2026-11-04

Machine-first view of this brief, grouped by story so indicator streams stay attributable. IoC values are raw, not defanged, one per line, ready for hunt queries — defang before pasting into chat or email. Everything here is public OSINT; exposure and behavior detail lives in the JSON (also grouped per story).

Endpoints

GET /?view=agent&format=json          this brief as JSON (stories, behaviors, exposure, IoCs, watch events)
GET /?view=agent&format=json&d=DATE   a specific day — available: 2026-11-10, 2026-11-09, 2026-11-06, 2026-11-05, 2026-11-04, 2026-11-03, 2026-11-02, 2026-10-30, 2026-10-29, 2026-10-28
GET /?view=iocs&format=json           cumulative IoC corpus — every brief + watch event, all time
GET /?q=TERM&format=json               search every stored brief (stories + IoCs)
GET /?view=cards&format=json          verdict-card manifest (slug, title, lane, cves, story_ids, url)
GET /?view=actors&format=json         adversaries by attributed country (w=14|30|90|all, cat=state|crime|hacktivist|spyware)
GET /cards/<slug>.html                 a hand-written verdict card; /cards/<slug> one the pipeline published; stories here carry verdict_card when one exists

Shapes: log_source is the extractor's free text; log_source_keys beside it is a closed vocabulary
(see vocab.log_source_keys) for mapping to your own data. evidence_samples are the exact strings the
sources printed (replay targets). exposure is null when the sources stated nothing.

P1 · Siemens IoT2050 Node-RED flaw CVE-2026-58115 exploited to drop Linux bot and webshell flows AI verdict card

Since Oct 30, 2026, VulnCheck has observed attackers exploiting CVE-2026-58115, a CVSS 10 missing-authentication flaw in the Node-RED HTTP interface on Siemens SIMATIC IoT2050 Advanced devices. A single HTTP request deploys and auto-triggers a malicious flow that runs a shell wrapper using wget (curl fallback) to fetch a Linux bot to /dev/shm/.b or /tmp/.kworker and execute it. Other requests plant persistent webshells: an HTTP in endpoint (e.g. /cmd) wired to an exec node that runs commands from a query parameter. SecurityWeek reports VulnCheck called the exploitation successful; hunt for wget/curl/sh spawned by the Node-RED process, hidden files in /dev/shm and /tmp, and unexpected exec nodes or HTTP endpoints in deployed flows.

Why P1: Actively exploited CVSS 10 with concrete huntable behaviors, but niche ICS/Node-RED product, less common in financial enterprise estates. (raised to P1: exploited + behaviors/KEV)

Behaviors (4) · as of 2026-11-04

Detection guidance (1) · as of 2026-11-04

source · tier B · published 2026-11-03 12:10Z · Node-RED flow configuration

Check whether Node-RED is reachable from outside the network; review deployed flows for unexpected exec nodes or HTTP endpoints; instances without adminAuth are being exploited with a single HTTP request.

ipv4 (2)

45.194.90.57
85.215.73.250

filepath (2)

/tmp/.kworker
/dev/shm/.b

filename (2)

wget.sh
.sys_update

P1 · Russia-aligned Gorbag (UAC-0226) exploits WinRAR CVE-2025-8088 to deploy BeautyStealer against Ukraine AI verdict card

ESET reports Gorbag, a Russia-aligned actor overlapping with CERT-UA's UAC-0226, targeting Ukrainian law enforcement, local government and defense entities via spearphishing. Since early 2026 it delivers RAR archives exploiting CVE-2025-8088 that show a decoy PDF while dropping a Startup-folder LNK, an encrypted payload and a PowerShell loader in %ProgramData%; earlier chains used XLSM macros dropping BeautyStealer into %ProgramData%. BeautyStealer harvests browser credentials/cookies, VPN configs and documents, exfiltrates via Telegram sendDocument or a FastAPI C2, then self-deletes. Hunt for WinRAR writing LNKs into Startup, PowerShell loaders in %ProgramData%, and Telegram API traffic from non-browser processes.

Why P1: Exploited WinRAR flaw with concrete huntable chain, but targeting is Ukraine-specific, not financial. (raised to P1: exploited + behaviors/KEV)

Behaviors (6) · as of 2026-11-04

filename (2)

додаток податкова.xlsm
Повідомлення 4726-49.rar

ipv4 (2)

89.44.9.186
142.111.194.73

sha1 (4)

0589d2079fbef814dc7bb95c4b3b555c8b933af6
c17369b4b49113d07f080df832e218156fb0940f
a5e0a82bf6cc302a20d917235643b748f73fcc27
e27e0d0a4b308f9b6b0469159931eb5e343e7ff8

P1 · WordPress Core CVE-2026-119977 TOCTOU race enables unauthenticated code execution during upgrade; added to CISA KEV AI verdict card

CISA's KEV catalog lists CVE-2026-119977, a WordPress Core TOCTOU race condition that could let unauthenticated attackers execute code on the server during full-package core upgrades, exploiting predictable web-accessible staging paths. The KEV entry, dated 2026-11-03 with a due date of 2026-11-06, requires forensic triage under BOD 26-04 and is the basis for the brief's claim of confirmed exploitation. The sources reviewed do not describe specific attacker behavior, payloads, or IoCs, so hunters should focus on web-accessible staging/upgrade directories and unexpected code execution during core updates.

Why P1: KEV-listed unauthenticated RCE in WordPress Core, a commonly deployed internet-facing product, with a mandated forensic triage requirement.

Detection guidance (1) · as of 2026-11-04

source · tier A

CISA KEV entry requires forensic triage per BOD 26-04 for CVE-2026-119977; the catalog does not print specific log patterns or queries.

No IoCs extracted for this story.

P1 · C3RB3R ransomware attacks target Synology DSM NAS devices; attempts to deliver ransomware via patched DSM flaws, no confirmed compromise count stated AI verdict card

Synology says threat actors exploited a DSM vulnerability patched in December 2024 (advisory SA_24_20, listing CVE-2024-10441, CVE-2024-50629, CVE-2024-10445) to target devices running outdated DSM, with customers reporting C3RB3R ransomware locking files with a .L0CK3D extension. Qihoo 360 links C3RB3R to two DSM flaws (CVE-2026-13684, CVE-2026-13639) it says were fixed in September 2026, and sources report ransom notes named read-me3.txt dropped in encrypted directories. Hunters should look for .L0CK3D file extensions, read-me3.txt files, and unexpected shell or ransomware activity on DSM hosts running outdated versions.

Why P1: Actively exploited internet-facing NAS platform with ransomware impact and concrete file-level artifacts to hunt for.

Behaviors (1) · as of 2026-11-04

No IoCs extracted for this story.

P1 · Europe-wide supermarket refrigeration attacks via Copeland XWEB controllers; UK meat suppliers caught in second wave, no attribution AI verdict card

Unidentified attackers remotely altered supermarket and grocery refrigeration controls across Europe in a second wave following a first wave in France, causing stock to spoil in some cases. The Record reports three UK meat suppliers and a UK fruit and vegetable wholesaler were hit via internet-exposed Copeland XWEB supervisory controllers, with an authentication bypass in firmware 1.12.1 and earlier, for which an update had been available since August. Hunters should look for exposed XWEB controllers and unexpected remote defrost-mode changes; no group has claimed or been attributed.

Why P1: Actively exploited internet-exposed OT/IoT controllers with confirmed physical impact; patch and exposure checks warrant action today.

Behaviors (1) · as of 2026-11-04

No IoCs extracted for this story.

P1 · OpsShield cPGuard update channel hijacked to push malicious root script to customer servers AI verdict card

Attackers used compromised credentials to reach OpsShield's update CDN and billing/licensing server, then uploaded a fake cPGuard update signed with a stolen access key. Versions 5.88.12–5.88.19 were served for roughly 70 minutes, and OpsShield estimates 2,950 servers executed the malicious script as root and about 7,900 client account records were copied. Hunters should look for a hidden root shell and temp-folder files left by the update, unexpected SSH keys, and cPGuard updates from versions 5.88.12–5.88.19; OpsShield has released 5.88.25 and later, which remove these artifacts.

Why P1: Supply-chain compromise of widely deployed Linux hosting security agent with confirmed root execution on customer servers.

Behaviors (3) · as of 2026-11-04

No IoCs extracted for this story.

P1 · Linux kernel IPv4 TCP use-after-free CVE-2026-98432: Red Hat fixes shipped, Ubuntu fixes in testing, no confirmed exploitation AI verdict card

A use-after-free in the Linux kernel's IPv4 TCP code, tracked as CVE-2026-98432, can be triggered remotely and unauthenticated by SYN requests carrying IPv4 Record Route or Timestamp options to a listening TCP port, potentially leading to RCE. Red Hat shipped fixed kernels for RHEL 8, 9 and 10 on November 1 and published an nftables interim mitigation, while Ubuntu fixes remain in the opt-in -proposed pocket. The source states no vendor, CERT, or kernel CVE team has reported attacks, and a proof-only GitHub crash PoC exists that does not implement code execution. Hunters should watch for inbound IPv4 TCP SYNs with IP options to listening ports and check kernel versions against the fixed builds.

Why P1: Remote unauthenticated kernel RCE class flaw in widely deployed Linux, with public proof-only PoC and a stated vendor-acknowledged RCE; patches available for RHEL but Ubuntu unpatched.

Behaviors (1) · as of 2026-11-04

Detection guidance (1) · as of 2026-11-04

source · tier B · published 2026-11-03 11:23Z · host nftables counters

Red Hat published an nftables rule that drops inbound IPv4 TCP packets carrying IP options; it can be used as a interim mitigation and the rule blocks the known trigger but cannot fully prevent exploitation.
table inet cve_2026_98432 { chain input { type filter hook input priority -310; policy accept; ip protocol tcp ip hdrlength > 5 counter drop } }

No IoCs extracted for this story.

P2 · Google/Mandiant: LLMjacking via stolen cloud tokens and API keys drives $100K+/day AI charges

GTIG and Mandiant describe multiple 2026 incidents where actors (including UNC6993) used stolen IAM credentials, service account keys, GitHub PATs, session tokens and leaked LLM API keys to enable LLM services (Bedrock, Gemini API), create keys and service accounts, inject SSH keys, and resell access via LLM Mixers such as Jet Night and newapi[.]pro. Charges exceeded $100,000 in a day and reached ~$1M cumulatively at some victims, including financial services. One cluster exploited LiteLLM CVE-2026-40217 to elevate virtual keys to PROXY_ADMIN. Hunt cloud audit logs for unexpected LLM service enablement, access/service-account key creation, burn-and-rotate service account churn, project/instance SSH key metadata changes, GPU quota requests, and max_tokens=1 key-validation sweeps.

Why P2: Concrete cloud-audit-log huntable behaviors in common cloud/LLM platforms affecting financial sector; no single mass-exploited perimeter product.

Behaviors (12) · as of 2026-11-04

Detection guidance (2) · as of 2026-11-04

source · tier A · Cloud audit logs

Treat unauthorized enablement of LLM services (Bedrock, Gemini API) as a critical event; Google SecOps rules: AWS Account Key Creation, AWS Create New Access Key, AWS Create User Account, AWS Delete User Account, GCE Project SSH Keys, GCP Service Account Key Creation, GCP Create New Service Account, GCP Firewall Rule Created, Persistence: Compute Set Instance or Project Metadata Startup Scripts or URLs, Linux Archive Exfiltration via Curl or Wget, Base64 Encoded Shell Command Execution.

source · tier B · Cloud audit and inference logs

Monitor cloud audit and inference logs for unauthorized service activation, suspicious credential checks, unusual usage, and attempts to disable logging; set budget alerts and API quotas.

domain (3)

vibe.aiok.me
jet-night.com
newapi.pro

P2 · BTCPay Server hot wallets drained of about $1.62M via flaw in versions 2.4.1 and earlier

BTCPay Server, a self-hosted cryptocurrency payment processor, says attackers stole Bitcoin and Litecoin from hot wallets on servers running 2.4.1 or earlier, and Bitquery reports about $1.62M (18.38 BTC and 3,405 LTC) across 682 sweeps. The sources do not name the exploited vulnerability or describe the attacker's on-host actions; they say the earlier August issue exposed .macaroon files, but it is unclear if the new attacks are related. Hunters should look for unexpected outbound wallet sweeps from hot wallets on BTCPay instances and treat older servers as compromised, using the published wallet addresses for matching.

Why P2: Confirmed cryptocurrency theft from internet-facing self-hosted payment software, but no concrete on-host behaviors are published.

No IoCs extracted for this story.

P2 · APT29 Watering-Hole Campaign Exploits Patched Apple and Chrome Flaws to Deliver Info-Stealers

Sekoia attributes with moderate-to-high confidence a watering-hole campaign to APT29 that used compromised legitimate sites and lookalike domains, plus a tampered Plerdy SEO tracker loaded by thousands of Ukrainian-heavy sites between August 27 and September 3. Injected JavaScript profiled visitor devices and browser versions, after which the C2 server pushed platform-specific n-day exploit chains. The sources report no confirmed compromises and say Apple and Google have patched the targeted flaws; hunters should look for visits to the named compromised or lookalike domains and the injected Plerdy tracker script.

Why P2: Actively exploited n-day chains on mobile browsers, but patched and no concrete endpoint behaviors or detections published, so hunt rather than act today.

No IoCs extracted for this story.

P2 · Attackers attempt to exploit unpatched CryptoPayment Gateway WordPress plugin flaw CVE-2026-81648 (no confirmed compromises stated) AI verdict card

Defused Cyber reports in-the-wild exploitation attempts against CVE-2026-81648, a CVSS 10.0 unauthenticated authorization flaw in the CryptoPayment Gateway WordPress plugin, versions 1.2.1 through 1.2.2, which has no known fix and was closed on the WordPress Plugin Directory. The flaw is an unauthorized AJAX endpoint that allows deleting arbitrary files, overwriting the payment gateway configuration, and recovering stored wallet credentials in cleartext. The attack traffic reportedly came from infrastructure marketing itself as 'Anonymous KYC-Free VPS Hosting', but the sources do not print specific indicators or log patterns. Site owners are advised to remove the plugin, rotate wallet keys, and audit for suspicious changes.

Why P2: Unpatched critical WordPress plugin under attempted exploitation, but no concrete huntable behaviors or indicators are printed and the install base is unclear.

No IoCs extracted for this story.

P2 · Binance attributes $6.34B theft to North Korea-linked compromise of three engineers' machines via fake recruiting, tampered Homebrew, and internal AI tool abuse

Binance's initial incident report says attackers ran a months-long campaign starting June with a tampered Homebrew download, then a September fake job interview leading to a malicious coding assignment that installed undetected malware. Attackers used the infected machine and an internal AI tool on October 20 to take over two engineers' systems, then deployed a container using a token from the first engineer to reach the wallet signing service and move hot-wallet assets, including abuse of EIP-7702 delegations. Hunters should look for unexpected package-manager installs of developer tools, malicious repository execution, container deployments using engineer tokens, and EIP-7702 authorizations; the FBI attributes the theft to TraderTraitor, a claim North Korea rejects.

Why P2: Concrete intrusion chain with huntable developer-endpoint and container behaviors, but largely a single vendor-reported incident with limited published detection content.

Behaviors (6) · as of 2026-11-04

No IoCs extracted for this story.

P2 · Chainstack discloses production breach exposing customer account data and password hashes; node credentials treated as exposed

Blockchain infrastructure provider Chainstack disclosed that an external attacker entered via a third-party component, reached a development environment on October 26, 2026, and then pivoted into parts of production. The company says the intrusion was detected and access cut on October 31, 2026, and that a database with organization names, account holder names, member emails and password hashes was accessed. Chainstack says there is no evidence node credentials were read but treats them as exposed; defenders should hunt for the access path, and customers are advised to rotate node credentials and API keys and reset passwords.

Why P2: Customer data breach with a vendor-stated access path but no published technical behaviors, IoCs, or detection guidance.

No IoCs extracted for this story.

P2 · WorkOS says attacker used ARTEX AI framework to breach internal sales app; no confirmed production or app data access Verdict card

Developer platform WorkOS disclosed unauthorized access to an internal application used by its sales team, identified on October 30, 2026, where the attacker took business contact records, customer account histories, and summaries of customer communications. The company says the attacker used the ARTEX AI offensive security framework to automate reconnaissance and exploitation attempts, and that no WorkOS app data or production services were affected. Hunters should look for web requests bearing the user agents 'artex-enrich/1.0' and 'norma/0.4', and recipients of the company warned about phishing and social engineering using the exposed contact data.

Why P2: Reported breach with a concrete huntable user-agent indicator tied to an AI pentest framework, but no confirmed exploited vulnerability or enterprise-deployed product compromise.

Behaviors (1) · as of 2026-11-04

Detection guidance (1) · as of 2026-11-04

source · tier B · web server access log

Hunt web requests carrying user agents reported by the investigating team for the attacker's traffic.

useragent (2)

artex-enrich/1.0
norma/0.4

P2 · Android November 2026 updates patch over 200 vulnerabilities, including critical Framework RCE CVE-2026-58868

Google's November 2026 Android security bulletins fix more than 200 flaws across two patch levels (2026-11-01 and 2026-11-05). The most severe is CVE-2026-58868, a critical Framework component issue that the vendor says could lead to remote code execution without user interaction or additional execution privileges. The sources describe no observed exploitation and print no detection artifacts, so hunting guidance is limited to confirming devices are at patch level 2026-11-05 or later.

Why P2: Critical unauthenticated RCE in Android Framework patched; no exploitation reported in sources, so patching is the action rather than hunting.

No IoCs extracted for this story.

P2 · Barracuda appliance flaws CVE-2026-116606 and CVE-2026-111560 can be chained to root; no exploitation reported

Barracuda disclosed a pre-authentication authorization bypass (CVE-2026-116606, CVSS 9.3, Email Security Gateway only) and a command injection flaw (CVE-2026-111560, CVSS 8.6, across several products) that together could let an attacker bypass authorization and obtain root. Exploitation requires access to the administrative interface, so exposure depends on whether admin interfaces are reachable from the internet. The source reports no exploitation; hunters should focus on admin-interface access logs and firmware currency rather than specific attack artifacts.

Why P2: Chained root path on commonly deployed email/web security appliances, but no exploitation reported and admin-interface access is required.

No IoCs extracted for this story.

P3 · Microsoft: fake cracked-software installers bundle WorldProxyPool proxyware, BOINC and adware

Microsoft Threat Intelligence reports a fake-download campaign using trojanized Inno Setup-style installers (cracked software, games, executors) that deliver multiple monetization 'offers': WorldProxyPool proxyware, CharityEngine/BOINC compute software, and AW Manager/Windows Manager adware. Microsoft confirmed installations on affected devices, including WorldProxyPool SYSTEM scheduled tasks. Hunt for eld*.exe/set_*.exe executing from %TEMP%\is-*.tmp\, HTTP callbacks containing d=inno&r=offer_execution, and new WorldProxyPool* scheduled tasks or unexpected BOINC/VirtualBox installs.

Why P3: Commodity PUA/proxyware bundling via user-run cracked software; low severity but concrete huntable artifacts and published queries.

Behaviors (4) · as of 2026-11-04

Detection guidance (4) · as of 2026-11-04

source · tier A · published 2026-11-03 17:32Z · Defender XDR DeviceNetworkEvents

Inno offer-execution callbacks
DeviceNetworkEvents | where RemoteUrl has "d=inno" | where RemoteUrl has_any ("r=offer_execution", "r=offer_execution_fail") | project Timestamp, DeviceName, RemoteUrl, InitiatingProcessFileName

source · tier A · published 2026-11-03 17:32Z · Defender XDR DeviceProcessEvents

Payload execution from Inno temporary directories
DeviceProcessEvents | where FolderPath has @"\AppData\Local\Temp\is-" | where FileName matches regex @"(?i)^(eld[0-9]+|set_[0-9]+|FirstFast(?:\[1\])?|SecondRunner(?:\[1\])?)\.exe$" | project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, SHA256

source · tier A · published 2026-11-03 17:32Z · Defender XDR DeviceNetworkEvents

Outbound connections to observed campaign infrastructure
DeviceNetworkEvents | where RemoteUrl has_any ("orbittrack.cfd", "prairielink.cfd", "willowbox.xyz", "stonestation.cfd", "foldlodge.xyz", "friendsanchor.xyz", "fallport.cfd", "wishcourt.cfd", "cratebase.cfd", "belieftrack.cfd", "beliefdesk.xyz", "companyharbor.xyz", "signalpane.cfd", "inkact.xyz", "wishgrove.cfd") | project Timestamp, DeviceName, RemoteUrl, RemotePort, InitiatingProcessFileName

Review newly created SYSTEM scheduled tasks with watchdog/updater functions; enable PUA protection, cloud-delivered protection, ASR prevalence rule; Defender detections Trojan:Win64/OfferLoader.DA!MTB, Behavior:Win32/SuspInnoOffer.A!mapsi, Adware:Win32/Clover.

sha256 (7)

006510ce1da2b7410376f0788c19e55616eb4bcc30072d25b7d0871dc32aa11c
ab2c2dd37fdcfe1e7620a57f98c80bd063258bea145adc0cc6a0f8b1e24c6a8f
523fb81fae0c7beba7b5171243cc0dee7a4d04ae0483be9172eef2394a5a2152
55cd3d36fdcc58016a64398357b2c9724a060da9f0d09266e537a61ec9552e4f
21306fc5716f95e252388f920314b42f1c8bcc7df67cb4d39da30217b96f4044
72750d32b440e9f2b6d05ff3d218a561a75d3d75fb976b461fa59897674a7f70
452a210bba4c8d08f7cb7733a816d7220a7fa570a469aea0a997cfc8b594b6a0

domain (15)

wishcourt.cfd
beliefdesk.xyz
cratebase.cfd
prairielink.cfd
friendsanchor.xyz
wishgrove.cfd
fallport.cfd
belieftrack.cfd
foldlodge.xyz
willowbox.xyz
inkact.xyz
signalpane.cfd
companyharbor.xyz
orbittrack.cfd
stonestation.cfd

filepath (1)

c:\program files\worldproxypool\sdk-agent.exe

P3 · Google and Japanese police dismantle X.CPE botnet hidden in firmware of 1.3M Android TV set-top boxes

Google, Japanese law enforcement, and security firms TrendAI, Human and Synthient disrupted domains underpinning the X.CPE botnet, which was built into firmware of more than 1.3 million Android TV set-top boxes and other Android IoT devices. Google attributes the scheme to Videostrong Technology, which allegedly sold backdoor access to criminal affiliates who loaded malware modules onto infected devices for residential proxy, ad fraud, and other monetization. The sources do not describe specific process-level host telemetry or detection queries; hunters should focus on unexpected residential proxy traffic and unexplained outbound connections from Android TV, set-top, and IoT devices on the network.

Why P3: Awareness only: IoT/set-top botnet already disrupted, no concrete enterprise-host behaviors or published detection content in sources.

No IoCs extracted for this story.

P3 · Apple spyware threat notifications reach German officials, lawmakers and journalists in 99 countries; no confirmed compromises stated

Apple sent threat notifications about mercenary spyware targeting to users in 99 countries, including German federal ministry staff, lawmakers and journalists traveling with Chancellor Merz. Germany's BSI sent a warning letter within 24 hours telling recipients to assume their devices are infected and replace them, though the BSI said it does not know how many devices were actually infected versus merely targeted. The sources describe no technical indicators, behaviors, or detection methods, so there is nothing concrete for a hunter to pivot on beyond the notifications themselves.

Why P3: Awareness only; the source gives no technical behaviors, indicators, or detection guidance.

No IoCs extracted for this story.

P3 · 3AM ransomware affiliate appears to have used an AI model to generate and revise commands in school breach

Per a single feed summary, a 3AM ransomware affiliate appears to have used an AI model to generate and revise commands during a school breach. Researchers reportedly stop short of claiming full automation. No source could be fetched, so no technical details, commands, or outcomes beyond this summary are confirmed.

Why P3: Awareness only; single unverified feed summary with no technical detail available.

No IoCs extracted for this story.

P3 · Haiou jailbreak bundle for OpenAI Codex injects persistent ads into agent instruction files (prompt adware)

Check Point Research analyzed the Haiou jailbreak bundle, a Chinese-language Codex jailbreak package on GitHub that installs security-focused Skills and modifies Codex global configuration so that ads for an LLM gateway site are injected into agent responses on trigger greetings. The ad text is contained in a prompt module (00-identity.md) and a CLAUDE.md file, and the researchers observed the package alongside Cobalt Strike, VulnClaw and Ladon on a threat actor's misconfigured webserver, though they state the bundle itself is not shown to be designed for cybercrime. Hunters can look for modifications to Codex global configuration or agent instruction files containing the advertised domain or the quoted trigger-word response, but the sources describe no confirmed compromise of victims by this bundle.

Why P3: Jailbreak adware with no confirmed exploitation or concrete intrusion behaviors; awareness only.

domain (1)

zz.aiapi2025.top

P3 · Frontline Education breach via exploited vulnerability in third-party software exposes data of about 1.3M US school staff and students

Frontline Education, which provides K-12 administration software, is notifying over 1.3 million people that personal information was stolen after attackers exploited a vulnerability in a third-party software product to access its environment on August 14. The stolen data from the Frontline Central and School Health Management products may include names, Social Security numbers, dates of birth, government ID numbers, Medicaid IDs and Student IDs. The company says the attack was contained by August 15; the sources do not name the vulnerability, the threat actor, or any technical indicators, so hunters should focus on vendor advisories tied to the third-party product rather than specific IoCs.

Why P3: Confirmed data breach with no published technical behaviors, CVE, or detection guidance; awareness only.

No IoCs extracted for this story.

P3 · mSecure password manager warns customers to change passwords and reset 2FA after suspicious activity; no confirmed vault data exposure stated

Vendor mSeven Software emailed current and former mSecure customers on November 3, 2026, citing suspicious activity linked to the app and advising password changes, 2FA resets and passkey removal. The email does not describe what happened, which systems were involved, when it occurred, whether it has stopped, or whether vault data was exposed. No technical indicators, attack behaviors, or detection guidance are published in the source.

Why P3: Awareness only: vendor disclosure of unspecified suspicious activity with no huntable behaviors or indicators.

No IoCs extracted for this story.

P3 · Revolve reports stolen saved payment card numbers and expiry dates; scope unconfirmed, no group claimed

Online fashion retailer Revolve Group disclosed that customers' saved payment card numbers and expiration dates, plus names and addresses, were stolen, per a Massachusetts AG notification and an SEC filing. A Texas AG listing shows 127,200 Texans, and an unpublished figure of about 1.5 million total, which Revolve has not confirmed. The sources say the attacker reached saved payment data 'through automated means' between September 11 and discovery on September 29, with no group claiming responsibility. The sources give no technical details on the intrusion, so there is nothing specific for defenders to hunt beyond general card-fraud monitoring.

Why P3: Consumer card data breach disclosure with no technical intrusion details or huntable behaviors in the sources.

No IoCs extracted for this story.

P3 · Breach reported at Philippine Overseas Employment Administration; attacker reportedly pulled 69GB of SQL Server backups

A feed summary reports that an attacker apparently exfiltrated 69GB of SQL Server backups containing migrant worker data from the Philippine Overseas Employment Administration in under 30 minutes. No primary source could be fetched, so technical details, the access method, and confirmation of the breach are unverified. Hunters should review database backup access and large outbound transfers from SQL Server backup storage.

Why P3: Unverified single feed summary with no technical detail; awareness only.

No IoCs extracted for this story.

P3 · Harvard alumni and fundraising systems breach exposes data of about 851,000 accounts; ShinyHunters claimed responsibility

Harvard University's Alumni Affairs and Development systems were breached in November 2025, with the university discovering the intrusion on November 18, 2025. Have I Been Pwned analyzed a leaked archive and reports 851k unique email addresses tied to alumni, donors, parents, and some faculty, staff and students, with Harvard stating no SSNs, passwords, or payment card data were stored in the breached systems. The ShinyHunters extortion gang claimed the breach and leaked a 1.1GB archive after Harvard refused to pay, and the source gives no technical intrusion details for defenders to hunt.

Why P3: Data breach disclosure with no technical behaviors, artifacts, or detection guidance; awareness only.

No IoCs extracted for this story.

P3 · Russia dismantles VasyGrek phishing infrastructure and detains three suspects; no published technical detection details

Russian Interior Ministry, working with Kaspersky, dismantled the infrastructure of the VasyGrek (Fluffy Wolf) cybercrime group and identified three suspects, one placed under house arrest and two released under travel restrictions. The group used phishing sites impersonating financial and accounting services, foreign-hosted servers, and dark-web-purchased remote administration tools, with one cited attack involving a malicious attachment and unauthorized online banking transfers. The source gives no concrete command lines, event IDs, or indicators, so hunting should focus on phishing-delivered remote access tools and anomalous banking activity from accounting staff.

Why P3: Awareness only: takedown news with no concrete huntable behaviors or indicators in the source.

Behaviors (2) · as of 2026-11-04

No IoCs extracted for this story.

P3 · Police arrest seven and seize over 100 servers in crackdown on investment scam fraud-site supplier

European law enforcement, supported by Europol and Eurojust, arrested seven suspects and seized more than 100 servers tied to an unnamed company suspected of supplying fraudulent trading websites to criminal call-center gangs. The investigation began in 2022 and followed earlier interventions in 2022 and 2025, with suspected operations linked to Cyprus and Israel. The sources describe no technical intrusion or hunting artifacts, so defenders should treat this as awareness only.

Why P3: Law-enforcement takedown of investment fraud infrastructure with no published technical behaviors or indicators.

No IoCs extracted for this story.

P3 · Leakers$ group claims billboard software hijack showing explicit footage in Egypt, Malaysia and Brazil

A group calling itself Leakers$ claims it exploited software used to send content to LED billboards, displaying explicit footage in Egypt, Malaysia and Brazil on or around October 29. Egyptian authorities reportedly described a website compromise at the billboard operator, and the group's account describes a content-transmission software vulnerability and weaknesses reachable through the systems' web pages and interfaces, which is not independently confirmed in detail. Defenders should review internet-exposed digital signage management and content-publishing interfaces, default or reused credentials, and access by suppliers.

Why P3: Awareness only: vendor and product not named, no hashes or concrete detection content published.

No IoCs extracted for this story.

P3 · Google Chrome 157 patches 213 vulnerabilities, seven rated critical; no exploitation reported

Google promoted Chrome 157 to stable with fixes for 213 vulnerabilities, including seven critical memory-safety bugs such as a buffer overflow in Dawn and a memory corruption in ANGLE. The source states Google reports no in-the-wild exploitation of these flaws. Defenders should confirm browsers are updated to 157.0.8103.38/.39 on Windows and macOS, or 157.0.8103.38 on Linux.

Why P3: Routine browser patch release with no exploitation reported and no huntable adversary behaviors; update hygiene only.

No IoCs extracted for this story.

P3 · Meta publishes Muse AI agent bug bounty results; top $300,000 flaw was a trusted-proxy-header auth bypass on pre-release test VMs

Meta disclosed roughly $1.2 million in bug bounty payouts for its Muse personal AI agent, including $300,000 for a pre-launch authentication bypass. The flaw treated a header added by a local HTTPS proxy as proof of a trusted source, and a later system migration added a second proxy layer so outside requests could carry the trusted header; the researcher demonstrated access to conversations and tokens on pre-release VMs used by Meta staff. Meta says it took the service offline, fixed the bug, and stopped treating the local machine as trusted, so hunters on this story have no public detection content to act on.

Why P3: Vendor bug bounty disclosure of a fixed pre-release flaw; no active exploitation or huntable behaviors in the wild.

No IoCs extracted for this story.

P3 · UK NCSC forecasts AI-enabled cyberattacks on critical infrastructure by 2028

The UK National Cyber Security Centre, in its annual report and a speech by director Richard Horne, assesses that the UK will likely face AI-enabled cyberattacks on critical infrastructure by 2028, with China, Russia, and criminals as drivers. The report says AI is more likely to enhance and scale existing tactics than to discover brand new vulnerabilities. The source describes a forecast and policy guidance (patching, limiting admin access, backups) with no specific intrusion activity or huntable technical artifacts.

Why P3: Strategic forecast and awareness item; no concrete huntable adversary behaviors or indicators in the source.

No IoCs extracted for this story.

P3 · Awareness tips on safer searching, logins and executive protection (no technical details)

A researcher blog feed item lists nine general awareness tips covering safer searching, logins, and executive protection. The brief contains no named threat actor, malware, vulnerability, or attack activity. No source could be fetched, so no technical claims can be confirmed.

Why P3: Generic awareness content with no huntable behaviors or confirmed threat activity.

No IoCs extracted for this story.

P3 · Google expands Cloud VRP with $250,000 reward for Root-in-Cloud bugs

Google added a $250,000 top-tier reward to its Cloud Vulnerability Reward Program for Root-in-Cloud flaws, such as tenant-isolation bypasses that grant full administrative control over arbitrary Google Cloud organizations or projects. Qualifying exploits must not depend on prior project access, compromised credentials, social engineering, or user interaction. The source describes a bug bounty policy change only and reports no attacks, threat actor activity, or compromises.

Why P3: Bug bounty program policy announcement with no exploited vulnerability or huntable adversary behavior.

No IoCs extracted for this story.

Watch streams — new IoCs in the last 48 h

Hackers actively exploit SSHole OpenSSH flaw (CVE-2026-123158) to gain root on Linux systems, confirmed by CISA KEV listing

domain (1)

tac.vpnla.org

filename (1)

TAC Agent

45.194.90.57
85.215.73.250
89.44.9.186
142.111.194.73

/tmp/.kworker
/dev/shm/.b
c:\program files\worldproxypool\sdk-agent.exe

wget.sh
.sys_update
додаток податкова.xlsm
Повідомлення 4726-49.rar
TAC Agent

0589d2079fbef814dc7bb95c4b3b555c8b933af6
c17369b4b49113d07f080df832e218156fb0940f
a5e0a82bf6cc302a20d917235643b748f73fcc27
e27e0d0a4b308f9b6b0469159931eb5e343e7ff8

vibe.aiok.me
jet-night.com
newapi.pro
wishcourt.cfd
beliefdesk.xyz
cratebase.cfd
prairielink.cfd
friendsanchor.xyz
wishgrove.cfd
fallport.cfd
belieftrack.cfd
foldlodge.xyz
willowbox.xyz
inkact.xyz
signalpane.cfd
companyharbor.xyz
orbittrack.cfd
stonestation.cfd
zz.aiapi2025.top
tac.vpnla.org

artex-enrich/1.0
norma/0.4

006510ce1da2b7410376f0788c19e55616eb4bcc30072d25b7d0871dc32aa11c
ab2c2dd37fdcfe1e7620a57f98c80bd063258bea145adc0cc6a0f8b1e24c6a8f
523fb81fae0c7beba7b5171243cc0dee7a4d04ae0483be9172eef2394a5a2152
55cd3d36fdcc58016a64398357b2c9724a060da9f0d09266e537a61ec9552e4f
21306fc5716f95e252388f920314b42f1c8bcc7df67cb4d39da30217b96f4044
72750d32b440e9f2b6d05ff3d218a561a75d3d75fb976b461fa59897674a7f70
452a210bba4c8d08f7cb7733a816d7220a7fa570a469aea0a997cfc8b594b6a0