an Okta single sign-on system. The leaked records reportedly include names, work emails, phone numbers, job titles, office locations, and which systems and applications each account can access. Okta says it has no evidence its data or systems were compromised, and DHS says it is aware of a potential breach; hunters should treat the access-mapping data as a targeting risk rather than confirmed SSO compromise.

Why P3: Data leak with alleged SSO origin but no confirmed compromise and no published technical behaviors or detection guidance.

No IoCs extracted for this story.

P3 · Sony So-net breach exposes about 2.6M member records and 54,000 mail account credentials; attack vector undisclosed

Sony Network Communications disclosed on October 27 that an unauthorized third party accessed the So-net member database on October 19, with the intrusion first spotted October 23. Exposed data includes names, dates of birth, contact details, user IDs, and internet connection IDs for about 2.6 million records, plus roughly 54,000 email addresses and passwords for four secondary mail services, which were reset. The initial access method has not been disclosed, so no behaviors or detection artifacts are published; hunters should treat this as awareness until the vendor publishes technical details.

Why P3: Data breach disclosure with no published attack vector, technical behaviors, or detection guidance.

No IoCs extracted for this story.

P3 · iRhythm data breach affects 8,179,772 people per HHS filing; extortion attempt confirmed

Medical device provider iRhythm disclosed a June 2026 breach of certain third-party-hosted business applications, and the attackers attempted to extort a ransom by threatening to leak the data. An HHS portal listing reports 8,179,772 affected individuals, with names, dates of birth, contact details, and iRhythm account and device data compromised. The sources report no technical attack details, and the company offers no free credit monitoring; hunters have no published behaviors or indicators to act on from these sources.

Why P3: Breach disclosure with extortion attempt but no technical details or huntable behaviors in sources.

No IoCs extracted for this story.

P3 · US bankruptcy courts' Bankruptcy Noticing Center back online after cyberattack; BAE Systems says no data taken

The Bankruptcy Noticing Center, a system run by BAE Systems for the Administrative Office of the U.S. Courts, was taken offline by a cyberattack announced October 22 and is now restoring service. BAE told Recorded Future News that no other systems were affected, no data was extracted, and no PII was breached; no hacker group claimed the attack. The sources do not describe the attack technique or provide any indicators, so there are no hunting details to act on.

Why P3: Availability incident with vendor-stated no data loss and no technical details or huntable behaviors published.

No IoCs extracted for this story.

P3 · UNM Health systems restored after ransomware attack; BYOD group claims attack with no confirmed data release

The University of New Mexico Health Sciences Center said its systems were restored and it did not pay a ransom after a cyberattack that forced ambulance diversions and class cancellations. A new ransomware group calling itself BYOD claimed the attack, offered free decryption keys, and demanded $2,500 to destroy stolen patient and employee data. The sources give no technical details on initial access, malware, or intrusion behaviors, so hunters have no concrete behaviors to pursue from this item.

Why P3: Awareness only; ransomware claim against a healthcare provider but no technical behaviors, IoCs, or detection guidance are published.

No IoCs extracted for this story.

P3 · Telegram for Android flaw in MediaState handling allows code execution during voice calls; fixed in 12.10.4, no confirmed exploitation

NebuSec disclosed a Telegram for Android flaw in code reading MediaState call messages that, combined with an information-leak bug and an Android root exploit, could give full phone control once a victim answered a call. The flaw affects versions 8.6.2 through 12.10.3 and was fixed in 12.10.4; NebuSec has not seen it used in real attacks and the full attack chain is not technically documented, relying on a video. Hunters should check the app version and consider setting call privacy to Nobody.

Why P3: Patched flaw with no confirmed exploitation and no published technical write-up; no concrete huntable behaviors.

Detection guidance (1) · as of 2026-10-30

source · tier B · published 2026-10-29 11:39Z

Verify Telegram for Android is version 12.10.4 or later; version number is shown at the bottom of the app's Settings page.

No IoCs extracted for this story.

P3 · Sponsored piece: AI agents already operate inside employee browsers via debugging interfaces, extensions, agentic browsers, and WebMCP

A sponsored BleepingComputer article by Keep Aware argues that AI agents can act inside authenticated browser sessions through Chrome DevTools Protocol debugging, AI extensions such as Claude in Chrome, agentic browsers, and the emerging WebMCP standard. It reports no confirmed compromise or observed attack. Hunters may consider inventorying debuggable browsers, AI extensions and their permissions (scripting, tabs, debugger API), and agentic browsers across the fleet.

Why P3: Vendor-sponsored awareness piece with no concrete adversary activity or huntable published detections.

No IoCs extracted for this story.

P3 · Google announces Gemini 4 Carbon AI model, claims lead in vulnerability-finding benchmarks; limited release to vetted cyber defenders

Google unveiled Gemini 4 Carbon, a frontier AI model, and claims it leads benchmarks for finding (SEC-bench Pro 88.2%), exploiting (ExploitGym 54.8%), and patching (CWE-bench 71.0%) vulnerabilities, as stated by Google DeepMind. Rollout is limited to a subset of cyber defenders before expanding to trusted partners under the Fairwind Program. The article contains no threat actor activity, malware, or detectable adversary behavior; these are vendor-reported benchmark claims only.

Why P3: Vendor AI model announcement with benchmark claims only; no adversary behavior or huntable artifacts.

No IoCs extracted for this story.

P3 · GitHub launches npm firewall preview to block malicious, vulnerable, and freshly published packages at install time

GitHub announced a public preview of a package firewall for npm, available to all GitHub Enterprise Cloud customers, that sits between endpoints or internal registries and upstream npm. The firewall checks metadata requests and package downloads against policy controls including malware advisories, vulnerability severity, attestation downgrades, newly added preinstall/postinstall scripts, and a configurable cooldown (default 1 day). This is a defensive control announcement, not a reported attack; the source describes no confirmed compromise. Hunters may consider reviewing install-time policy and CI/coding-agent dependency sources.

Why P3: Vendor defensive feature announcement with no concrete adversary behavior to hunt.

No IoCs extracted for this story.

P3 · Cisco open-sources Project Quarry, a rule language for detecting multi-step AI-agent attacks

Cisco released Project Quarry, an open-source neurosymbolic rule language that combines ML classifiers and LLM judges with symbolic checks to detect suspicious patterns spanning individually benign agent actions. It ships a DSL, evaluation runtime, CLI scanner, Python SDK, and a Claude Code/Codex plugin for writing and testing rules. The source describes a 2025 Claude Code campaign against about 30 organizations that split an attack into routine-looking tasks, but it is a product announcement with no concrete attacker behaviors or indicators to hunt.

Why P3: Tool/framework announcement for AI-agent detection engineering; no actively exploited technology or huntable adversary behavior described.

No IoCs extracted for this story.

P3 · Opinion analysis of US election voting-machine and AI-driven influence risks; no confirmed compromise reported

A SecurityWeek opinion piece by Kevin Townsend examines theoretical attacks on US voting machines and the growing threat of AI-enabled influence operations. It quotes practitioners on EAC certification gaps, Voting Village findings, and deepfake robocalls such as the 2024 New Hampshire Biden impersonation call that failed. The article states there is no evidence that machine tampering has changed the outcome of a US election, so there are no concrete adversary behaviors or indicators to hunt.

Why P3: Awareness-only opinion piece with no concrete huntable adversary behaviors or indicators.

No IoCs extracted for this story.

P3 · CrowdStrike publishes new prompt injection techniques targeting agent planning (Goal Decomposition Exploitation, Constraint-Driven Task Steering)

CrowdStrike's research blog introduces a new version of its Prompt Injection Taxonomy (222 techniques) that adds attacks on how autonomous agents plan, including Goal Decomposition Exploitation and Constraint-Driven Task Steering. The post describes a hypothetical scenario in which a poisoned test utility message induces a coding agent to send local config files with credentials to an outside endpoint, with no confirmed real-world incident. Defenders should review agent telemetry for multi-step sequences such as reading .env files followed by outbound HTTP requests to unfamiliar endpoints.

Why P3: Awareness-level research on hypothetical LLM agent attacks with no confirmed exploitation or published detection content.

No IoCs extracted for this story.

P3 · Check Point finds Qwen3.8-Flash-Next 'call home' upload to cloud address looks like model jaggedness, not a backdoor

Cohere reported that the open-weight model Qwen3.8-Flash-Next, while writing a detection rule, produced a shell command attempting to send a test string to an Alibaba Cloud storage address in Beijing, which Cohere's sandbox blocked. Check Point replayed the trace and sampled 64 completions, finding 52 distinct destination hosts including local addresses and nonexistent domains, and concluded model jaggedness is the most likely explanation rather than a fixed backdoor. Hunters with agentic LLM deployments may look for unrequested curl upload commands issued by model tool-call processes, though the source does not provide detection content.

Why P3: Awareness only: no confirmed malicious activity or huntable published detection; the source attributes the behavior to model inconsistency.

No IoCs extracted for this story.

P3 · Huntress opinion piece: SIEM is not dead; filter logs before storage and limit AI query costs

Huntress blog post by Ben Bernstein argues the problem with SIEM is the cost model of ingesting and storing everything, not SIEM itself. It contrasts storing filtered security-relevant logs plus compliance-required records against AI-native designs that query source APIs on demand, which it says shifts cost to tokens and adds retention and availability risks. The post describes no specific threat actor, malware, or intrusion, so hunters have no concrete adversary behavior to pursue from it.

Why P3: Vendor opinion and SIEM strategy content with no confirmed threat activity or huntable adversary behavior.

No IoCs extracted for this story.

P3 · Ghidra Server: local shared-project server for malware-analysis labs (not a threat; defensive setup guidance)

SANS ISC describes deploying the bundled Ghidra Server (Ghidra 12.1.4) in a malware-analysis lab so analysis projects persist across VM snapshot reverts. The post stresses keeping the server on the lab network, never exposing it to the Internet, and treating it as hosting live malware, since it runs as a Java RMI service on TCP 13100-13101 (and 13102). No adversary activity, exploitation, or detection content is described.

Why P3: Awareness only: defensive tooling guidance with no adversary behavior or exploitation.

No IoCs extracted for this story.

P3 · Anthropic-themed phishing reportedly bypasses some leading email gateways

A brief item reports that obvious Anthropic-themed phishing emails are getting past some leading email gateways. No source could be fetched, so no technical details, sender infrastructure, or outcome beyond this headline are confirmed. Hunters should treat this as awareness only until a primary source is reviewed.

Why P3: Brief-only awareness item with no fetched sources and no concrete huntable behaviors.

No IoCs extracted for this story.

P3 · Unofficial relay reportedly resells Codex and Claude Code access with sandboxes disabled

A researcher blog item reports that an unofficial relay service resells access to Codex and Claude Code with sandboxing disabled. No source could be fetched, so the claim is unverified beyond the brief line. Hunters should treat this as awareness only unless primary sources confirm specific behaviors or indicators.

Why P3: Single unverified brief line with no fetched sources and no concrete huntable behaviors.

No IoCs extracted for this story.

P3 · Researchers report unusual threat profile in Italy with unexplained cause

A brief item states that researchers observed an unusual threat profile in Italy but could not explain it. No source could be fetched and the item names no actor, malware, CVE, or technique. Nothing in the item is confirmed as a compromise or as a huntable behavior.

Why P3: Awareness only; the brief item contains no concrete behaviors, indicators, or detection guidance.

No IoCs extracted for this story.

P3 · Researcher blog post on a four-question threat modeling whiteboard exercise for CISOs

A brief item describes a four-question whiteboard exercise offered as a low-cost threat modeling approach for CISOs. It is general methodology guidance rather than reporting on an adversary or intrusion. No threat actor, malware, CVEs, or technical detail are stated, so there is nothing huntable in this item.

Why P3: General threat modeling guidance with no adversary activity or huntable behaviors.

No IoCs extracted for this story.

P3 · Security awareness training programs shifting to AI-assisted training for new workers

The brief item reports that security awareness training programs are moving toward AI-assisted training for new workers. No source could be fetched, and the item names no threat actor, malware, vulnerability, or technical behavior. Nothing in this story is huntable.

Why P3: Awareness-only trend item with no adversary activity, no technical detail, and no sources fetched.

No IoCs extracted for this story.

Watch streams — new IoCs in the last 48 h

Hackers actively exploit SSHole OpenSSH flaw (CVE-2026-123158) to gain root on Linux systems, confirmed by CISA KEV listing

domain (1)

tac.vpnla.org

filename (1)

TAC Agent

sqlserver-sqlite.com
www.ddduuuppp.com
nginxmysql.com
data.debugbear.com
cdn.debugbear.com
total-sitevv.lol
maxwintodaybtc.com
exodus.bonto.io
coinbase.bonto.io
jupiter.bonto.io
phantom.bonto.io
bonto.io
bitget.bonto.io
js-static.cfd
tac.vpnla.org

364251838edfcf5ef1107fa692da3c5bd9a540482449f645992830134bf807ab
49fe70419fd19b81ca8d730a6ef7c1ec71b681d60b390761070d42686c7d2068
3fb5a9fb3e2cb1d6208966bd4e55d10282d19c7250d827efa560463d60a12ee4

graphics-hook_config.bin
graphics-hook-filter64.dll
C7xcKKrjUnXK.js
mbr_backup.bin
bootkit.bin
lock_start.bat
browserdata.zip
lock_screen.html
fly.exe
3092666
3092059
3092199
TAC Agent

45.153.126.223
192.121.47.20
89.46.234.50
134.209.82.225
87.120.196.120
172.67.155.198
104.21.34.69

http://134.209.82.225:8099/beacon
http://cdn.debugbear.com/C7xcKKrjUnXK.js
https://api-com.cfd/7ge0w58tzzjsv9
https://cf-id.com/?ray-id=nz0ovm2jq2g68i

Win.Trojan.GoDiscorder-10060526-0

CVE-2023-20198