2026-11-10

Machine-first view of this brief, grouped by story so indicator streams stay attributable. IoC values are raw, not defanged, one per line, ready for hunt queries — defang before pasting into chat or email. Everything here is public OSINT; exposure and behavior detail lives in the JSON (also grouped per story).

Endpoints

GET /?view=agent&format=json          this brief as JSON (stories, behaviors, exposure, IoCs, watch events)
GET /?view=agent&format=json&d=DATE   a specific day — available: 2026-11-10, 2026-11-09, 2026-11-06, 2026-11-05, 2026-11-04, 2026-11-03, 2026-11-02, 2026-10-30, 2026-10-29, 2026-10-28
GET /?view=iocs&format=json           cumulative IoC corpus — every brief + watch event, all time
GET /?q=TERM&format=json               search every stored brief (stories + IoCs)
GET /?view=cards&format=json          verdict-card manifest (slug, title, lane, cves, story_ids, url)
GET /?view=actors&format=json         adversaries by attributed country (w=14|30|90|all, cat=state|crime|hacktivist|spyware)
GET /cards/<slug>.html                 a hand-written verdict card; /cards/<slug> one the pipeline published; stories here carry verdict_card when one exists

Shapes: log_source is the extractor's free text; log_source_keys beside it is a closed vocabulary
(see vocab.log_source_keys) for mapping to your own data. evidence_samples are the exact strings the
sources printed (replay targets). exposure is null when the sources stated nothing.

P1 · AhsayCBS CVE-2026-105133/105134 exploited to plant JSP webshells, XMRig miner, Python C2 implant AI verdict card

Huntress analyzed three Windows AhsayCBS servers breached Oct 8-11, 2026 via an auth bypass and unauthenticated SYSTEM RCE through /rps/api/json/UpdateReceivers.do. The operator planted five JSP webshell families (including a PNG-steganography loader and a signed-API shell), an XMRig miner relaunched by a SYSTEM scheduled task every minute, a MachineGuid-keyed Python implant launched from a Run key, tunneling tools (gost, chisel), RMM tools, Defender exclusions, and a NetExec-style Veeam credential query. Hunt for cbssvcX64.exe spawning cmd.exe, new .jsp files in webapps\cbs and webapps\rps, ahsay_* and Linux-style folders at the drive root, the kvm task, and python.exe under the SYSTEM profile.

Why P1: Actively exploited internet-facing backup console with concrete huntable behaviors and backup-credential targeting.

Behaviors (10) · as of 2026-11-10

Detection guidance (4) · as of 2026-11-10

source · tier A · process creation

Sigma rule from earlier Huntress post: cbssvcX64.exe spawning a command shell

source · tier A · process creation / registry

python.exe/pythonw.exe running from a path under the SYSTEM profile; Run key launching embedded Python

source · tier A · file creation

New .jsp files under AhsayCBS webapps\cbs and webapps\rps; folders ahsay_*, home, opt, srv, usr at drive root or Program Files; timestamp-named folders near shells

source · tier A · Task Scheduler / Defender

SYSTEM scheduled task with one-minute repeat testing for a process via tasklist; unexpected Defender exclusions

sha256 (16)

a87002c32723f1849b3ad17b1fe6da732c9810b54b08501be21f5b1fcd882a59
6c7a4061bcf08df5fe4a49d37442dc650d751be1a91a8bc802edff213e4d5e61
ca5f8e5247f1a044b8be45ef03187726b9af3ac30fd93fb5bb54144e34ed3738
7a13e59d816d68a071a8648e62a7c3c7f929a61c618a2133ab6f511da24f979d
bb2472cf5dc7e5c94216d355bf84fba2c8d088d03d61a1ac0d78639049cf5e1f
8245c7e7d944923f1608592f6c3473dcc6e3a3e43df3dd1c6257e7880948787b
91b3cc9d6421b651ec85a16062af3ba26700dad2eea4a8a7e42fdd2e422f8803
e6e576a634166a16bdbfc09b14e7cf8eab90015d2dfa67dd73f3968ee869229b
6953618238eb40f45b584e52aca22cebbe8ba03e9a80c15c6b593f51f7e49527
e79c91e8157fef862be8cbe80bdf57b87a541416717265f81f669d751fca4a3d
8aac187bae71f75fa2dde03dcb4a9279c982182ee8254ae96e7a6626fe4c7617
875d0986ddaa51bfb5e03b06df1213cc3bb7966588d6153bdda57f2e3671e986
f76dae028e0c43248c128b3bf609e8d660ce0bf44b53ab9e097887e6f5206eb5
6c695baad1d81ed49194d07a79381292c0466208ff1a9862c0c55f971d6a409f
818bb464271a539c96bcbbfea1db7d5a722512041ed8ed10d3f6c7f366190044
6f6b66cbdc4a5aa5685d0017abd3f65843a28bcc2bb4e5b78d6d12a844a51aa8

filename (4)

AhsayCBS.jsp
nsmind.jsp
heap_shellcode_runner_bound_weaponized.py
kvm-agent.exe

domain (3)

pool.supportxmr.com
pool-fr.supportxmr.com
creepexplosiondarknight.com

ipv4 (1)

104.243.43.115

url (1)

https://creepexplosiondarknight.com/d

P1 · Attacker abuses Qubole's AWS account to assume customer IAM roles, steal secrets and S3 data

Between Oct 14-26, 2026, an unknown actor used IAM credentials from Qubole's AWS account 805246085872 to assume trusted cross-account integration roles (with valid External IDs) in multiple customer AWS accounts, then enumerated resources, harvested secrets from Lambda env vars, Secrets Manager and SSM, validated found AWS/Entra ID/Okta credentials with TruffleHog, and exfiltrated S3 data. Wiz, Sentra and Mandiant confirm compromise of multiple victim environments. Hunt CloudTrail from Oct 1 for AssumeRole from 805246085872 with non-AWS sourceIPAddress, principal AIDA3W7DIFLYOLTK63SFS, session names starting quiam-, and TruffleHog user agents on GetCallerIdentity and IdP sign-ins.

Why P1: Confirmed supply-chain compromise via trusted vendor role with concrete CloudTrail hunt guidance; affects any Qubole-integrated AWS account, even unused ones.

Behaviors (5) · as of 2026-11-10

Detection guidance (3) · as of 2026-11-10

source · tier A · published 2026-11-09 14:56Z · AWS CloudTrail

AssumeRole events where userIdentity.accountId is 805246085872 and sourceIPAddress is not an AWS address; principalId AIDA3W7DIFLYOLTK63SFS any activity; AIDAJYRRH5Y3A7AAJM2HW from non-AWS IPs; session names quiam-*.

source · tier A · published 2026-11-09 14:56Z · AWS CloudTrail; IdP sign-in logs

GetCallerIdentity with TruffleHog user agent paired with IOC IPs; check IdP sign-in logs for the same user agent.

source · tier A · published 2026-11-09 14:56Z · AWS CloudTrail

Alert on AssumeRole from a vendor account via VPN or hosting provider not previously used; enable S3 data events to see object reads.

sha1 (1)

1c7437dac21630f53c0b888b50662c6487e23fd7

ipv4 (4)

45.83.220.211
57.129.54.120
89.37.63.175
185.209.199.73

useragent (5)

Boto3/1.43.108 md/Botocore#1.43.108 ua/2.1 os/linux#6.1.0-53-arm64 md/arch#aarch64 lang/python#3.11.2
Boto3/1.37.9 md/Botocore#1.37.9 ua/2.1 os/linux#6.12.111+deb13-amd64 md/arch#x86_64 lang/python#3.13.5
Boto3/1.43.113 md/Botocore#1.43.113 ua/2.1 os/linux#7.0.0-38-generic md/arch#x86_64 lang/python#3.12.3
TruffleHog
aws-cli/2.37.12 md/awscrt#0.37.0 ua/2.1 os/linux#6.12.111+deb13-amd64 md/arch#x86_64 lang/python#3.14.6

ipv6 (1)

2001:41d0:70d:7800::

filename (1)

sso_agent.iso

sha256 (1)

65f061281c9a712e9502793dc4c5035cae490b84da05f7d4223cefa65ad396e4

md5 (1)

086d4a83181971e883c53a4c44f46da2

P1 · Google patches Chrome zero-day CVE-2026-125350 (XML use-after-free) exploited in the wild; no public exploit details

Google confirmed an exploit for CVE-2026-125350 exists in the wild, a use-after-free in Chrome's XML component that is the eighth Chrome zero-day exploited this year. Fixed in Stable 157.0.8103.50/.51 on desktop; Google has not shared attack details or victim information. Hunting guidance is not published in the sources, so defenders should prioritize ensuring Chrome desktop auto-updates are applied.

Why P1: Actively exploited zero-day in a ubiquitous browser; no huntable behaviors published yet.

No IoCs extracted for this story.

P1 · CISA adds OpenSSH CVE-2026-123158, GPUStack CVE-2026-102895, FreeSWITCH CVE-2026-116779 and IBM Aspera Faspex CVE-2026-123218 to KEV; no confirmed compromises stated in sources

CISA added four vulnerabilities to the KEV catalog on 2026-11-09 with a 2026-11-12 due date: OpenSSH CVE-2026-123158 (authentication bypass on Linux builds, with Alpine/musl hosts named for update), GPUStack CVE-2026-102895 (unauthenticated admin access and secret disclosure), SignalWire FreeSwitch CVE-2026-116779 (code injection), and IBM Aspera Faspex CVE-2026-123218 (authenticated privilege escalation). The brief states GreyNoise observed a first confirmed successful exploitation of the OpenSSH flaw on Nov 7, but the CISA entries themselves print no exploitation details. Hunters should prioritize patch verification and review of OpenSSH authentication logs and GPUStack API activity.

Why P1: Actively exploited, KEV-listed internet-facing components with a stated exploitation observation for OpenSSH; no concrete huntable behaviors printed in the sources provided.

Detection guidance (1) · as of 2026-11-10

source · tier A

CISA KEV entry for CVE-2026-123158 directs forensic triage under BOD 26-04 and points to vendor and Alpine advisories for mitigation.

From this story's watch (last 48 h):

domain (1)

tac.vpnla.org

filename (1)

TAC Agent

P1 · Barracuda confirms exploitation of ESG flaws CVE-2026-116606 and CVE-2026-111560 giving root access at a small number of organizations

Barracuda updated its advisory to confirm that two patched Email Security Gateway flaws are being exploited against a limited number of customers. Per BleepingComputer, CVE-2026-116606 is an authentication weakness allowing modification of global configuration, and CVE-2026-111560 allows unauthenticated OS command injection running as root; combined, they allow authorization bypass and root access, but require access to the Admin UI. Hunters should review Admin UI access logs and look for unexpected OS command execution from the appliance and unauthorized global configuration changes, and confirm patch status (BNSF-40425 for 9.4.017+, BNSF-40430 for earlier versions).

Why P1: Vendor-confirmed active exploitation of internet-manageable email gateway appliances with root impact; patch and admin-interface lockdown are immediate.

Behaviors (2) · as of 2026-11-10

No IoCs extracted for this story.

P1 · Plex2Shell (CVE-2026-96652 et al.) exploitation reported against Plex Media Server on QNAP NAS devices

QNAP warns that threat actors are exploiting Plex2Shell, a four-flaw chain in Plex Media Server, to compromise QNAP NAS devices; exploitation reportedly began in mid-October after PoC code was published, and QNAP says some users report their Plex servers appear compromised. Exploitation requires no valid credentials and grants code execution with the privileges of the Plex service, and QNAP's OS itself is not affected. Hunters should review internet-exposed Plex Media Server instances on QNAP for unexpected code execution by the Plex process, and remediate by updating to Plex Media Server 1.43.3 or later and rotating Plex and NAS passwords.

Why P1: Actively exploited internet-facing media server software on widely deployed NAS devices with public PoC; no credentials needed.

Behaviors (1) · as of 2026-11-10

Detection guidance (1) · as of 2026-11-10

QNAP step-by-step remediation guide is referenced for identifying potential compromises; the guide itself is not reproduced in the source.

No IoCs extracted for this story.

P1 · Apple patches iMessage group-chat authorization flaws and Bluetooth/AirPlay pairing bugs; Brotli fix included Verdict card

Apple released security updates fixing two iMessage flaws (CVE-2026-113961 lets a remote attacker join a group chat and receive messages; CVE-2026-113960 exposes earlier messages to someone added to a group) and nine Bluetooth/AirPlay issues, with iOS/iPadOS 27.2.1 describing all three flaws. The sources state neither iMessage flaw has been confirmed exploited, and the notes do not say which devices are affected or offer workarounds. The updates also include a Google Brotli decoder fix (CVE-2026-111497) that is on CISA's KEV catalog, though the notes mention no attacks using it. No behavioral telemetry or hunting guidance is published, so the main action is patching.

Why P1: Patch-driven story with no published exploitation or huntable behavior; the Brotli fix is KEV-listed, which keeps it above awareness-only. (raised to P1: exploited + behaviors/KEV)

No IoCs extracted for this story.

P2 · Hijacked Ethersphere release automation pushes malicious bee-js 13.3.0 and Swarm Desktop 0.56.2 wallet stealer/backdoor

Attackers using stolen CI credentials (bee-worker account) published bee-js 13.3.0 to npm and Swarm Desktop 0.56.2 via the project's signed build workflows. A loader fetches code from api.frameworkmetrics[.]xyz that exfiltrates config.yaml and swarm.key, installs a Go remote shell (evjawbreaker) on Linux/macOS under ~/.solidity with systemd/LaunchAgent persistence, and on Windows uses a UAC bypass, adds a Defender exclusion and installs a ScreenConnect client. No infection count or fund theft reported; hunt for npm postinstall network calls, ~/.solidity, the persistence units, and unexpected ScreenConnect services.

Why P2: Supply-chain compromise with concrete huntable persistence/behaviors, but niche package with ~10 npm downloads.

Behaviors (7) · as of 2026-11-10

Detection guidance (3) · as of 2026-11-10

source · tier B · published 2026-11-09 17:36Z · proxy

Hunt for HTTP header X-Ethersphere: 1 and requests to api.frameworkmetrics[.]xyz /v1/ paths

source · tier B · published 2026-11-09 17:36Z · lockfiles/CI logs

Search lockfiles, caches, internal registries and CI logs for @ethersphere/bee-js@13.3.0

source · tier B · published 2026-11-09 17:36Z · Swarm Desktop app log

Look for 'Bee Desktop version: 0.56.2 (production)' in bee-desktop.log

sha256 (6)

37d14bff30762ca701e9c1f8bc6c57c065bb20ae3a2208cb7411a6530610f08e
80d2672e2599732d3c0ae2a4cd0d1e3fe4d555a60273ce33feb99db3f34d250f
7527e86d70e7c9493db4356f1c3775380431b310000f2602c1e993cf435d01da
9b73e7cd4e1425e770392549d8df46c706139ef476f4f7b9ac405165dc8d9696
b601776817363b96295119f7221338a122d5247a35a77a64b04f286e1bbcc565
fae61f31f00988fdc5cc9e7272b51e08af2e245d81003237875415930fd27358

filepath (1)

~/.solidity/

domain (1)

api.frameworkmetrics.xyz

ipv4 (2)

185.232.84.169
193.57.9.155

filename (2)

solidity-langsupport-runner.service
com.solidity.langsupport.runner

P2 · Attackers reportedly breach German host Mittwald via flaw in MCP server; 56 customer projects compromised

Mittwald CM Service disclosed that attackers exploited a flaw in its Model Context Protocol (MCP) server, used to connect customer AI assistants to its mStudio hosting platform, and compromised 56 customer projects after eight days undetected. The source says it is unclear whether the flaw lies in Mittwald's own code or in open-source MCP libraries, and the claim of AI-assisted attacking is alleged and unconfirmed. The source does not print specific commands, IoCs, or detection queries; hunters should review MCP server access and logs for rapid multi-step activity and any access to customer projects.

Why P2: Internet-facing MCP endpoint compromise with no published technical detail; worth a hunt this week, not a confirmed mass-exploitation campaign.

No IoCs extracted for this story.

P2 · France attributes October refrigeration-controller attacks on about 700 retail sites to IRGC unit Shahid Kaveh

France's foreign ministry and C4 coordination center attributed October 11–12 attacks that remotely altered defrost settings on Danfoss refrigeration controllers at retail sites to the IRGC-affiliated Shahid Kaveh unit, with at least 15 fires reported. The sources describe the attribution, linked hacktivist personas (CyberAveng3rs, Soldiers of Solomon, Mr. Soul, Cyber Isnaad Front), and reconnaissance of Schneider Electric industrial systems using FOFA. The sources provide no technical detection content or indicators for the intrusion path, so hunters should focus on exposed industrial controller management interfaces and FOFA-style internet-exposed device reconnaissance.

Why P2: Attributed state-backed OT/ICS sabotage against Danfoss refrigeration controllers, but sources give no concrete technical behaviors or indicators.

No IoCs extracted for this story.

P2 · Turla attempts espionage with Cereal malware injected into Exchange EdgeTransport.exe at government organizations

Russian state-linked group Turla deployed a modular .NET toolset called Cereal against government Exchange servers, documented by ESET in Kazakhstan and Romania. CerealBox injects into EdgeTransport.exe to hijack transport agent handlers and harvest selected email, while CerealNeuron receives encrypted web requests on Exchange-like paths and executes CerealRunner programs. ESET observed no external C2, so the compromised Exchange server served as the control point; hunters should look for unusual code in EdgeTransport.exe, encrypted web requests to Exchange-like paths, and the CerealRunner/CerealNeuron artifacts listed in ESET's GitHub IoCs.

Why P2: Concrete huntable behaviors in Exchange, but targeting is government-focused and no CVE or mass exploitation is stated.

Behaviors (7) · as of 2026-11-10

Detection guidance (1) · as of 2026-11-10

source · tier C

ESET published an extended IoC list on its GitHub page for the Cereal toolset.

No IoCs extracted for this story.

P2 · N-able N-central: researcher discloses 30+ unpatched flaws (Able2Shell) with public exploit chains; no CVEs assigned, no exploitation observed

A researcher published more than 30 unpatched N-able N-central flaws, dubbed Able2Shell, with public exploit chains, and N-able took hosted instances offline. Per the brief, no CVEs have been assigned and no exploitation has been observed. Defenders should keep on-prem N-central servers off exposed networks until a hotfix ships and review authentication logs from November 8.

Why P2: Unpatched management-platform flaws with public exploit chains warrant a hunt, but the brief reports no exploitation and no CVEs or technical sources were available.

No IoCs extracted for this story.

P2 · SAP November patch day fixes four unauthenticated CVSS 10.0 flaws in NetWeaver ICM, Web Dispatcher, Gateway and SAML2; no confirmed exploitation

SAP's November 2026 Security Patch Day fixed four flaws rated CVSS 10.0 that can be exploited without authentication, affecting the ICM, Web Dispatcher, Gateway and the SAML2 service provider in NetWeaver AS ABAP. Onapsis reports that the ICM and Web Dispatcher flaws (CVE-2026-76964 and CVE-2026-89126) stem from one WebSocket split-message bug it calls ICM2SHELL, with a working exploit running OS commands as <sid>adm, and that the Gateway flaw (CVE-2026-89103, PROXYGATE) can be abused through a permissive proxy list. The sources state that none of the flaws has been seen exploited in attacks. Hunters should review Web Dispatcher and gateway proxy configuration and look for SAML logons by privileged users from unexpected sources.

Why P2: Unauthenticated CVSS 10.0 flaws in widely deployed SAP components with a public working exploit, but no confirmed exploitation and no concrete in-the-wild behaviors yet.

Detection guidance (1) · as of 2026-11-10

source · tier B · published 2026-11-10 10:02Z · SAP audit log

Vendor and researcher guidance: review SAML2 logons by privileged users from unexpected sources in audit logs; review trusted identity providers in transaction SAML2.

No IoCs extracted for this story.

P2 · Attackers probing SAP NetWeaver honeypots for webshells left by CVE-2025-31324; no confirmed compromises stated

SANS ISC observed a campaign against SAP NetWeaver in honeypot data, with requests for /irj/servlet_jsp/irj/root/ant.jsp and many other upload and webshell paths from a single source, 82.26.72.21. The diary says the campaign exploits or searches for webshells left by CVE-2025-31324, an unauthenticated file upload flaw the diary describes as CVSS 10, and that webshells usually end up under /irj/servlet_jsp/irj/root/. Hunters should look for requests to ant.jsp or upload paths on SAP web servers and for unexpected files in that webroot; the source does not confirm any successful compromise.

Why P2: Probing for webshells on a known exploited SAP flaw with concrete request paths, but the source reports only scanning and no confirmed compromise.

Behaviors (1) · as of 2026-11-10

ipv4 (1)

82.26.72.21

P3 · Bitter APT deploys new PapRAT backdoor (C++/Rust) against South Asian organizations via LNK, VHDX, URL lures

Fortinet FortiGuard Labs reports Bitter (TA397) targeting South Asian organizations with PapRAT, a new C++ and Rust RAT, via three infection chains: LNK abusing ftp.exe to run scripts and create scheduled tasks, VHDX containing an LNK that opens a decoy Excel file while installing an MSI, and URL files fetching an LNK over WebDAV that leads to an MSI. The LotL stage collects directory, task, AV, and drive information, saves it as abc.pdf, and exfiltrates it with curl. Hunt for ftp.exe launched from LNK files, schtasks creation, curl uploads, msiexec launched from LNK or mounted VHDX images, and WebDAV-fetched LNKs.

Why P3: Regionally focused espionage campaign outside the financial sector; its LotL behaviors are still reusable for hunting.

Behaviors (7) · as of 2026-11-10

Detection guidance (1) · as of 2026-11-10

source · tier B · published 2026-11-09 14:31Z · EDR

Monitor scripting tools, scheduled tasks, and installer activity; treat unexpected LNK, URL shortcut, disk image, and MSI files with caution.

domain (3)

techtalkhelp.com
goodnfortunes.com
rivingtonclarks.com

filename (2)

abc.pdf
talk.log

P3 · Qilin ransomware passes 900 claimed victims in 2026, per weekly recap

A weekly recap reports that the Qilin (aka Agenda) RaaS operation has claimed more than 900 victims so far in 2026, citing Acronis. Acronis says affiliates commonly gain access through phishing, stolen credentials, vulnerable internet-facing systems and remote-management tools, and that Qilin can encrypt local files, network shares and VM infrastructure. The sources give no specific technical indicators or detection guidance for this activity, so hunters should rely on general ransomware precursors such as remote-management tool abuse.

Why P3: Victim-count update only; no concrete huntable behaviors or indicators in the sources.

No IoCs extracted for this story.

P3 · Vanderbilt University responds to cyber incident claimed by BYOD ransomware gang; university has not confirmed encryption or data theft

Vanderbilt University confirmed it is responding to an active cybersecurity incident affecting devices, systems, and cloud services, and told users to shut down devices and disconnect from Wi-Fi. The BYOD ransomware gang claimed on its leak site to have encrypted databases and stolen over 1 million SSNs, and BleepingComputer received a photo of a ransom note on a Vanderbilt computer, but the university has not confirmed the group's involvement, encryption, or data theft. The sources publish no technical details of the intrusion, so no specific behaviors or indicators are available to hunt for.

Why P3: Awareness only: claimed ransomware against a university with no published technical behaviors or indicators.

No IoCs extracted for this story.

P3 · Fireworks AI discloses second breach: attackers reached dev machines via third-party cloud provider, exposing billing data and partial model weights

Fireworks AI disclosed a new incident in which a third-party cloud provider hosting its R&D machines was compromised on October 23, and the unauthorized party used that access to reach Fireworks development machines and run an unauthorized workload on October 24. The company says the attackers accessed resource metadata, billing information, and incomplete model weights and datasets for some customers, but not payment card numbers, and that no further unauthorized access to the customer platform was detected as of October 25. Hunters should look at cloud provider-hosted R&D and development systems for unauthorized workloads and access from the provider environment; the sources print no specific commands, IoCs, or detection queries.

Why P3: Awareness only: a supply-side cloud compromise with no printed technical behaviors, commands, or indicators.

No IoCs extracted for this story.

P3 · SEGA newsletter data breach via vendor ARARA exposes 2.2 million subscriber email addresses

SEGA disclosed that its third-party newsletter provider ARARA suffered a breach exposing email addresses of 2.2 million SEGA newsletter subscribers across 11 newsletters, plus 92,300 records with further data still under review. ARARA reported a web server vulnerability and environment problems contributed, but the intrusion method and timing remain under investigation, and the attackers abused access to send over 7 million impersonation emails in late October. SEGA says it has no confirmed evidence of misuse, and the source provides no technical indicators or hunting guidance.

Why P3: Vendor data breach with no published technical behaviors, IoCs, or detection guidance; awareness only.

No IoCs extracted for this story.

P3 · York University confirms breach of departmental web forms exposing personal data dating to 2007; no confirmed attacker or victim count

York University in Toronto confirmed an unauthorized actor accessed limited online forms used by university departments, discovered October 25 and affecting submissions on 14 websites between 2007 and 2026. Exposed data categories reportedly include contact details, York ID numbers, government ID, health information, and financial status, and the university has not stated how many individuals were affected. No threat actor or ransomware group claim was identified, and no technical details such as attack vector or indicators were published; hunters have no concrete artifacts to target from this source.

Why P3: Data-exposure disclosure with no published technical behaviors, indicators, or detection guidance; awareness only.

No IoCs extracted for this story.

P3 · Russian hosting provider Beget rebuilding infrastructure after data-wiper attack; attacker reportedly gained access to management layer

Russian web-hosting and cloud provider Beget says an attacker gained access to its management systems on the night of November 1 and deployed malware and data-zeroing scripts that erased data across VPS, S3, and Kubernetes environments. The company disconnected all servers after detecting the attack and, as of its November 9 update reported in BleepingComputer, had restored roughly 60% of shared hosting and 40% of dedicated servers with recovery ongoing. The sources state the attack focused on destruction and found no evidence of data download or modification; no IoCs, malware names, or detection guidance are published in the sources.

Why P3: Destructive attack on a hosting provider with no published technical indicators or detection guidance; awareness only for most defenders.

Behaviors (1) · as of 2026-11-10

No IoCs extracted for this story.

P3 · Binance denies claimed 335 million-record leak attributed to ShinyHunters impersonator

Binance denied a forum claim by an actor using the ShinyHunters handle to sell records of 335 million users for $900,000. Binance spokesperson said it found no evidence that its systems, KYC data, credentials, wallet keys, or infrastructure were compromised, and called the listing likely a scam, noting similar listings often involved infostealer data from users' own devices. No confirmed compromise is reported; hunters should focus on customer phishing and infostealer exposure rather than a Binance intrusion.

Why P3: Breach claim denied by vendor with no technical behaviors or artifacts published; awareness only.

No IoCs extracted for this story.

P3 · FinCEN bars US institutions from dealing with MEXC crypto exchange over illicit flows

The brief reports that FinCEN barred US financial institutions from the MEXC cryptocurrency exchange, citing more than $16 billion in illicit flows. No source could be fetched, so no technical details of adversary activity are confirmed. The item concerns sanctions and financial-crime enforcement rather than an intrusion, so there are no huntable host or network behaviors to extract.

Why P3: Sanctions/financial-crime awareness item with no technical behaviors or sources available.

No IoCs extracted for this story.

P3 · Ukrainian police arrest four over fraudulent crypto investment call centers that defrauded German victims

Ukraine's cyber police arrested four suspects allegedly running fraudulent call centers that posed as financial advisers and steered victims in Germany into fake cryptocurrency and stock investments. Investigators identified 135 German victims who lost more than €4.3 million, and in some cases the scammers gained access to online banking accounts. This is a fraud and law-enforcement story with no technical intrusion details, so there are no behaviors, artifacts, or IoCs to hunt.

Why P3: Law-enforcement arrest and fraud report with no huntable technical behaviors or indicators.

No IoCs extracted for this story.

P3 · Italy's foreign minister Tajani says personal data leaked on dark web; Meloni blames pro-Russian hackers

Foreign Minister Antonio Tajani said in a social media post that his personal data was being spread on the dark web and that criminals were seeking further information about him and his family. Premier Giorgia Meloni blamed pro-Russian hackers and called the sale of confidential information about officials a grave concern. The sources do not specify the data type, the attack method, or confirmed attribution beyond the government statements, so no technical behaviors or indicators are published to hunt for.

Why P3: Data leak and intimidation of an official with no published technical details; awareness only.

No IoCs extracted for this story.

P3 · Claude document tool flaw reported: planted temporary file can lead to code execution on Linux (feed summary only, unverified)

A brief item from the Patches & Advisories section reports a Claude document tool issue in which a planted temporary file can make the assistant run code on Linux. The only source is a feed summary; no primary advisory was fetched, so no CVE, vendor confirmation, patch version, or exploitation status can be stated. Hunters should wait for the vendor advisory before defining specific detections.

Why P3: Single unverified feed summary with no primary advisory, no exploitation evidence, and no concrete huntable behaviors.

No IoCs extracted for this story.

P3 · AI models complete about three-quarters of multi-stage attack scenarios in Irregular's CyScenarioBench; no real-world intrusions reported

Source reports that Anthropic's Claude Fable 5.2 completed 76.3% of challenges on Irregular's CyScenarioBench, which measures whether a model can plan and execute a multi-stage cyber operation in a realistic environment, versus 61.7% for Fable 5.1 and 61% for OpenAI's GPT-6 Cyber. Irregular also reported Google's Gemini 4 Argon solved 12 challenges end to end in a subset of the suite. The article describes model benchmark results only and names no victims, malware, or intrusion activity for defenders to hunt.

Why P3: AI model benchmark results with no concrete adversary behaviors or huntable artifacts; awareness only.

No IoCs extracted for this story.

P3 · Microsoft FORGE Lab reports soundness bugs in Rust standard library found with AI-assisted scanning

Microsoft's FORGE Lab reports memory-safety soundness bugs in Rust's std and core, including cases where safe Rust code can trigger undefined behavior, some found with its Hyenas (MDASH) AI scanner. The post describes panic-safety, trust-in-user-implementation, and OS-boundary bug classes, and notes two issues remain open at publication. The sources describe no in-the-wild exploitation, so hunters have no adversary behavior to search for; the only actionable item is patching Rust toolchains and reviewing unsafe-code usage in own software.

Why P3: Vendor research on library soundness bugs with no exploitation or huntable adversary behavior described.

No IoCs extracted for this story.

P3 · CISA incident reporting questionnaire update (no technical details available)

A brief item reports that CISA released a new questionnaire asking for more incident detail. The item is a feed summary only, and no source could be fetched, so no adversary activity, malware, or vulnerability is confirmed. No hunting guidance can be derived from this item.

Why P3: Administrative reporting-process update with no technical adversary behavior or exploitation.

No IoCs extracted for this story.

P3 · NIST publishes basic security guidance for solo business owners

A NIST item in the researcher blogs and reports section describes a basic security framework for solo business owners. The brief item is feed-summary only and no source could be fetched, so no adversary activity, malware, or CVEs are reported. Nothing in this item is huntable.

Why P3: General security guidance with no reported threat activity; awareness only.

No IoCs extracted for this story.

P3 · Vendor-sponsored article argues rich network data is needed to investigate alerts and verify AI-generated SOC conclusions

A contributed partner article from The Hacker News, sponsored by Corelight, argues that network security data quality (full transactions, packet content, extraction, long retention, cross-host correlation) determines whether analysts can investigate alerts and validate AI-assisted findings. It describes no specific threat actor, malware, vulnerability, or observed intrusion. The practical takeaway for hunters is to test whether network telemetry supports pivoting and reconstruction before trusting AI-generated conclusions.

Why P3: Awareness only; vendor-contributed opinion piece with no concrete adversary behavior or huntable detection content.

No IoCs extracted for this story.

a87002c32723f1849b3ad17b1fe6da732c9810b54b08501be21f5b1fcd882a59
6c7a4061bcf08df5fe4a49d37442dc650d751be1a91a8bc802edff213e4d5e61
ca5f8e5247f1a044b8be45ef03187726b9af3ac30fd93fb5bb54144e34ed3738
7a13e59d816d68a071a8648e62a7c3c7f929a61c618a2133ab6f511da24f979d
bb2472cf5dc7e5c94216d355bf84fba2c8d088d03d61a1ac0d78639049cf5e1f
8245c7e7d944923f1608592f6c3473dcc6e3a3e43df3dd1c6257e7880948787b
91b3cc9d6421b651ec85a16062af3ba26700dad2eea4a8a7e42fdd2e422f8803
e6e576a634166a16bdbfc09b14e7cf8eab90015d2dfa67dd73f3968ee869229b
6953618238eb40f45b584e52aca22cebbe8ba03e9a80c15c6b593f51f7e49527
e79c91e8157fef862be8cbe80bdf57b87a541416717265f81f669d751fca4a3d
8aac187bae71f75fa2dde03dcb4a9279c982182ee8254ae96e7a6626fe4c7617
875d0986ddaa51bfb5e03b06df1213cc3bb7966588d6153bdda57f2e3671e986
f76dae028e0c43248c128b3bf609e8d660ce0bf44b53ab9e097887e6f5206eb5
6c695baad1d81ed49194d07a79381292c0466208ff1a9862c0c55f971d6a409f
818bb464271a539c96bcbbfea1db7d5a722512041ed8ed10d3f6c7f366190044
6f6b66cbdc4a5aa5685d0017abd3f65843a28bcc2bb4e5b78d6d12a844a51aa8
65f061281c9a712e9502793dc4c5035cae490b84da05f7d4223cefa65ad396e4
37d14bff30762ca701e9c1f8bc6c57c065bb20ae3a2208cb7411a6530610f08e
80d2672e2599732d3c0ae2a4cd0d1e3fe4d555a60273ce33feb99db3f34d250f
7527e86d70e7c9493db4356f1c3775380431b310000f2602c1e993cf435d01da
9b73e7cd4e1425e770392549d8df46c706139ef476f4f7b9ac405165dc8d9696
b601776817363b96295119f7221338a122d5247a35a77a64b04f286e1bbcc565
fae61f31f00988fdc5cc9e7272b51e08af2e245d81003237875415930fd27358

AhsayCBS.jsp
nsmind.jsp
heap_shellcode_runner_bound_weaponized.py
kvm-agent.exe
sso_agent.iso
solidity-langsupport-runner.service
com.solidity.langsupport.runner
abc.pdf
talk.log
TAC Agent

pool.supportxmr.com
pool-fr.supportxmr.com
creepexplosiondarknight.com
api.frameworkmetrics.xyz
techtalkhelp.com
goodnfortunes.com
rivingtonclarks.com
tac.vpnla.org

104.243.43.115
45.83.220.211
57.129.54.120
89.37.63.175
185.209.199.73
185.232.84.169
193.57.9.155
82.26.72.21

https://creepexplosiondarknight.com/d

1c7437dac21630f53c0b888b50662c6487e23fd7

Boto3/1.43.108 md/Botocore#1.43.108 ua/2.1 os/linux#6.1.0-53-arm64 md/arch#aarch64 lang/python#3.11.2
Boto3/1.37.9 md/Botocore#1.37.9 ua/2.1 os/linux#6.12.111+deb13-amd64 md/arch#x86_64 lang/python#3.13.5
Boto3/1.43.113 md/Botocore#1.43.113 ua/2.1 os/linux#7.0.0-38-generic md/arch#x86_64 lang/python#3.12.3
TruffleHog
aws-cli/2.37.12 md/awscrt#0.37.0 ua/2.1 os/linux#6.12.111+deb13-amd64 md/arch#x86_64 lang/python#3.14.6

2001:41d0:70d:7800::

086d4a83181971e883c53a4c44f46da2

~/.solidity/