Latest

RESPONSE · NEW YORK

Wordfence Says Attackers Started Hunting a WordPress Core Update Race Within Hours of the 7.1.4 Fix, Sending More Than 18,500 Requests in 21 Hours to Catch a Window That Lasts Seconds

The unauthenticated flaw, rated 8.1, lets an attacker who requests the staged installer during a full Core update work toward PHP code execution. WordPress fixed it in 7.1.4 and backported the change to every branch back to 4.7; Wordfence says site owners should confirm the update landed and check wp-content/upgrade for stray requests.

Noah Park, Response, New York

THREAT INTEL · SINGAPORE

Sophos Says the GOLD OGRE Ransomware Crew Had Cursor's AI Agents Work From Stolen VPN Logins to Domain Admin, Then Named Three of the Victims on Its Aur0ra Leak Site

Sophos Counter Threat Unit researchers say Russian-speaking operators handed AI agents VPN credentials, SOCKS access and targets, and the agents ran Active Directory discovery, Kerberoasting, NTLM relay and credential extraction with limited human involvement. Sophos published seven network indicators and the detections it built for the activity.

Priya Shah, Threat Intel, Singapore

TOOLS · AUSTIN

Remedio Says a Single 32-Bit Multiply in TeamViewer Let a Malicious Host Run Code on the Support Technician's Machine That Connected to Help It, and Version 15.83 Fixes It

CVE-2026-111585, rated 8.8, sits in the viewer's screen decoder and needs only an accepted session. TeamViewer's Oct. 27 bulletin fixes it alongside two more client flaws, says the company knows of no exploitation and lists patched builds for legacy 13.2, 14.7 and 15.64 installs.

James Whitford, Tools, Austin

RESPONSE · NEW YORK

A Trojanized Claude Code Extension Reached Up to 5,000 Cursor Users Through Open-VSX and Planted an Attacker's SSH Key, and Uninstalling It Does Not Remove the Backdoor

Version 2.1.313 of the official anthropic.claude-code extension carried a loader that ran as soon as the extension loaded, added an svc-telemetry key to authorized_keys and installed persistence disguised as system monitoring. Cursor and StepSecurity published indicators and say responders should hunt for the key, remove the persistence and rotate credentials from a clean machine.

Noah Park, Response, New York

OPINION · LONDON

Malware Image Classifiers Report 97% to 99% Accuracy, but an Audit of 10 Benchmarks Found as Much as 50.6% of Test Images Had a Copy or Near-Copy in Training, and SOC Teams Should Ask What a Model Was Graded On

Vanderbilt University researchers audited 10 public benchmarks for malware classifiers that read programs as images and found that the standard cleanup, removing files with the same hash, left identical images on both sides of the train and test split. Elena Vos argues that SOC teams should treat any malware model's accuracy figure as a claim about its test set until they know how that set was built.

Elena Vos, Opinion, London

DETECTION · LONDON

Did You Know: PowerShell 7 Writes Script Block Logs to Its Own Event Log, Not the One Windows PowerShell Uses

Windows PowerShell 5.1 and PowerShell 7 both record script blocks as event 4104, but Microsoft documents them in different event logs, set by different policy paths. A hunt that searches only one channel can come back empty while the other holds the evidence. Collect both, and check that each one is actually turned on.

Ava Okello, Detection, London

RESPONSE · NEW YORK

Hudson Rock Says a DebugBear Performance-Monitoring Script on Polymarket Was Rewritten to Hijack Logged-In Trading Sessions, Sell Positions and Send Assets to an Attacker Wallet

Polymarket halted trading for about an hour and said a third-party provider was compromised, as DebugBear told customers to pull its monitoring embed code. The 15,187-byte payload reused the page's own trading client and signer, and Hudson Rock warns that allowing a trusted CDN does not verify the bytes it serves.

Noah Park, Response, New York

THREAT INTEL · SINGAPORE

Pluto Security Says a Hugging Face Cryptomining Campaign Hid in 31 Fake Qwen2 Repositories That Run Code the Moment a Model Loads, and Came Back Within Days of a Takedown

The payloads ride on the trust_remote_code option rather than poisoned weights, scanned clean, and target self-hosted GPU inference servers such as Xinference and GPUStack. The top second-wave model passed 28,000 downloads, and Pluto says killing the miner leaves the backdoors in place.

Priya Shah, Threat Intel, Singapore

DETECTION · LONDON

CrowdStrike Says China-Nexus VAPOR PANDA Used the ARTEX AI Agent Framework Against More Than 200 Organizations in 11 Days, With an Operator Telling the Agents to Find Windows Machines Without Falcon

Recovered agent transcripts show one human operator steering parallel intrusions at foreign ministries, pharmaceutical companies and telecoms on DeepSeek and a second commercial model. CrowdStrike confirmed post-exploitation at nine organizations and published hunt markers, including artx strings and a C:\ProgramData\artx5v\ directory.

Ava Okello, Detection, London

THREAT INTEL · SINGAPORE

TRM Labs Says North Korea's TraderTraitor Took About $6.36 Billion From Binance Across 10 Blockchains, and the Evidence Points to the Exchange's Hot Wallet Signing System

Binance says a compromised DevOps engineer's laptop let an attacker reach a service container and submit withdrawals, and it has found no sign of a private key leak. TRM says 50 pre-signed EIP-7702 authorizations turned an Ethereum hot wallet into an attacker's sweeper, and that treasury teams should alert on any such delegation.

Priya Shah, Threat Intel, Singapore

RESPONSE · NEW YORK

Hudson Rock Says a Second FortiBleed Cache of FortiGate Configurations Holds 40,573 Cleartext Secrets, Including 1,576 Active Directory Bind Passwords

The 1,703 configuration reports, most dated Feb. 20, 2026, cover 1,689 firewall host identifiers, 924 of them missing from the first FortiBleed list. For responders, the lesson is that a FortiGate exposure reaches LDAP service accounts, administrator tables and HA, RADIUS and SMTP secrets, not just VPN passwords.

Noah Park, Response, New York

THREAT INTEL · SINGAPORE

Hunt.io Says an Operator Copied 68 GB of Philippine Overseas-Employment Database Backups in Under 24 Minutes, Then Left the Transfer Log and a Rebranded GodPotato Toolkit in an Open Directory

The capture shows the agency's own portal hosts pulling the loader and both payloads the same evening. Hunt.io says the GodPotato rebuild leaves one durable trace, a combase.dll memory page left writable, and that how the operator got in, and what ran as SYSTEM, are not in the data.

Priya Shah, Threat Intel, Singapore

TOOLS · AUSTIN

Cisco Open-Sources Project Quarry, a Rule Language for Catching AI Agent Attacks That Only Show Up Across a Sequence of Individually Permitted Steps

Cisco pitches Quarry as Snort, YARA and Sigma for agent traces: rules that mix exact checks with classifier and LLM-judge signals, run over stored or live sessions and return the evidence behind each match. It built the case around the July incident in which OpenAI evaluation agents spent about two and a half days inside Hugging Face.

James Whitford, Tools, Austin

RESPONSE · NEW YORK

Anthropic Says Claude Wrote a Remote Root Exploit for Linux Kernel Flaw CVE-2026-98432, Rated 9.8, as Ubuntu and Red Hat Still Have No Fixed Kernel to Install

The IPv4 TCP handshake race, present since Linux 4.4, is fixed upstream and in Debian, Oracle Linux and some SUSE and Amazon Linux kernels. Vendors score it from 7.0 to 9.8, no advisory reports exploitation in the wild, and Red Hat says no mitigation meets its standards.

Noah Park, Response, New York

THREAT INTEL · SINGAPORE

Microsoft Says North Korean Hackers Have Built AI Into Their Operations, With Onyx Sleet Producing More Than 100 Tailored PDF Lures and Two Groups Now Using the ARTEX Agentic Pentest Framework

Microsoft Threat Intelligence rated AI adoption high across the regime's actors and put Jade Sleet, Coral Sleet and Jasper Sleet at the operationalized stage. It said the operations remain human-directed, and it published Defender detections and hiring checks aimed at fake IT worker personas.

Priya Shah, Threat Intel, Singapore

TOOLS · AUSTIN

A Scan of 7.25 Million Gitee Repositories Found 26,400 Live Credentials, and TruffleHog and Kingfisher Each Caught Only About Half, Agreeing on Just 1,001

Independent researcher Ben Zimmermann ran both open-source scanners on every repository and kept only secrets that still authenticated. Alibaba Cloud keys led at 9,473, an organization-admin credential for an unnamed enterprise AI platform turned up, and revocation of the reported keys had not been confirmed when he published.

James Whitford, Tools, Austin

THREAT INTEL · SINGAPORE

Infoblox Ties a QuickBooks Callback Scam on More Than 350 Lookalike Domains to UltraMailer's Default Tracker, Then Finds Trojanized UltraMailer and UltraViewer Installers Carrying Remote Access Trojans

The trail began with a tech-support scammer pushing UltraViewer, a remote access tool Infoblox sees on up to 30% of its customer networks on some days. Every phishing email fired a pixel at track.chanret[.]com with the recipient's address base64-encoded in the path, and one trojanized UltraMailer installer carried njRAT.

Priya Shah, Threat Intel, Singapore

DETECTION · LONDON

Cisco Talos IR Says Ransomware Made Up 27% of Its Q3 Engagements as Fake IT Help Desk Callers Opened Remote Sessions, Operators Disabled EDR and Logging Gaps Hampered More Than 40% of Cases

Phishing, including voice calls that steered users into Quick Assist and RMM tools, opened 37% of engagements and public-facing exploits 33%. Interlock operators and a new Conti-derived strain called VYPR went after EDR directly, and Talos told defenders to keep at least 90 days of logs off the box.

Ava Okello, Detection, London

TOOLS · AUSTIN

Socket Says 319 Search-Hijacking Browser Extensions Reach About 13.4 Million Users, Routing Every Query Through Operator Proxies for Yahoo and Bing Referral Fees

Most of the extensions are unlisted Manifest V3 search-provider overrides with no permissions and no UI, pushed through ads. Socket published Censys and Urlscan hunts, named operators from Intango to System1, and argued the redirects could be switched from syndication results to phishing or malware lures per request.

James Whitford, Tools, Austin

DETECTION · LONDON

Symantec Says an Unauthorized Relay Installs Real Codex and Claude Code CLIs, Then Sets sandbox_mode to danger-full-access and Routes Every Prompt Through Its Own Servers

Threat Hunter found the grey-market service on systems at a dozen organizations since early 2026, mostly in mainland China. A fileless setup script fetched from lookalike domains rewrites CLI config, replaces API credentials and disables telemetry; Symantec published hashes and domains and said it has not yet seen the operator abuse the access.

Ava Okello, Detection, London

THREAT INTEL · SINGAPORE

Cisco Talos Says NIK C2 Is an AI-Enabled C2 Framework Whose Windows Implant Calls OpenAI From the Compromised Host, Streams Keystrokes and Can Lock the Screen for Bitcoin or USDT

The Go implant talks over a TLS WebSocket with a 250-millisecond HTTP fallback, can bill OpenAI against the victim's own API key, and grew from a stealer into a full framework with HVNC, AMSI bypass and bootkit staging between Aug. 12 and Aug. 17. Talos published ClamAV coverage and C2 path IOCs.

Priya Shah, Threat Intel, Singapore

RESPONSE · NEW YORK

Alpine Linux Says an Attacker Tried to Exploit CVE-2026-97229 on Its Own GitLab, and Upgrading GitLab Alone Did Not Close the Hole Because the Fix Lives in Ruby

The project's Oct. 28 notice says the CVSS 10.0 CI regex flaw crashed workers eight times and came close to working. Alpine rebuilt the server after finding no proof of code execution but also no way to rule it out, and warned anyone running GitLab on their own Ruby that the GitLab version string is not enough.

Noah Park, Response, New York

RESPONSE · NEW YORK

Cisco Says Attackers Are Exploiting CVE-2026-76418 to Crash ASA and FTD Firewalls When Secondary Authentication Is On the SSL VPN Tunnel Group

The advisory rates the unauthenticated denial-of-service flaw 8.6 and says PSIRT became aware of active exploitation in October. Only devices with a reachable SSL remote access VPN and secondary authentication on a tunnel group are exposed, and Cisco published fixed releases plus a mitigation that strips those secondary checks.

Noah Park, Response, New York

OPINION · LONDON

A Detector That Flagged 82.8% of Random Data Corruption Was Blind on 64.7% of the Source and Task Pairs Researchers Audited, and SOC Teams Should Stop Grading Anomaly Detection on Clean Metrics

Researchers at India's Centre for Development of Advanced Computing show that a cross-source anomaly detector with a 3.18% false-positive rate, which flagged 82.8% of random corruptions, was still first-order blind on 64.7% of the source and task pairs they audited. Elena Vos argues that SOC teams should test detectors against an attacker who controls some of their inputs, and add independent checks where cross-checking is weakest.

Elena Vos, Opinion, London

THREAT INTEL · SINGAPORE

Kaspersky Says an Unknown APT Abused Patch My PC Components and a Microsoft-Signed Assembly to Load NetamLoader on a Government-Only Windows 10 Build in Asia, Then Scrubbed Update Logs and Prefetch Files

The chain used AppDomainManager injection and a booby-trapped .resx file to unpack layered XAML payloads, blinded AMSI and ETW, and moved into dllhost.exe through a remote COM object. Kaspersky found one victim and could not tie the framework to any known group, but the file paths, registry artifacts and command server it published give hunters something concrete.

Priya Shah, Threat Intel, Singapore

DETECTION · LONDON

SOCRadar Says an Exposed n0n Ransomware Workspace Shows Every Documented Break-In Used Weak or Stolen Credentials, From Credential Stuffing Against 305 FortiGate VPNs to Exposed AWS Keys, With AI-Written Scripts Doing the Legwork

The open directory held 1,719 files from September, including 829 scripts and five encryptor sources, and tied the operator to at least 23 organizations in 14 countries. SOCRadar also published behavioral detections a SOC can run today, from .n0n file renames and a Run key named n0nNote to FortiGate login requests carrying the cookie APBSID=n0n.

Ava Okello, Detection, London

THREAT INTEL · SINGAPORE

Cisco Talos Says UAT-11473 Hid a Malware Framework Inside Cisco SD-WAN Controllers to Collect IPsec Key Material, Using Infrastructure That Overlaps Volt Typhoon's Silent Train Network

The KeyDrift framework came in through CVE-2026-20127, an authentication bypass in Catalyst SD-WAN Controller, then injected itself into the vdaemon control-plane process and hooked decrypted traffic, Talos said. Targets included space and satellite services, defense and aerospace technology and policy research, and Talos published Snort coverage and file paths defenders can check now.

Priya Shah, Threat Intel, Singapore

RESPONSE · NEW YORK

Did You Know: Defender for Endpoint Device Isolation Keeps the Sensor Online and Lifts Itself After Seven Days

Microsoft says isolating a device cuts it off from the network but keeps it connected to the Defender for Endpoint service, which continues to monitor it. The isolation is lifted automatically after seven days, and VPN, proxy and exclusion settings can change what it actually blocks. Treat isolation as a containment step with a clock, not a finished state.

Noah Park, Response, New York

RESPONSE · NEW YORK

Palo Alto Networks Confirms Attackers Are Exploiting PHP2Shell Against Internet-Exposed PAN-OS Management Interfaces, as 19 of 20 Hotfixes Ship and One Remains Due October 30

The company's advisory now reports active exploitation against PAN-OS management interfaces reachable from the internet, days after Dream said a China-linked operator rooted 25 firewall servers with the same PHP flaws. Only the HTTPS web UI and XML API are affected, so cutting internet access to them is the fastest protection while hotfixes roll out.

Noah Park, Response, New York

RESPONSE · NEW YORK

ESET Says Russia-Aligned Hackers Hijacked Ukrainian MDaemon Mail Servers With No Click Needed, Using a WinRAR Flaw Left in MDaemon's Bundled ClamAV Library Until Version 26.0.4

The finding, in ESET's APT Activity Report for April through September 2026, comes with a second warning for Windows shops: Belarus-aligned FrostyNeighbor pushed a VBScript wiper through Group Policy at a Ukrainian manufacturer, the first destructive attack ESET has documented from a Belarus-aligned group. Mail administrators should confirm every MDaemon server is on version 26.0.4 or later.

Noah Park, Response, New York

THREAT INTEL · SINGAPORE

CrowdStrike Says CHATTY SPIDER Hired a Russian National to Walk Into a U.S. Law Firm Posing as IT Staff, as Its Legal-Sector Activity Rose 129% and China-Nexus Groups Exploited Intapp Time Server and an ESXi Zero-Day

The company's 2026 Legal Threat Landscape Report says financially motivated crews drove 82% of the activity it observed against legal entities, leak sites named 455 of them, and one intruder tried to pull data four minutes after getting in. The FBI's indicators for the same group give defenders a starting point: unapproved remote tools, WinSCP or Rclone traffic to outside addresses, and unknown visitors claiming to be IT support.

Priya Shah, Threat Intel, Singapore

DETECTION · LONDON

Cequence Says a Single Scanner Posing as 32 AI Bots Hunted for .env Files, Cloud Credentials and SSH Keys, Reaching 48% of Its Customers With AI Bot Traffic in One Day

The CQ Prime Research team says the actor rotated through crawler and assistant identities from OpenAI, Anthropic, Meta and Perplexity, burned through more than 300 cloud addresses in a day, and gave itself away by asking for secrets no real AI agent needs. Its advice is to verify agents by signed requests or published address ranges and to flag any claimed assistant that requests credential files.

Ava Okello, Detection, London

THREAT INTEL · SINGAPORE

Black Lotus Labs Says Volt Typhoon Built a Disposable Relay Network Called Silent Train to Hide Zero-Day Attacks on Management Platforms, Tearing Down Each Chain After About Four Hours

Lumen's threat research unit says the Chinese state-sponsored group has rotated hijacked routers, IoT devices and enterprise appliances through four-to-six-hop SSH chains since late 2023, and used them to exploit Quest KACE, Versa Director, N-able N-central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator. Its advice to defenders is to treat management and control-plane systems as priority targets and keep their logs.

Priya Shah, Threat Intel, Singapore

DETECTION · LONDON

LevelBlue Says Data Exfiltration Showed Up in 83% of Q3 Intrusions While Encryption Fell to 67%, and Attackers Bypassed MFA in 79% of the Business Email Compromise Cases Where It Was On

The quarterly briefing, drawn from LevelBlue's own incident response work, says attackers are keeping stolen data and skipping the ransomware payload, so detection built around encryption events will miss a growing share of intrusions. Phishing still led initial access at 42%, down from 65%, as internet-facing routes rose, and the firm says to watch outbound transfers, archive creation, new cloud destinations, and device-enrollment activity.

Ava Okello, Detection, London

RESPONSE · NEW YORK

Attackers Begin Probing the Critical Oracle E-Business Suite Flaw CVE-2026-101767 a Week After the Patch, and Horizon3 Says the Fix or the URL Firewall Allowlist Is the Only Thing Standing in the Way

Defused says its decoys recorded exploratory exploits against the unauthenticated SQL-injection-to-RCE flaw in the EBS Thin Client Framework servlet on Oct. 27, days after Oracle's Oct. 20 patch. Horizon3, which reported the bug in July, rates it 9.8 and says removing /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist buys time until the October Critical Patch Update is applied.

Noah Park, Response, New York

THREAT INTEL · SINGAPORE

Dream Says a China-Linked Operator Chained PHP2Shell With the Fragnesia Kernel Flaw to Root 25 Firewall Servers, Then Tunneled From a US Government-Affiliated Firewall Into Active Directory

The custom exploit took unauthenticated requests to root on internet-facing firewalls, planted 103-byte webshells on 24 of them, and left 22 parked. Dream, which has not named the firewall vendor, says the operator then broke into the firewall management server of a US government-affiliated organization, decrypted an LDAP service account, and sprayed passwords at every domain user.

Priya Shah, Threat Intel, Singapore

RESPONSE · NEW YORK

ELLIO Says the First In-the-Wild Node2Shell Exploit Never Reached a Shell, but Failed Brotli Attempts Crash Node.js Workers and Can Leave Another Visitor's Session in a Core Dump

Node.js 22.23.4, 24.22.1 and 26.12.1 fix the Brotli decoder flaw, which CISA now lists as exploited, and Broadcom says patches for VMware SDDC Manager are still pending. ELLIO's analysis tells responders to treat a run of decoder crashes as an outage and a possible credential leak at once, and warns that process.versions.brotli reads the same on fixed and vulnerable builds.

Noah Park, Response, New York

OPINION · LONDON

Arctic Wolf Says Its AI Agents Now Resolve 60% of SOC Investigations Alone, and Buyers Should Ask Every Agentic SOC Vendor How Often Analysts Overrule the Machine

Arctic Wolf's 2026 Agentic Security Operations Report says agents in its managed SOC resolved 60% of investigations with no human involvement and that human-only cases fell from about 81% to 2%. Its most useful page describes an AI that was confidently wrong. Elena Vos argues that buyers should judge agentic SOCs by how often analysts overrule them, not by how much they do alone.

Elena Vos, Opinion, London

TOOLS · AUSTIN

Did You Know: Sysmon Logs Only What Its Configuration Asks For, and a Default Install Skips Network Connections

Microsoft says a default Sysmon install hashes process images with SHA1 and does no network monitoring, and that image load events stay off until configured. A widely forked community configuration leaves process access logging empty, the event Microsoft ties to spotting LSASS memory reads. Before trusting a hunt, check which configuration the host was running.

James Whitford, Tools, Austin

THREAT INTEL · SINGAPORE

Cyble Says the INJ3CTOR3 FreePBX Implant Now Uploads SIP Trunk and Database Credentials From 17 Configuration Files Every Minute, So Rebuilding an Infected Phone System No Longer Stops the Toll Fraud

A new generation of the toll-fraud operation's implant sends trunk, AMI, database and mail-relay secrets to two staging hosts and has rotated the watermark and webshell gate hash that defenders were told to hunt. Cyble's researchers say to cut the PBX off, preserve evidence, clean from cron upward and rotate every secret only after the host is clean.

Priya Shah, Threat Intel, Singapore

RESPONSE · NEW YORK

Tailscale Ships 1.104.4 to Close Tailworm SSH Forwarding Flaws That Let a Permitted Session Reach Root-Only Sockets, and the Researcher Says Reimaging a Compromised Node Does Not Revoke Its Stolen Keys

Tailscale's four new bulletins say an attacker who already controls a device allowed to open Tailscale SSH sessions could use socket forwarding to reach the Docker socket or the tailscaled local API on the server. Updating closes the holes. For a node that may already be compromised, the Tailworm report says to delete it at the control plane and rotate keys, because a copied node identity survives a rebuild.

Noah Park, Response, New York

DETECTION · LONDON

Atos Says a New ClickFix Variant Maps a Remote WebDAV Drive With net use and Hides Its Beacon in a Trojanized WorkFlowy App, Slipping Past Default Detection Until a RunMRU Hunt Caught It

Atos researchers say a ClickFix lure had victims paste a net use command that mounted an attacker's WebDAV share, ran a batch file from it and removed the drive, then launched an old, signed copy of the WorkFlowy desktop app whose packaged code had been swapped for a beacon and dropper. Out-of-the-box controls missed it. A hunt on the Explorer RunMRU registry key did not.

Ava Okello, Detection, London

DETECTION · LONDON

Sysdig Says Every Public Pickle Bypass Beat Machine Learning Model Defenses the Same Way, and Its Runtime Test Shows Why Command-Line Detection Rules Miss the Malicious Load

Sysdig's threat research team traced six documented bypasses of PyTorch, Keras and picklescan protections to one gap: the tool checking a model file and the library loading it read the bytes differently. In its own test, runtime rules caught the consequences of malicious model loads within two seconds, but no rule ever saw the load itself.

Ava Okello, Detection, London

RESPONSE · NEW YORK

Wiz Says Exposed Machines Vulnerable to PHP2Shell Fell About 67% in Days, While Public Exploit Kits Still Fail to Finish the Memory Leak

One week after disclosure, Wiz telemetry shows roughly 67% fewer distinct internet-exposed machines still vulnerable and a 47.9% drop in significantly affected organizations. In the same window, open-source exploit kits exhausted PHP memory on Wiz honeypots but never leaked the addresses needed for a working shell.

Noah Park, Response, New York

DETECTION · LONDON

Huntress Says Attackers Are Getting In Through Camera Management Software, Then Sideloading Beacons Through a Copied Copy of Windows' WpcMon.exe

Across a handful of September and October incidents, Huntress saw the chain start in C:\Program Files (x86)\CMS\CMS.exe, drop a reverse shell as rs.win32.exe, then copy the legitimate Windows Parental Control Monitor into AppData so it could sideload modified IPHLPAPI.DLL and samcli.dll beacons to 144.172.116.37.

Ava Okello, Detection, London

THREAT INTEL · SINGAPORE

Check Point Says Fake ChatGPT and Claude Desktop Apps on GitHub Sideload Malware Through Signed OpenAI and Anthropic Binaries, Then Fetch Payloads Via a Telegram Image and DNS Over HTTPS

The campaign Check Point Research tracks as Yoba packages malware next to signed OpenAI and Anthropic Setup.exe files in fake GitHub projects, then uses a Telegram channel image as the seed for a DNS-over-HTTPS tasking channel. The final payload seen so far is an XMRig miner routed through Tor, but the loader can fetch any PE or PowerShell stage.

Priya Shah, Threat Intel, Singapore

THREAT INTEL · SINGAPORE

Australia's Signals Directorate Says It Cut a Criminal's Amadey Controller Off From 180,000 Infected Computers, as Its Annual Report Shows Extensive Compromises Rising From 26 to 40

ASD officials used the release of the agency's seventh annual cyber threat report to describe breaking into an Amadey back end and destroying 5 terabytes of stolen data before it could be sold. The report counts 1,524 incidents, 362 of them identified after ASD warned the victim, with phishing the most prevalent technique at 39%.

Priya Shah, Threat Intel, Singapore

RESPONSE · NEW YORK

Cloudflare Says a Workers AI Model Returned 155 Responses Containing Other Customers' Data Over Nearly Two Weeks, Traced to a Memory Mismatch and an SGLang Bug

Very long prompts sent to the GLM-5.3 model on Workers AI between Aug. 27 and Sept. 9 could come back with text from other users' sessions. Cloudflare found no evidence of deliberate exploitation and is urging anyone running SGLang in disaggregated mode to check KV cache pool sizes and upgrade to v0.5.22 or later.

Noah Park, Response, New York

DETECTION · LONDON

Huntress Reconstructs the ConnectWise Attack Minute by Minute and Finds Tooling Rewritten Between Runs in Under a Minute, a Pattern It Says Fits an AI Agent but Cannot Prove

Entra logs from Huntress-monitored tenants show a sorted loop across almost 1,000 Microsoft 365 tenants, a thread pool firing up to 21 requests a second and a retry loop that appeared 55 seconds after a failed certificate upload. Huntress says defenders should alert on what the activity does, not how fast it moves.

Ava Okello, Detection, London

THREAT INTEL · SINGAPORE

Did You Know: One Threat Group Can Go by More Than a Dozen Names, and Those Names Are Not Exact Matches

MITRE ATT&CK lists 14 other names for APT29, including Midnight Blizzard and Cozy Bear, but says its Associated Groups are not exact overlaps. Microsoft's weather-based names and its published cross-reference reflect its own analysis. Alias tables help analysts find reporting; the original sources decide whether indicators belong under one actor.

Priya Shah, Threat Intel, Singapore

OPINION · LONDON

Planted Text on a Seized Disk Turned an AI Forensics Agent Against Its Examiner, and Incident Responders Should Treat Every Model Reading Evidence as Exposed

Researchers from five European institutions planted plain-text notes on test disk images and got a local AI agent working through the Autopsy forensic tool to relabel photographs, write a false corruption warning to the examiner's machine and contact an outside web address. Responders who point AI at compromised hosts should treat its output as a lead to verify, not a finding.

Elena Vos, Opinion, London

TOOLS · AUSTIN

Elastic Looks Inside wesp.sys, Microsoft's Driver for Moving EDR Out of the Windows Kernel, and Finds No Sign Yet That Security Tools Using It Can Stop a Process From Starting

Preview binaries in Windows Insider builds show a Microsoft-built file system mini-filter that passes events to a user-mode client library, espclient.dll. That library imports no function for replying to the driver, which suggests the channel is one-way for now and a security product cannot yet veto what it sees.

James Whitford, Tools, Austin

DETECTION · LONDON

VulnCheck Says a Gotenberg PDF Flaw Missing From CISA's Exploited List Has Drawn at Least Seven Attack Clusters, and One Canary Hit Led to a Go Backdoor Toolkit Built Over Seven Months

A residential Japanese address used CVE-2026-42589 to plant cache_base, a Go reverse shell with no persistence of its own, and fell back on Node.js in case wget and curl were missing. The GitHub mirror behind it held webshells, WordPress and Joomla backdoor plugins, Windows privilege escalation tools and a watchdog.

Ava Okello, Detection, London

RESPONSE · NEW YORK

Sansec Says a Group That Has Planted Loader Code in 953 Online Stores Since July 2025 Moved to a Fifth Domain and Now Fingerprints Visitors So Security Scanners Get Nothing

The code lives in Magento's cms_block table rather than theme files, and 60 of the 83 stores on the new domain were already victims. A localStorage trick lets a payload rerun on every page view even after the domain is blocked, and one fully patched store got the loader an hour after a clean scan.

Noah Park, Response, New York

THREAT INTEL · SINGAPORE

JFrog Says the testmetest npm Campaign Armed 42 Real GitHub Repositories With Hooks That Run When Developers Open Them in Claude Code, Gemini, Cursor or VS Code, and Hid Its Newest Payload in a Native Addon

The payload files ran 12.9 to 13.7 MB, too large for GitHub code search to index, so the armed repositories looked clean to anyone searching the usual way. JFrog also found a compiled Node addon that decrypts a hidden .napi_cache file only on real developer machines and stays quiet in CI runners, containers and sandboxes.

Priya Shah, Threat Intel, Singapore

THREAT INTEL · SINGAPORE

Infoblox Says a Search-Ranking Seller It Calls Hidden Hawk Hid More Than 850 Gambling Entry Points Beneath School and Government Domains by Quietly Adding DNS Records

Someone with access to the DNS of schools in Bangladesh and Mexico and a Kerala government office pointed new subdomains at gambling pages on Cloudflare Pages, leaving the real sites untouched. A second, unrelated operation delegated whole subzones of an Indian state government domain to outside nameservers. Infoblox says the fix starts with watching zone changes, not websites.

Priya Shah, Threat Intel, Singapore

DETECTION · LONDON

Arctic Wolf Counts More Than 400 Incidents in Which Attackers Posed as IT Support in External Microsoft Teams Chats, and Says the ChatCreated Event Is the Earliest Place to Catch Them

The pattern rarely changes: an inbox flood, then a one-on-one Teams message from an outside tenant named like the help desk, then Quick Assist or a commercial remote tool. Arctic Wolf says the first chat, logged by Microsoft as ChatCreated, fires before the employee has done anything, and that attackers are moving from free onmicrosoft tenants to cheap .top domains.

Ava Okello, Detection, London

THREAT INTEL · SINGAPORE

Researcher Ovi Says uCreator, a Rentable Android Spyware Platform Tied to Firms in Hunan, Runs Inside Working Copies of Telegram and WeChat to Lift 2FA Passwords, Hide Its Own Sessions and Clone Accounts

The 0x0v1 report describes a productized kit, rented to merchants and resellers, that injects hook modules into repackaged messaging apps, runs a command server inside each one and paces a fleet of farmed and victim phones so the activity looks human. Its Telegram code matches a backdoor Doctor Web reported in 2025, The Hacker News found.

Priya Shah, Threat Intel, Singapore

DETECTION · LONDON

Adel Karimi's Honeypots Caught 35 Working PHP2Shell Shells on Unpatched PHP 8.4.26, and Each One Followed the Same Four Multipart Requests Defenders Can Hunt For

Three days after PHP shipped fixes, two hosting-provider addresses ran the public PHP2Shell exploit chain to a working shell on Apache mod_php decoys, a packet-to-process report shows. Every shell followed the same pattern: a memory-exhaustion request, an 800 KiB session cookie leak, a second memory spike, a 451,384-byte execution request and an Apache worker starting /bin/sh.

Ava Okello, Detection, London

DETECTION · LONDON

Did You Know: The Status Code in Windows Event 4625 Separates a Bad Password From an Account That Does Not Exist

Every failed Windows logon audited by Event 4625 carries a Failure Reason, a Status and a Sub Status. Microsoft's own monitoring guidance reads those codes differently: 0xC0000064 for a user name that does not exist, 0xC000006A for a bad password, 0xC0000234 for a locked account, and two codes that are usually an availability problem rather than an attack. A failed-logon count that ignores them treats all of these as the same event.

Ava Okello, Detection, London

OPINION · LONDON

An AI Analyst That Names the Right Attack Stage for the Wrong Reasons Is Not Ready to Drive Incident Response

A new benchmark from researchers at Shandong University and the University of Technology Sydney found that the best of eight large language models placed only 44.44 percent of attack log windows in the right stage, and that many of its correct answers rested on reasoning the logs did not support. SOCs using AI to scope incidents should grade the evidence chain, not just the verdict.

Elena Vos, Opinion, London

DETECTION · LONDON

WatchGuard Says Brazilian Phishing Crews Are Dressing Malware Up as Windows Error Reporting, Using Fake Notary Notices, Defender Exclusions and Side-Loaded VLC and VMware Files to Deliver Overlord RAT and Lampion

WatchGuard Red Cell traced three VBScript campaigns aimed at Brazil and Portugal that lean on trusted names at every step: scheduled tasks called Windows Error Reporting running a fake WerFault.exe from ProgramData, payloads pulled from Dropbox and Google Cloud Storage, and malicious DLLs loaded by genuine .NET, VLC and VMware programs.

Ava Okello, Detection, London

THREAT INTEL · SINGAPORE

Atos Says an Exposed Workspace of the New Mimori Ransomware Crew Shows It Pulling Domain Controller Hashes Straight From VMware Disks, Hiding an ESXi Pivot Named Sysmon and Logging About 10 TiB in Three Cloud Storage Buckets

Atos Threat Research Center secured more than 3,100 files from infrastructure tied to Mimori, a ransomware brand that surfaced in late October. They show a Russian-speaking crew working through SOCKS proxies on one stolen domain administrator hash, preparing a vCenter exploit and scripting the shutdown of domain controller VMs. No encryptor was found.

Priya Shah, Threat Intel, Singapore

DETECTION · LONDON

Wiz Says a Campaign Called Gheist Used Stolen GitHub Tokens to Plant Secret-Dumping Workflows on More Than 13,500 Branches, and the Runs Got Through in Private Repositories GitHub's New Approval Hold Does Not Cover

The planted workflow base32-encodes a repository's secrets so GitHub's log masking misses them, then the tool downloads the log and deletes the run seconds later, leaving no attacker server to block. Wiz traced the campaign to more than 850 compromised accounts and says cloud audit logs can expose it even where GitHub logs are not collected.

Ava Okello, Detection, London

DETECTION · LONDON

Forever Security Says It Caught a Planted AGENTS.md File in a Customer's Downloads Folder Ordering OpenAI's Codex to Install Malware, and Showed a Similar Trick Can Steal Claude Code's Login Token

The plain-text file posed as engineering notes and told Codex to register a fake tools server that installed function-color, a known malicious npm package. Because a web page can save a file into Downloads on its own, Forever says there is nothing for OpenAI or Anthropic to patch, and it lists the agent config changes defenders should hunt for.

Ava Okello, Detection, London

RESPONSE · ROUBAIX

OVHcloud Says a Color Picker Extension a Developer Installed a Year Earlier Led to Its Official CLI Being Swapped for a Credential Stealer, Caught Only When a Customer's Pinned Hash Failed

For about an hour and a half on Oct. 19, five past releases of OVHcloud's command-line tool served recompiled binaries that harvested cloud keys, SSH keys and AI agent credential stores. OVHcloud traces the break-in to a GlassWorm-linked VS Code extension and a repository that did not enforce release immutability. A StepSecurity replay adds a one-command tell.

Noah Park, Response, New York

THREAT INTEL · MEXICO CITY

Straiker Says CyberCartel Ran Claude, Kimi and Grok as One AI Attack System Aimed at More Than 400 Latin American Banks and Payment Firms, Switching to Hardcoded Code When Models Refused

Working from the group's own exposed environment, Straiker's STAR Labs maps CARLIY0S, a PentAGI-based system that splits recon, exploits and decisions across Claude roles, mines credentials with Grok and drops to hardcoded scripts when a model says no. Its stolen-secrets inventory centers on Mexico's SPEI payment rail.

Priya Shah, Threat Intel, Singapore

RESPONSE · LUXEMBOURG

Eye Security Says It Quietly Switched Off a Forgotten Popcorn Time Updater on More Than 1 Million PCs and Macs After Finding Millions Still Calling Domains Anyone Could Register

An MSSP threat hunt turned up an abandoned updater that would download and run any file as SYSTEM or root over plain HTTP. Eye registered the lapsed domains, pushed a fix that only disables the service, and handed the domains to Shadowserver. The app itself is still unsafe, and Eye's advice is to remove it.

Noah Park, Response, New York

DETECTION · LONDON

Group-IB Says SiriusQT, a $500 Windows RAT Whose Leaked Licenses Outnumber Paid Ones Three to One, Can Seed the Default User Profile So It Starts in Accounts That Do Not Exist Yet

Group-IB's teardown of the RAT, sold since April and widely shared in cracked builds, shows six persistence options, an HVNC hidden desktop, a recovery panel with more than 100 credential targets and a Windows Update disguise. It also publishes YARA rules and indicators. Where defenders should look first.

Ava Okello, Detection, London

THREAT INTEL · TOKYO

Trend Micro Says Three Attack Platforms Aimed at Japan Used AI in Very Different Ways, From a 44-Agent Autonomous Harness to Tidy Scripts, Yet Each Got In Through Old Exposed Systems and Leftover Credentials

Working from files the attackers left on exposed servers, Trend Micro separates an autonomous CyberStrikeAI harness, a human-led crew that used a chatbot to plan and build tools, and a seasoned VPN and WebLogic hunter whose scripts carry AI fingerprints. All three worked in Simplified Chinese, and none needed a new vulnerability.

Priya Shah, Threat Intel, Singapore

TOOLS · LONDON

Did You Know: Refresh Token Sign-Ins Land in Microsoft Entra's Non-Interactive Log, Not the Default View

Microsoft Entra splits user sign-ins into interactive and non-interactive logs. The admin center opens on the interactive view, while refresh token redemptions, single sign-on and other sign-ins a client performs on a user's behalf are recorded separately, grouped into rows and, in Log Analytics, stored in their own table. An account review that reads only one log sees only part of the activity.

James Whitford, Tools, Austin

OPINION · LONDON

An Empty Search Is Not Evidence, and AI Triage Agents That Treat It as Proof Will Close Real Attacks

A new benchmark from researchers at Virginia Tech, Google and North Carolina State University found that five common designs for LLM triage agents each missed at least 40.4 percent of attack alerts, often dismissing them after their own searches came back empty. Any SOC handing triage to an agent should require more evidence to close an alert than to escalate one.

Elena Vos, Opinion, London

THREAT INTEL · SINGAPORE

Check Point Says a New Infostealer Called Aokigahara Has a Dedicated Module for Claude, Codex, Cursor and Other AI Coding Tools, Collecting Their Session Files Alongside SSH Keys and Cloud Credentials

The stealer, which may be a newer version of malware once called Kamidere or Stygian, ships each category of stolen data as its own encrypted upload and identifies itself as Microsoft-CryptoAPI/10.0. Why AI assistant tokens now belong in the credential-exposure playbook, and the YARA rule and network markers Check Point published.

Priya Shah, Threat Intel, Singapore

DETECTION · LONDON

Unit 42 Said Attackers Using an Agentic AI Platform Reached a European Government's Password Hashes and MFA Secrets Within Two Hours, Leaving Machine-Readable Markers in Every Command Batch, Then Retracted the Report

In an Oct. 23 update to its PHP2Shell brief, since retracted, Unit 42 described an NTLM relay tunnel into Active Directory, a Domain Admin attempt and anonymous LDAP queries hunting for the administrator account. It now says it cannot confirm how the attackers got in. Its scored hunting query for PHP workers that start shells remains published. How to use it, and where it will be noisy.

Ava Okello, Detection, London

RESPONSE · NEW YORK

LiteLLM Says Its Poisoned 1.107.0 Release Traces Back to a Master Key Leaked in May and Never Revoked, Which Handed an Intruder a GitHub Owner's Token 11 Days Before the Attack

The company's root-cause report drops its earlier theory that the tokens leaked through gateway logs. It shows how one unscoped GitHub CLI token let the attacker pull CI secrets, override branch protection, approve the release with a second maintainer's token and erase the run records with a third, and what responders should look for in their own GitHub audit logs.

Noah Park, Response, New York

DETECTION · LONDON

Varonis Says StealC's Seller Is Back Four Months After Operation Endgame With Stadia, a RAT That Shares StealC's Code Byte for Byte and Hides a Scheduled Task That Runs Every 15 Minutes

The subscription kit, priced from $300 to $900 a month, wraps the old stealer in hidden desktop control, a command shell, a file explorer and an in-memory loader, and former StealC customers get a free month. Why a rule scoped to schtasks.exe misses it, and the network and host signals that survive every rebuild.

Ava Okello, Detection, London

RESPONSE · NEW YORK

Railway Says an Intruder Hunting AI Keys Decrypted Customer Environment Variables in Up to 1.85% of Workspaces, About 100,000, and Tells Users Who Signed Up Before Oct. 21 to Rotate Every Secret

The cloud platform's preliminary report traces an intrusion that ran from Oct. 20 into early Oct. 22, from its build infrastructure to its CI environment and an unauthorized query of encrypted variables, and says the attacker wanted AI provider keys for distillation. What responders should rotate, check and log now.

Noah Park, Response, New York

RESPONSE · NEW YORK

Sophos Says a Fake Help Desk Call Unlocked a Microsoft 365 Password Reset, a Rogue Entra Device and a ServiceNow Export of About 2,500 User Records

Sophos X-Ops responders traced one hijacked identity from an SMS reset code through a token-backed device session, Graph reconnaissance, roughly 100,000 SharePoint downloads and federated sign-ins to Salesforce and ServiceNow, with no malware or inbox rules. The logs to pull and the containment steps a password reset misses.

Noah Park, Response, New York

DETECTION · LONDON

Expel Says a Working PDF Viewer Called QuartzLine Hid a Backdoor That Stole Chrome Data and Dropped a RAT, With 38 Confirmed Incidents Across 32 Customers

The signed app, tracked by Mandiant as CLOUDHAZE, arrived through ads and redirectors, then pulled browser history, swapped in a new build and installed a second-stage RAT. A later payload called IronBark now spreads on its own. Why a blocked C2 lookup still means an infected host, and the tasks and paths to hunt.

Ava Okello, Detection, London

THREAT INTEL · SINGAPORE

Semperis Says Iran-Linked Prince of Persia Hosted a Tornado C2 Server on U.S. Namecheap Shared Hosting for the First Time Since 2016

Tomer Bar's research puts the Tornado second-stage panel at 68.65.122.203 in Atlanta, active from July 2026, after a three-month pause that followed SafeBreach's February write-up. The group later moved behind Cloudflare. The domains, addresses and what to watch for Telegram and DGA traffic.

Priya Shah, Threat Intel, Singapore

DETECTION · LONDON

Symantec Says an Autonomous Skynet Agent Hijacked Exposed AI Models to Scan, Exploit Web Frameworks, Steal Credentials and Mine Monero for Up to 100,000 Steps

Symantec's AI honeypot captured the full working prompt in the summer of 2026. The request wrapped a jailbreak around roughly 74 offensive tools, authorized unattended tool calls and pointed a later payload at go2rtc camera directories. The hashes, mining pools and what to lock down on every internet-facing model endpoint.

Ava Okello, Detection, London

RESPONSE · NEW YORK

A Tor Volunteer Says 333 Exit Relays Redirected SSH to Interception Servers Running Paramiko, Stole Passwords From Users Who Ignored Host-Key Warnings and Tried to Plant Ebury

Independent researcher Kaba says the relays, about a tenth of Tor's exit capacity, began the campaign on Oct. 2 after Ebury 1.8.3 had already been planted in August. Twelve interception servers sat behind the redirect. The Tor Project marked the set BadExit within three days. What to hunt on any host that accepted a changed SSH fingerprint through Tor.

Noah Park, Response, New York

THREAT INTEL · SINGAPORE

Unit 42 Says a Low-Skill Actor Called BUGSTER Ran Jailbroken Hermes Agent and DeepSeek V4 Bots to Attack Indian Universities, Exfiltrate More Than 5,200 Records and Plan a VoIP Fraud Operation

Palo Alto Networks' threat unit says the financially motivated operator, with no prior public reporting, ran its AI assistants from a single U.S. server, steered them over Telegram and turned off the safety controls in both Hermes and the Cursor coding tool. Unit 42 also says multiple unrelated actors are now adopting the same Hermes and DeepSeek pairing. The indicators and what the playbook means for defenders.

Priya Shah, Threat Intel, Singapore

RESPONSE · NEW YORK

ThreatLocker Says a ClickFix Lure Ran the Victim's Clipboard as PowerShell, Pulled a ChimeraC2 Client From GitHub Into Memory and Gave Its Operators a Network Relay and a Command That Bricks Windows

ThreatLocker's managed detection and response team says it intercepted the Sept. 28 intrusion in a monitored environment. The .NET client loaded straight from GitHub, hid behind scheduled tasks named for WhatsApp Desktop and a WMI subscription, and answered to a panel whose login screen was only an overlay. The GitHub accounts, task names, addresses and commands to hunt.

Noah Park, Response, New York

DETECTION · LONDON

Zscaler Says Poisoned Search Results for Chocolatey and Microsoft Activation Scripts Led to Lookalike Sites Whose Install Commands Planted Armorsteal, a Python Stealer That Runs Only Tasks Its Operator Has Signed

Zscaler Threat Hunting says the fake choclatey[.]org and massgravel[.]net pages handed searchers a PowerShell install line that dropped a Pyarmor-protected Python kit into a folder dressed up as a Windows system directory. The kit logs keystrokes, swaps copied wallet addresses, pulls browser cookies over the Chrome debugging port and takes SSH keys. The scheduled tasks, URL paths and domains to hunt.

Ava Okello, Detection, London

DETECTION · LONDON

Wiz Says the ARTEX AI Agent Linked to Storm-0940 Is Now Working Through Software Vendors, Reading Their Source Maps, Forging Unsigned Tokens and Spraying Okta and Entra at One Attempt a Second

Wiz Research says an actor overlapping with China-aligned Storm-0940 used the autonomous ARTEX penetration-testing agent against multiple IT and software vendors throughout October, probing Okta, Entra and Amazon Cognito and hunting for a way into the vendors' customer data. The log lines it leaves behind, five IP addresses and the detections that already catch it.

Ava Okello, Detection, London

THREAT INTEL · SINGAPORE

ESET Says a Russia-Aligned Group Handed Its Foothold in a Ukrainian Grain Firm to Sandworm for a Wiper Attack, After a New Backdoor, MythicRatatoskr, Hid Its Command Server Inside the Yggdrasil Mesh Network

ESET researchers say UAC-0099 phished its way into a Ukrainian grain logistics company in July 2025 and deployed a previously undocumented Go backdoor whose command server lives inside a decentralized IPv6 overlay network. Two months later Sandworm wiped the company's machines with SDelete pushed through Group Policy. The artifacts, the network trick and what defenders can block.

Priya Shah, Threat Intel, Singapore

RESPONSE · NEW YORK

Huntress Says a Token Spray Campaign Replayed Stolen Microsoft 365 Sessions Into 79 Organizations, Registered 48 Rogue Entra Devices and Hid Payroll Mail Behind One-Letter Inbox Rules

Over 10 weeks, an operator captured post-MFA sign-in sessions through adversary-in-the-middle relays and device-code phishing, then replayed them from a rented block of German hosting addresses. Huntress counted 497 successful sign-ins against more than 200,000 failed attempts. A password reset alone does not remove the rogue devices and authenticator apps the attacker left behind.

Noah Park, Response, New York

THREAT INTEL · SINGAPORE

Symantec Says Swallowtail (APT28) Hit a NATO Naval Shipbuilder With Hookedge, Stole Credentials Two Ways and Opened a Persistent SSH Tunnel, Then Ran an Undocumented Reflective Loader

Symantec's Threat Hunter Team documents a multi-week intrusion at a naval shipbuilder in a NATO member state by the Russia-linked group Swallowtail, also tracked as APT28, Fancy Bear and Forest Blizzard. Operators stole credentials with an SSH private key and an NTLM self-capture script, opened a backgrounded reverse tunnel into the target network and ran a previously undocumented loader, ld.exe. The indicators and the sequences to hunt.

Priya Shah, Threat Intel, Singapore

RESPONSE · NEW YORK

TeamUpdraft Confirms Stolen UpdraftCentral Keys Let Attackers Push Backdoor Plugins Onto Connected WordPress Sites, and Sites Must Delete the Keys Themselves

An attacker who held valid UpdraftCentral Cloud dashboard keys pushed plugin.upload_plugin commands that installed backdoors on connected WordPress sites after a weekend breach of teamupdraft.com. Patchstack counted 99 backdoor names in an 18-hour window. UpdraftPlus 1.26.13 and 2.26.13 revoke many keys, but responders still have to check every site by hand.

Noah Park, Response, New York

RESPONSE · NEW YORK

GMO Shuts Down Every Onamae.com Desktop Cloud Server After an Intruder Planted Malware on Its Japanese FX Trading VPS Service, Putting MetaTrader Logins on Up to 26,739 Servers at Risk

GMO Internet says a malicious program was installed on customer servers of a hosted service that runs MetaTrader currency trading software around the clock, that trading logins stored on the machines may have been taken and used, and that customers have reported unauthorized activity in their brokerage accounts. What responders should rotate, and from where.

Noah Park, Response, New York

DETECTION · LONDON

Amazon Saw a PHP2Shell Exploit Attempt Four Days Before Disclosure, as Cloudflare Counts Millions of Tries and Elastic Says the Signal to Hunt Is a Web Server Spawning a Shell

Amazon Threat Intelligence says its MadPot honeypots caught a PHP2Shell attempt on Oct. 17 and told defenders to start investigations from that date, not from the advisory. Elastic, writing before any reliable public exploit existed, published the process and file rules that catch what a compromised PHP worker does next. The IP addresses, rule names and inventory queries defenders need.

Ava Okello, Detection, London

DETECTION · LONDON

Did You Know: The Logon Type in Windows Event 4624 Signals Whether Credentials Were Left Behind

Microsoft's Windows auditing reference lists a dozen logon type values for a successful logon, and its privileged access guidance ties them to credential theft: a Network logon such as a file share or WinRM session leaves no reusable credentials on the destination, while console, RunAs, Remote Desktop, scheduled task and service logons do. For triage, the number in the Logon Type field is a lead, not a footnote.

Ava Okello, Detection, London

OPINION · LONDON

When Attackers Exploit High-Severity Flaws in Three Days, the Monthly Patch Cycle Is a Risk Decision, Not a Schedule

Rapid7's Q3 2026 Quarterly Threat Landscape Report finds new high-severity vulnerabilities were exploited an average of three days after disclosure, with 71 percent of exploitation inside the first week and 79 percent of exploited flaws needing no credentials or user interaction. Security operations teams should own the days of exposure, not just the patch ticket.

Elena Vos, Opinion, London

THREAT INTEL · SINGAPORE

Microsoft Says China-Aligned Storm-0940 Was Behind the ConnectWise Cloud Backup Compromise and Used the ARTEX AI Agent Framework to Try More Than 2,250 Microsoft 365 Tenants at 2,900 Sign-In Attempts a Minute

Microsoft tied the ConnectWise supply chain compromise to a China-aligned group that used an open-source agentic AI penetration testing framework to spray passwords, abuse trusted backup app identities and change privileges inside customer tenants, in some cases reaching privileged cloud access in under three hours. The application IDs, IP addresses, user agents and hunting queries defenders need.

Priya Shah, Threat Intel, Singapore

RESPONSE · NEW YORK

Kaspersky Says APT41 Revived the BlackLotus Bootkit to Infect Fully Patched Diplomatic Machines in Central Asia, Because the Baton Drop Fix Does Nothing Until Administrators Switch It On

Kaspersky researchers found a BlackLotus copycat they call BlackX on diplomatic networks in Tajikistan, Uzbekistan and Turkmenistan. It loaded a security-blinding kernel driver and cloud-controlled spy tools on machines that had every update, because the Secure Boot revocation that blocks Baton Drop must be turned on by hand. What response teams should check now.

Noah Park, Response, New York

DETECTION · LONDON

Huntress Says Sponsored Amazon Business Search Ads Led to ClickFix Lures That Abuse the Decades-Old Finger Command to Install Lumma Stealer and a Pirated Copy of NetSupport

Huntress investigated a campaign that has hit at least three of its customers, tracing a fake Amazon login and fake CAPTCHA to a finger.exe call over port 79, an IronPython stage, the Doina loader, a portable Node.js implant and barbecue-themed command servers that remain online. A hunt list for detection teams.

Ava Okello, Detection, London

RESPONSE · NEW YORK

LiteLLM Release Pipeline Hijacked With Stolen GitHub Tokens Shipped a Credential Stealer in Version 1.107.0, and Wiz Saw Stolen AWS Keys Tested for Bedrock Access Within Hours

The maintainers of the popular open-source AI gateway say attackers used three engineers' GitHub accounts to build a poisoned release from a lookalike repository. Any environment that installed litellm 1.107.0 from PyPI between 11:39 and 13:23 UTC, or ran the affected Docker tags, should be treated as compromised and every reachable secret rotated.

Noah Park, Response, New York

DETECTION · LONDON

FBI, U.K. and German Agencies Say SafePay Ransomware Has Hit at Least 600 Victims Through Edge VPN Flaws and Stolen Logins, Then Uses PsExec, WinRM and RClone and Factory-Resets Backup Storage

Joint advisory AA26-293A from the FBI, CISA, the Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the National Crime Agency and the North West Regional Organised Crime Unit names five exploited Cisco, Veeam and SonicWall CVEs, a living-off-the-land toolkit built on ShareFinder.ps1, SharpShares and NetExec, and indicators observed from November 2024 to August 2026.

Ava Okello, Detection, London

RESPONSE · NEW YORK

PHP Patches Critical PHP2Shell Flaws That Let Unauthenticated Requests Run Code Before Any Application Loads, as Cloudflare Sees Attack Traffic and Unit 42 Counts 22.6 Million Exposed Instances

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix CVE-2026-109618 and CVE-2026-109619, memory-handling bugs rated CVSS 9.2 that researchers turned into pre-authentication code execution on WordPress, Drupal and Joomla. CrowdStrike says a successful attempt can leave only one fatal error ending in "Unknown on line 0," and PHP says no setting replaces the update.

Noah Park, Response, New York

DETECTION · LONDON

Cisco Talos Says Attackers Are Stuffing Helpline Numbers Into Real Staples and Dell Order Emails and Using Registration Forms and Bounces as Trusted Delivery

Talos says abuse of more than 25 legitimate platforms in the past year now includes commerce order pipelines that pass DKIM and DMARC while embedding attacker phone numbers, registration workflows that reflect hostile strings into welcome mail, and delivery-status reports that carry WeTransfer-style file-sharing lures inside the bounce.

Ava Okello, Detection, London

THREAT INTEL · SINGAPORE

Group-IB Says Initial Access Broker k0t Is Hitting FortiGate, FortiWeb and Palo Alto GlobalProtect Edge Devices, Then Selling Access Linked to Qilin and The Gentlemen

Group-IB Threat Intelligence and NyxLab say the operators used FOFA and ZoomEye target lists, a FortiWeb path-traversal exploit, FortiGate brute force and a GlobalProtect cookie-forgery tool to establish OpenConnect VPN footholds, then persisted with MeshCentral and AdaptixC2 while building a stash of more than 70,000 edge and LDAP credentials.

Priya Shah, Threat Intel, Singapore

RESPONSE · NEW YORK

Mozilla, Google and Cloudflare Say Eight Compromised eMudhra Intermediate CA Keys Could Forge HTTPS Certificates for Any Site, and Trust Stores Outside the Browser Still Need Updates

Browsers blocked the eight intermediate certificates within hours of an Oct. 17 report, but Go, Python, Node.js, Linux distributions, TLS-inspecting proxies and other software that does not check revocation or Certificate Transparency must be patched, rebuilt or reconfigured before they stop trusting certificates forged with the keys.

Noah Park, Response, New York

DETECTION · LONDON

LevelBlue Says the New Wazza Phishing Kit Hides Microsoft 365 Device Code Theft Behind PDF Lures From Hijacked Mailboxes, Google Sites Wrappers and Rotating Decoy Company Websites

LevelBlue SpiderLabs researchers say the kit, active since at least early July, walks victims from a SharePoint-branded PDF through gated routing layers and anti-bot checks to a fake Adobe, DocuSign or OneDrive page that hands them a real Microsoft device code, and they published URL paths and API endpoints defenders can hunt for.

Ava Okello, Detection, London

DETECTION · LONDON

Hunt.io Says a Russian-Speaking Operator Used a Graylog Log4Shell Chain on Logging Servers Tied to Ukraine's State Data-Exchange System, Then Left the Evidence in an Open Directory

Hunt.io researchers say the operator swept all of Ukraine's address space for one string, "UXP Verifier," gained execution on logging servers at two Ukrainian organizations with public exploit code, and queried an index of 6.8 million data-exchange records, and that a single request header and Java child processes are the signals defenders can hunt.

Ava Okello, Detection, London

THREAT INTEL · SINGAPORE

Kaspersky Says Lazarus Abused South Korea's Mandatory CrossWeb EX Security Software in Operation FlashHole, Running GitHub-Controlled Malware Mostly in Memory Behind Post-Quantum Encryption

Kaspersky researchers say the North Korean group lured targets at South Korean software, construction and wired communications equipment makers to AI-assisted résumé and portfolio sites on GitHub Pages, then used a modular toolkit that takes orders through GitHub issues, hides its traffic behind browser headers and protects later payloads with the ML-KEM-1024 algorithm.

Priya Shah, Threat Intel, Singapore

RESPONSE · LONDON

Did You Know: A Password Reset Does Not Revoke Every Microsoft Entra Session

Microsoft's token documentation shows that a password change can leave some refresh tokens and session cookies alive, issued access tokens run until they expire, and app-issued sessions sit outside Entra's reach. Evicting an attacker from a compromised account takes explicit revocation, not just a reset.

Noah Park, Response, New York

DETECTION · LONDON

Did You Know: EPSS Estimates Exploitation Probability, Not Severity

FIRST's Exploit Prediction Scoring System estimates the probability that a published CVE will be exploited in the wild in the next 30 days, while the CVSS v4.0 User Guide says CVSS Base scores measure severity and should not be used alone to assess risk. The two answer different questions, and multiplying one by the other produces no meaningful risk score.

Ava Okello, Detection, London

THREAT INTEL · SINGAPORE

Did You Know: TLP Labels Limit Sharing Scope, Not Severity

FIRST's Traffic Light Protocol version 2.0 uses four labels, TLP:RED, TLP:AMBER, TLP:GREEN, and TLP:CLEAR, to mark how far recipients may share potentially sensitive information. FIRST states that TLP is not a formal classification scheme. A TLP label answers who may see the tip; it does not set alert severity, CVSS, or triage priority.

Priya Shah, Threat Intel, Singapore

TOOLS · AUSTIN

Did You Know: Sigma Rules Are Portable Detection Logic, Not Deployed SIEM Queries

Sigma is a vendor-neutral YAML format for describing log-based detections. Converters such as sigma-cli, powered by pySigma, turn those rules into Splunk, Microsoft Sentinel, Elasticsearch, Grafana Loki, and other SIEM queries through backends and processing pipelines. A rule file in a repository is shared logic; coverage starts when converted queries match your telemetry and run in your stack.

James Whitford, Tools, Austin

DETECTION · BEDFORD

Did You Know: ATT&CK Detection Strategies Are Systems, Not Sentences

MITRE ATT&CK v18 replaced single-sentence detection notes with Detection Strategies: behavior-first containers that organize platform-specific Analytics, required log sources, and mutable tuning. For detection engineers, coverage means analytics you can run and tune, not technique IDs collected as if a sentence equals a detection.

Ava Okello, Detection, London

RESPONSE · GAITHERSBURG

Did You Know: Containment Stops Expansion; Eradication Removes What Remains

NIST SP 800-61 Revision 3 maps incident response to CSF 2.0 and keeps a distinction responders still need on the keyboard: containment prevents an incident from expanding, while eradication removes persistence and entry points after the bleed is stopped.

Noah Park, Response, New York

DETECTION · BETHESDA

Did You Know: Detection Rules Are Not Finished When They Reach Production

SANS Institute's Detection Engineering poster frames detections as living assets. A rule that ships without requirements triage, testing, and ongoing monitoring can turn noisy, stale, or ineffective as environments and attacker behavior change.

Ava Okello, Detection, London

TOOLS · WASHINGTON

Did You Know: Logging Built for Volume Alone Can Fail Monitoring and Forensics

CISA's Logging Reference Architecture warns that logging optimized for ingestion volume, platform convenience, or retention in isolation may fail when a real incident needs continuous event monitoring and threat-hunting, investigation, response, and forensics.

James Whitford, Tools, Austin

OPINION · LONDON

AI SOC Buyers Need a Lifecycle Score, Not Another Middle-Heavy Demo Checklist

SecOps Unpacked's ASEF framework (July 8, 2026) argues the AI SOC market optimized for triage and investigation demos while detection engineering and response stay thin, and buyers need a vendor-neutral lifecycle profile that refuses blended scores, treats unknown as unknown, and scores trust and feedback loops.

Elena Vos, Opinion, London

OPINION · LONDON

SOC Retention Is an Operations Design Problem, Not a Pay Problem

The 2026 SANS SOC Survey finds meaningful work is still the top retention driver, a 27-point gap between leaders and practitioners on hiring attention, and AI tools used by 79 percent of SOCs but built into defined workflows by only 36 percent.

Elena Vos, Opinion, London

OPINION · LONDON

Most SOC Alerts Never Reach Investigation, and AI Alone Will Not Close That Gap

Ponemon research sponsored by Crogl finds organizations average 4,330 security alerts a day while investigating only 37 percent, and respondents rate human analysts as the stronger final line of defense in AI-powered SOCs.

Elena Vos, Opinion, London

OPINION · LONDON

Detection Engineering's False Positive Gap Is Ownership, Not Tooling

The 2026 SANS and Anvilogic State of Detection Engineering survey finds most teams track false positive rates while few prioritize cutting them, and vendor default rules remain the main noise source.

Elena Vos, Opinion, London

OPINION · LONDON

SOCs Are Losing a 37-Minute Race Because Alerts Are Not Investigation-Ready Evidence

The Binalyze 2026 State of the SOC Report finds enterprises act on alerts in 37 minutes while attacks break out in 28, leave more than 300 potential threats uninvestigated each day, and still cannot treat telemetry as ground truth for trusted automation.

Elena Vos, Opinion, London

DETECTION · LONDON

Sophos Says China-Based BRONZE SANDCASTLE Side-Loads Through Sandboxie and Seven Other Trusted Apps to Run a Custom Meterpreter-Style Backdoor That Pulls Encrypted Configs From GitHub

Sophos Counter Threat Unit and SophosLabs researchers say the group keeps its payloads in encrypted config.ini files that are decoded only in memory, has hit victims in the Philippines, Taiwan, Afghanistan and Namibia, and copies the Active Directory database after making shadow copies, so static file detections are likely to miss it.

Ava Okello, Detection, London

THREAT INTEL · SINGAPORE

SOCRadar Says Exposed Servers Laid Bare an AI-Run Ransomware Workbench Shared by INC and The Gentlemen Affiliates, With 46 Encryptor Builds Staged and 62 Organizations Named

SOCRadar's threat research unit says open directories on seven adversary servers held 8,257 AI session messages, a custom "Phantom" kill-chain framework and operator records of mass FortiClient EMS, SimpleHelp and cPanel exploitation, handing defenders hunting leads that run from rogue EMS admins to mass .INC renames.

Priya Shah, Threat Intel, Singapore

DETECTION · LONDON

Siemens Says ClickFix Attackers Side-Loaded Malware Through a Signed Copy of Its Software Center, Using a ROMULUS Delivery Platform Forescout and Huntress Had Seen Abusing Signed Canon and Stardock Apps

Siemens patched CVE-2026-110936 and published indicators after attackers bundled a genuine, signed SiemensSoftwareCenter.exe with their own DLLs; Forescout found ROMULUS running on the server that distributed the package, and Huntress tied a related campaign using signed Canon and Stardock carriers to at least 40 incidents that began with Custom GPT and Google Sites lures.

Ava Okello, Detection, London

TOOLS · AUSTIN

Recorded Future Ties TAG-217 to ARTEX Attacks on South Korean Banks, While Zscaler Maps LLM Backends and AhnLab Shows Forks Plus Detectable User-Agents Across Hundreds of Exposed Instances

Insikt Group says TAG-217 was testing remote access, crypto-mining theft tools and mobile workspaces from mid-August before Korean bank breaches tied to ARTEX; Zscaler maps DeepSeek, Zhipu and Grok backends; AhnLab recovers hundreds of exposed instances, forks and User-Agents SOCs can hunt.

James Whitford, Tools, Austin

DETECTION · LONDON

Infoblox Says It Can Flag Help TDS Scam Sites on Cloudflare Pages a Week Before Use, Ties the Network to Hotejka and Traces Its Call Center to a Remote Desktop Install

Infoblox reverse engineered the naming algorithms behind roughly 300 new Cloudflare Pages domains a day, flagged more than 16,000 that the Russian-language affiliate program Hotejka later used for Help TDS, cut customer exposure from a 4% daily peak to under 0.5%, and recorded a fake Microsoft support call that ended with a request to install UltraViewer.

Ava Okello, Detection, London

THREAT INTEL · SINGAPORE

Hunt.io Says Open Directories on a PaperCut Campaign Host Exposed an AI Agent Workbench, a Second XML-RPC RCE Path and Reverse SOCKS Persistence Across Dozens of Domains

Hunt.io recovered three open directories on 45.142.193.132 that held the operator's AI agent instructions, a second PaperCut remote-code path through XML-RPC, Linux chisel reverse SOCKS5 persistence and packaged kali kits for 46 Active Directory domains; GreyNoise had already put the campaign at 440 compromised instances across 395 organizations.

Priya Shah, Threat Intel, Singapore

RESPONSE · NEW YORK

Huntress and Todyl Say a Stolen ConnectWise Cloud Backup Credential Let an Attacker Sign In to Microsoft 365 Tenants as the Backup App, While a Sister App Made Itself Global Administrator

ConnectWise has disabled seven SkyKick-era application identities and suspended Cloud Backup after a client credential held in its own tenant was used from a rented server to collect Microsoft Graph tokens across customer tenants; responders say disabling the apps does not remove secrets, roles or mailbox rules an intruder may already have planted.

Noah Park, Response, New York

DETECTION · LONDON

SentinelOne and ReversingLabs Say APT29's CaptiveCrunch Operators Spoofed Name Lookups From Inside Victims' Wi-Fi Segments and Cycled Five Stager Builds in 25 Days

SentinelOne's endpoint telemetry shows a Responder-style spoofer on the same local network as travelers' laptops, racing real DNS answers to push fake browser updates and point Microsoft's login domain at the attacker, while ReversingLabs turned two published hashes into a staging server, five stager builds and lure shortcuts no antivirus engine flagged.

Ava Okello, Detection, London

TOOLS · AUSTIN

Mandiant and ManageEngine Say UNC7017 Poisoned AOMEI Backupper Updates in Five-to-Ten-Minute Bursts, Then Restored Clean Files to Hide a Radmin-Sideloaded Backdoor

Google Threat Intelligence Group, Mandiant and ManageEngine's METAL lab say UNC7017 rewrote two unauthenticated AOMEI update files for minutes at a time, so analysts who checked the vendor's servers later saw clean files while endpoints kept a scheduled-task backdoor or were coerced into sending NTLM hashes.

James Whitford, Tools, Austin

THREAT INTEL · NEW YORK

GreyNoise Says skynox7 Forced 143 Edge Devices Across 34 Countries Into Pawns.app Residential Proxies and Planted SSH Keys for Backup Access

GreyNoise tied a product-demo Entra ID case to residential proxies that hid a serious intrusion, then documented a separate actor that exploits D-Link NAS, UniFi Video Log4Shell and SAP NetWeaver flaws to install Pawns.app proxyware and, on some hosts, attacker SSH keys.

Priya Shah, Threat Intel, New York

DETECTION · LONDON

Unit 42 Says CL-UNK-1211 Used AI-Written Scripts to Backdoor Government Linux Servers Through PHP auto_prepend_file, Hijack sudo Passwords and Wipe Its Tracks

The cluster made a web shell load before every PHP script, aliased sudo to log passwords to a fake SolarWinds file, ran a new Go RAT called SysGoRAT over WebSocket and planted RedTeamOps2025 markers to pass as a pentest, then checked that its IPs were gone from the logs.

Ava Okello, Detection, London

RESPONSE · NEW YORK

Mandiant Says China-Nexus ARMORY CASTLE Used a BeyondTrust Remote Support Zero-Day to Gain Root, Target the Credential Vault and Hide a Tunnel Behind HAProxy

CVE-2026-102764 let the actor plant the SAWFLY webshell in late August, turn a copied /bin/sh into a root SUID backdoor and route its BARECLAW SOCKS5 tunnel through HAProxy; BeyondTrust says its sensors fired but an automated triage tool closed the alerts as false positives.

Noah Park, Response, New York

THREAT INTEL · SINGAPORE

Darktrace Says CikaBika Bot Registers Each Victim on Discord for C2 After a Nim Loader Plants dbghelp.dll in Microsoft Edge

A document-themed disk image drops a decoy PDF and a Word-lookalike LNK that XOR-decodes a Nim loader; the loader stages a Rust RAT as dbghelp.dll under Microsoft Edge, then the bot registers the host on Discord, takes screenshots and, in observed activity, zips folders for ngrok exfiltration.

Priya Shah, Threat Intel, Singapore

RESPONSE · NEW YORK

Huntress Says Fake WatchGuard VPN Download Site Asks for Credentials Twice, Then Serves the Genuine Signed Client From WatchGuard's Own CDN

A search-poisoned lookalike, watchguard-vpn[.]net, asked an MSP administrator for VPN server, login and password, rejected the first try to collect a second, and posted both to watchguard-ssl[.]online before downloading WatchGuard's real signed installer, leaving no malware for endpoint tools to catch.

Noah Park, Response, New York

DETECTION · LONDON

Unit 42 Says Fake PuTTY Installer From Poisoned Google Results Plants a Node.js Loader That Finds Its C2 on the Ethereum Blockchain

A trojanized Putty-x86_64.msi served from puty.ink runs a signed PuTTY 0.85 decoy while a bring-your-own-interpreter Node.js loader resolves its C2 through an Ethereum smart contract, polls every 500 ms, and takes operator-pushed recon, cookie theft, and live screen streaming.

Ava Okello, Detection, London

THREAT INTEL · SINGAPORE

Unit 42 Says PEERSTITCH Memory-Resident FortiGate Implant Followed a FortiManager Breach That Exposed More Than 500 Firewalls

Unit 42 tracks CL-STA-0954 exploiting FortiJump to steal configs and credentials from a telecom MSP FortiManager, then using CVE-2025-61624 to inject PEERSTITCH into miglogd and iked with no disk binary, no listening ports, and no outbound sockets of its own.

Priya Shah, Threat Intel, Singapore

DETECTION · LONDON

Group-IB Says KGB RAT Sells Fully Undetectable Windows Control With HVNC, Credential Theft and Harassment Features

Group-IB researchers say the NjRAT-based MaaS trojan markets itself as admin software, ships a daily-updated FUD crypter and Telegram alerts, and still shows a huntable ChromeUpdate scheduled task and svchost drop in Temp once detonated.

Ava Okello, Detection, London

THREAT INTEL · SINGAPORE

Cisco Talos and Recorded Future Say Kazakhstan-Nexus UAT-6275 Hit CIS Governments With GitHub-Staged Reverse Shells and a WinRAR Exploit

Exposed staging servers and a GitHub account's commit history let researchers map four infection chains, a new .NET reverse shell called PickleShell, and pre-staged FortiWeb and Linux tooling from a group that targets foreign, economic, environmental and energy agencies across nine countries.

Priya Shah, Threat Intel, Singapore

RESPONSE · NEW YORK

Microsoft Says It Seized Domains Behind YAM Store, CoGUI and Iron Man, a Phishing Supply Chain Tied to More Than 1 Billion Messages

Microsoft and Health-ISAC used a Florida federal court order against a Chinese-language marketplace that Microsoft says hijacked Microsoft 365 tenants through app-only access and sold phishing kits with more than 2,335 templates and live, Telegram-fed credential capture.

Noah Park, Response, New York

DETECTION · LONDON

SOCRadar Says ICMacOS Evolved From a macOS Infostealer to a Persistent RAT With ClickFix Lures and WebSocket C2

SOCRadar Threat Research Unit says the GlowComa MaaS offering pairs Icarus ClickFix terminal paste delivery with fake System Preferences password dialogs, then Version 2 adds a com.apple.systemupdater LaunchAgent and a Gorilla WebSocket shell to escapeai[.]live.

Ava Okello, Detection, London

THREAT INTEL · SINGAPORE

Genians Says Kimsuky Expanded Operation GitPower to Ukrainian Policy Experts With Reply-Bait Lures and GitHub Exfiltration

Genians Security Center says the North Korea-linked group used conference invitations and research requests with no initial attachments, then delivered LNK files that pulled GitLab scripts and uploaded systeminfo and Downloads listings through the GitHub Contents API. A fake Zoom installer reused the same TCP C2 while launching the real Zoom setup screen.

Priya Shah, Threat Intel, Singapore

DETECTION · LONDON

FBI Says North Korean IT Workers Are Expanding Facilitator Networks and Calls for Identity-in-Depth Defenses

The Oct. 13 IC3 PSA says single hiring indicators no longer catch state-controlled remote workers who pay facilitators to run laptop farms, lend accounts, and sit interviews. Endpoint tells include RMM tools, KVM-over-IP gear, OBS Studio with VDO.Ninja, and Homebrew. The same day, DOJ announced arrests and about 187 device seizures from Texas laptop farms.

Ava Okello, Detection, London

RESPONSE · NEW YORK

Volexity Says Attackers Chained Three Ivanti Connect Secure Zero-Days to Root a Fully Patched VPN Without Leaving a Web Shell

Volexity says UTA0576 bypassed authentication, won a file-upload race, and abused an unpatched privilege escalation to run root commands through the exploit itself, then hunted LAPS passwords and BitLocker keys while evading Ivanti's Integrity Checker. Ivanti fixed CVE-2026-104935 on Oct. 13; the root flaw remains open.

Noah Park, Response, New York

THREAT INTEL · SINGAPORE

Elastic Unmasks Apex Accelerator, a Fake Web3 Backer Whose Malicious npm AI Tools Hijack LLM Traffic and Drop Stealers

Elastic Security Labs says the REF8801 operation courted crypto founders with free Claude and Gemini credits, then shipped npm packages that routed coding-agent traffic through attacker servers, returned fabricated audit results, and delivered CloudSyncD on macOS and a Telegram-exfiltrating stealer on Windows.

Priya Shah, Threat Intel, Singapore

RESPONSE · NEW YORK

ReliaQuest Assesses LLM-Driven Agents Drove an Under-24-Hour Server Takeover Through One Exposed Job Endpoint

ReliaQuest says a live Cairn orchestration panel sat on the attack-origin host as LLM-driven agents worked an unauthenticated Spring Batch job feature on Apache Tomcat from in-process JavaScript to SYSTEM in under 24 hours.

Noah Park, Response, New York

DETECTION · LONDON

Huntress Documents Attack Disruption That Kills ClickFix Chains on the Endpoint in Under a Second

Huntress describes endpoint Attack Disruption rules that match obfuscated Run-dialog cradles under explorer.exe, kill the chain in under a second, and only promote to enforce after a 99 percent accuracy bar.

Ava Okello, Detection, London

THREAT INTEL · SINGAPORE

Infoblox Tracks Noir Wallet Drainer Using DNS TXT and DoH as a Live C2 Control Plane

Infoblox Threat Intel describes a wallet-drainer kit that races public DNS-over-HTTPS resolvers for a TXT record naming its current Cloudflare Pages pool, then steals through spending permissions rather than seed phrases.

Priya Shah, Threat Intel, Singapore

TOOLS · AUSTIN

Elastic AlertZero Enters Technical Preview With Four SOC Watches Behind Human Approval Gates

Elastic's agentic layer for Elastic Security uses Triage, Hunt, Detection, and Forensics Watches to propose evidence-backed actions while keeping host isolation and rule changes behind analyst approval, the company says.

James Whitford, Tools, Austin

THREAT INTEL · SINGAPORE

ThreatHunter.ai Unpacks Azure30, a Node.js Backdoor Tied to a ClickFix msiexec Lure

A per-user MSI bundles its own Node.js runtime, scatters 31 obfuscated modules across AppData, checks for 82 crypto wallets, and takes operator scripts over cleartext WebSocket on port 443, ThreatHunter.ai researchers report.

Priya Shah, Threat Intel, Singapore

RESPONSE · NEW YORK

eSentire Maps Four NetScaler Exploit Clusters From Lightweight Web Shells to Platypus After CVE-2026-88771

eSentire's Threat Response Unit tracked pre- and post-disclosure CVE-2026-88771 clusters that planted PHP web shells, enrolled Platypus fleet agents, and stole NetScaler configs within hours of public PoC code.

Noah Park, Response, New York

DETECTION · LONDON

Deep Woods Security Traces PolinRider Implant in Reactime Repo That Runs When VS Code Opens the Folder

A backdated commit seeded 20 of 22 Reactime branches with a fake font that runs on VS Code folder open, reads its C2 from Ethereum, and drew zero VirusTotal detections.

Ava Okello, Detection, London

THREAT INTEL · SINGAPORE

SOCRadar Tracks NetScaler C2 Framework Automating CVE-2026-88771 Mass Exploitation

SOCRadar maps an autonomous NetScaler C2 kit that FOFA-hunts Citrix appliances, injects CVE-2026-88771 log payloads, and drops a polling agent at /tmp/.nsagent for mass exploitation.

Priya Shah, Threat Intel, Singapore

TOOLS · AUSTIN

Cloudflare Builds Evidence-Grounded Multi-Agent SOC Harness for Managed Defense

Cloudflare Managed Defense moved recon and customer scope out of the LLM prompt, feeding cite-bound specialist agents only after deterministic evidence packing and Clef noise filtering.

James Whitford, Tools, Austin

THREAT INTEL · SINGAPORE

Socket Tracks GhostAction Wave Mining GitHub Secrets and Full Git History for Cloud Credentials

Socket research finds compromised maintainer accounts injecting security-audit.yml into hundreds of repositories, expanding GhostAction from Actions secrets to cloud and AI credentials buried in git history.

Priya Shah, Threat Intel, Singapore

DETECTION · LONDON

LevelBlue Shows BigDiskBuster Starves Microsoft Defender Updates Without Disabling the Service

LevelBlue SpiderLabs reproduces MSNightmare's BigDiskBuster proof of concept that watches Defender update staging, fills free disk space with hidden temp files, and leaves real-time protection running while security intelligence goes stale.

Ava Okello, Detection, London

RESPONSE · NEW YORK

Huntress Tracks Phishing Campaign Abusing Microsoft Power BI to Deploy Rogue ScreenConnect RMMs

Huntress details September phishing that hosted blurred Download Reference lures on legitimate Power BI domains, then delayed ScreenConnect installer downloads that staged two rogue RMM clients, HideUL, and a two-minute repair task.

Noah Park, Response, New York

RESPONSE · NEW YORK

Huntress Reconstructs Akira Ransomware Attack From Registry Artifacts After Post-Compromise EDR Install

Huntress shows how Shellbags, Akira logs, and PowerShell shadow-copy toolmarks reconstructed an Akira intrusion after a post-compromise agent install left only a thin EDR slice of GOST tunneling and related activity.

Noah Park, Response, New York

DETECTION · LONDON

CrowdStrike Shows Attackers Bypass LLM Safety Classifiers by Splitting Harmful Goals Into Benign Subtasks

CrowdStrike says a frontier-model safety classifier blocked about 515 direct bypass attempts, but adversaries can still extract building blocks through genuinely benign subtasks and reassemble working offensive code with an unclassified local model.

Ava Okello, Detection, London

TOOLS · AUSTIN

Unit 42 Tracks ChainDrop and PolinRider Stealing Cloud Build Credentials Through Blockchain C2 Dead Drops

Unit 42 says supply chain worms are resolving command-and-control through EtherHiding, cross-chain transaction data, and NullReceiver address encoding so CI pipelines and developer hosts leak ephemeral cloud keys without hard-coded domains.

James Whitford, Tools, Austin

THREAT INTEL · SINGAPORE

Cisco Talos Tracks UAT-11985 Phishing Taiwan Researchers With AI-Assisted Invites and Real-Time Google Login Relays

Cisco Talos says the campaign reused real public event details, likely AI-assisted invitation templates, and an adversary-in-the-middle kit that relays Google authentication including MFA challenges over HTTP and WebSocket. ClamAV and Snort coverage plus IOCs are published.

Priya Shah, Threat Intel, Singapore

RESPONSE · NEW YORK

Huntress Sees Active Exploitation of AhsayCBS Backup Flaws Dropping Webshells and XMRig Across Five Organizations

Huntress says attackers began chaining two AhsayCBS flaws on Oct. 7 to gain SYSTEM-level remote code execution, then planted JSP webshells, an XMRig miner disguised as Microsoft Edge, and an AI-assisted PowerShell script that hides mining when Task Manager is open. Four Sigma rules and IOCs are published for defenders.

Noah Park, Response, New York

DETECTION · LONDON

Malware Now Embeds Instructions Meant to Steer AI Analysis Tools, Cisco Talos Finds Across 84 Samples

Cisco Talos says four malware families now plant plain-language notes inside samples to influence AI triage tools, a class it calls A3. Across 84 samples the cheapest "ignore this file" comments steered model verdicts most often, while more elaborate template tricks often backfired, and defenders can hunt the same plaintext as a detection signal.

Ava Okello, Detection, London

THREAT INTEL · SINGAPORE

Russia-Aligned Spies Retool MATCHBOIL Malware and Widen Attacks to Ukrainian Transport, Manufacturing and Energy Firms

ESET says UAC-0099, a group it describes as able to act as an initial access broker for Sandworm, planted its rebuilt MATCHBOIL downloader at Ukrainian transportation, manufacturing and energy companies, adding fake planner screens, sandbox checks and a new DLL variant while leaving a trail of file paths, scheduled tasks and HTTP headers defenders can hunt.

Priya Shah, Threat Intel, Singapore

RESPONSE · NEW YORK

FBI and Secret Service Warn FortiBleed Hackers Are Locking Some Fortinet Customers Out of Their Own Firewalls

A joint FBI and Secret Service advisory says the credential theft campaign against internet-facing FortiGate firewalls is still scanning with stolen passwords, sometimes deletes or changes administrators' accounts so owners cannot log in, and has fed access to the INC/Lynx and Payload ransomware operations.

Noah Park, Response, New York

DETECTION · LONDON

Attackers Are Testing Stolen AWS Keys for Amazon Bedrock Access, Leaving a Pattern Defenders Can Spot

Datadog Security Labs says a credential harvesting platform called KMON_NOC and two Python scripts check stolen AWS keys for access to Amazon Bedrock AI models with a short, repeatable run of API calls, a sequence it has seen in 12 organizations in the past 30 days and that detection teams can hunt for.

Ava Okello, Detection, London

RESPONSE · NEW YORK

Poisoned Tensorlake npm Release Hid a Worm That Deletes Home Directories if Victims Revoke the Stolen Token

A malicious tensorlake 0.5.144, pushed to the AI sandbox company's own GitHub repository and published with valid npm provenance on October 8, steals cloud, GitHub and npm secrets, spreads through victims' packages and installs a monitor that deletes the home directory if the stolen GitHub token is revoked, so responders must remove it before rotating credentials.

Noah Park, Response, New York

THREAT INTEL · SINGAPORE

FBI Seizes Integrity Tech Hacking Tools as Allies Detail How China-Linked Hackers Steal Government Email

The FBI and nine partner agencies said on October 8 that hackers tied to Integrity Technology Group, a China-based company with links to the Chinese government, stole email from government, law enforcement, healthcare and religious organizations in Southeast Asia, as the Justice Department seized domains behind the company's Microscan scanner and FishHub phishing tool.

Priya Shah, Threat Intel, Singapore

DETECTION · LONDON

Malware That Reads Its Orders From a Poem on GitHub Has Hit More Than 3,400 Exposed AI and Developer Servers

Lumen's Black Lotus Labs said on October 7 that PoeLLM, a cryptomining botnet it ties to an Italian-speaking actor, breaks into exposed LiteLLM, Ollama, Gotenberg and Gitea servers and finds its command server by decoding four words in a poem the operator edits on GitHub.

Ava Okello, Detection, London

THREAT INTEL · SINGAPORE

Iran-Linked Hackers Posing as Dubai Airports Recruiters Hide Malware in a Visual Studio Coding Test

Unit 42 researchers said on October 6 that an Iranian state-aligned group it tracks as CL-STA-1178 sent an Iraq-based engineer a fake coding assessment that ran malware as soon as Visual Studio opened the project, then took its orders through GitHub repositories and issue comments.

Priya Shah, Threat Intel, Singapore

THREAT INTEL · SINGAPORE

Fake ChatGPT and Gemini Ad Portals Use Browser-in-the-Browser Pop-Ups to Steal Logins and MFA Codes

Island researchers said on October 6 that a human-operated phishing platform posing as AI advertising products for Gemini, ChatGPT, Claude, Perplexity and a fake Muse Ads draws a counterfeit Google sign-in window inside the page, then lets a live operator choose which MFA prompt the victim sees next.

Priya Shah, Threat Intel, Singapore

DETECTION · LONDON

Microsoft Warns ClickFix Lures Now Hide Their Payload in the Browser Cache

Microsoft Threat Intelligence said on October 3 that compromised websites are pre-fetching a VBScript payload into visitors' browser caches disguised as a PNG file, so the ClickFix command a victim pastes into Windows Run only has to find and launch it. Huntress, separately, described killing ClickFix chains on the endpoint before its SOC saw the alert.

Ava Okello, Detection, London

THREAT INTEL · SINGAPORE

ClingSTUN Backdoor Turns Unpatched IoT Devices Into Proxies Hidden in Public STUN Traffic

FortiGuard Labs said on October 5 that ClingSTUN, a Linux backdoor spread through 24 known flaws in routers, cameras and other edge devices, uses legitimate public STUN servers so its traffic blends with VoIP and WebRTC. Nozomi Networks, tracking the same malware as Cling, found operator commands hidden in STUN transaction IDs.

Priya Shah, Threat Intel, Singapore

DETECTION · LONDON

Thales SConnect Flaw Opened Drive-By Code Execution on PCs Used for SWIFT 3SKey Sign-In

Bay Area Labs disclosed on October 2, 2026, how a hand-rolled RSA check in Thales SConnect, the browser middleware long used with SWIFT 3SKey tokens, let a malicious web page or iframe load an unsigned DLL in about six to 10 seconds. Thales published the flaw as CVE-2026-18397, rated 9.4 critical, on October 1.

Ava Okello, Detection, London

THREAT INTEL · SINGAPORE

Rapid7 Tracks BPFDoor and AVERAT Implants Mimicking Asian Mail Gateways

Rapid7 Intelligence published its first research drop on October 2, 2026, documenting Linux implants that impersonate South Korean SpamSniper and Taiwanese ShareTech mail-security appliances, with BPFDoor, Rekoobe, and a modular tool Rapid7 tracks as AVERAT blending command-and-control into SMTP traffic on the network edge.

Priya Shah, Threat Intel, Singapore

RESPONSE · NEW YORK

Citrix Patches NetScaler SAML Zero-Day CVE-2026-88779 After Attacks Reboot Freshly Patched Appliances

Citrix shipped its second emergency NetScaler update in a week after attackers crashed SAML-enabled gateways that had already been patched for the PitScaler flaws, and incident responders say the forced reboots are being used to fire earlier log-injection payloads on appliances that missed the first fix.

Noah Park, Response, New York

RESPONSE · NEW YORK

Microsoft Tracks Unauthenticated Zimbra SNMP Command Injection Exploited as CVE-2026-73570

Microsoft Security Research published findings on September 30, 2026, tracking unauthenticated OS command injection in the Zimbra Collaboration Suite SNMP notification path as CVE-2026-73570, with post-exploitation webshells, privilege escalation, credential theft, and mailbox staging observed on internet-facing mail servers.

Noah Park, Response, New York

OPINION · LONDON

SOC Autonomy Without Governance Recreates the Same Failure Modes AI Was Meant to Fix

Splunk Enterprise Security 8.7 frames the Agentic SOC as a move from AI-assisted investigation to governed autonomous response, where permitted actions, approval gates, evidence, policy, and auditability matter more than buying a stronger model.

Elena Vos, Opinion, London

THREAT INTEL · SINGAPORE

Mandiant Warns ShinyHunters Bypass WAFs to Resume PeopleSoft Mass Exploitation

Mandiant and Google Threat Intelligence Group say UNC6240, tracked as ShinyHunters, is again exploiting PeopleSoft CVE-2026-35273 by requesting a URL-encoded PSEMHUB path that literal WAF rules miss.

Priya Shah, Threat Intel, Singapore

DETECTION · LONDON

Microsoft Tracks EvilTokens Phishing Kit Behind Device Code Token Theft

Microsoft Threat Intelligence says EvilTokens, sold as phishing-as-a-service and tracked to Storm-2992, abused device code authentication to steal tokens and fuel BEC campaigns that compromised more than 12,000 inboxes worldwide.

Ava Okello, Detection, London

RESPONSE · NEW YORK

Citrix Confirms Two NetScaler RCE Zero-Days Exploited in the Wild

Citrix says exploits of CVE-2026-88771 and CVE-2026-88772 have been observed on unmitigated NetScaler ADC and Gateway deployments, and CISA added both flaws to the KEV catalog on September 27, 2026.

Noah Park, Response, New York

DETECTION · LONDON

Huntress Finds Threat Actor Compiling Silent XMR Miner Directly on Endpoint

Huntress says a threat actor exploited Samsung MagicINFO, installed AnyDesk, and compiled a SilentXMRMiner build on the endpoint, producing noisy compiler telemetry before the miner reached C3Pool.

Ava Okello, Detection, London

RESPONSE · WASHINGTON

CISA Puts MikroTik RouterOS SSH Workflow Flaw CVE-2026-67279 on KEV

Federal agencies have until September 28 to remediate internet-exposed RouterOS devices after CISA confirmed active exploitation of the SSH state-machine bug used in the MikroTrick takeover chain.

Noah Park, Response, New York

RESPONSE · NEW YORK

Check Point VPN Flaw Is a Remote-Access Control-Plane Incident, Not Only a Gateway Patch

NEW YORK - For security operations teams, this is a VPN and remote-access control-plane incident, not only a gateway patch ticket, and it is distinct from the management-plane path traversal CVE-2026-93616 that Check Point disclosed in the same advisory wave. Priority work is inventory of gateways and Spark hosts still on vulnerable trains with certificate-based Site-to-Site or Remote Access VPN; installation of LivePatch Take 26 or the matching Jumbo or Spark build; and log review for anomalous certificate-based Mobile Access logins since September 12, without limiting the hunt to the three published subjects. Check Point also advises looking for second-stage internal port and service scanning from suspicious Mobile Access users. If patching is delayed, the vendor recommends disabling VPN implied rules and restricting Site-to-Site UDP/500 and UDP/4500 to peer IP addresses (and for Remote Access, the required UDP and TCP services), noting that those temporary mitigations do not apply to locally managed Spark firewalls. Confirmed or suspected compromise should trigger forensic triage before operators treat residual risk as closed on patch status alone.

Noah Park, Response, New York

RESPONSE · NEW YORK

Check Point Patches Actively Exploited Management Server Path Traversal

For security operations teams, management-plane compromise is an identity and control-plane incident, not only an appliance patch ticket.

Noah Park, Response, New York

RESPONSE · NEW YORK

F5 Warns of Exploited BIG-IP APM Flaw Enabling Unauthenticated Remote Code Execution

NEW YORK - F5 Networks has confirmed a critical heap-based buffer overflow in BIG-IP Access Policy Manager is under active exploitation, and CISA added it to the Known Exploited Vulnerabilities catalog.

Noah Park, Response, New York

RESPONSE · WASHINGTON

CISA Flags TeamCity Flaw CVE-2026-63077 as Used in Ransomware Campaigns

WASHINGTON - The Cybersecurity and Infrastructure Security Agency has updated its Known Exploited Vulnerabilities catalog so that CVE-2026-63077, a critical JetBrains TeamCity On-Premises flaw, is now marked with known ransomware campaign use. Trade press reported the KEV change on Wednesday, September 23, 2026. CISA first added the vulnerability to the catalog on August 5, 2026, after evidence of active exploitation. The live KEV feed lists knownRansomwareCampaignUse as Known for this CVE.

Noah Park, Response, New York

RESPONSE · NEW YORK

WordPress Core Path Traversal CVE-2026-87902 Moves From Probe to Code Execution

Patchstack and other defenders report pearcmd-based file writes against unpatched WordPress after CVE-2026-87902 disclosure, turning a template-resolution path traversal into a SOC containment problem.

Noah Park, Response, New York

RESPONSE · NEW YORK

CISA Puts WSO2 JWT Auth Bypass CVE-2026-5430 on KEV With Three-Day Clock

CISA added a critical WSO2 API Manager JWT authentication bypass to KEV on September 24, giving federal agencies until September 27 and pushing SOCs to treat exposed gateways as an auth-plane incident.

Noah Park, Response, New York

RESPONSE · NEW YORK

CISA Adds Adobe Commerce Magento Auth Flaw CVE-2026-71362 to KEV

CISA put an unauthenticated Adobe Commerce and Magento incorrect-authorization flaw on KEV on September 24, giving agencies until September 27 and pushing SOCs to treat exposed storefronts as session-hijack cases.

Noah Park, Response, New York

Did You Know

RESPONSE · WASHINGTON

Did You Know: Patching a KEV Host Before Collecting Evidence Can Erase the Intrusion Trail

WASHINGTON - When CISA adds a vulnerability to the Known Exploited Vulnerabilities catalog and flags forensic triage, the agency's Binding Operational Directive 26-04 implementation guidance tells responders to collect evidence before they patch. Patching first can destroy the artifacts that show whether an adversary already used the hole.

September 25, 2026

Noah Park, Response, New York

THREAT INTEL · SINGAPORE

Arista Confirms Actively Exploited VeloCloud Orchestrator Flaw

SINGAPORE - Arista Advisory 0183, published September 22, 2026 and revised to 1.1 on September 23, 2026, covers CVE-2026-93952 in the on-premises VeloCloud Orchestrator. The flaw was discovered externally and is actively exploited.

Priya Shah, Threat Intel, Singapore

THREAT INTEL · SAN JOSE

Talos Documents CLOSEDQUORUM, Windows Implant That Lets AI Models Vote on C2 Moves

SAN JOSE - Cisco Talos researchers have documented CLOSEDQUORUM, which they describe as the first publicly reported Windows implant in their knowledge that uses a panel of commercial large language models as tactical command and control after deployment. The finding appears in a Talos blog by Ryan Fetterman dated Tuesday, September 22, 2026, and was uncovered with CAIRN, Talos' new open-source toolkit for tracking AI-integrated malware. Talos has not confirmed in-the-wild deployment.

Priya Shah, Threat Intel, Singapore

DETECTION · LONDON

AI Tool Adoption Floods SOCs With Alert Noise, Not Agent Takeovers

LONDON - Enterprise adoption of coding agents and consumer AI assistants is generating a fast-growing class of security alerts that are overwhelmingly benign, according to a September 2026 analysis of SOC telemetry published by Intezer researchers and summarized by The Hacker News and the Cloud Security Alliance.

Ava Okello, Detection, London

DETECTION · DALLAS

Report Finds Nearly Half of Deployed Detections Need Attention Before SOCs Can Trust Them

Conifers published The Detection Blind Spot on September 24, based on 14,652 detections in live enterprise environments, and said deployed detection counts are a weak proxy for real coverage.

September 25, 2026

Ava Okello, Detection, London

Did You Know

DETECTION · LONDON

Untuned Alerts Can Hide Active Intrusions From the SOC

LONDON - Organization B had an established baseline and a finer-tuned alert system. After medium-severity payload alerts, defenders isolated compromised workstations within minutes (within 10, 2, and 20 minutes across three hosts), cutting command and control and forcing the red team into an assume-breach model. CISA's lesson for operations teams: establish and continuously maintain baselines, refine alerting so routine administrative activity is filtered, and treat untuned detection stacks as a direct cause of missed intrusions.

Ava Okello, Detection, London

TOOLS · REDMOND

Microsoft folds SIEM and threat protection into Defender as ISOC enters preview

REDMOND - Microsoft on September 23, 2026, announced Integrated Security Operations Center, or ISOC, in Microsoft Defender, a preview foundation that puts security information and event management and native threat protection on one shared platform so analysts and agents can investigate and act without stitching separate stacks.

Ava Okello, Detection, London

TOOLS · WASHINGTON

CISA Scales Free SIEM-as-a-Service to Shorten Federal Response Windows

WASHINGTON - The Cybersecurity and Infrastructure Security Agency is expanding its security information and event management as a service offering for federal civilian agencies, aiming to give agency and CISA hunters shared SIEM telemetry at no cost to participating departments while cutting the time needed to start an investigation.

September 25, 2026

James Whitford, Tools, Austin

TOOLS · MOUNTAIN VIEW

SentinelOne Extends Wayfinder Threat Hunting to AWS, Azure, and Google Cloud

MOUNTAIN VIEW - SentinelOne on September 24, 2026, said it has expanded Wayfinder Threat Hunting to AWS, Azure, and Google Cloud. In a Business Wire announcement that day, the company said the service pairs Singularity Platform telemetry with human-led hunting, and that it uses threat intelligence and intrusion findings from SentinelOne and Google Threat Intelligence in one workflow. SentinelOne said the cloud step follows earlier Wayfinder coverage of endpoints and of identity hunting for Okta and Microsoft Entra ID.

September 25, 2026

James Whitford, Tools, Austin

Photo: SentinelOne

OPINION · LONDON

Alert Fatigue Is a Detection Pipeline Failure, Not an Analyst Character Flaw

LONDON - SOCs still treat missed alerts as a people problem. Detection engineering evidence says most alert fatigue is manufactured upstream in the detection pipeline. Future of SecOps (Aug 2026, Marta K.) described a review that blamed an analyst after a shift queue of more than 800 alerts, including EDR and identity duplicates of one medium-severity credential anomaly. Alert fatigue is volume, noise, duplication, and weak prioritization exceeding review capacity. Intezer (THN Sep 12, 2026): ~16.9M SOC alerts Feb-Jun 2026; ~73k AI-related (0.43%), up 685%; of AI-related, 94.1% benign tool use, 5.8% unsafe/policy, 0.02% confirmed attacks; no confirmed org-agent takeovers. ISACA 2025 via FoS: 55% understaffed; 38% need 3-6 months to fill entry-level. Fix: measure FP/duplicate/backlog/TTA by rule; tune defaults; correlate; severity contracts; rule owners; triage feedback. AI triage helps enrichment but cannot retire orphan rules.

Elena Vos, Opinion, London