Stories with indicators of compromise: attacker IPs, domains, URLs and file hashes to hunt for and block.
3 stories match your filters.
Volexity caught UTA0576 chaining three Ivanti Connect Secure zero-days into unauthenticated root on a fully patched VPN, then pulling LAPS passwords and BitLocker keys. Ivanti's Oct. 29 update closes the last bug.
Kaspersky found BlackX, a UEFI bootkit used against Central Asian diplomats that bypasses Secure Boot via Baton Drop because Microsoft's revocation step was never applied. Medium-confidence link to APT41.
Unit 42 says a cluster it calls CL-UNK-1211 spent six months in government Linux servers using AI-generated scripts, a new Go RAT and fake red-team markers, going after databases, mailboxes and linked social media accounts.