2026-11-05

CERT-In reports an active AI-assisted actor, Crafty Falcon, using offensive AI tools (ARTEX, PentAGI, Cairn, CyberStrikeAI) against Indian BFSI, fintech and crypto firms, stealing payment gateway/partner-bank API credentials and invoking fund-transfer APIs from victims' allow-listed infrastructure, with theft of keys and funds reported. Tactics include web shells via file-upload/deserialization chains in PHP and Node.js apps, stolen static API tokens, plaintext creds in configs, micro-value test transactions, log deletion and endpoint security tampering. Separately, a copycat ARTEX GitHub repo pulls the backdoored Docker image tomicdd/artex, whose login handler runs a CAPTCHA field beginning with a secret marker through sh -c as root; 62 internet consoles served it. Hunt for web shells, anomalous fund-transfer/settlement API calls and Rs.1 test transactions, log clearing, and any deployment of artex images.

Why it matters: Active, ongoing campaign against financial sector with API-credential theft and fraudulent transfers; directly relevant sector.

CrowdStrike reports median time from public PoC to in-the-wild exploitation was under one day in H1 2026 (fastest 35 minutes). Case studies: mass exploitation of cPanel/WHM auth bypass CVE-2026-41940 (zero-day since at least April 3, 2026); UMBRAL BISON using a modified CopyFail (CVE-2026-31431) exploit to escalate www-data to root at a Ukrainian government entity and attempt to deploy a Mythic Poseidon agent (terminated by Falcon); STATIC KITTEN hosting a modified CVE-2024-55591 FortiOS exploit with 13 payloads creating backdoor admin/VPN users. Hunt for root password changes/WHM root logins, www-data to root escalation via Python, and rogue FortiOS admins like FortiWiFi, FortiSetup, darlen, offices.

Why it matters: Actively exploited internet-facing cPanel and FortiOS bugs plus Linux LPE with concrete backdoor account names to hunt.

Sekoia reports that APT29 is presumed behind a watering hole campaign using compromised sites, lookalike domains, and a supply chain compromise of the Plerdy SEO Tracker script (main.js, August 27 to September 3, 2026) to deliver a JavaScript loader that profiles visitors and serves iOS (DarkSword-based) or Android (AndroSnitch) exploit chains. The sources describe exfiltration to ad.starx-net[.]com:8881/telemetry/v12 but do not confirm how many victims were compromised. Hunters should look for outbound connections to that endpoint, requests to a.plerdy[.]com/public/js/click/main.js, and visits to the listed lookalike domains.

Why it matters: Concrete network indicators and a supply-chain vector, but the campaign targets mobile browsers and the sources give no endpoint-side detection content. (raised to P1: the same brief carries a P1 item on this campaign)

Binarly reports that CVE-2026-107441, an out-of-bounds write in the CGI program of Zyxel GS1900 series switch firmware, was exploited in the wild as a zero-day to hack almost 1,000 devices, in attacks previously attributed to a Chinese hacking group. According to Zyxel, an unauthenticated attacker can achieve OS command execution via crafted HTTP requests. The brief reports new firmware released for 10 affected models; the source states Zyxel's fixes rolled out October 23 and the advisory was published November 3, while the source reports the earlier CVE-2026-7273 patch did not block this exploitation. Hunters should look for unusual HTTP requests to GS1900 CGI endpoints and unexpected OS command execution on these switches.

Why it matters: Actively exploited unauthenticated command execution on internet-facing network devices with a reported ~1,000 compromised devices.

CISA added CVE-2024-27834, a medium-severity Apple improper authentication (Pointer Authentication bypass) flaw, to its KEV catalog after reports of active exploitation. Sekoia reported that possibly Russia-linked actors, attributed by the source to APT29 with moderate to high confidence, used the flaw alongside previously patched Safari and Chrome vulnerabilities to serve JavaScript that profiles visitors and deploys browser-cookie-stealing malware. Access came via compromised legitimate websites, fake lookalike sites, and a supply-chain attack on Plerdy SEO Tracker. The source does not print specific hunting artifacts, so defenders should focus on patch status for listed Apple builds and on web-based delivery and browser cookie theft behavior.

Why it matters: KEV-listed Apple flaw reported in active exploitation with a web delivery chain; patch status is directly checkable.

Since mid-August 2026, an operator used Google Calendar invites (and later Drive share invites) sent from 8,570 compromised sender accounts, with Google /url redirector, share.google, Drive and Intuit links leading through Cloudflare Turnstile to a Nyasher reverse proxy in front of the real Google sign-in page, relaying all MFA factors to capture live sessions. Material Security reports sessions were harvested and took down 897 domains via Cloudflare abuse reporting. Hunters should review Google Workspace audit logs for hijacked-session activity, new OAuth grants, and inbound calendar invites containing google.com/url redirects; an unactivated Microsoft 365 branch exists.

Why it matters: AiTM session theft against Google Workspace with huntable audit-log signals; campaign appears dispersed but cheap to rebuild.

The French Blood Establishment (EFS) said a cyberattack on its refrigeration equipment supplier, Coolworld Rentals per BleepingComputer, raised temperature and defrost thresholds at three facilities on November 2. Coolworld said attackers exploited a vulnerability in a third-party component in remote monitoring software affecting a limited number of units. EFS reported no health impact or loss of blood products, with plasma transferred or secured, and it works with ANSSI. The article links the activity to wider attacks on Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controllers, but the sources do not confirm the specific vulnerability used at EFS.

Why it matters: Operational-technology attack on refrigeration controllers with no published technical behaviors or detection guidance for this specific incident.

Japan Airlines, Cathay Pacific, Korean Air, Asiana, Singapore Airlines and Malaysia Airlines reported customer data exposure traced to a cyberattack on Spanish IT provider Amadeus. Amadeus said a vulnerability affecting a travel booking display environment exposed booking-display data, with no evidence payment data was accessed, and an airline said the threat actors used login credentials assigned to a system account. The airlines state their own systems and operations were not affected, so hunters should focus on Amadeus-facing account and booking-display activity rather than airline infrastructure.

Why it matters: Breach disclosure with a stated credential-misuse vector against a widely used reservation provider, but no published technical detail or detection guidance.

Blockchain analytics firm Chainalysis disclosed a breach first reported October 30 and later said names, usernames, password hashes and live tokens for all users were exposed to a malicious actor. The company said some customer passwords were exposed in an on-path attack and some KYT accounts appeared accessed, and it took several products offline. The sources do not identify the attacker or confirm how the attacker used agentic techniques, and Chainalysis said it has no evidence investigations data was accessed; hunters should watch for suspicious logins and token reuse against Chainalysis-hosted services.

Why it matters: Breach of a widely used financial-crime analytics provider with exposed live tokens and on-path password interception, but no technical indicators or detection guidance are published.

DreamHost says an unauthorized third party accessed the server running its web-based File Manager at files.dreamhost.com between August 2026 and October 23, 2026, exploiting a vulnerability in that software. The intruder obtained FTP/SFTP usernames and passwords of users who logged into File Manager during that window and may have accessed webmail session information for a limited number of users. The sources report no confirmed access to control panel logins or billing data, and DreamHost says the access was blocked and the vulnerability addressed; hunters should review File Manager server logs, FTP/SFTP auth logs, and webmail forwarding rules.

Why it matters: Breach disclosure with no published technical indicators or behaviors beyond exploitation of a web application; hosting-provider credential exposure warrants a hunt for customer-side impact.

SonicWall says two flaws in end-of-life Global Management System 9.5.2 and earlier will receive no fix; CVE-2026-109593 (CVSS 9.1) is an unauthenticated file read and CVE-2026-109594 (CVSS 6.8) is a post-authentication SQL injection. SonicWall recommends migrating to Network Security Manager (NSM). The source reports a related CVE-2026-102255 SSRF (CVSS 10.0) under active exploitation, with Previdian telemetry showing 2,541 attempts from eight IPs since October 9, 2026, but does not tie those attempts directly to the GMS flaws. Hunters should inventory any GMS instances and review web access for file-read requests.

Why it matters: Unpatched EoL product with a 9.1 unauthenticated file read, but no confirmed exploitation of these specific GMS flaws in the source.

Barracuda released patches for CVE-2026-116606 (authentication bypass in ESG versions earlier than 9.4.0.030, allowing unauthenticated restore of a crafted configuration backup) and CVE-2026-111560 (administrator-authenticated command injection in the timezone setting, shared with five other Barracuda products). Combined, the flaws can yield root on ESG appliances, and neither advisory states whether they have been exploited in the wild. Defenders should confirm admin interfaces are restricted to trusted networks and that all firmware patches are applied.

Why it matters: Chainable path to root on internet-facing email gateway appliances, but sources report no exploitation and no published detection content.

A flaw in APT, the package manager for Debian and Ubuntu, lets an attacker who can modify HTTP package downloads substitute a checked package with their own, which then runs as root when APT retries failed downloads. Debian, Ubuntu, and APT's developers published advisories on November 4, 2026, with fixed builds for several releases, and Ubuntu still listed all eight tracked releases as vulnerable at 15:46 UTC that day. None of the advisories describe exploitation in the wild or offer a workaround, so hunters should focus on verifying APT versions and retry configuration (Acquire::Retries) rather than on observed attack activity.

Why it matters: Root code execution via a widely deployed package manager, but no exploitation reported and no concrete attack telemetry published.

Bitdefender disclosed GhostMap, a malformed-APK ZIP parsing discrepancy between two Android libraries that lets an app with no permissions and no code force a SIGBUS crash in system_server and a persistent boot loop on a Pixel 10 running Android 17 (August 2026 patch). Google closed the report as Won't Fix (Not Reproducible) and out of scope for a security update. Hunters should look for installation of APKs with malformed ZIP entries that map beyond file contents, and for repeated system_server crashes after installation; the only stated block point is during installation.

Why it matters: Device-level DoS with no patch and no published exploitation in the wild; limited huntable telemetry beyond crash loops and malformed APK installs.

Attackers modified four JavaScript files on Level Infinite's official CDN (from Sept 27, 2026) used by the Goddess of Victory: NIKKE PC launcher, injecting an obfuscated loader that pulled code from insightjs[.]com / insightjs[.]org. Per researcher MotherSphere, the code abused launcher functionality to run a LuaJIT payload (insight.bundle) that installed the K2F remote-access agent. K2F could execute commands, steal files, screenshots, browser data and credentials, and optionally drop platform_experience_helper.dll with crypto-wallet theft code; whether the DLL was deployed or crypto stolen is unknown. Hunt for DNS/proxy traffic to the insightjs domains, the k2f_chan string in Launcher/intl_service/debug.log, and platform_experience_helper.dll on endpoints.

Why it matters: Consumer game supply-chain compromise; relevant only for corporate endpoints with NIKKE installed. Quick DNS/file check.