The Indicator — Threat Intelligence Digest

Threat Intel Digest
August 29–October 9, 2026

Published October 9, 2026 | Based on 318 IOC reports | TLP: CLEAR
318 Reports analyzed
9,413 IOCs extracted
4 Publishers reporting Citrix NetScaler zero-day exploitation
4 State-sponsored actors using one Chrome zero-day kit
772 GitHub repositories hit by GhostAction workflows
Key Takeaways for Security Professionals
  • Patch Citrix NetScaler for CVE-2026-88771 and CVE-2026-88772, then hunt for web shells.

    Rapid7, Google Threat Intelligence, Hive Pro and the UK NCSC report zero-day exploitation. Google documents WHIPSHOT PHP web shells and a SLAPSHOT tunneler, and attackers have created privileged accounts, so patching alone does not clear an already compromised appliance.

  • Inventory and restrict management interfaces on Cisco, SonicWall, Check Point, Arista and Fortinet appliances.

    Active exploitation is reported for Cisco FMC, Secure Email Gateway and SD-WAN Manager, SonicWall SMA1000, Check Point, Arista VeloCloud and FortiMail. The FBI also warns of credential-driven FortiGate compromise, so pair patching with MFA and unique credentials.

  • Confirm Chrome and Windows kernel patches together: CVE-2026-85046, CVE-2026-87491 and CVE-2026-85880.

    The BlueMoon exploit kit chains the Chromium V8 flaws with a Windows kernel privilege escalation. CyberVeille counts four state-sponsored actors using it within 12 days, so prioritize endpoints used by government, policy and aerospace staff.

  • Alert on any ScreenConnect, Action1, Atera or MeshAgent install outside your approved deployment.

    Huntress, SANS ISC and Cryptika document phishing that delivers legitimate remote-management clients configured for attacker instances, and Hive Pro reports exploitation of ScreenConnect client flaw CVE-2026-84869. Allow-list approved tools and instance names.

  • Pin dependency versions, restrict GitHub Actions permissions and rotate secrets after any package compromise.

    Shai-Hulud returned after 111 days with the same payload, a Tensorlake release carried a worm variant, and GhostAction injected malicious workflows into 772 repositories. Terraform providers and Go modules were also trojanized.

  • Detect vulnerable-driver loads and security-tool termination before ransomware reaches encryption.

    SparkRAT, Settra, INC, DragonForce, IronChain, Warlock and Lunex all load vulnerable drivers. Warlock pairs CVE-2025-1055 with SharePoint exploitation, so patch SharePoint and alert on driver installs from unusual paths.

  • Restrict the Run dialog and flag endpoints that query blockchain RPC services.

    ClickFix variants now hide payloads in the browser cache and PNG files, and more than a dozen reports resolve C2 through Ethereum, Polygon, Solana or BNB Smart Chain. Blocking the final domains alone will not stop them.

Contents
  1. Citrix NetScaler Zero-Days Lead a Period of Edge and Enterprise-Software Exploitation
  2. One Chrome Zero-Day Chain, Several State Actors, and a Wide Espionage Field
  3. Autonomous C2, Agent-Driven Intrusions, and AI-Branded Lures
  4. Developer Machines and CI Pipelines Stay the Softest Target
  5. Legitimate Remote Tools, ClickFix and Token Theft Replace Exploits
  6. Ransomware Families Multiply, BYOVD Is the Common Tool, and OT Exposure Persists
  7. Also Worth Tracking: Stealers, Mobile, Fraud and Research Notes
Appliance and server exploitation dominates the six weeks from August 29 to October 9, led by two Citrix NetScaler zero-days that Rapid7, Google Threat Intelligence, Hive Pro and the UK NCSC all describe. The BlueMoon exploit kit moved a Chrome and Windows zero-day chain across several state actors within days. AI moved from novelty to workflow, from malware that asks commercial LLMs for C2 decisions to agent-driven intrusions. Supply-chain worms and malicious CI workflows hit developers again, rogue remote-management tools and ClickFix replaced exploits as common footholds, and bring-your-own-vulnerable-driver became the shared step in ransomware intrusions.
01 — TOP STORY

Citrix NetScaler Zero-Days Lead a Period of Edge and Enterprise-Software Exploitation

Exploitation of network appliances and server software fills this digest, and the Citrix NetScaler pair is the best corroborated: four publishers describe the same two zero-days, and the supporting reporting shows what attackers do after they land on the appliance.

Citrix — NetScaler zero-days — 108 IOCs

Two NetScaler zero-days, four independent publishers

Rapid7, Google Threat Intelligence, Hive Pro and the UK NCSC (reported via Cryptika) all describe active exploitation of CVE-2026-88771 and CVE-2026-88772 in NetScaler ADC and Gateway. Google documents WHIPSHOT PHP web shells and a SLAPSHOT Python tunneler used to reach internal networks, while CyberPress reports attackers creating superuser accounts and stealing configuration data. The NCSC advisory covers eight NetScaler vulnerabilities, so patch the full set rather than only the two zero-days.

108 IOCs · PHP web shells + Python tunneler · Root access · Config theft
Sandworm, Qilin affiliates — Cisco Secure FMC — 87 IOCs

Cisco Secure FMC draws in APT and ransomware operators

Talos and CyberVeille report exploitation of CVE-2026-20079 (authentication bypass) and CVE-2026-20316 (static credentials) in Cisco Secure Firewall Management Center. Talos names Sandworm and Qilin ransomware affiliates among the actors, with web shells, Cyclops Blink and ransomware as payloads. Rapid7’s Metasploit notes show a public module for CVE-2026-20079, which lowers the bar for copycats.

87 IOCs · Auth bypass + static credentials · Web shells · Ransomware
SonicWall, Cisco, Check Point, Arista, Fortinet — edge appliances — 132 IOCs

A steady drumbeat of management-plane zero-days

Rapid7 reports active exploitation of CVE-2026-83548 and CVE-2026-83549 in SonicWall SMA1000, CVE-2026-76461 in Cisco Secure Email Gateway (unauthenticated commands as root) and CVE-2026-76504 in the Cisco Catalyst SD-WAN Manager API. Hive Pro adds Check Point (CVE-2026-93616, CVE-2026-85102) and Arista VeloCloud Orchestrator (CVE-2026-93952), and Cryptika reports a FortiMail zero-day (CVE-2026-104286) and a GlobalProtect flaw (CVE-2026-0257) used to steal customer data for 2.4 million fraud messages. Rapid7’s Metasploit wrap-ups add modules for the SonicWall SMA1000 flaws among others.

132 IOCs · Unauthenticated RCE and auth bypass · Fraud-at-scale follow-on
FBI — FortiBleed — 50 IOCs

FBI warns of credential-driven FortiGate compromise

The FBI and USSS describe FortiBleed as a global credential-compromise campaign against internet-facing FortiGate firewalls and SSL VPN gateways, used for initial access and ransomware deployment. Cryptika attributes it to weak credentials and legacy hashing, and the Cryptika and CyberPress write-ups share 20 IOCs. Hive Pro separately reports PAYLOAD ransomware abusing FortiGate SSL VPN logins, which fits the same access pattern.

50 IOCs · Weak credentials · SSL VPN gateways · Ransomware initial access
PaperCut, N-able, JFrog, Magento, PeopleSoft — enterprise software — 177 IOCs

Enterprise software zero-days feed web shells and extortion

Active exploitation is reported for PaperCut NG/MF (CVE-2026-82078, CVE-2026-81578), N-able N-central (CVE-2026-86218), JFrog Artifactory (CVE-2026-42018, CVE-2026-42016, CVE-2026-82329) and Adobe Commerce/Magento (CVE-2026-75650). Cryptika traces one PaperCut compromise from a print server through an AdaptixC2 implant to a domain controller. ShinyHunters (UNC6240) is renewing mass exploitation of Oracle PeopleSoft CVE-2026-35273 with a URL-encoding WAF bypass, deploying web shells and the SIDEEYE backdoor, in four reports from Google, Cryptika, Hive Pro and CyberPress.

177 IOCs · Web shells + SIDEEYE · WAF bypass · Lateral movement to DC
WordPress, Gitea, Zimbra, AhsayCBS — web platforms — 132 IOCs

WordPress core RCE and self-hosted tooling under attack

WordPress core CVE-2026-87902 was exploited within hours of disclosure, and CrowdSec counted 30,000 IPs targeting it in five days, escalating to RCE through pearcmd.php. Red Heron exploits Gitea CVE-2026-60004 to steal source code and deploy the JITTERLY implant and SIXZUT rootkit. Zimbra CVE-2026-73570, AhsayCBS CVE-2026-105133 and CVE-2026-105134, and Elementor Pro CVE-2026-32475 are being used for web shells or miners.

132 IOCs · File inclusion to RCE · Source-code theft · Linux rootkit

Patch, then hunt. Google’s WHIPSHOT and SLAPSHOT findings and reports of new privileged accounts mean an appliance patched after exploitation can stay compromised. Check for unexpected web shells, accounts and configuration access before declaring it clean.

02 — ESPIONAGE

One Chrome Zero-Day Chain, Several State Actors, and a Wide Espionage Field

Espionage reporting splits into one shared exploit kit and a long tail of actor-specific campaigns. BlueMoon is the connection: several state-aligned actors adopted it within days of each other.

BlueMoon — Chrome V8 + Windows kernel chain — 116 IOCs

BlueMoon chains Chrome and Windows bugs for several actors

Hive Pro, Polyswarm and CyberVeille describe the BlueMoon exploit kit chaining the Chromium V8 flaws CVE-2026-85046 and CVE-2026-87491 with the Windows kernel privilege escalation CVE-2026-85880. CyberVeille counts four state-sponsored actors using it within 12 days, with payloads including GemStone and ShadowPad, and separately reports UTA0560 and JungleBamboo deploying CLEANGULP and LONGTALE against governments and NGOs. Three of the reports are one publisher’s view; Polyswarm and Hive Pro supply the independent confirmation, with targets across the US and Asia.

116 IOCs · Chromium V8 + kernel LPE chain · Multiple state actors · ShadowPad, CLEANGULP
UAT-11587 — Antino backdoor — 470 IOCs

Antino’s Microsoft 365 C2 overlaps with earlier Jewelbug reporting

Talos attributes the Rust-compiled Antino backdoor to China-nexus UAT-11587, which spear-phishes Asian government and policy organizations and uses Microsoft 365 for C2. The Cryptika write-up shares 14 IOCs with the Jewelbug report from August 28 and 11 with the August 20 Jewelbug report, so this may be a continuation of that tracked infrastructure rather than a new campaign. FamousSparrow’s new SparroWocky backdoor targets Latin American governments, and TA419 impersonated a senior Anthropic employee to phish US AI policy experts.

470 IOCs · Microsoft 365 as C2 · Spear-phishing · Overlaps 2 earlier reports
Mirage Kitten, WaterPlum — recruiting lures — 232 IOCs

Fake interviews and coding tests remain a favored way in

Mirage Kitten targets aviation, aerospace and FinTech staff with fake interviews and trojanized coding challenges that drop NodeRabbit and PollCat across Windows, Linux and macOS (SecureList, Hive Pro and Polyswarm, with 29 shared IOCs between two of them). WaterPlum (Contagious Interview) pushes malicious npm packages through fake recruitment, and a North Korea-linked campaign hides C2 locations in Ethereum transfers. Iranian state-aligned operators used a fake Dubai Airports coding test against Iraqi critical infrastructure, and Talos warns of consultancy-offer lures aimed at security professionals.

232 IOCs · Trojanized coding challenges · npm delivery · Cross-platform RATs
Konni, Kimsuky, DPRK APTs — 143 IOCs

Konni, Kimsuky and Ted/curlRAT broaden Korean-peninsula tradecraft

Konni uses LNK files disguised as PDFs to deliver VelvetCake to Ukraine-focused organizations; SOCRadar’s and Cryptika’s coverage of what SOCRadar calls Operation Conflict Compass share 24 IOCs and describe one campaign. Rapid7 reports DPRK actors using the Ted backdoor and curlRAT against South Korean media and automotive firms. Hive Pro says Kimsuky is combining AI-generated lures with QR-code phishing.

143 IOCs · LNK-as-PDF lures · Ted + curlRAT · AI-generated lures
BlueDelta, Star Blizzard, Midnight Blizzard — Russia-linked — 153 IOCs

Russia-linked phishing and backdoors target Europe and Ukraine supporters

Polyswarm reports BlueDelta’s HOOKEDGE backdoor against European diplomatic and defense organizations, and Microsoft describes Star Blizzard’s RedFlick method delivering CosmicPulse to organizations supporting Ukraine. Midnight Blizzard’s CaptiveCrunch campaign uses hotel Wi-Fi captive portals to deliver CornFlake and ChocoShell. Earth Sirrush hides espionage malware in PNG files and Notepad++ plugins against Ukrainian organizations, and MATCHBOIL (UAC-0099) hides C2 behind Cloudflare. DomainTools’ Lemmings leak documents a Russian system for creating fake personas at scale.

153 IOCs · Backdoors via phishing · Captive-portal delivery · PNG steganography
APT36, SideCopy, Dark Caracal, Handala — regional campaigns — 839 IOCs

Regional campaigns: South Asia, Latin America, Southeast Asia and Iran

Zscaler reports APT36 using RUSTYSHADE, RUSTYMOVE, PSNATCH and BASHNATCH against India and Afghanistan, and Trellix describes SideCopy’s fileless MSHTA RAT. Hive Pro tracks Dark Caracal’s Go-based GoCaracal framework in Venezuela and SparkRAT in Cambodia via a BYOVD chain (CVE-2026-36425), and QUICSILVER dropping QUICAgent on Myanmar’s government. Group-IB’s HEAVYGRAM Telegram backdoor, linked to Handala Hack, shares 12 IOCs with two earlier reports on MOIS Telegram C2 malware.

839 IOCs · Go and Rust backdoors · DLL sideloading · Continues earlier MOIS reporting

Check both halves of the chain. BlueMoon needs the Chromium V8 and Windows kernel flaws together, so confirm browser and OS patches land as a pair, and prioritize them on endpoints used by staff in government, policy, aerospace and finance.

03 — AI & AGENTIC

Autonomous C2, Agent-Driven Intrusions, and AI-Branded Lures

AI appears in three distinct places this period: inside the malware, inside the attacker’s workflow, and in the lures aimed at people who use AI tools. Most of this is reported by a single vendor per tool, so treat the details as early.

CLOSEDQUORUM — AI in the C2 loop — 38 IOCs

CLOSEDQUORUM puts commercial LLMs in the C2 loop

Talos calls CLOSEDQUORUM the first reported autonomous AI C2 implant: a Windows implant that uses commercial LLMs to harvest credentials and crypto wallets without a human operator. Polyswarm independently describes it delegating tactical C2 decisions to models including DeepSeek, Qwen, Mistral and Google Gemini, and the two reports share six IOCs. Talos also introduced CAIRN to track AI-integrated malware by artifacts such as provider endpoints, and describes families such as FRUITSHELL and MANTLEMAZE that embed instructions meant to derail automated AI analysis.

38 IOCs · LLM-directed C2 · Credential + wallet theft · AI-analysis evasion
SecFlow, CyberXero, CARBONATO, Azazel — agents in intrusions — 97 IOCs

Attackers run intrusions through AI agents

Cryptika and CyberPress report Claude, Qwen and DeepSeek agents driven through the SecFlow framework against government networks in Taiwan, Indonesia, China and Vietnam, and CyberXero combining Claude Code, PentAGI and Cobalt Strike to mass-exploit WordPress and target Ukrainian infrastructure. The CARBONATO botnet deploys an AI agent on compromised Docker servers, and ransomware affiliate Azazel drove an AI coding assistant over MCP to steal data and deploy ransomware. A solo actor used the ARTEX AI pentest tool against South Korean financial organizations.

97 IOCs · Agent orchestration · MCP abuse · Docker + WordPress targets
BREEZE COMET, RemControl, BraZetsu — AI-built crimeware — 194 IOCs

Criminal crews use AI to build overlays, scripts and recon

Google Threat Intelligence says BREEZE COMET uses custom malware and AI-generated scripts to make fraudulent transfers over Brazil’s payment rails. Group-IB’s RemControl is an Android banking trojan whose overlays and infrastructure were built by AI, and the Cryptika and Group-IB write-ups share 31 IOCs. Group-IB and Polyswarm describe BraZetsu, a Python framework from Exilware that automates reconnaissance to feed an initial-access marketplace, while Cryptika reports RATHat Android malware using Gemini and the PhantomRaven infostealer, whose JavaScript was LLM-generated.

194 IOCs · AI-generated overlays · Access-broker marketplace · Android + Windows
Custom GPTs, fake AI ads, Jev clones — AI-brand lures — 266 IOCs

AI brands are now a lure, and AI servers a target

Huntress and Cryptika report ChatGPT Custom GPTs delivering a ClickFix lure and a RAT through DLL sideloading. Cryptika also found fake ChatGPT, Claude and Gemini ads stealing passwords and MFA codes, and fake Jev AI storefronts that proxy requests through third-party servers (CyberPress covers the same). PoeLLM, controlled through a GitHub-hosted poem, targets exposed LiteLLM and Ollama servers, including CVE-2026-42271, to build a mining botnet, and Talos describes UAT-11985 using AI-assisted event lures against Taiwan research organizations.

266 IOCs · ClickFix via Custom GPTs · Fake AI storefronts · Exposed AI servers
Research — AI offense and defense — 42 IOCs

AI research notes: PageBreak, PRC use of commercial AI, AI-built apps

Cryptika reports Google’s internal agent PageBreak found over 500 verified XSS flaws. Polyswarm covers PRC-linked actors’ use of commercial AI and attempts to extract capabilities from US frontier models. Censys examines AI-generated student web apps that collect sensitive data without adequate controls, and publishes CLI skills for AI-assisted investigations.

42 IOCs · Defensive AI · Policy context

Audit AI assistant permissions like service accounts. Azazel reportedly drove an AI coding assistant over MCP and CARBONATO left an agent on compromised Docker hosts, so connector scopes, API keys and tool access are now part of the attack surface.

04 — SUPPLY CHAIN

Developer Machines and CI Pipelines Stay the Softest Target

Package registries, CI workflows and infrastructure-as-code tooling account for a large share of the period’s reporting, and several stories continue ones from earlier digests.

Shai-Hulud, ChainDrop — npm worms — 47 IOCs

Shai-Hulud returns after 111 days with the same payload

Aikido and CyberPress report a dormant Shai-Hulud payload resurfacing on npm after 111 days, bypassing publish-time malware scanning. Cryptika and CyberPress then describe a Shai-Hulud variant in the tensorlake package (0.5.144) that steals AWS keys, SSH credentials and wallet data. ChainDrop, which earlier posts tracked with seven vendors, appears again in a Cryptika report as an Ethereum smart-contract C2 layer, and Aikido found a separate self-propagating worm, supplychain.local, in npm and PyPI packages.

47 IOCs · Credential-stealing worms · Evades publish-time scans · Continues ChainDrop story
GhostAction, MALFEX, XCSSET — CI and package ecosystems — 158 IOCs

GhostAction hits 772 repositories while other registries are poisoned

A new GhostAction wave injects fake GitHub Actions workflow files into 772 public repositories to steal CI/CD secrets and deploy cryptominers (three reports from CyberPress and Cryptika). MALFEX npm malware hides executables in PNG files to infect Windows developers, and a compromised pub.dev Flutter package, universal_file_viewer, carries a variant of the XCSSET macOS worm. Cryptika’s broader pieces warn that poisoned updates and developer-machine infostealers lead straight to cloud credentials.

158 IOCs · Malicious workflows · PNG-hidden payloads · Cloud credential theft
TraderTraitor, Graphalgo — Terraform and Go — 56 IOCs

Trojanized Terraform providers reach developer systems

Zscaler attributes a trojanized Terraform provider delivering cross-platform FLATROOF and ROOFDECK malware to a suspected TraderTraitor group, and Cryptika’s coverage shares 7 IOCs with it. CyberPress separately reports Graphalgo-linked malware in Terraform providers and Go modules that deploys an RAT communicating over Slack and the Arbitrum Sepolia test network.

56 IOCs · Infrastructure-as-code tooling · Cross-platform implants
Brevo CDN — injected customer sites — 34 IOCs

A CDN compromise injects ClickFix scripts into customer sites

CyberPress reports attackers abusing Brevo’s CDN and DNS to inject malicious JavaScript into customer websites through trackers, chat widgets, hosted forms and unsubscribe pages. Rescana attributes it to a stolen Cloudflare API key and says the injected scripts were ClickFix lures.

34 IOCs · Third-party script host · ClickFix injection

Treat dependencies, workflows and script hosts as production. The common thread is trust in something already inside the pipeline: a package name, a workflow file, a provider or a CDN. Pin versions, restrict workflow permissions and rotate secrets whenever a dependency is compromised.

05 — INITIAL ACCESS

Legitimate Remote Tools, ClickFix and Token Theft Replace Exploits

Many intrusions in this period start without an exploit: a signed remote-management agent, a paste-and-run prompt or a stolen session token.

ScreenConnect, Action1, Atera — rogue RMM — 274 IOCs

Rogue remote-management clients are the most common foothold

Huntress, SANS ISC and Cryptika document phishing that delivers legitimate ScreenConnect clients configured to call attacker-controlled instances, including through Microsoft Power BI domains and browser-in-the-browser pages. Huntress’s worm-like rogue installs and Hive Pro’s report on ScreenConnect client flaw CVE-2026-84869 share 6 IOCs. Action1, MSP360, Atera and Faronics Deploy appear as alternative channels, and AgtaBackup uses fake Microsoft Store pages to deliver RMM tools.

274 IOCs · Signed agents · Phishing + fake PDF invoices · Persistence
CSuite, EvilTokens, Knight Office — token theft — 498 IOCs

Device-code phishing and AiTM kits keep growing

CSuite combines device-code phishing with ScreenConnect and Action1 against US and EU organizations, and any.run’s two reports on it share 111 IOCs. CyberVeille counts a 37.5x rise in device-code phishing in 2026 and names the EvilTokens kit; Huntress found the Knight Office Microsoft 365 AiTM kit and CloudSEK the Evilginx2-based BigBear 2.0. Cryptika describes TrustSink, a rogue MFA provider that steals Entra passwords, and Huntress shows OAuth token theft through sideloaded AppX packages.

498 IOCs · Device-code flow · MFA bypass · Session theft
ClickFix — TerminalFix, Macfinger and variants — 527 IOCs

ClickFix keeps spreading across Windows, macOS and the browser

TerminalFix uses fake Cloudflare CAPTCHAs, DLL sideloading (dui70.dll) and PNG steganography to land a Python reverse tunnel (Hive Pro, CyberPress, SANS ISC). Microsoft warns of a variant that hides payloads in the browser cache as PNG files, and Macfinger delivers Atomic macOS Stealer from scripts injected into legitimate sites. A hijacked HBO Max Reddit account served ClickFix lures, and over 100 sites with fake Cloudflare checks spread LUNEXSTEALER.

527 IOCs · Run-dialog paste · PNG steganography · macOS + Windows
EtherHiding and friends — public blockchains as C2 — 714 IOCs

More than a dozen reports hide C2 lookups on public blockchains

Malware and injected scripts in this period resolve C2 or delivery domains from Ethereum, Polygon, Solana, BNB Smart Chain and TON: a Magecart-style skimmer, ChainScript, SloppyRAT, the Node.js implants in Security.com’s report, EtherRAT and TONResolver, MovieReaper, ClearFake, KREMLIN, REVSTEALER, the SC WordPress backdoor and Dark Caracal’s fallback C2. Blocking the malware’s domains is not enough on its own; the blockchain lookups are themselves detectable.

714 IOCs · Ethereum, Polygon, Solana, BNB · Takedown-resistant C2

Hunt the install, not the exploit. A signed ScreenConnect or Action1 agent that nobody deployed is a stronger signal than any single exploit, so inventory approved remote-management tools and alert on everything else.

06 — RANSOMWARE & OT

Ransomware Families Multiply, BYOVD Is the Common Tool, and OT Exposure Persists

New ransomware brands, established crews and extortion-only groups all appear this period. The shared technique is bring-your-own-vulnerable-driver to silence security tools before encryption.

Longlegs — Warlock ransomware — 98 IOCs

Four reports track Warlock ransomware against water and telecom operators

Security.com, Cryptika, CyberPress and Polyswarm describe China-nexus Longlegs (also tracked as Storm-2603) exploiting SharePoint flaws (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771) to deploy Warlock ransomware against water and telecom operators in Portuguese- and Spanish-speaking countries. A vulnerable signed driver (CVE-2025-1055) disables security tools first, and Polyswarm notes ransomware distribution via SYSVOL replication. Security.com’s and Cryptika’s reports share 15 IOCs.

98 IOCs · SharePoint exploit chain · BYOVD · SYSVOL distribution
Panzer, Galago, Settra, PAYLOAD, IronChain — new families — 132 IOCs

New ransomware brands arrive with familiar tradecraft

Hive Pro says Panzer, a cross-platform RaaS hitting Windows, Linux, ESXi and FreeBSD, claimed over 20 victims in its first month, while Cryptika reports Galago claiming a Panzer partnership with no verified victims. Huntress saw Settra deploy MeshAgent after BYOVD. PAYLOAD abuses malicious Group Policy Objects to extort with or without encryption (SecureList, Hive Pro), and any.run’s IronChain build uses several drivers for destructive actions with no reliable recovery path.

132 IOCs · Cross-platform RaaS · GPO abuse · Destructive drivers
INC, Akira, DragonForce, Storm-2570, Feral Wolf — established crews — 121 IOCs

Established crews lean on RMM tools, tunnels and drivers

Huntress documented INC using BYOVD, AnyDesk and two different ransom notes, and an Akira intrusion via RDP, procdump, Rclone and a GOST tunnel. Hive Pro says DragonForce hides C2 in Microsoft Teams TURN-relay traffic with Backdoor.Turn and uses vulnerable drivers. Microsoft’s Storm-2570 reuses one blueprint of remote management tools, credential theft and exfiltration across ransomware families, and Feral Wolf exploits Confluence CVE-2023-22515 and 1C:Enterprise to deploy GenieLocker.

121 IOCs · BYOVD · Teams-relayed C2 · RMM + tunneling
ShinyHunters, Silent Ransom, Meowciety403 — extortion — 53 IOCs

Extortion-only groups and rivalries

MalwareBytes reports ShinyHunters defacing the leak site of rival Clop and claiming an FBI breach as revenge for an advisory. Silent Ransom Group steals data from law firms through social engineering, RMM tools and physical intrusions, and its report shares 8 IOCs with a June UNC3753 vishing report. Hive Pro profiles Meowciety403, a data broker targeting financial and tech firms in the UAE, Singapore and Germany, and the Stormous group’s shutdown after four years.

53 IOCs · Data theft without encryption · Leak-site takeover
Exposed controllers, cameras — OT and IoT — 30 IOCs

Exposed industrial controllers and cameras keep getting hit

Cryptika and Polyswarm describe attacks on internet-exposed industrial controllers affecting US water utilities and other critical infrastructure; the two reports share 16 IOCs and continue the PLC story from earlier digests. CyberPress adds that Volt Typhoon and CyberAv3ngers are among actors targeting OT to disrupt military operations without breaching bases. CameraSwarm compromised more than 14,500 Dahua cameras and backdoored about 1,900, and Hikvision CVE-2021-36260 exploitation attempts rose in Ukraine.

30 IOCs · Exposed PLCs · Camera botnets · Continues PLC story

BYOVD is the detection opportunity. SparkRAT, Settra, INC, DragonForce, IronChain, Warlock and Lunex all load a vulnerable driver before the main payload, so a driver-load or security-tool-termination alert is available well before encryption starts.

07 — ALSO TRACKING

Also Worth Tracking: Stealers, Mobile, Fraud and Research Notes

The remaining reports are mostly commodity malware, mobile and macOS activity, consumer fraud and vendor research. Several are duplicates or syndications of reports above, which is noted where the overlap data shows it.

Vidar, Remus, Warden, SectopRAT — stealers — 870 IOCs

Infostealers keep iterating on evasion and delivery

Vidar adds a custom virtual machine and stream ciphers for string obfuscation (Zscaler, CyberPress), and 2CLoader delivers Vidar, Remus and XWorm, with Zscaler’s and Cryptika’s reports sharing 22 IOCs. Remus removes syscall hooks to evade EDR, Warden spreads through ClickFix, malvertising, cracked software and game cheats, and CastleStealer adds a browser-protection bypass and remote shell. SectopRAT hides inside tampered legitimate software, JSCeal ships as V8 bytecode through malvertising, and PEEP turns a bookmark extension into a Chromium backdoor.

870 IOCs · EDR evasion · Crypto wallets + browser data · Fake installers
AvisLoader, Sauron, BambooToken — loaders and backdoors — 171 IOCs

Loaders and backdoors: Tox, MQTT, 7-Zip and LATAM lures

AvisLoader uses Tox peer-to-peer messaging to survive server takedowns, and BambooToken is a Linux backdoor that uses MQTT for C2. Cryptika and CyberPress report malware hidden in recompiled 7-Zip components, including OpenSUpdater, and Sauron Loader uses DLL side-loading and in-memory decryption against German organizations. SANS ISC analyzes a geofenced Guildma (Astaroth) infection and a LausivLoader chain, while any.run describes an HVNC backdoor with fake tax and DocuSign lures in LATAM.

171 IOCs · P2P and MQTT C2 · DLL sideloading · Brazil + LATAM
DarkSword, MacSync, Anatsa — mobile and macOS — 399 IOCs

Mobile and macOS: DarkSword continues, MacSync changes shape

The DarkSword/Coruna iOS platform appears again, as in the July 24–31 and August 1–21 digests: Censys’ open-directory report and Cryptika’s coverage share 40 IOCs and describe wallet-recovery-phrase theft, with a new iOS 26 exploit in development, and a fake iPhone Duo preorder page triggers the chain. MacSync moves to binary droppers and an Objective-C/Swift payload (SecureList and Cryptika share 36 IOCs), while a fake Zoom installer drops the CloudSyncD macOS backdoor. On Android, an Anatsa dropper hid in a PDF reader with over 10,000 Google Play installs, GoldFactory’s Vwork clones banking apps for Gigabud, and Midnight Mimosa ships preinstalled on low-cost MediaTek devices.

399 IOCs · Continues DarkSword story · Wallet seed theft · Preinstalled Android malware
Free Mobile, Revolut, Ledger, GTA 6 — fraud and lures — 372 IOCs

Breach-driven phishing, crypto drainers and leaked-game lures

Phishing followed data breaches at Free Mobile and Revolut, with MalwareBytes’ two Free Mobile reports sharing 15 IOCs because they are the same article. T-Mobile rewards-expiry texts, fake parcel-delivery messages and shipping-rebate subscription traps target consumers, while fake Ledger ads, 70 fake crypto-project sites, fake Bitrefill checkouts and malicious Firefox wallet extensions go after crypto holders. Fake leaked GTA 6 copies deliver NJRAT, DCRAT, Mercurial Grabber and Chaos ransomware acting as a wiper, in reports from Huntress, Polyswarm and MalwareBytes. Group-IB analyzes the Smishing Triad’s JWR phishing kit.

372 IOCs · Breach-driven phishing · Wallet drainers · Chaos wiper in fake game
Samsung MagicINFO, Redis, Cling — miners and IoT — 235 IOCs

Cryptominers and opportunistic exploitation of exposed services

Samsung MagicINFO CVE-2025-4632 (and the earlier CVE-2024-7399) is used to install AnyDesk, disable Defender and compile SilentXMRMiner on the endpoint, in reports from Huntress, Cryptika and CyberPress. Threat actors hijacked 3,562 Redis servers through rogue replication to run XMRig, and Cling/ClingSTUN IoT malware disguises C2 as Google STUN traffic while exploiting CVE-2021-35394 and other router and camera flaws (Cryptika and CyberPress share 13 IOCs). SANS ISC saw scanning for Proxmox, hospitality PBX applications and Atlassian CVE-2026-21589, plus a RedTail Linux payload; other items cover Gogs CVE-2026-52813 and malicious HEIC images.

235 IOCs · XMRig + SilentXMRMiner · Router and camera botnets · Scanning
Parks platform, South Korean churches, Storm-3168 — intrusions — 201 IOCs

Intrusion write-ups: web shells, cloud wipes and AD RMS keys

Huntress describes web shells on a parks-and-recreation management platform used to steal payment card data, and two South Korean churches were breached through web shells, leaked credentials and IDOR flaws, exposing over one million congregants’ records. Storm-3168 used compromised cloud identities to delete Azure resources within seven minutes. Attackers also abused MSSQL xp_cmdshell for Base64 exfiltration, the TIKTOUK toolkit mined exposed WordPress backups for AWS and email credentials, and Huntress’s AD RMS series shows how extracting the Server Licensor Certificate key allows offline decryption that cannot be rotated away.

201 IOCs · Web shells · Destructive cloud access · Unrotatable key
Talos newsletters, Censys, SANS ISC — research — 158 IOCs

Research and newsletters: mostly recurring indicators

The four Talos Threat Source newsletters repeat prevalent-malware hashes that also appear in at least eight earlier issues and in earlier Talos posts, so they add little new indicator coverage. Censys reports on Mythic C2 at internet scale, 14 and 22 new protocol scanners in August and September, and a brand-protection guide that shares 9 IOCs with the July UNC1151 report. Other items include VirusTotal’s daily IPv4 scanning, SANS ISC diaries on honeypot logs and TTY logs, a macOS 27 first-boot capture, PaperPhone’s 75,000-IP headless-browser network, Safari forensic tags and an ANY.RUN piece on SOC bottlenecks.

158 IOCs · Recurring hashes · Internet-scale scanning · SOC practice

Analyst Assessment: August 29–October 9, 2026 in Context

The edge is still the front door. The Citrix NetScaler pair is the best-corroborated story in the data, with four independent publishers, and it sits beside Cisco FMC, SonicWall SMA1000, Check Point, Arista and FortiMail reports. Several of those flaws have public Metasploit modules or ransomware affiliates already using them, so the window between disclosure and mass exploitation is short. WordPress core CVE-2026-87902 was reportedly exploited within hours.

Exploits are optional. Rogue ScreenConnect, Action1 and MSP360 agents, device-code phishing, AiTM kits and ClickFix deliver access with no vulnerability at all. Many of the same actors then use public blockchains for C2, which means the final domains rotate while the technique stays constant. Detection that keys on the delivery behavior holds up better than indicator blocking.

AI is now part of the intrusion workflow, though evidence is thin. CLOSEDQUORUM is corroborated by two vendors, but SecFlow, CyberXero, CARBONATO and Azazel each rest on one or two reports, and several of those are republished by news sites rather than independently confirmed. The consistent point is practical: connectors, API keys and coding-assistant access are targets, and AI product names are effective lures.

What to do now: (1) Patch Citrix NetScaler and check appliances for web shells and new privileged accounts. (2) Review management-interface exposure on Cisco, SonicWall, Check Point, Arista and Fortinet devices. (3) Confirm Chrome and Windows kernel patches together for the BlueMoon chain. (4) Allow-list approved remote-management tools and alert on all others. (5) Pin dependencies, restrict workflow permissions and rotate secrets after any compromised package. (6) Alert on vulnerable-driver loads and security-tool termination. (7) Review permissions granted to AI assistants and MCP connectors.

Sources

  1. Hive Pro — PaperCut NG/MF Zero-Day Under Active Exploitation Across All Versions
  2. Hive Pro — SparkRAT Ignites Cambodia via BYOVD Chain
  3. Hive Pro — Dark Caracal Modernizes Its Espionage Toolkit
  4. CyberPress - Cyber-Attack — TerminalFix Attack Uses Fake Cloudflare CAPTCHA to Deploy Reverse Tunnel Into Corporate Networks
  5. CyberPress - Cyber-Attack — Hackers Turn Ethereum Blockchain Into a Card-Skimming Network Targeting Online Shoppers
  6. Group IB Blog — Anatomy of BraZetsu: How Cybercriminals Fuel the Underground Ecosystem
  7. SecureList — ValleyRAT masquerading as adware
  8. Polyswarm — SLEEPWALKER: Passive Backdoor Awakens Only When Attackers Call
  9. Censys — Blog August 31, 2026 So Your CFO's Phone Has Been Pwned: A DFIR Journey
  10. SANS ISC — Guildma (Astaroth) malware infection from Brazilian Portuguese email, (Tue, Sep 1st)
  11. Google Threat Intelligence — Financially Motivated Threat Actor BREEZE COMET Targets Brazil
  12. Hive Pro — Operation QUICSILVER Drops a Go Backdoor on Myanmar Government
  13. any.run — Major Cyber Attacks in August 2026: US and EU Businesses Hit by Session Hijacking, Remote Access, and Insider Risk
  14. SecureList — Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set
  15. Huntress — The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT
  16. Huntress — Daisy-Chaining Trust: Investigating Faronics Deploy Abuse
  17. MalwareBytes — Fake GTA 6 leaked copy drains your crypto wallet
  18. CyberPress - Cyber-Attack — Silver Fox Hackers Target China-Based Organizations With Counterfeit Software Installers
  19. CyberPress - Cyber-Attack — Hackers Use AI Malware to Break Into Brazilian Banks and Make Fraudulent Transfers
  20. Checkpoint Research — Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon
  21. Huntress — Inside Knight Office, a New M365 AiTM Phishing Kit
  22. Elastic Security Lab — From 88 lines to 1: Detecting DLL hijacking with Elastic Defend
  23. Elastic Security Lab — REVSTEALER ramps up: analysis of up-and-coming infostealer
  24. microsoft.com — Deceptive Software Download Campaign
  25. SANS ISC — Honeypot-Omaha and batch.py [Guest Diary], (Wed, Sep 2nd)
  26. Aikido Blog — MECCHA CHAMELEON can't hide from the RCE
  27. Huntress — Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity
  28. Security.com Threat Intel — Node.js: Old Technique Makes a Comeback
  29. Talos — The story behind the intelligence
  30. Huntress — AD Rights Management Service (Part 2): Extraction, Offline Decryption, and the Unrotatable Key
  31. Huntress — AD Rights Management Service (Part 1): Architecture, Deprecation, and Reconnaissance
  32. CyberPress - Cyber-Attack — CameraSwarm Hackers Compromise 14,500+ Dahua Cameras, Backdoor 1,900 Devices
  33. CyberPress - Cyber-Attack — Hackers Use Claude, Qwen and DeepSeek AI Agents to Attack Government Networks
  34. SecureList — Angry Birds: Toy Ghouls’ new toys
  35. Rapid7 — DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors
  36. Censys — Blog September 4, 2026 Neither Malware nor Harmless: Tracking the NPS Proxy Across the Internet
  37. Polyswarm — Hooked on Espionage: BlueDelta Targets Europe with HOOKEDGE
  38. Hive Pro — One Empty File to Full Takeover: Elementor Pro Under Active Attack
  39. Hive Pro — Mirage Kitten Turns Job Interviews into a Gateway for Corporate Espionage
  40. Hive Pro — TerminalFix: Fake Cloudflare Checks Open a Reverse Tunnel
  41. CyberPress - Cyber-Attack — New Windows Attack Hijacks Trusted Security Apps to Abuse Powerful Kernel Drivers
  42. Aikido Blog — Shai-Hulud Rises From the Dead after 111 days
  43. CyberPress - Cyber-Attack — npm Supply Chain Worm Returns After Four-Month Dormancy With Same Malicious Payload
  44. Talos — ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager
  45. Talos — ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2
  46. any.run — HVNC Backdoor Targets LATAM Organizations with Fake Tax and DocuSign Lures
  47. Aikido Blog — Compromised Flutter package on pub.dev contains XCSSET malware
  48. Polyswarm — The Job Offer Has Claws: Mirage Kitten Deploys NodeRabbit and PollCat
  49. CyberPress - Cyber-Attack — Hackers Hijack 3,562 Redis Servers via Rogue Replication to Deploy XMRig Miner
  50. Group IB Blog — Vwork: Weaponized Open-source Software as an Addon for Gigabud
  51. Huntress — Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence
  52. Huntress — Grand Theft Auto VI Hype Leads to Malware
  53. Talos — Active exploitation of Cisco Secure Firewall Management Center vulnerabilities
  54. SANS ISC — Scans for Proxmox Servers, (Wed, Sep 9th)
  55. Censys — Blog September 9, 2026 New on the Map — August 2026: 14 Protocol Scanners
  56. CyberPress - Cyber-Attack — AI-Assisted Hackers Target Government Ministries and Critical Infrastructure in Latin America
  57. SANS ISC — Redtail Payload Analysis [Guest Diary], (Wed, Sep 9th)
  58. Huntress — AD Rights Management Service (Part 2): Extraction, Offline Decryption, and the Unrotatable Key
  59. Zscaler — SloppyRAT: A New Tool For Ransomware Attacks
  60. Talos — We've got one word for it, and it's usually the wrong one
  61. Censys — Blog September 11, 2026 No One Inside The Machine
  62. Polyswarm — BraZetsu: AI-Enhanced Reconnaissance Fuels Exilware’s Access Marketplace
  63. Group IB Blog — Smish. Click. Drained: Inside the Smishing Triad’s Phishing Cockpit
  64. Polyswarm — Gamers Get Played: Fake GTA6 Leaks Deliver a Grab Bag of Malware
  65. Huntress — Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware
  66. CyberPress - Cyber-Attack — Hackers Hijack HBO Max Reddit Account to Target Windows and macOS Users With ClickFix Malware
  67. MalwareBytes — Search results are sending people to fake Bitrefill checkouts
  68. MalwareBytes — HBO Max’s verified Reddit account hijacked to spread malware
  69. Hive Pro — BREEZE COMET Turns Brazil's Instant Payment Rails into a Cash-Out Channel
  70. Hive Pro — JSCeal: Crypto Stealer Hidden in V8 Bytecode
  71. Hive Pro — PEEP: The Bookmark Extension That Backdoors Your PC
  72. Hive Pro — StyleSmuggler: Adobe Commerce and Magento Zero-Day Exploited
  73. Hive Pro — N-able N-central Pre-Auth RCE Exploited in the Wild (CVE-2026-86218)
  74. Hive Pro — Patch-Gap Panic: Chrome V8 Zero-Day Fuels the BlueMoon Espionage Wave
  75. Hive Pro — Panzer: New Cross-Platform RaaS Claims Global Victims in Its First Month
  76. SANS ISC — MacOS 27 - First Boot, (Tue, Sep 15th)
  77. Censys — Blog September 15, 2026 Mythic C2 Activity at Internet Scale
  78. Rapid7 — Metasploit Wrap Up: Payloads and Exploits, and Scanners, Oh my!
  79. Rapid7 — CVE-2026-76461: Critical Cisco Secure Email Gateway Vulnerability Exploited in the Wild
  80. Rapid7 — Metasploit Wrap Up: This One Goes to Sixteen!
  81. Rapid7 — Metasploit Wrap Up: Lot of summer shells and fit http profiles
  82. Rapid7 — Critical SonicWall SMA1000 Vulnerabilities CVE-2026-83548, CVE-2026-83549 Exploited in the Wild
  83. SecureList — NightEagle targets Russian companies
  84. Zscaler — Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH
  85. DomainTools — DomainTools Investigations | Lemmings: A Russian Industrialized Persona Provisioning And Management for Active Measures Campaigns
  86. SANS ISC — Scans Targeting Hospitality Applications, (Wed, Sep 16th)
  87. Group IB Blog — HEAVYGRAM: A Telegram-based Surveillance Backdoor Linked to Handala Hack
  88. MalwareBytes — T-Mobile rewards points expiry texts are a phishing scam
  89. SecureList — The Odyssey and trojans again: MovieReaper attacks users in multiple countries via compromised torrents
  90. Huntress — Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM
  91. MalwareBytes — Revolut phishing texts appear days after data breach
  92. SANS ISC — LausivLoader analysis, or how to pass data between malware stages, (Thu, Sep 17th)
  93. Talos — Should you care about an “AI slowdown?”
  94. CyberPress - Cyber-Attack — Attackers Abuse Brevo CDN and DNS to Inject Malicious JavaScript Into Customer Websites
  95. MalwareBytes — Fake parcel delivery messages steal your card and bank details
  96. DomainTools — Twenty Flight Newsletter
  97. Hive Pro — Kimsuky Blends AI-Generated Lures and Quishing into an Expanded Espionage Arsenal
  98. Hive Pro — JFrog Artifactory Flaws Chained for Administrative Takeover
  99. Hive Pro — CVE-2026-84869: Critical ScreenConnect Client Flaw Under Active Exploitation
  100. Hive Pro — Stormous Extortion Group Announces Shutdown After Four Years of Leak-Site Activity
  101. SecureList — Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO
  102. SANS ISC — TerminalFix: PNG Steganography, (Mon, Sep 21st)
  103. MalwareBytes — ShinyHunters hacks rival extortion gang and takes over its dark web site
  104. Huntress — The Tale of Two INC Ransom Notes
  105. Zscaler — Vidar Adds Virtual Machine and Custom Stream Ciphers For String Obfuscation
  106. Polyswarm — BlueMoon Exploit Kit Rapidly Targets Key Verticals Across Multiple Espionage Campaigns
  107. Polyswarm — China and the Cyber Arms Race for AI Supremacy
  108. CyberPress - Threats — Vidar Infostealer Uses Custom Virtual Machine and Stream Ciphers to Evade Malware Analysis
  109. Talos — Introducing CAIRN: Frontier tracking for AI-integrated malware
  110. Talos — The Closed Quorum: Inside the first reported autonomous AI C2 implant
  111. any.run — CSuite Targets US and EU Organizations with Device-Code Phishing and Remote Access
  112. cryptika.com — Chrome and Windows Zero-Day Exploits
  113. CyberVeille — BlueMoon Exploit Kit : quatre acteurs d'espionnage ciblent secteurs clés aux États-Unis et en Asie
  114. socradar.io — Operation Conflict Compass Konni Campaign
  115. rescana.com — Brevo CDN Supply-Chain Compromise
  116. cyberpress.org — BambooToken Linux MQTT Backdoor
  117. cloudsek.com — BigBear 2.0 Evilginx2 Phishing Campaign
  118. mandarnaik016.in — Phantom Stealer Malware Analysis
  119. Elastic Security Lab — The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions
  120. Huntress — DarkMe Email Campaign Broadens Targeting For APT RAT
  121. SANS ISC — Macfinger ClickFix campaign, (Tue, Sep 22nd)
  122. CyberPress - Cyber-Attack — Attackers Keep Malware Campaigns Alive by Rotating Domains and Hosting Infrastructure
  123. CyberPress - Cyber-Attack — Graphalgo Malware Hits Terraform and Go Packages in New Supply Chain Attack
  124. Aikido Blog — Novel supplychain.local Go worm appears
  125. Group IB Blog — RemControl: AI Built the Overlays. Victims Lose their PINs
  126. MalwareBytes — ShinyHunters claims FBI breach was revenge for “false” report
  127. Huntress — OAuth Token Theft Through Microsoft's Front Door | Huntress
  128. SecureList — MacSync under the microscope: new delivery methods and a new payload
  129. Huntress — The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint
  130. Censys — Blog September 24, 2026 Introducing Censys CLI Skills: AI-Assisted Investigations at Scale
  131. cyberveille.ch — ChainScript Node.js RAT
  132. cryptika.com — Remus Infostealer EDR Evasion
  133. cryptika.com — Blockchain Malware Steals Bank Logins
  134. Talos — Trust and the enticing consultancy offer
  135. CyberVeille — Advisory conjoint : WaterPlum (Contagious Interview) cible les professionnels IT mondiaux
  136. CyberVeille — Feral Wolf exploite Confluence et 1C:Enterprise pour déployer le ransomware GenieLocker
  137. CyberVeille — PhantomRaven : un infostealer JS généré par LLM distribué via npm pour le bug bounty
  138. CyberVeille — BlueMoon : quatre acteurs étatiques exploitent le même kit Chrome zero-day en 12 jours
  139. CyberVeille — Exploitation active de vulnérabilités critiques dans Cisco Secure FMC par des APT et ransomware
  140. CyberVeille — Ingénierie sociale sur le thème des passkeys mène à la compromission d'identités cloud
  141. CyberVeille — Explosion du device code phishing en 2026 : 37,5x d'augmentation et émergence du kit EvilTokens
  142. Cryptika — Fake PDF Files Hide Konni Malware Campaign Targeting Ukraine Organizations
  143. Cryptika — AvisLoader Windows Malware That Learned to Survive Even After Its Servers Are Taken Down
  144. Cryptika — New Android Banking Trojan Uses AI-Built Overlays to Steal Users’ Banking PINs
  145. Cryptika — New Galago Ransomware Operation Emerges With Links to Panzer Group
  146. Cryptika — Malicious Firefox Extension Disguised as PDF Tool Steals Google Account Sessions
  147. SANS ISC — A Closer Look at Malware From the Macfinger ClickFix Campaign, (Fri, Sep 25th)
  148. MalwareBytes — That shipping rebate offer may come with a monthly charge
  149. Cryptika — New MacSync Malware Turns macOS Apps Into Tools for Crypto and Password Theft
  150. Cryptika — Microsoft Finds Ransomware Group Using Same Attack Blueprint Across Multiple Malware Families
  151. Cryptika — Attackers Are Turning Everyday Business Emails Into Malware Delivery Machines
  152. MalwareBytes — Criminals turn placeholder domain into ClickFix trap
  153. Cryptika — TWEAKOS Malware Turns Telegram Into a Stealer, C2 Platform and Stolen Account Marketplace
  154. Cryptika — Sauron Loader Malware Uses DLL Side-Loading and In-Memory Decryption to Evade Detection
  155. Rapid7 — Metasploit Wrap Up: Belgian Waffles, Chocolates, and…Modules-Frites?
  156. Polyswarm — FamousSparrow Takes Flight with New SparroWocky Backdoor
  157. MalwareBytes — Kothamine malware uses Tailscale’s tailcat to evade network detection 
  158. Cryptika — Hackers Used a Samsung Flaw to Build a Cryptominer Inside Victim Systems
  159. Cryptika — Researchers Found a Botnet That Uses an AI Agent to Operate Inside Compromised Servers
  160. cyberpress.org — PowerShell Malware Deploys XMRig Miner
  161. CyberPress - Cybersecurity News — Samsung MagicINFO Flaw Used to Deploy AnyDesk and Compile Stealthy Cryptominer Payloads
  162. cyberveille.ch — Red Heron Gitea Exploitation Campaign
  163. welivesecurity.com — FamousSparrow deploys SparroWocky backdoor
  164. trellix.com — SideCopy MSHTA RAT Deployment
  165. ransom-isac.org — MacOS ClickFix AMOS Campaign
  166. Zscaler — Threat Actors Use Google Ads To Target Ledger Users
  167. Google Threat Intelligence — ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
  168. CyberPress - Cybersecurity News — Red Heron Hackers Exploit Critical Gitea RCE to Steal Source Code and Deploy Linux Rootkit
  169. Cryptika — Hackers Exploit GlobalProtect Flaw and Turn Stolen Data Into 2.4 Million Fraud Messages
  170. Cryptika — Hackers Don’t Need to Break Into the Cloud When They Can Steal the Keys
  171. Cryptika — Python MaaS Infostealer Builder Steals Passwords, Credit Cards and Cookies From 17 Browsers
  172. Rapid7 — Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772
  173. Hive Pro — PAYLOAD Ransomware Emerges as a Fast-Growing Extortion Threat
  174. Hive Pro — Critical Zero-Day in Arista VeloCloud Orchestrator Under Active Attack
  175. Hive Pro — Check Point Rushes Fixes as Two Critical Flaws Come Under Active Attack
  176. Hive Pro — Paws on the Payroll: The Rise of Meowciety403
  177. Cryptika — TrustSink Attack Uses Rogue MFA Provider to Steal Microsoft Entra Passwords During Legitimate Logins
  178. Hive Pro — DragonForce Evolves: Teams-Relayed C2 and BYOVD Kernel Evasion
  179. Hive Pro — Race Against the Patch: Critical WordPress RCE Exploited Within Hours
  180. Cryptika — ShinyHunters Bypasses WAF Protections to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells
  181. Cryptika — Attackers Create Fake Jev AI Stores to Intercept Prompts Through Third-Party Servers
  182. CyberVeille — CVE-2026-87902 : 30 000 IP ciblent WordPress en 5 jours via une faille LFI critique
  183. CyberVeille — Des APT chinois exploitent une chaîne de zero-days Chrome/Windows pour déployer CLEANGULP
  184. Cryptika — NCSC Urges UK organizations to Patch for Citrix NetScaler ADC and Gateway 0-Day Vulnerabilities
  185. Cryptika — Hackers Built an AI-Powered Attack Machine and Accidentally Left the Control Panel Open
  186. Cryptika — Microsoft Finds New Malware Used by Hackers to Maintain Secret Access Inside Target Networks
  187. Polyswarm — CLOSEDQUORUM: Malware Puts AI in the C2 Loop
  188. CyberPress - Cybersecurity News — Jev Clone Websites Proxy Official AI API Requests Through Fake Third-Party Platforms
  189. CyberPress - Cybersecurity News — ShinyHunters Exploits Oracle PeopleSoft Vulnerability CVE-2026-35273 in New Attack Wave
  190. Cryptika — Fake VPN Extensions Hijack Browser Traffic Through Hidden Proxy Servers
  191. Cryptika — BotHelper RAT Uses Encrypted Payloads and Live Screen Surveillance to Spy on Windows Users
  192. any.run — Major Cyber Attacks in September 2026: US and EU Face Session Theft, Remote Access, and Payment Fraud
  193. CyberPress - Threats — OpenSUpdater Malware Hides Reflective Loader Inside Recompiled 7-Zip SFX to Evade Detection
  194. Cryptika — Storm-3168 Deletes Azure Resources in 7-Minute Destructive Cloud Attack
  195. MalwareBytes — Fake iPhone Duo preorder scam triggers DarkSword attack
  196. Cryptika — AgtaBackup RAT Uses Fake Microsoft Store Pages and RMM Tools to Hijack Windows Systems
  197. Cryptika — Hackers Using ChatGPT’s Custom GPT feature to Trick Victims into Installing Malware
  198. Google Threat Intelligence — Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances
  199. Cryptika — SilverFox Hackers Built Fake Software Sites That Hide Malware From Security Researchers
  200. Cryptika — Hackers Hide Malware Inside 7-Zip Installers Using a New Evasion Technique
  201. Cryptika — Hackers Turned Ethereum Into a Secret Messaging System for Malware
  202. cyberxtron.com — Silent Ransom Group Operations
  203. huntress.com — ChatGPT Custom GPTs ClickFix RAT
  204. CyberPress - Cybersecurity News — CSuite Targets US and EU with Session Theft and RMM Abuse, Expanding Fraud and Access Risk
  205. CyberPress - Cyber-Attack — Malware Hidden in Legitimate Software Can Steal Passwords, Cards and Crypto Wallets
  206. Cryptika — RATHat Android Malware Uses Gemini AI to Control Phones Outside Normal App Permissions
  207. Cryptika — Fortinet Uncovers SectopRAT Variant Hidden Inside Tampered Legitimate Windows Software
  208. any.run — Phishing Response Protocol: 3 Essential SOC Steps Powered by ANY.RUN’s Latest Updates
  209. Talos — China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor
  210. Cryptika — Hackers Broke Into Microsoft 365 Through Forgotten Accounts Nobody Was Watching
  211. Huntress — Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers
  212. Cryptika — Hackers Turned a PaperCut Print Server Into a Path to the Domain Controller
  213. Zscaler — 2CLoader: A New Malware Loader Delivering Vidar and Remus
  214. Cryptika — Hackers Disguise Remote Access Tools as Zoom and PDF Installers to Take Over PCs
  215. Rapid7 — Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)
  216. Cryptika — Phishing Response: 3 Steps SOC Teams Can Take to Investigate Threats Faster
  217. Cryptika — PaperPhone Headless Browser Network Uses 75,000 IPs and Fabricated Mobile Identities Across 43 Countries
  218. Cryptika — Supply Chain Attacks Turn Developer Machines Into Gateways for Cloud Breaches
  219. Cryptika — Google Warns of Hackers Actively Exploiting Citrix 0-Day Vulnerabilities to Deploy Web Shells
  220. CyberPress - Cybersecurity News — Hackers Exploit Citrix NetScaler Zero-Days to Gain Root Access and Deploy Web Shells
  221. SANS ISC — ScreenConnect Client (Ab)used by Attackers, (Thu, Oct 1st)
  222. Hive Pro — Citrix NetScaler Zero-Days Under Active Exploitation
  223. Cryptika — New 2CLoader Malware Evades Security Tools to Deploy Vidar and Remus Stealers
  224. Hive Pro — NeedyMantis: The Patient Predator Hiding in Plain Sight
  225. Hive Pro — From Zero-Day to N-Day: ShinyHunters Renews Oracle PeopleSoft Mass Exploitation
  226. Cryptika — Hackers Exploit Zimbra Mail Servers With Crafted Emails to Gain Remote Access
  227. Security.com Threat Intel — Warlock Ransomware Attackers Hit Water and Telecom Operators
  228. Cryptika — Warlock Ransomware Exploiting SharePoint Flaws to Attack Water and Telecom Operators
  229. Cryptika — WordPress Malware Comes Back After Removal Using a Self-Healing Backdoor
  230. Cryptika — Fake Zoom Installer Tricks Mac Users Into Installing New CloudSyncD Backdoor
  231. Cryptika — Chinese Hackers Posing as Senior Anthropic Employee Targeting US AI Policy Experts
  232. Cryptika — Hackers Built a Windows Backdoor Whose Entire C2 Lives Inside Microsoft 365
  233. MalwareBytes — Fake xStocks, Pendle, and other sites bait crypto users with rewards votes
  234. Talos — Give yourself room to be human
  235. CyberPress - Cybersecurity News — SC WordPress Malware Rebuilds Itself From 8 Locations and Uses Ethereum for C2
  236. CyberPress - Cybersecurity News — Fake Zoom Installer Deploys CloudSyncD macOS Backdoor and Hides Password in Zero-Width Unicode
  237. CyberPress - Cybersecurity News — Warlock Attackers Abuse Vulnerable Driver to Disable Security Tools Before Ransomware Deployment
  238. CyberPress - Cybersecurity News — TerminalFix Campaign Uses PowerShell and DLL Sideloading to Establish Covert C2 Tunnels
  239. Cryptika — Critical Fortinet FortiMail 0-Day Vulnerability Actively Exploited in Attacks
  240. Cryptika — Treasury Sanctions Tren de Aragua ATM Jackpotting Network Linked to $40.7 Million in Losses
  241. CyberPress - Cybersecurity News — MSSQL Post-Exploitation Toolkit Could Enable Credential Theft and Lateral Movement Attacks
  242. Cryptika — Exposed WordPress Backups Became a Gold Mine of AWS and Email Credentials
  243. Rapid7 — SMTP is the key: BPFDoor and AVERAT hitting the network edge
  244. MalwareBytes — Convincing Free Mobile phishing emails appear after data breach
  245. Cryptika — Hackers Turned a Microsoft SQL Server Into a Command and Data Exfiltration Channel
  246. Cryptika — Hackers Poison Trusted Software Updates to Steal Developer and Cloud Credentials
  247. MalwareBytes — Convincing Free Mobile phishing emails appear after data breach
  248. Polyswarm — Lunex Uses BYOVD to Disable Security Monitoring and Deploy Persistent Stealer
  249. microsoft.com — Star Blizzard RedFlick Phishing Campaign
  250. CyberPress - Cybersecurity News — Safari History Tags Expose Browsing Themes During macOS Forensic Investigations
  251. CyberPress - Cybersecurity News — Microsoft Warns of ClickFix Attacks Using Browser Cache to Hide Malicious Payloads
  252. CyberPress - Cybersecurity News — Cling IoT Malware Masquerades as Google STUN Traffic to Hide C2 Communications
  253. SANS ISC — TTY Logs and the Data it Captures, (Sun, Oct 4th)
  254. CyberPress - Cyber-Attack — Hackers Abuse Trusted RMM Software to Bypass Suspicion and Gain Remote Access
  255. Cryptika — Cling Malware Masquerades as Google STUN Traffic to Control Compromised IoT Devices
  256. Cryptika — Google’s AI Hacker Finds 500+ XSS Flaws and Builds Working Exploit Chains
  257. Cryptika — Hackers Abuse Legitimate ScreenConnect Tool to Gain Remote Access Through Phishing
  258. Cryptika — ClickFix Fake CAPTCHA Attack Executes Malware Hidden Inside Browser Cache
  259. Huntress — How Huntress Detects and Responds to a ClickFix Attack
  260. Cryptika — Malicious HEIC Images Can Trigger Remote Code Execution on WordPress Servers
  261. Polyswarm — Targeting the Systems Behind the Mission: OT Threats to US Critical Infrastructure and Military Operations
  262. SANS ISC — More RMM Tools In the Wild, (Tue, Oct 6th)
  263. CyberPress - Cybersecurity News — Hackers Target US Critical Infrastructure to Disrupt Military Operations Without Breaching Bases
  264. Cryptika — ClingSTUN Backdoor Exploits Multiple IoT Vulnerabilities to Gain Persistent Remote Access
  265. any.run — IronChain Ransomware Threatens Businesses with Permanent Data Loss and Costly Downtime
  266. Cryptika — Midnight Blizzard Abuses Hotel Wi-Fi Captive Portals to Deliver Malware and Steal Credentials
  267. Huntress — Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack
  268. Cryptika — Iranian Hackers Use Fake Dubai Airports Coding Test to Target Iraqi Critical Infrastructure
  269. Cryptika — Ransomware Hacker Uses AI Coding Assistant as Attack Channel Against Enterprise Networks
  270. Cryptika — Hackers Exploit Exposed Industrial Controllers to Disrupt US Water and Critical Infrastructure
  271. Cryptika — Hackers Hide Vasilek Backdoor Inside VMware Tools to Target Medical Organizations
  272. Cryptika — Hackers Use Fake ChatGPT, Claude and Gemini Ads to Steal Passwords and MFA Codes
  273. CyberPress - Cyber-Attack — Cyberattack on South Korean Churches Exposes Data of More Than 1 Million Congregants
  274. CyberPress - Cybersecurity News — CyberXero Uses 51 AI Agents to Target Ukrainian Critical Infrastructure and Mass-Exploit WordPress
  275. Cryptika — Earth Sirrush Uses PNG Steganography and Malicious Notepad++ Plugins to Deploy Espionage Malware
  276. Huntress — Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs
  277. Cryptika — Hackers Breach Two Major South Korean Churches, Exposing Data of Over 1 Million People
  278. Cryptika — Hackers Compromise 100+ Websites With Fake Cloudflare Checks to Spread LUNEXSTEALER
  279. Cryptika — FortiBleed Attack Campaign Exploiting Fortinet Firewalls and VPNs – FBI Warns
  280. Cryptika — CyberXero Combines Claude Code, PentAGI and Cobalt Strike in AI-Augmented Cyberattacks
  281. SANS ISC — Scans for Atlassian vulnerablity (CVE-2026-21589), (Wed, Oct 7th)
  282. Censys — Blog October 7, 2026 DarkSword/Coruna Open Directory Finding Report
  283. Cryptika — Alert Overload, Tool Sprawl and Evasive Phishing: The 5 Bottlenecks Slowing Down US SOCs
  284. CyberPress - Cybersecurity News — FortiBleed Campaign Exploits Fortinet Firewalls and VPNs, FBI Warns
  285. CyberPress - Cyber-Attack — Attackers Exploit Citrix NetScaler RCE Flaw to Create Superuser Accounts and Web Shells
  286. CyberPress - Cyber-Attack — GhostAction Supply Chain Attack Hits 772 GitHub Repositories to Steal CI/CD Secrets
  287. Cryptika — Hackers Registered New Domain with Exact Microsoft Teams Interface to Steal Logins
  288. Cryptika — MALFEX npm Malware Hides Executables in PNG Files to Infect Windows Developers
  289. Cryptika — Hackers Use GitHub-Hosted Poem to Control PoeLLM Malware Targeting AI Infrastructure
  290. Talos — UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing
  291. Talos — Ignore all instructions and read this blog: The state of AI-analysis evasion in malware
  292. Cryptika — Solo Hacker Used AI Tools to Breach South Korean Financial Organizations and Steal Data
  293. BitDefender Blog — The phone was compromised before the user turned it on: the rise of Midnight Mimosa
  294. Cryptika — Hackers Exploit Critical Citrix NetScaler Flaw to Deploy Web Shells and Steal Configuration Data
  295. Cryptika — GhostAction Supply Chain Campaign Uses Malicious GitHub Actions to Steal CI/CD Credentials
  296. Cryptika — DarkSword iOS Exploit Platform Uses Coruna Malware to Steal Crypto Wallet Recovery Phrases
  297. Cryptika — Hackers Use Negative Hotel Reviews to Spread Malware That Hides C2 on Blockchain
  298. Cryptika — Hackers Use Web3 and Blockchain C2 to Hide Supply Chain Attacks Targeting Cloud Credentials
  299. Censys — Blog October 8, 2026 New on the Map — September 2026: 22 Protocol and Endpoint Scanners
  300. Cryptika — Tensorlake npm Package Compromised to Spread Shai-Hulud Worm and Steal Developer Secrets
  301. Cryptika — Hikvision Camera Vulnerability Targeted in Remote Code Execution Exploitation Attempts
  302. Cryptika — Hackers Use Fake Firefox Wallet Extensions to Steal Crypto Recovery Phrases
  303. Talos — Making sure the checks get printed
  304. Zscaler — Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware
  305. Huntress — Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer
  306. Cryptika — FBI Seized Vulnerability Scanning and Spear Phishing Tools Used by China-Linked Hackers
  307. CyberPress - Cybersecurity News — Malicious Tensorlake npm Package Steals AWS Keys, SSH Credentials and Crypto Wallet Data
  308. CyberPress - Cybersecurity News — 16 Firefox Extensions Caught Stealing Crypto Wallet Recovery Phrases and Private Keys
  309. Cryptika — Malicious PDF Reader With 10,000+ Installs on Google Play Delivers Anatsa Banking Trojan
  310. Cryptika — VirusTotal Adds Scanning for Public IPv4 Space to Expose C2 Servers and Malware Infrastructure
  311. Cryptika — MATCHBOIL Malware Uses Cloudflare-Hidden C2 Servers to Deliver Backdoor Payloads
  312. Rapid7 — Metasploit Wrap Up: A Collection of What Can Only Be Called Eclectic Modules
  313. Cryptika — Warden Stealer Spreads Through ClickFix, Malvertising, Cracked Software and Game Cheats
  314. Cryptika — Hackers Abuse Trusted Terraform Workflows to Infect Developer Systems With Cross-Platform Malware
  315. Cryptika — CastleStealer Malware Uses Browser Protection Bypass and Remote Shell to Expand Attacker Access
  316. Polyswarm — China Linked Warlock Ransomware Campaign Targets Critical Infrastructure
  317. Cryptika — New GhostAction Attack Compromises Hundreds of GitHub Repos to Steal Secrets
  318. Censys — Blog October 9, 2026 The Ultimate Guide to Brand Protection with Censys

This digest was generated with Claude by Anthropic, based on source reporting from the publications listed above and analysis of 318 IOC submissions to iocget.com between August 29, 2026 and October 9, 2026.

The Indicator — iocget.com · Reports spanning August 29–October 9, 2026 · All IOCs TLP:CLEAR