ThreatRoundup

Hunt Leads

Detection-ready hunt leads for blue teams, threat hunters and reverse engineers, mapped to MITRE ATT&CK.

CriticalCVE-2026-102764 8 Hunt Leads

China-Linked Spies Turned BeyondTrust Help Desks Into Skeleton Keys

Google and Mandiant say suspected Chinese espionage group ARMORY CASTLE has exploited a BeyondTrust Remote Support zero-day since late August. Once inside, it took root, dumped stored credentials and used the support tool to reach internal machines.

· via Google Threat Intelligence Group / Mandiant

HighCVE-2021-4034CVE-2025-55182 12 Hunt Leads

AI-Written Malware Spent Six Months Inside Government Linux Servers

Unit 42 says a cluster it calls CL-UNK-1211 spent six months in government Linux servers using AI-generated scripts, a new Go RAT and fake red-team markers, going after databases, mailboxes and linked social media accounts.

· via Palo Alto Networks Unit 42