The Indicator — Threat Intelligence Digest

Weekly Threat Intel
October 9–16, 2026

Published October 16, 2026 | Based on 80 IOC reports | TLP: CLEAR
80 Reports analyzed
2,255 IOCs extracted
5 Exploited edge-device zero-days in this period’s reports
440 PaperCut servers reportedly breached by AI agents
2 Infostealers now targeting AI-assistant data
Key Takeaways for Security Professionals
  • Patch BeyondTrust Remote Support to BT26-05 and hunt for SAWFLY and BARECLAW.

    Google reports exploitation since late August 2026 on versions up to 26.2.3. Patching does not remove prior compromise: check for mangoapi.php, a SUID /usr/bin/dbus-authd, and role changes, then rotate vault and admin credentials after the patch.

  • Restrict PAN-OS, FortiMail and NetScaler management and SAML surfaces to trusted networks.

    CVE-2026-0322 has no complete workaround beyond limiting management access. FortiMail fixes lagged its exploited CVE-2026-104286. NetScaler CVE-2026-88779 only affects SAML-configured appliances, so inventory those configurations first.

  • Patch Ivanti Connect Secure, then plan Active Directory credential rotation.

    Attackers who reached root ran LDAP, Kerberos and password-spray tooling from the appliance. Review appliance tmp paths for ml.py, mk.py and sp_out.txt, and treat directory credentials reachable from it as exposed.

  • Alert on AI-agent workbench traffic and LLM API calls from servers.

    Two reports describe attackers running AI agents against Tomcat, PaperCut and Korean financial targets. Unexpected outbound calls to LLM APIs, Chisel tunnels or unfamiliar listeners on exposed servers are worth a triage ticket.

  • Treat AI-assistant config and session files as secrets to protect and rotate.

    Aoki targets .claude.json, config.toml and .env, and Warden Stealer goes after AI agent data. Keep API keys out of plain-text files, scope tokens narrowly, and rotate them after any endpoint infection.

  • Audit repositories for injected workflows and verify npm and Terraform provider sources.

    GhostAction injects security-audit.yml workflows, Apex Accelerator ships malicious npm packages, and a trojanized Terraform provider reached developers. Review .github/workflows changes and pin packages and providers to verified publishers.

  • Alert on ScreenConnect installs outside your approved deployment.

    A Power BI phishing lure delivers rogue ScreenConnect clients for persistent access, and ClickFix chains stage Python tunnels ahead of ransomware. Allow-list remote-management tools and flag new tunnelers on user endpoints.

Contents
  1. Edge-Device Zero-Days: BeyondTrust, NetScaler, FortiMail, PAN-OS and Ivanti
  2. AI Agents Run Intrusions While Stealers Hunt AI Credentials
  3. Developer Machines and CI Pipelines Stay Under Attack
  4. Kimsuky, Iran-Nexus Actors and a Busy State-Linked Field
  5. Exploited Servers and Ransomware Precursors
  6. Phishing at Scale: PhaaS, Fake VPNs and Fake Careers
  7. Also Worth Tracking: Botnets, Mobile, Stealers and Research Notes
Five edge-device zero-days — BeyondTrust Remote Support, NetScaler, FortiMail, PAN-OS and Ivanti Connect Secure — dominate this period’s reporting, and the BeyondTrust case comes with a full attacker playbook. Alongside it, AI is now in the intrusion loop on both sides: agent frameworks drove breaches of PaperCut servers and South Korean financial firms, while infostealers began harvesting AI-assistant credentials. Developer tooling, Kimsuky and Iran-nexus espionage, and large phishing-as-a-service operations fill out the week.
01 — TOP STORY

Edge-Device Zero-Days: BeyondTrust, NetScaler, FortiMail, PAN-OS and Ivanti

Five exploited flaws in remote-support, ADC, mail, firewall and VPN appliances reached the iocget queue this period. The BeyondTrust case is the best documented, because Google’s write-up covers the attacker’s tooling, persistence and anti-forensics. Fortinet, Palo Alto and Citrix each have separate advisories.

ARMORY CASTLE — BeyondTrust Remote Support — 22 IOCs

BeyondTrust zero-day gives a suspected PRC-nexus actor root and the credential vault

Google Threat Intelligence attributes zero-day exploitation of CVE-2026-102764, an unauthenticated file-operation flaw in Remote Support appliances up to 26.2.3, to ARMORY CASTLE (formerly UNC5221), a suspected PRC-nexus espionage actor. Mandiant found it in late August 2026 during incident response. The actor dropped the SAWFLY web shell (mangoapi.php), created a SUID copy of /bin/sh at /usr/bin/dbus-authd, dumped the vault with bt-secrets, and exposed the BARECLAW tunneler (ingredi_ws) through HAProxy. BeyondTrust shipped patch BT26-05 and patched SaaS tenants on October 9. The Cryptika and CyberPress reports restate the Google write-up, so this is one primary source.

22 IOCs · CVE-2026-102764 · SAWFLY web shell + BARECLAW tunneler · Patch BT26-05
Unattributed — NetScaler SAML — 27 IOCs

Another NetScaler zero-day, this time limited to SAML configurations

CVE-2026-88779 is a memory overflow (CVSS 8.7) in NetScaler ADC and Gateway that only affects appliances set up as a SAML service provider or identity provider, meaning an authentication samlAction or samlIdPProfile entry. Citrix reports targeted attacks against unmitigated deployments, and fixed builds include 14.1-73.41 and 13.1-64.28. CISA’s KEV deadline was October 7. It follows CVE-2026-88771 and CVE-2026-88772, tracked in the previous digest; Cryptika’s report this week says those two delivered a modified Platypus remote access tool, with payloads such as .ns_09343.pl under /var/tmp/.

27 IOCs across two reports · CVE-2026-88779 · SAML-only exposure · Platypus RAT on the earlier pair
Unattributed — FortiMail — 31 IOCs

FortiMail path traversal is exploited to write files before fixes ship

Fortinet’s advisory for CVE-2026-104286 (CVSS 9.8) describes a path traversal that lets an unauthenticated attacker write arbitrary files through crafted HTTP or HTTPS requests. Affected releases are 7.2.0–7.2.9, 7.4.0–7.4.8, 7.6.0–7.6.6 and 8.0.0–8.0.1. Help Net Security noted on October 2 that fixes in 7.4.9, 7.6.7 and 8.0.2 were still pending, with an interim mitigation of disabling IBE and restricting management access, so confirm current builds with Fortinet. Hive Pro’s indicators include /data/lib/liblog.so, /data/etc/ld.so.preload and /bin/smit.

31 IOCs · CVE-2026-104286 · Arbitrary file write · CISA KEV deadline October 4
Unattributed — PAN-OS and GlobalProtect — 19 IOCs

PAN-OS management flaw is exploited as ransomware crews abuse GlobalProtect

CVE-2026-0322 is an authenticated code-injection flaw in the PAN-OS management interface that yields root (CVSS 4.0 8.6). Palo Alto reports very limited exploitation, CISA added it to KEV on October 14 with an October 17 deadline, and there is no complete workaround beyond restricting management access to trusted internal addresses. Two reports share three exploit-attempt source IPs. Separately, CyberPress reports that ransomware operators including Qilin and Settra are exploiting CVE-2026-0257 in GlobalProtect to obtain VPN access.

19 IOCs across three reports · CVE-2026-0322 · CVE-2026-0257 · Qilin and Settra named
Unattributed — Ivanti Connect Secure — 25 IOCs

Ivanti Connect Secure zero-days lead to Active Directory credential theft

Cryptika reports that attackers exploited Ivanti Connect Secure zero-days, including CVE-2026-104935 (authentication bypass and file write), to gain root and steal Active Directory credentials. The listed tooling includes a packet-capture binary renamed dsstatmond, custom LDAP scripts (ml.py, rq5.py), Kerberos testing scripts (mk.py, rr.py), and password-spray output in /tmp/sp_out.txt. This is a single report, so confirm patch status and exposure with Ivanti’s advisory.

25 IOCs · CVE-2026-104935 · LDAP and Kerberos tooling · Single-source report
Unattributed — Fortinet and Atlassian — 45 IOCs

FortiGate implant, FortiClient EMS exploit code and an Atlassian file-read flaw

Cryptika reports the PEERSTITCH implant on FortiGate firewalls, delivered through Fortinet flaws including CVE-2024-47575 and CVE-2025-61624, and staged from two hosts over HTTP. A public proof-of-concept now exists for CVE-2026-35616, a FortiClient EMS authentication bypass. Hive Pro covers CVE-2026-21589, a critical unauthenticated file-read in eight self-hosted Atlassian products, with attacker IPs and targeted files such as crowd.properties.

45 IOCs across three reports · PEERSTITCH · FortiClient EMS PoC · Atlassian CVE-2026-21589

Inventory first. Each of these flaws sits on a management or authentication surface. Knowing which appliances expose it, and whether logs are forwarded off-box, decides how fast you can answer the BeyondTrust-style question: were we exploited before the patch?

02 — AI

AI Agents Run Intrusions While Stealers Hunt AI Credentials

Last digest tracked AI in command-and-control loops. This period adds agent frameworks driving real intrusions and stealers that treat AI-assistant files as high-value loot.

Unattributed — ARTEX agentic pentest framework — 6 IOCs

Agentic pentesting framework used against South Korean financial institutions

Zscaler reports an actor abused the ARTEX agentic AI pentesting framework against South Korean financial institutions, exfiltrating personal data on roughly 67,000 people. The indicators are the LLM APIs the framework called (Anthropic, DeepSeek, Zhipu and xAI endpoints) and *.aspx and *.jsp web shells. The Hacker News, citing CrowdStrike, reports the same campaign and that the developer closed the project’s source on October 8.

6 IOCs · LLM API calls as indicators · Web shells · PII of about 67,000 people
Unattributed — PaperCut and Tomcat agents — 33 IOCs

AI agents breach PaperCut servers and a Tomcat endpoint

Cryptika reports attackers used Codex and DeepSeek agents to exploit CVE-2026-81578 and CVE-2026-82078 in PaperCut NG/MF, compromising at least 440 servers, with an agent workbench and Chisel staging on the primary host. CyberPress separately describes AI agents compromising an exposed Apache Tomcat endpoint and escalating to SYSTEM with PrintSpoofer and GodPotato. Treat the 440 figure as the reporter’s claim.

33 IOCs across two reports · PaperCut CVE-2026-81578 · GodPotato and PrintSpoofer · Chisel tunnels
Midnight Blizzard-linked — Claude-rebuilt malware — 59 IOCs

Midnight Blizzard-linked actors reportedly used Claude to rebuild ChocoShell and CornFlake

Cryptika reports actors linked to Midnight Blizzard used Claude to rebuild the ChocoShell and CornFlake malware to evade detection. The report’s hashes overlap with iocget reports from August and early October on CaptiveCrunch, so it extends a campaign tracked in earlier digests. This is a single report.

59 IOCs · ChocoShell + CornFlake · Overlaps earlier CaptiveCrunch reports
Aoki, Warden Stealer — AI-credential theft — 316 IOCs

Aoki and Warden Stealer collect AI-assistant credentials and agent data

Security.com and Cryptika describe the updated Aoki infostealer targeting .claude.json, Codex config.toml and .env files; the two reports share 23 hashes and domains. Gen Digital’s analysis of the Rust-based Warden Stealer adds AI agent data, a crypto clipper and an Application-Bound Encryption bypass, and overlaps heavily with an earlier iocget Warden report from October 9. Any developer endpoint with AI tooling is now a credential store.

316 IOCs across three reports · Aoki C2 on three domains · Warden Stealer C2 on hundreds of domains
Unattributed — Fake AI tools and Linux sudo hijack — 97 IOCs

Counterfeit AI installers and AI-assisted sudo hijacking

Any.run documents fake Claude, ChatGPT, Copilot and Gemini download pages, ClickFix-style InstallFix lures, and trojanized installers that deliver stealers and Quasar RAT. Cryptika adds AI-generated scripts used to hijack Linux sudo and steal passwords, alongside custom SysGoRAT backdoors against government organizations.

97 IOCs across two reports · InstallFix lures · Trojanized AI installers · SysGoRAT

Source caveat. The ARTEX reporting differs by outlet on the number of victims, and several AI-assisted claims come from a single vendor, so scope these as reported rather than confirmed.

03 — SUPPLY CHAIN

Developer Machines and CI Pipelines Stay Under Attack

The previous digest tracked Shai-Hulud, GhostAction and a trojanized Terraform provider. All three return, with new lures aimed at crypto founders and IT administrators.

Apex Accelerator — Malicious npm packages — 103 IOCs

Fake Web3 accelerator delivers macOS and Windows stealers through npm

Elastic Security Labs and Cryptika describe a fake accelerator, Apex, that distributed @apexacc/cli and @apexacc/audit, delivering CloudSyncD on macOS and a custom infostealer on Windows. Elastic’s report and Cryptika’s share 21 indicators, including verify.apexfdn[.]xyz; Cryptika appears to rely on the Elastic research. The packages also touch MCP configuration at ~/.apex/agent/mcp.json.

103 IOCs across two reports · CloudSyncD · MCP config targeted · 21 shared indicators
TraderTraitor-linked — Terraform provider — 31 IOCs

Trojanized Terraform provider delivers FLATROOF and ROOFDECK

Cryptika reports Terraform provider workflows were abused to infect developer systems with the FLATROOF and ROOFDECK backdoors across Windows, macOS and Linux, including a trojanized terraform-provider-awsbeta_v1.0.0. Seven indicators overlap an earlier iocget report on a TraderTraitor trojanized provider, so this appears to continue that activity.

31 IOCs · FLATROOF + ROOFDECK · Pastebin dead-drop · Overlaps the earlier TraderTraitor report
Shai-Hulud and GhostAction — CI and registry compromise — 24 IOCs

Shai-Hulud hits Tensorlake’s npm SDK; GhostAction injects workflows

Hive Pro reports a Shai-Hulud variant in the tensorlake npm SDK that steals secrets and includes a dead-man’s switch wiping the home directory; three of its indicators match an October 8 report. Cryptika and CyberPress report GhostAction injecting security-audit.yml workflows to steal CI secrets, with CyberPress putting the number of compromised GitHub accounts above 500. The two GhostAction reports share a C2 address.

24 IOCs across three reports · Dead-man’s switch · Malicious workflow files · Shared C2
Unattributed — PuTTY EtherHiding — 22 IOCs

Poisoned search results deliver a trojanized PuTTY installer that hides C2 on Ethereum

Cryptika reports poisoned Google results for PuTTY lead IT administrators to puty[.]ink, where an MSI drops a Node.js loader. The loader resolves its C2 through public Ethereum RPC endpoints (EtherHiding), with a fallback domain. Blocking public blockchain RPC endpoints from servers and admin workstations is a cheap control.

22 IOCs · EtherHiding · Node.js loader · Public Ethereum RPC endpoints
04 — ESPIONAGE

Kimsuky, Iran-Nexus Actors and a Busy State-Linked Field

Korean-peninsula, Iranian and Chinese activity all appear, several with overlaps to earlier reports.

Kimsuky — Operation GitPower — 230 IOCs

Kimsuky abuses GitHub and GitLab against Ukrainian security experts

Cryptika and CyberPress report Kimsuky phishing Ukrainian experts with scripts hosted on GitHub and GitLab, with dozens of free-hosting domains in the indicator set. Both reports share three indicators, including 111.92.246[.]145. Cryptika separately reports Kimsuky delivering Funhouse ransomware through malicious .hwp résumés, with Quasar RAT in the chain.

230 IOCs across three reports · GitHub and GitLab hosting · Funhouse ransomware
CL-STA-1178 — Blinder Tunnel and DarkBlinders — 47 IOCs

Iran-nexus fake coding tests and a fake meeting app share loader artifacts

Hive Pro and CyberPress describe Blinder Tunnel, where a fake Dubai Airports coding test delivers ShelbyLoader through AppDomainManager hijacking and DLL sideloading. A separate CyberPress report on DarkBlinders (StarkMeet, targeting Israel and the Kurdistan Region of Iraq) lists the same file names, including RuntimeBrokerApi.dll and PsProxy.dll, which suggests related tooling, though the reports do not state a link. Hive Pro’s indicators overlap an earlier report on Iranian targeting of Iraqi infrastructure.

47 IOCs across three reports · AppDomainManager hijacking · Shared RuntimeBroker artifacts
UAT-6275 — WinRAR exploitation — 31 IOCs

UAT-6275 exploits WinRAR against CIS government organizations

Cryptika reports UAT-6275 exploiting the WinRAR path traversal CVE-2025-8088 to deploy custom reverse shells including PickleShell, Laplas and Chvost. Talos’s Q3 vulnerability review discusses the same activity alongside patch-gap data. The two reports come from different vendors, so this activity has two independent descriptions.

31 IOCs · CVE-2025-8088 · PickleShell, Laplas, Chvost · Two sources
Various — State-linked roundup — 40 IOCs

FBI, Iranian DNS tunneling, laptop farms and spyware lures

CyberPress carries an FBI warning that Chinese state-linked operators use automated tools and botnets, and Cryptika reports the FBI disrupting North Korean FAMOUS CHOLLIMA laptop farms. CyberPress also reports Iran-linked DNS tunneling producing 40 billion passive DNS records. Gen Digital details a Sogou Input Method one-click flaw, CVE-2026-51990, used to deploy the GRAYRABBIT backdoor, and Cryptika covers iOS exploit kits and the AdFection ad-based spyware campaign.

40 IOCs across six reports · FAMOUS CHOLLIMA · GRAYRABBIT · DNS tunneling
Unattributed — Third-party gateway breach — 4 IOCs

European bank breached through a third-party gateway

Cryptika reports attackers breached a European bank through a poorly secured third-party gateway and tried to exploit the WSUS flaw CVE-2025-59287 before being contained. The lesson is about vendor-connected paths into core networks.

4 IOCs · CVE-2025-59287 · Third-party gateway
05 — RANSOMWARE

Exploited Servers and Ransomware Precursors

Mail, backup and collaboration servers draw web shells and miners, while ClickFix and rogue remote tools prepare the ground for ransomware.

Longlegs — Warlock ransomware — 38 IOCs

Warlock operators combine SharePoint exploitation, BYOVD and VS Code tunnels

Polyswarm reports China-nexus actor Longlegs exploiting SharePoint flaws (CVE-2025-53770 among them) to deploy Warlock ransomware, using web shells, DLL sideloading, a vulnerable driver and VS Code tunneling, then distributing the payload via SYSVOL replication. Two hashes match earlier iocget Warlock reports from October 1, so this extends campaign tracking.

38 IOCs · SharePoint exploitation · SYSVOL distribution · Two hashes seen on October 1
Unattributed — ClickFix and ScreenConnect — 132 IOCs

ClickFix, Python tunnels and rogue ScreenConnect precede ransomware

Cryptika reports ClickFix chains installing Lorem Ipsum and AxolotlLoader and Python tunnels on Windows hosts to prepare ransomware; three of its domains match a May 2026 report. A separate Cryptika report says a Power BI phishing page delivers rogue ScreenConnect installers, with indicators that overlap an October 7 report. Both are one-vendor reports.

132 IOCs across two reports · Lorem Ipsum + AxolotlLoader · Rogue ScreenConnect
Unattributed — Zimbra — 83 IOCs

Zimbra SNMP flaw and four more Zimbra bugs

Hive Pro reports CVE-2026-73570, a command injection exploited to install web shells, miners and backdoors, with nine indicators shared with an October 1 report. Rapid7’s Part 1 describes five further Zimbra flaws, including CVE-2026-10631 (EWS cross-user mailbox access) and CVE-2026-73571 (email impersonation), with proof-of-concept scripts.

83 IOCs across two reports · CVE-2026-73570 · Rapid7 PoCs · Web shells and miners
Unattributed — AhsayCBS and Nextcloud — 25 IOCs

AhsayCBS and Nextcloud Collabora flaws are exploited for miners and web shells

Cryptika reports CVE-2026-105133 and CVE-2026-105134 in AhsayCBS used to deploy web shells and an XMRig miner disguised as Edge; Huntress’s newsletter also lists both. CyberPress reports CVE-2026-110447 in Nextcloud’s Collabora CODE server app exploited for remote commands and web shells. Huntress also notes older flaws in MOVEit, Exchange and ScreenConnect.

25 IOCs across three reports · XMRig · Web shell shxa35d0.php · Backup and collaboration servers
06 — PHISHING

Phishing at Scale: PhaaS, Fake VPNs and Fake Careers

Several reports describe large infrastructure and kits rather than single lures.

Iron Man System — PhaaS — 26 IOCs

Iron Man phishing platform is reported at 2,360 pages and 130 countries

CyberPress and Cryptika describe the Iron Man System, a commercial phishing-as-a-service operation with thousands of page templates; Cryptika cites a billion messages to 75,000 organizations. Both reports share four infrastructure domains, including api2[.]peaceman[.]cc. A separate Cryptika report describes a Chinese-language operation using about 17,000 domains and the CoGUI, CoAceV and CoFish_Ws kits against Japanese banks.

26 IOCs across two reports · Shared licensing backend · 17,000-domain Japanese bank operation
Unattributed — Fake WatchGuard VPN site — 26 IOCs

Fake WatchGuard VPN site steals credentials, then serves the genuine installer

Huntress and Cryptika both report watchguard-vpn[.]net capturing credentials with popup.js before serving the legitimate signed installer, so victims see a working install. Seven indicators are shared, and both name watchguard-ssl[.]online as the collector.

26 IOCs across two reports · Seven shared indicators · Signed installer after capture
Various — AitM, career and tech-support lures — 74 IOCs

AitM Google kit, fake Meta careers pages and Help TDS

Cryptika reports a Google AitM kit using WebSockets to relay MFA in real time against Taiwanese research organizations, overlapping an October 8 report. Malwarebytes documents fake Calendly pages for Meta job interviews that steal Facebook and Google logins and 2FA codes. Cryptika also reports over 20,000 Cloudflare Pages domains driving fake Microsoft alerts to scam call centers, and Censys uses lookalike-domain examples including UNC1151 indicators.

74 IOCs across four reports · WebSocket MFA relay · Calendly lures · Cloudflare Pages abuse
Casbaneiro — Banking trojan — 62 IOCs

Casbaneiro hides C2 until victims visit banking sites

Cryptika reports Casbaneiro using phishing PDFs, HTA files and AutoIt scripts, injecting into RegSvcs.exe, and staying quiet until a targeted banking site is visited.

62 IOCs · Banking-site triggered C2 · RegSvcs.exe injection
07 — ALSO TRACKING

Also Worth Tracking: Botnets, Mobile, Stealers and Research Notes

Shorter items grouped by theme.

ClingSTUN and proxyjacking — IoT and edge botnets — 108 IOCs

ClingSTUN proxy backdoor and a D-Link, Ubiquiti and SAP proxyjacking crew

Hive Pro and Polyswarm both report ClingSTUN, a Linux back-connect proxy backdoor that exploits dozens of IoT vulnerabilities and uses public STUN servers; 19 indicators are shared and 24 overlap an October 6 report. Cryptika reports actor skynox7 exploiting D-Link, Ubiquiti and SAP flaws to install Pawns.app proxy software.

108 IOCs across three reports · 19 shared hashes · .cling persistence
Android and mobile — Firmware malware and banking apps — 171 IOCs

Midnight Mimosa firmware malware, GhostBat and a fake Chrome app

Cryptika and CyberPress report Midnight Mimosa, firmware-level Android malware on low-cost MediaTek phones for ad fraud and proxying; Cryptika’s hashes overlap an October 8 report. Cryptika also reports GhostBat targeting about 60 Indian banking apps and a fake Chrome app on Google Play with over 100,000 downloads.

171 IOCs across four reports · Preinstalled malware · Accessibility abuse
Various — Windows and macOS malware — 172 IOCs

RATs, loaders and macOS stealers

Cryptika and others cover KGB RAT (Group-IB and Cryptika share 19 indicators), XWorm’s microphone and browser-session hijacking, VulcanRAT207.A spread through WhatsApp lures, CastleStealer’s Steam-file targeting, AvisLoader’s Tox-based C2, GhostProfile’s hidden browser profiles on macOS, and the ICMacOS remote access trojan.

172 IOCs across eight reports · KGB RAT overlap · Tox C2 · macOS profile cloning
Various — Research and incident notes — 12 IOCs

Ghostscript, orphaned DWG macros and the BAE Systems incident

Cryptika reports CVE-2026-39919, a critical Ghostscript heap overflow reachable through JPEG 2000 content in PDFs. SANS ISC analyses orphaned VBA projects inside AutoCAD DWG files. CyberPress reports a cyberattack on BAE Systems that disrupted the federal Bankruptcy Noticing Center.

12 IOCs across three reports · Ghostscript RCE · DWG VBA · BAE Systems outage

Analyst Assessment: October 9–16, 2026 in Context

Edge devices remain the entry point. The BeyondTrust, Citrix, Fortinet, Palo Alto and Ivanti reports share a pattern: unauthenticated or lightly authenticated access to a management or authentication surface, then credential theft and persistence on an appliance that rarely has endpoint telemetry. Google’s BeyondTrust write-up is the most complete, with the actor wiping logs and elevating roles in the product itself.

AI shows up on both sides of the intrusion. Agent frameworks and commercial models are lowering the effort of exploitation and post-exploitation, and stealers have started collecting the credentials those tools hold. The reports do not show AI producing novel techniques; they show familiar techniques run faster and at a wider scale.

Corroboration is thinner than the volume suggests. Several clusters here are one primary write-up reproduced by Cryptika or CyberPress, including BeyondTrust, Aoki and the KGB RAT. Independent confirmation exists for ClingSTUN (Hive Pro and Polyswarm), the fake WatchGuard site (Huntress and a second outlet) and the PAN-OS flaw.

What to do now: (1) Patch BeyondTrust to BT26-05 and Ivanti Connect Secure, and review both appliances for the files and accounts named above. (2) Confirm PAN-OS, FortiMail and NetScaler management interfaces are not internet-reachable and that fixed FortiMail builds are installed. (3) Rotate credentials stored on or reachable from any exposed appliance. (4) Add detections for unapproved ScreenConnect installs and unexpected LLM API traffic. (5) Review GitHub workflow and package-source changes from the last two weeks.

Sources

  1. Cryptika — Hackers Abuse Trusted Terraform Workflows to Infect Developer Systems With Cross-Platform Malware
  2. Cryptika — CastleStealer Malware Uses Browser Protection Bypass and Remote Shell to Expand Attacker Access
  3. Polyswarm — China Linked Warlock Ransomware Campaign Targets Critical Infrastructure
  4. Cryptika — New GhostAction Attack Compromises Hundreds of GitHub Repos to Steal Secrets
  5. Censys — Blog October 9, 2026 The Ultimate Guide to Brand Protection with Censys
  6. CyberPress - Cybersecurity News — FBI Warns Chinese State-Linked Hackers Use Automated Tools to Steal Sensitive Data
  7. CyberPress - Cybersecurity News — Hackers Deploy AI Agents to Automate Server Compromise and Privilege Escalation
  8. CyberPress - Cybersecurity News — DarkBlinders Hackers Use Fake Meeting App and GitHub Backdoor to Spy on Government Targets
  9. CyberPress - Cybersecurity News — Iran-Linked DNS Tunneling Activity Generates 40 Billion Records During 2026 Conflict
  10. CyberPress - Cybersecurity News — GhostAction Attack Compromises 500+ GitHub Accounts to Steal Cloud and AI Credentials
  11. Hive Pro — ClingSTUN Backdoor Turns Exposed IoT Devices into Stealthy Proxy Nodes
  12. Hive Pro — Hostage Token: Shai-Hulud Hijacks Tensorlake's npm SDK
  13. Hive Pro — Blinder Tunnel: Iran-Nexus Actor Hides Backdoor in Fake Coding Test
  14. Hive Pro — One Flaw, Eight Products: Atlassian's Critical Pre-Auth File Read (CVE-2026-21589)
  15. Hive Pro — Fortinet FortiMail Zero-Day Exploited to Write Arbitrary Files
  16. Hive Pro — Citrix NetScaler SAML Zero-Day CVE-2026-88779 Under Active Exploitation
  17. Hive Pro — 274 Mail Servers Down as CVE-2026-73570 Fuels Zimbra SNMP Exploitation Wave
  18. CyberPress - Cybersecurity News — Hackers Exploit Palo Alto GlobalProtect Flaw to Gain VPN Access and Deploy Ransomware
  19. Cryptika — Midnight Mimosa Infects Android Phones Before Users Even Turn Them On
  20. Cryptika — Microsoft Power BI Phishing Campaign Deploys Rogue ScreenConnect RMMs for Persistent Access
  21. Cryptika — Casbaneiro Malware Hides C2 Activity Until Victims Visit Banking Websites
  22. Cryptika — Hackers Exploit Critical AhsayCBS Flaws to Deploy Webshells and XMRig Miners
  23. Cryptika — Google AitM Phishing Kit Uses WebSockets to Bypass MFA in Real Time
  24. Elastic Security Lab — Auditing the auditor: Unmasking Apex Accelerator
  25. CyberPress - Cybersecurity News — Kimsuky Hackers Abuse GitHub and GitLab to Target Ukrainian Security Experts
  26. CyberPress - Cybersecurity News — VulcanRAT207.A Malware Spreads via WhatsApp to Gain SYSTEM-Level Access
  27. CyberPress - Cybersecurity News — Low-Cost Android Phones Ship With System-Level Malware That Cannot Be Uninstalled
  28. CyberPress - Cybersecurity News — Blinder Tunnel Uses AppDomainManager Hijacking and DLL Sideloading to Evade Security
  29. Cryptika — Kimsuky Operation GitPower Uses GitHub to Deliver Malware and Steal Data
  30. Cryptika — GhostProfile macOS Malware Clones Browser Profiles to Hijack Live Sessions
  31. Cryptika — Hackers Exploit Citrix NetScaler 0-Days to Deploy Platypus Remote Access Tool
  32. Cryptika — Fake Web3 Accelerator Uses Malicious npm Packages to Target Crypto Founders
  33. Cryptika — Critical Ghostscript Flaw Lets Attackers Use Malicious PDFs to Execute Code
  34. Cryptika — Kimsuky Hackers Use Malicious Resume Documents to Deploy Funhouse Ransomware
  35. Cryptika — XWorm Malware Can Spy Through Your Microphone and Hijack Logged-In Browser Sessions
  36. Cryptika — ICMacOS Malware Evolves to Steal Credentials and Provide Persistent Remote Mac Access
  37. varonis.com — AvisLoader Windows Malware
  38. Polyswarm — ClingSTUN Turns Vulnerable Edge Devices Into Attacker Infrastructure
  39. Huntress — Fake WatchGuard VPN Site Steals Credentials
  40. SANS ISC — Orphaned VBA Projects Inside DWG Files, (Wed, Oct 14th)
  41. Cryptika — Hackers Abuse Google Search to Attacks ITadmins with Weaponized PuTTY Installer
  42. Cryptika — Attackers Breach European Bank Through Third-Party Gateway and Target WSUS Server
  43. Cryptika — Ivanti Connect Secure 0-Days Exploited to Steal Active Directory Credentials
  44. any.run — Fake AI Tools Put US Companies at Risk: Inside the Counterfeit Claude, ChatGPT, and Copilot Campaigns
  45. Group IB Blog — KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize
  46. Cryptika — Coruna and DarkSword Exploit Kits Can Fully Compromise iPhones From a Single Web Visit
  47. MalwareBytes — Fake Calendly “Meta Careers” pages steal Facebook and Google logins
  48. Cryptika — FBI Disrupts North Korean Famous Chollima Laptop Farms Used to Infiltrate U.S. Companies
  49. Cryptika — Hackers Use Fake WatchGuard VPN Download Site to Steal Login Credentials
  50. Rapid7 — From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1)
  51. Zscaler — Threat Actor Abuses Agentic AI Pentesting Framework to Target South Korean Financial Institutions
  52. Cryptika — Hackers Exploit Palo Alto PAN-OS 0-day Flaw to Gain Root Code Execution on Firewalls
  53. Cryptika — Fake Chrome App on Google Play Evades Detection and Reaches 100,000+ Downloads
  54. CyberPress - Cybersecurity News — Iron Man Phishing Kit Uses 2,360 Fake Pages to Target Victims Across 130 Countries
  55. CyberPress - Cybersecurity News — PoC Exploit Released for Critical Fortinet FortiClient EMS Authentication Bypass Vulnerability
  56. Cryptika — UAT-6275 Hackers Exploit WinRAR Flaw to Target CIS Government Organizations
  57. Security.com Threat Intel — Aoki: Infostealer Targets AI Coding Assistant Credentials
  58. Cryptika — Hackers Exploit Fortinet Vulnerabilities to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
  59. Huntress — Huntress + AlgaPSA Integration: Built in Days by Nine Minds
  60. Cryptika — KGB RAT Malware Bypasses Windows Defender to Steal Credentials and Control PCs
  61. Cryptika — Hackers Use ClickFix and Python Tunnels to Prepare Systems for Ransomware Attacks
  62. Cryptika — Chinese Phishing Network Linked to 1 Billion Messages Targeting 75,000 Organizations
  63. Cryptika — Just Viewing an Online Ad Can Infect Your Device With Spyware, Researchers Reveal
  64. Gen Blog — Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent Data
  65. Talos — The Q3 Vulnerability Pulse: Discovery ≠ Exploitation
  66. Gen Blog — Gray Rabbits and the Tale of a One-Click Backdoor
  67. Google Threat Intelligence — ARMORY CASTLE Exploits BeyondTrust
  68. Cryptika — Hackers Target 60 Indian Banking and UPI Apps With New GhostBat Android Malware
  69. Cryptika — Chinese Hackers Exploit BeyondTrust Zero-Day to Gain Root Access and Deploy Backdoors
  70. Cryptika — CISA Warns of Palo Alto Networks PAN-OS Code Injection Vulnerability Exploited in Attacks
  71. Cryptika — Midnight Blizzard-Linked Hackers Use Claude AI to Rebuild Malware and Evade Detection
  72. Cryptika — Hackers Exploit D-Link, Ubiquiti and SAP Flaws to Hijack Devices for Proxy Networks
  73. Cryptika — New Aoki Malware Targets ChatGPT, Claude, Codex and Gemini to Steal Credentials
  74. CyberPress - Cybersecurity News — Cyberattack on BAE Systems Disrupts Bankruptcy Court Operations Across the US
  75. CyberPress - Cybersecurity News — China-Linked Hackers Exploit Critical BeyondTrust Zero-Day to Steal Credentials
  76. CyberPress - Cybersecurity News — Hackers Exploit Critical Nextcloud Collabora Flaw to Execute Remote Commands
  77. Cryptika — Chinese Phishing Network Uses 17,000 Domains to Target Japanese Banks and Steal Credentials
  78. Cryptika — Hackers Use Codex and DeepSeek AI Agents to Breach 440 PaperCut Servers Worldwide
  79. Cryptika — Hackers Use AI-Generated Scripts to Hijack Linux Sudo Commands and Steal Passwords
  80. Cryptika — Hackers Abuse 20,000 Cloudflare Pages Domains to Push Fake Microsoft Security Alerts
  81. The Hacker News — New NetScaler zero-day exploited in attacks
  82. Help Net Security — Critical FortiMail zero-day exploited in the wild (CVE-2026-104286)
  83. The Hacker News — ARTEX AI pentesting tool used in data theft

This digest was generated with Claude by Anthropic, based on source reporting from the publications listed above and analysis of 80 IOC submissions to iocget.com between October 9, 2026 and October 16, 2026.

The Indicator — iocget.com · Reports spanning October 9–16, 2026 · All IOCs TLP:CLEAR