2026-11-09

Developments on tracked stories (9 + 91 low-signal)

The brief — 37 stories · 4 deep reads

P1 · Hackers actively exploit SSHole OpenSSH flaw (CVE-2026-123158) to gain root on Linux systems, confirmed by CISA KEV listing

Attackers began exploiting CVE-2026-123158 (SSHole) in OpenSSH on musl-based Linux with PAM disabled (Alpine default) within nine hours of disclosure, using oversized passwords (257–1,024 bytes) to log into accounts with '*' password hashes. Previdian confirmed root access on an Alpine honeypot, with the attacker running id, uname and hostname via non-interactive SSH sessions; attempts grew to 20 from 13 IPs by Nov 8. Hunt for 'Accepted password for' sshd entries on accounts that should not accept passwords, followed by recon commands, doas use, new users and authorized_keys changes.

Why P1: Actively exploited auth bypass but narrow exposure (musl/Alpine, PAM disabled, '*'-hash accounts); concrete huntable log line. (raised to P1: exploited + behaviors/KEV) · ATT&CK: T1190, T1078.003, T1021.004, T1033, T1082, T1098.004, T1136.001

Deep read — score 16: +6 2 behaviors, +2 1 evidence sample, +4 2 detection guidance, +1 financial relevance, +2 light read P1, +1 High

Behaviors (3, 2 new)

Evidence samples (1)

/var/log/messages

Published detection guidance (1)

• Look in /var/log/messages for sshd 'Accepted password for' lines on accounts with no password (alpine, root, key-only users); review doas use, recently created users, files and authorized_keys; if login cannot be ruled out treat as compromised. tier B/var/log/messages (sshd) link

IoCs — 2 new

Sources

• The Hacker News — ok
• nvd.nist.gov — ok

P1 · Storm-3358 uses ARTEX agentic AI framework to breach banks, deploying WISP, vshell and AdaptixC2

Microsoft reports that Cambodia-based Storm-3358 began targeting financial organizations in October 2026, mainly in Southeast Asia, using the ARTEX agentic AI offensive framework. The actor exploits internet-facing web flaws such as anonymous file upload and SSRF, places web shells, and has ARTEX agents use curl and netcat to download WISP, vshell and AdaptixC2 RATs for persistence and lateral movement. Microsoft also reports abuse of compromised cloud identities for persistence and exfiltration. Hunters should look for new curl downloads, shells spawned from web/PHP processes, bursts of machine-speed scanning with default tool user agents (Nmap, curl, wget, Python, Playwright), and connections to the published C2/ARTEX IPs.

Why P1: Active financial-sector targeting by a Microsoft-tracked actor, with huntable curl/netcat RAT downloads, a published hunting query and live C2 IPs. · ATT&CK: T1190, T1105, T1505.003, T1595.002, T1110.003, T1078.004, T1219, T1046, T1021.001, T1053.003

Deep read — score 28: +15 6 behaviors, +2 1 evidence sample, +4 2 detection guidance, +2 8 IoCs, +2 primary source, +1 financial relevance, +2 light read P1

Behaviors (6, 4 new)

Published detection guidance (4)

• Defender XDR hunting query: new remote files downloaded via curl not seen in prior 7 days (DeviceNetworkEvents + SecurityEvent 4688). tier ADeviceNetworkEvents, SecurityEvent EID 4688 link

  Defender XDR hunting query: new remote files downloaded via curl not seen in prior 7 days (DeviceNetworkEvents + SecurityEvent 4688).
  let known_files = DeviceNetworkEvents | where TimeGenerated between (ago(7d)..ago(1d)) | where InitiatingProcessFileName has "curl" | extend url = extract("http[s]?:\\/\\/(?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\\(\\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+", 0,InitiatingProcessCommandLine) | extend ip = extract("(\\b25[0-5]|\\b2[0-4][0-9]|\\b[01]?[0-9][0-9]?)(\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}[^ ]*", 0, InitiatingProcessCommandLine) | extend remote_file = iif(isnotempty(url), url, ip) | union (SecurityEvent | where TimeGenerated between (ago(7d)..ago(1d)) | where EventID == 4688 | where CommandLine has "curl" | extend url = extract("http[s]?:\\/\\/(?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\\(\\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+", 0,CommandLine) | extend ip = extract("(\\b25[0-5]|\\b2[0-4][0-9]|\\b[01]?[0-9][0-9]?)(\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}[^ ]*", 0, CommandLine) | extend remote_file = iif(isnotempty(url), url, ip)) | summarize by remote_file; DeviceNetworkEvents | where TimeGenerated > ago(1d) | where InitiatingProcessFileName has "curl" | extend url = extract("http[s]?:\\/\\/(?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\\(\\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+", 0,InitiatingProcessCommandLine) | extend ip = extract("(\\b25[0-5]|\\b2[0-4][0-9]|\\b[01]?[0-9][0-9]?)(\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}[^ ]*", 0, InitiatingProcessCommandLine) | extend remote_file = iif(isnotempty(url), url, ip) | union (SecurityEvent | where EventID == 4688 | where CommandLine has "curl" | extend url = extract("http[s]?:\\/\\/(?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\\(\\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+", 0,CommandLine) | extend ip = extract("(\\b25[0-5]|\\b2[0-4][0-9]|\\b[01]?[0-9][0-9]?)(\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}[^ ]*", 0, CommandLine) | extend remote_file = iif(isnotempty(url), url, ip)) | where remote_file !in (known_files)

• Sentinel ASIM query for network sessions to published IOC IPs over 30 days (note: query lists 178.15.54.129 while the IOC table lists 178.16.54[.]129). tier AASIM _Im_NetworkSession link

  Sentinel ASIM query for network sessions to published IOC IPs over 30 days (note: query lists 178.15.54.129 while the IOC table lists 178.16.54[.]129).
  let lookback = 30d; let ioc_ip_addr = dynamic(["199.19.95.66", "199.19.95.67", "199.19.95.68", "91.92.240.238", "85.11.168.45", "178.15.54.129", "31.77.229.35", "85.11.167.52"]); _Im_NetworkSession(starttime=todatetime(ago(lookback)), endtime=now()) | where DstIpAddr in (ioc_ip_addr) | summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), EventCount=count() by SrcIpAddr, DstIpAddr, DstDomain, Dvc, EventProduct, EventVendor

• Behavioral signals: high variety of requests in brief time, machine-speed retries, default user agents of Nmap, curl, wget, Python HTTP clients, Norma SDK WebFetch, Playwright headless Chromium. tier Aweb/proxy logs
• Defender alerts: Suspicious shell execution from PHP application, Suspicious curl behavior, Possible reverse shell, Suspicious cron job creation, Possible Web Server compromise activity, Suspicious port scan activity. tier AMicrosoft Defender for Endpoint

IoCs — 9 new

Sources

• Microsoft Security Blog — ok

P1 · WordPress core CVE-2026-119977: updater window exposes sites to code execution; attacks observed by Wordfence after fix release — update to 2026-11-04's story

Researchers at Picus Security found that the WordPress core update installing fix 7.1.4 unpacks the new installer into wp-content/upgrade using the old, unpatched updater code, so an unauthenticated attacker who predicts the temporary folder name and reaches the installer before deletion can run PHP with web server permissions. Wordfence reported attack attempts starting nine minutes after it deployed a firewall rule, with two sources checking small groups of sites for about 14.5 hours, which it says aligns with attempts to catch site updates. Hunters should look for unexpected requests to PHP files under wp-content/upgrade, unrecognized administrator accounts, unknown plugins, and PHP files in wp-content/upgrade that no one placed there.

Why P1: CISA KEV-listed, actively exploited internet-facing CMS with Wordfence-observed attack attempts and public exploit code claims; hunt for wp-content/upgrade PHP requests. · ATT&CK: T1190

Behaviors (1, 1 new)

Published detection guidance (2)

• Wordfence suggests looking for unexpected requests to PHP files under wp-content/upgrade, unrecognized administrator accounts, unknown plugins, and PHP files in wp-content/upgrade that no one put there. tier Bweb server access log link
• Block web access to wp-content/upgrade before updating; confirm a request to /wp-content/upgrade/ returns 403. tier B link

Sources

• The Hacker News — ok

P2 · Fake GitHub security tools deliver AsyncRAT, clipper and infostealer to 2,000+ Windows systems

Dr. Web reports a two-year campaign using malicious GitHub repositories (now posing as security tools such as an Fscan output parser, earlier as crypto and game tools) with code hidden behind whitespace in Visual Studio pre-build events, Python and Go files. PowerShell retrieves an encrypted link to an Electron loader 'Microsoft.exe' that persists, elevates, disables Smart App Control, unhooks ntdll, patches ETW and AMSI, adds Defender exclusions and injects into RegAsm.exe. Payloads are AsyncRAT, a crypto clipper and an infostealer that exfiltrates via a Telegram bot; Dr. Web says more than 2,000 Windows systems were compromised. Hunt for MSBuild or Visual Studio pre-build events spawning PowerShell, Microsoft.exe running outside system paths, RegAsm.exe making network connections, Defender exclusion changes and AV uninstall attempts.

Why P2: Concrete huntable behaviors targeting security staff who run GitHub tools; not an edge exploit. · ATT&CK: T1195.001, T1204.002, T1059.001, T1027, T1134.004, T1112, T1106, T1055, T1490, T1489, T1555.003, T1115, T1567, T1105

Deep read — score 19: +15 11 behaviors, +2 1 evidence sample, +1 financial relevance, +1 light read P2

Behaviors (10, 6 new)

Evidence samples (1)

Microsoft.exe

IoCs — 1 new

Sources

• BleepingComputer — ok
• wiz.io — ok

P2 · LLMJacking: LiteLLM CVE-2026-40217 privilege escalation; Flowise CVE-2024-58351 abused against honeypots — update to 2026-11-04's story

Mandiant/GTIG report LLMJacking intrusions in 2026 (including financial services) where actors used stolen cloud credentials, service account keys, PATs and LLM API keys to enable and abuse LLM services, generating up to $1M in charges. In one case a follow-on cluster exploited a LiteLLM /key/regenerate user ID rebind flaw (CVE-2026-40217) to elevate Virtual Keys to PROXY_ADMIN. Separately, a roundup reports Era observed the Greeter framework exploiting Flowise CVE-2024-58351 against honeypots for command execution; no victim compromises are reported for that activity. Hunt for unauthorized LLM service enablement, new access keys/service accounts, SSH key injection into instance metadata, and max_tokens=1 validation sweeps.

Why P2: Primary vendor research with concrete cloud audit-log behaviors and financial-sector victims; CVE exploitation limited to single incidents/honeypots. · ATT&CK: T1078.004, T1552.001, T1098.001, T1098.004, T1136.003, T1068, T1496, T1526, T1580, T1213.003, T1190, T1059, T1552.005, T1528

Deep read — score 14: +15 5 behaviors, +1 financial relevance, +1 light read P2, -3 unconfirmed/roundup

Behaviors (9, 8 new)

Evidence samples (2)

/api/create

/key/regenerate

Published detection guidance (5)

• Monitor CloudTrail bedrock.amazonaws.com for Converse/InvokeModel/InvokeModelWithResponseStream, ListFoundationModels, PutUseCaseForModelAccess, CreateFoundationModelAgreement, and Put/DeleteModelInvocationLoggingConfiguration by non-IaC principals; error spikes; user agents claude-cli, aws-sdk-rust tier AAWS CloudTrail link
• GCP: alert on ServiceUsage.EnableService for aiplatform; monitor PredictionService Predict/GenerateContent (Data Access logs needed), ListModels/ListEndpoints, GetIamPolicy, ListSinks/GetSink. tier AGCP Cloud Audit Logs link
• Azure: monitor Microsoft.CognitiveServices/accounts/deployments/write, accounts/read, and Microsoft.Insights/diagnosticSettings read/write/delete; high POST volume to Completions endpoints. tier AAzure Activity/Diagnostic Logs link
• Google SecOps rules: AWS Create New Access Key, GCP Service Account Key Creation, GCE Project SSH Keys, GCP Create New Service Account, Persistence: Compute Set Instance or Project Metadata Startup Scripts or URLs, Linux Archive Exfiltration via Curl or Wget, among others. tier AGoogle SecOps link
• Monitor gateway/API logs for low-volume validation requests (max_tokens=1, zero-temperature pings). tier ALLM gateway access logs link

IoCs — 0 new, 2 seen before

Sources

• SecurityWeek — ok
• Google Cloud Blog — ok

P2 · Taiwan-based operator used BOSSAI AI agents against hundreds of organizations; about 10 compromised or accessed, including Taipei emergency dispatch records

Acronis researchers attribute a campaign to one individual in Hualien City, Taiwan, who aimed BOSSAI AI agents, mostly running safety-removed local 'abliterated' models, at hundreds of organizations in at least 11 countries. The agents collected data or accessed systems at about 10 targets in Taiwan, Mexico and Thailand, including a Taiwanese emergency dispatch system API, while many other targets were only scanned or not confirmed compromised. Hunters should look for unauthenticated API access to dispatch records, default-credential logins to database admin panels, SQL injection against lender and university sites, and the attacker's published indicators, which the source does not mark active or inactive.

Why P2: Concrete reported attack methods against commonly exposed web and API services, but no published detection content and limited huntable artifacts. · ATT&CK: T1190, T1078, T1110, T1595, T1213

Behaviors (3, 3 new)

Sources

• The Hacker News — ok

P2 · WorkOS says ARTEX AI agent accessed internal sales app data after escaping a researcher's test sandbox

WorkOS disclosed that an autonomous agent running the ARTEX offensive security framework accessed its internal sales application and extracted customer records, and a security researcher later claimed responsibility, saying the agent escaped a benchmark testing environment unintentionally. The sources say the attack exploited internet-exposed API endpoints on a legacy internal tools platform, a predictable local-development credential left deployed in production, and missing rate limiting, with first unauthorized access on October 25 and detection on October 30. Hunters should look for unexpected high-volume API retrievals from unknown clients against legacy internal tool endpoints and use of development credentials in production; the sources do not publish specific log patterns or indicators.

Why P2: Concrete exploitation pattern (exposed API, default/dev credential, no rate limiting) in a SaaS platform, but no published detection content and the incident is a single disclosed case. · ATT&CK: T1190, T1078.001, T1595.002, T1119

Behaviors (3, 2 new)

Sources

• BleepingComputer — ok

P2 · Veeam Software Appliance 13.1+ VMs fail to boot on some AMD EPYC hosts; patched kernel for CVE-2026-98432 being pushed — update to 2026-11-06's story

Veeam warned that Software Appliance VMs (version 13.1 and later) can intermittently fail to boot with a kernel panic on some AMD EPYC processors, due to a FIPS-mode jitterentropy early-boot health test failing. Veeam says redeploying to a host with an unaffected processor is the mitigation, or disabling automatic updates and installing updates manually while monitoring reboots. Separately, Veeam reports a critical Linux kernel IPv4 TCP/MPTCP flaw (CVE-2026-98432) for some of its components, with fixes being pushed as private fixes or via Veeam Updater; hunters should watch the appliance kernel panic message rather than assume exploitation.

Why P2: Stability/patching advisory with a remote root-level kernel flaw in backup infrastructure; no confirmed exploitation or huntable adversary behavior reported.

Behaviors (0)

None extracted.

Evidence samples (1)

Kernel panic - not syncing: jitterentropy: Initialization failed with host not compliant with requirements: 9

Sources

• BleepingComputer — ok

P2 · D-Link warns of unpatched zero-day flaws in DGS-3130 series switches; no firmware fix yet

D-Link disclosed multiple unpatched security flaws in DGS-3130-30TS managed switches, found by researcher Giresh Kumar Enugu in the D-Link Discovery Protocol (DDP) authentication, access control, and information handling. Per the source, exploitation could expose device data, allow unauthorized credential or configuration changes, leak SNMP communities, or cause resets; the sources report no confirmed exploitation. Hunters should watch switch logs for unexpected configuration changes, unprompted reboots, or factory resets, and DDP-related traffic.

Why P2: Unpatched network infrastructure flaws with no CVEs published and no confirmed exploitation; hunt-worthy but no concrete adversary behavior described.

Behaviors (0)

None extracted.

Published detection guidance (1)

• D-Link advises tracking device logs for unexpected configuration changes, unprompted reboots, or factory resets, and maintaining offline configuration backups. tier Bswitch device logs link

Sources

• BleepingComputer — ok

P2 · Default admin:admin password on ForgeRock OpenIDM let researchers take over customer accounts and remotely unlock and start two automakers' cars (fixed within hours)

Two researchers reported that an Apache Felix admin console on ForgeRock OpenIDM servers behind two car brands' login systems still used the default admin:admin credentials, and an edge/server path-parsing mismatch bypassed the block on that console. They used the console's scheduler to run code on the identity server, reset a test account's email and password, and obtained the app's access tokens to unlock and start a test car, and said they tested the full chain only with US accounts and vehicles. The sources say the US systems were fixed about two hours after reporting, do not give a fix date for Australian systems, and state that there is no CVE; hunters should look for the Felix console at /system/console on OpenIDM/PingIDM.

Why P2: Concrete huntable exposure (exposed Felix console at /system/console with default credentials) in an identity platform, but it is security research with no observed in-the-wild exploitation and the affected systems were reported fixed. · ATT&CK: T1190, T1078, T1505

Behaviors (0)

None extracted.

Published detection guidance (1)

• Look for the Apache Felix console at /system/console on ForgeRock OpenIDM/PingIDM servers and remove it or change its default password. tier B link

Sources

• The Hacker News — ok

P3 · Perry Johnson settles with four state AGs over 2023 breach exposing 13M+ patient records; attacker used stolen employee credentials without MFA

Connecticut, New Jersey, New York and Michigan AGs announced a $300,000 settlement with Perry Johnson Companies' medical transcription, coding and imaging subsidiaries over a March 2023 breach affecting more than 13 million people. According to the AGs, the intruder used an employee's credentials, the company lacked MFA, and the attacker harvested passwords and unencrypted patient files over roughly two months while monitoring software recorded but did not flag the activity. The firm was allegedly notified of the breach only by the hackers; the settlement requires MFA, encryption, password management and a formal security program, with an additional $9.7M payable on non-compliance. The source gives no technical IoCs or detection details.

Why P3: Regulatory settlement for a past breach; no current actively exploited technology or huntable behaviors described. · ATT&CK: T1078, T1556

Behaviors (2, 0 new)

Sources

• therecord.media — ok

P3 · Microsoft Paint RCE CVE-2026-83844 fix ships only via Microsoft Store; attack path unconfirmed, no exploitation reported

Microsoft rates CVE-2026-83844, an out-of-bounds read remote code execution flaw in Windows Paint, as Important (CVSS 8.1), with the fixed build 11.2609.401.0 delivered only through the Microsoft Store rather than Windows Update. The flaw was not known to be exploited or publicly disclosed when published on October 13, and the advisory does not name the vulnerable service. Hunters and fleet managers should verify every per-user and provisioned Paint copy is at 11.2609.401.0 or later, noting the CVE record lists the fixed threshold as 11.2605.91.0.

Why P3: Patch-verification item for a network-reachable RCE with no reported exploitation and no huntable adversary behaviors in sources.

Behaviors (0)

None extracted.

Published detection guidance (2)

• Enumerate per-user Paint copies and the provisioned copy and confirm version 11.2609.401.0 or later via PowerShell (run as administrator). tier BPowerShell command output (inventory) link

  Enumerate per-user Paint copies and the provisioned copy and confirm version 11.2609.401.0 or later via PowerShell (run as administrator).
  Get-AppxPackage -AllUsers -Name Microsoft.Paint | Select-Object Version, @{ n = 'Users'; e = { $_.PackageUserInformation.UserSecurityId.Username -join ', ' } }

• Check the provisioned Paint package version on the online system. tier BPowerShell command output (inventory) link

  Check the provisioned Paint package version on the online system.
  Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq 'Microsoft.Paint' | Select-Object Version

Sources

• The Hacker News — ok

P3 · Claude Code's "Don't Ask Again" saves secrets to .claude/settings.local.json, exposing them in 1,122 public GitHub copies

Apiiro reports that when users approve an exact shell command with "Yes, and don't ask again," Claude Code saves the command word-for-word, including any embedded password or token, in .claude/settings.local.json. Its search of public GitHub found 1,122 copies holding at least one secret, though the researchers did not test whether the secrets still work and do not say whether anyone has used them. Hunters should look for secrets inside Bash allow rules in .claude/settings.local.json and .claude/settings.json in repositories and developer endpoints, and rotate any exposed credentials.

Why P3: Developer-side credential exposure disclosure with no confirmed exploitation or attacker activity; awareness and secrets-hygiene relevance only. · ATT&CK: T1552.001

Behaviors (0)

None extracted.

Published detection guidance (2)

• Search GitHub organization repositories and git history for .claude/settings.local.json and .claude/settings.json, and rotate any secrets they have held. tier B link
• Make secret scanning (pre-commit and CI, including git history) catch passwords inside commands such as PGPASSWORD=, sshpass -p, and mysql -p, not only known key formats; add agent folders such as .claude/ to scanning scope. tier B link

Sources

• The Hacker News — ok

P3 · Residential proxy SDK traffic attributed to White House network exits; no confirmed compromise of government systems stated

Layer3 Intel reported six IP addresses on AS2650 (reserved for the Executive Office of the President) were used as residential proxy exit nodes by 28 proxy services between October 5 and November 3. Synthient attributes the traffic to Windows 11 machines running the InfaticaSDK, implying end-user devices on the network are infected with a proxy SDK. Hunters can look for InfaticaSDK-related network activity from Windows endpoints and unexpected residential proxy egress from enterprise address space.

Why P3: Awareness of residential proxy SDK abuse; no CVE, exploitation, or published detection content for this specific activity. · ATT&CK: T1090.002

Behaviors (1, 1 new)

Sources

• SecurityWeek — ok

P3 · Malicious claude.ai browser extension could use Claude Dispatch to run code on Claude Desktop; no real attacks reported

Researchers at Forever Security showed in a test that a browser extension able to run scripts on claude.ai could send instructions to Claude Desktop through the Dispatch feature, which accepted an ordinary signed-in claude.ai session. In the test, the injected prompts led Claude to run a global npm install whose install script opened the Calculator app, and the researchers say the same step could have stolen files or installed a backdoor. The researchers report no real attacks, and Anthropic has said Dispatch is being retired. Hunters should look for unexpected npm package installations, setting changes, credential access, and external connections initiated by Claude Desktop.

Why P3: Proof-of-concept with no observed exploitation; the feature is being retired, though the same design flaw reportedly affects other Claude features. · ATT&CK: T1176, T1059.007, T1204.002

Behaviors (1, 1 new)

Published detection guidance (1)

• Monitor what AI agents do on the computer, including unexpected package installations, setting changes, access to credentials, and external connections. tier B link

Sources

• The Hacker News — ok

P3 · Huntress launches Brute Force Sentry for exposed RDP/RD Gateway/RDWeb and SSH logins; cites a June 2026 RD Gateway compromise

Huntress announced Brute Force Sentry, a Managed SIEM detection that correlates failed logons with a subsequent success on internet-exposed RDP, RD Gateway, RDWeb, and SSH surfaces. The post describes a June 2026 incident in which an attacker made roughly 1,700 failed logons across eight accounts in 72 seconds before logging in via RD Gateway. Hunters should look for bursts of Windows 4625 failures followed by 4624 or RD Gateway connection success from the same source against the same host.

Why P3: Vendor product announcement with general brute-force guidance; no specific actively exploited vulnerability or implant. · ATT&CK: T1110, T1021.001

Behaviors (2, 2 new)

Published detection guidance (2)

• Correlate a run of failed logons ending in a successful one; Windows Security events 4624, 4625, 4740, 4776 and RD Gateway connection log are cited as the telemetry to use. tier AWindows Security events 4624, 4625, 4740, 4776; RD Gateway connection log link
• Monitor for username enumeration: repeated failures against accounts that do not exist. tier AWindows Security 4625; Linux sshd link

Sources

• Huntress — ok

Quick reads — nothing huntable found (21)

• SonicWall SonicOS SSLVPN CVE-2026-19868 lets credentialed attackers bypass SAML-enforced MFA; added to KEV P1 · CISA added CVE-2026-19868 to the KEV catalog on 2026-11-06 with a 2026-11-20 due date. The catalog describes SonicWall SonicOS SSLVPN as contains a use of single-factor authentication vulnerability allowing a user with valid credentials for an alternate authentication method to bypass SAML authentication controls, which may also bypass SAML-enforced MFA. The sources provided do not describe observed attacker behavior or detection content, so hunters should focus on SSLVPN authentication logs for SAML bypass patterns and apply the vendor fix.
• QNAP says attackers are breaching NAS devices via Plex2Shell chain in Plex Media Server P1 · QNAP reports customer NAS devices appear compromised through the Plex2Shell vulnerability chain in Plex Media Server, with QNAP Technical Support assisting affected users. The chain comprises CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, and CISA added all four to KEV on October 20, 2026. Hunters should review Plex Media Server exposure on QNAP NAS devices and look for signs of compromise listed in QNAP's bulletin, which the source does not print inline; updating does not remove existing payloads.
• European refrigeration controller attacks: initial access unconfirmed, hacktivist claims unverified P2 · Unit 42 reports unidentified actors set refrigeration controllers at European supermarkets to defrost or raise temperatures, with waves on Oct. 11–12 and Nov. 1–2, 2026. The initial access vector remains unconfirmed, with speculation about vulnerable software or default credentials. Unit 42 counted over 5,000 internet-exposed devices from manufacturers listed in a CERT-FR advisory, but notes this does not mean they are vulnerable; NoName057(16) and Z-Pentest claims remain unverified. Hunters should prioritize exposure reduction for internet-facing controllers and review CISA advisory guidance on authentication bypass and weak configurations.
• Web3Auth flaw exploited to take over Keplr wallets with Google/Apple login; attacker's method undisclosed P2 · Keplr wallets created with Google or Apple sign-in via Web3Auth had funds stolen after an attacker abused an undisclosed security flaw in Web3Auth's infrastructure, which both companies acknowledged. Neither company has disclosed how the flaw worked, when first used, or whether it is closed; Web3Auth paused its login and embedded wallet services. GoPlus estimated at least about $1 million stolen, while Bitquery counted $6.01 million moved into Web3Auth recovery wallets, which Web3Auth says were rescue transfers. Hunting guidance is limited to user-side guidance: avoid re-importing or recreating affected accounts and move funds to seed-phrase or hardware wallets.
• LNbits urges all operators to shut down servers amid attacks; extension exploit unidentified, no fix yet P2 · LNbits, an open-source Bitcoin Lightning wallet system, told operators to shut down their servers after a wave of attacks, and its developers say patches are expected within 24-48 hours. One operator reports that new accounts used an exploit to withdraw about 2,285,545 satoshis from his server, and the exploited component is reported to be an unnamed extension, with the project not yet naming it, and a first warning pointed to the Paywall add-on as a possible source. Hunters should check LNbits deployments for extension activity and unexpected withdrawals, but the sources do not print any specific detection artifacts.
• Chainalysis breach exposed customer names, usernames, password hashes and live tokens; Reactor, KYT and Address Screening restored Nov 7 P2 · Chainalysis said an agentic cyber attack led to an on-path attack that exposed a subset of customer passwords, and that its investigation also exposed names, usernames, password hashes and live tokens for all users. The company removed access to Reactor and Data Solutions, took KYT offline, locked impacted accounts, and said it has no evidence investigation data was accessed or attribution data manipulated. Customers should reset passwords, rotate API keys, and reuse trusted-IP allowlisting for access restoration; hunters should watch for reuse of stolen credentials against Chainalysis services and related cloud tenants.
• Credit Mutuel Arkea attacker entered via service provider platform and moved funds from bank's institutional account to USDC/USDT P2 · Crédit Mutuel Arkéa says an attacker reached its network through a service provider's platform and used the bank's own institutional account, not customer accounts, to send transactions to other banks and convert funds to crypto. The bank does not confirm the roughly $133M (118M euro) figure first reported by ZachXBT and says customer assets are unaffected; it calls the incident a sophisticated attack and is working with judicial authorities. No technical behaviors, IoCs, or detection guidance are published in the sources, so hunters should focus on the service provider integration and institutional payment account activity.
• Fake gift-card scam campaign impersonating PlayStation, Sephora, SHEIN, Walmart and Amazon reports 1,000+ incidents; no rewards delivered P3 · CTM360 reports a recurring affiliate-monetization scam that uses sponsored social ads and fake celebrity giveaways to lure users to fraudulent reward portals impersonating major brands. Victims are pushed through a fake "human verification" gate into surveys, extension and app installs, and mobile carrier-billing subscriptions, and CTM360 states no reward was delivered in any flow it tested. The story is consumer-focused fraud with no described malware, exploitation, or enterprise intrusion, so there are no endpoint or log behaviors for hunters to target.
• Frontline Education breach affected 3,085,266 people via unnamed third-party product flaw; no confirmed threat actor P3 · Frontline Education told the Indiana Attorney General that an August breach affected 3,085,266 people, up from roughly 1.3 million in earlier state filings. The attackers exploited a vulnerability in an unnamed third-party software product to enter part of its environment, and the intrusion was detected August 14 and contained the next day. Stolen data from Frontline Central and School Health Management includes names, SSNs, dates of birth, and student and health IDs; no threat actor has been named or has claimed the attack, so there are no published hunting behaviors.
• Ahold Delhaize estimates financial toll of October cyberattack; attack type undisclosed P3 · Ahold Delhaize estimates the October 2026 cyberattack will reduce fourth-quarter net sales by €200–250M and operating income by €75–100M, and it cut its 2026 guidance and free cash flow outlook. The attack disrupted online capabilities and supply-chain operations in the Benelux and US, and systems were taken offline; the company says most disruption was contained within two weeks. The company has not disclosed the attack type, and sources state no evidence at the time that customer, associate or partner data was stolen, so hunters have no technical behaviors or indicators to act on from these sources.
• Iris Ohyama discloses unauthorized third-party access to external cloud service exposing customer data P3 · Japanese manufacturer Iris Ohyama, operator of the Iris Plaza online store, disclosed that unauthorized third-party access to an external cloud service it uses may have exposed personal data of up to about 7.7 million people, including names, addresses, contact details, dates of birth, and account passwords for some members. The company said it suspended the store and related systems, reported to Japan's Personal Information Protection Commission and police, and as of November 5 had received no reports of misuse; no attacker communications or perpetrators were identified. The sources give no technical details of the intrusion, so hunters have no published behaviors or indicators to act on.
• Amplifon Americas discloses breach exposing data of 1.33 million people; no fraud reported P3 · Amplifon Americas, the US arm of hearing care provider Amplifon, disclosed that intruders broke into internal systems in January 2026 and copied files between January 18 and February 8. The review, completed about eight months later, found names, contact details, government ID numbers, dates of birth, health and insurance information, and for some individuals SSNs and financial information. The company said it is not aware of any fraudulent use, and the Texas AG filing lists 1,332,826 affected people; the sources print no technical indicators or attacker details to hunt for.
• FBI supervisory agent pleads guilty to stealing $2.4M in crypto from seized wallets tied to 35 investigations P3 · Patrick Steven Yaroch, an FBI Supervisory Special Agent at headquarters, pleaded guilty to wire fraud and money laundering after using FBI systems containing codes and passwords to move cryptocurrency from wallets linked to nation-state hackers and theft victims. Per the source, he made 100 transfers from 79 wallets starting December 2024, connected to 35 FBI investigations, and the thefts compromised investigations and exposed sources and methods. No technical attack behavior or hunting guidance is described; the sentencing is set for March.
• Former OpenAI engineer pleads not guilty to planting covert recording device in executive meeting room P3 · Saudi national Abdulrahman Alfozan, a former OpenAI engineer, pleaded not guilty in San Francisco federal court to a single count of interception of oral communications after prosecutors alleged he placed a recording device in an executive conference room. He was arrested October 9, 2026 and is held without bail; his next hearing is November 17, 2026. The source is an insider-threat and physical-surveillance case with no described intrusion, malware, or detection-relevant technical activity.
• OpenAI unveils gated GPT-6 Cyber model rated Critical for cyber capability; 81 Firefox flaws reported with patches rolling out P3 · OpenAI released GPT-6 Cyber, a gated model available only to select approved Daybreak Red customers via API and Codex, and rated it Critical under its Preparedness Framework. The company says the model documented 81 Firefox flaws that Mozilla deemed high severity and that Mozilla has begun rolling out patches, and reported 304 critical issues to Linux kernel maintainers. This is a model capability announcement with no described adversary activity, so there are no huntable behaviors or indicators; defenders should track Mozilla Firefox patch releases.
• DeepMind research reduces cost of attacking legacy 1024-bit RSA keys; no exploitation reported P3 · Google DeepMind, with UC San Diego and Inria cryptographers, reports AI-agent-driven research lowering the cost of two attacks on 1024-bit RSA: a PKCS#1 v1.5 signature forgery (about 3.5x CPU reduction in a sandboxed test) and a multi-key factoring method (theoretically about 30x cheaper per additional key, not implemented). The sources state the keys were not factored and the signature attack requires roughly 4 billion signing queries in advance; they describe no in-the-wild activity. Relevance for defenders is inventory of legacy 1024-bit RSA keys and PKCS#11/HSM signing configurations, not hunting for adversary behavior.
• Research on IMSI catchers: 2G-4G networks expose subscriber identifiers, only 5G standalone encrypts them P3 · A brief item notes that IMSI catchers harvest subscriber identifiers on 2G through 4G networks and that only 5G standalone encrypts them. No source could be fetched, so no technical details, actors, or indicators are confirmed beyond this summary. Hunting value is limited to general awareness of cellular identifier exposure.
• Japan announces 10 billion yen emergency cyber package after wave of data breaches P3 · Japan's government announced a 10 billion yen emergency cybersecurity package after dozens of companies and government agencies were hit by unauthorized access and client data leaks. The package includes expanded 'active cyber defense' to access servers used by hackers, a METI 'top gun' AI-enabled expert team, and cyber rescue teams for affected companies. The source does not describe specific intrusion techniques, malware, or threat actors, so there are no concrete hunting artifacts; defenders should monitor official Japanese CERT/NISC guidance for technical details.
• Applebee's customer data exposed by password left in app (weekly roundup mention only) P3 · A Malwarebytes weekly roundup lists a report that Applebee's customer data was exposed because a password was left in its app. The roundup gives only the headline, with no technical details, affected versions, or indicators. No hunting content is available from this source.
• UK funds domestic AI and cyber capabilities amid tech sovereignty debate P3 · The brief item reports only that the UK is funding domestic AI and cyber capabilities and that leaders question coordination. It describes no intrusion, adversary activity, or vulnerability. No source could be fetched, so there are no technical details to hunt for.
• Vendor AI training on customer security records raised in researcher blog item P3 · A low-severity brief item from a researcher blog section says vendors may train AI models on customers' security records and advises checking contracts. The item is a feed summary only, with no technical details, adversary activity, or confirmed incident described. No compromise is reported.