Stories with detection-ready Hunt Lead reports for blue teams and threat hunters. https://threatroundup.com/feeds/hunt-leads.atom 2026-10-29T20:13:09+00:00 ThreatRoundup.comhttps://threatroundup.com/ © 2026 ThreatRoundup.com https://threatroundup.com/wp-content/themes/tr/assets/icons/favicon.svg https://threatroundup.com/news/aokigahara-infostealer-ai-coding-tools/ 2026-10-29T12:45:00+00:00 2026-10-29T20:12:54+00:00 ThreatRoundup.com

Check Point says the new Aokigahara infostealer has a dedicated module for AI assistant and coding-tool sessions, plus cloud configs, SSH keys, browsers and crypto wallets.

ThreatRoundup.com Check Point Research Medium 6 0 https://threatroundup.com/news/volt-typhoon-silent-train-zero-days-lumen/ 2026-10-29T12:45:00+00:00 2026-10-29T20:12:49+00:00 ThreatRoundup.com

Lumen ties Volt Typhoon's Silent Train covert network to zero-days in N-able, Cisco SD-WAN, VeloCloud and likely Quest KACE, while Cisco Talos details KeyDrift malware stealing SD-WAN keys.

ThreatRoundup.com Lumen Black Lotus Labs Critical 6 1 https://threatroundup.com/news/yoba-fake-chatgpt-claude-installers-sideloading/ 2026-10-29T12:45:00+00:00 2026-10-29T20:12:50+00:00 ThreatRoundup.com

Check Point's Yoba campaign pairs genuine signed OpenAI and Anthropic installers with a sideloaded DLL on fake GitHub AI-app pages, installing a hidden XMRig miner via a Telegram-seeded DGA.

ThreatRoundup.com Check Point Research High 6 0 https://threatroundup.com/news/qilin-ransomware-acronis-esxi-deep-dive/ 2026-10-29T12:45:00+00:00 2026-10-29T20:12:50+00:00 ThreatRoundup.com

Acronis TRU dissects Qilin's Rust encryptor, its password gate and the PowerShell routine that resets ESXi root passwords and encrypts every host, as the gang passes 900 claimed victims in 2026.

ThreatRoundup.com Acronis TRU High 6 0 https://threatroundup.com/news/skyw4lker-device-code-phishing-m365/ 2026-10-29T12:45:00+00:00 2026-10-29T20:12:50+00:00 ThreatRoundup.com

ANY.RUN tracked the SkyW4lker kit across 173 domains: password-protected lures send Microsoft 365 users to the real device login page, where one typed code hands the attacker a token.

ThreatRoundup.com ANY.RUN High 5 0 https://threatroundup.com/news/cyberdakait-android-banking-trojans-india/ 2026-10-29T12:45:00+00:00 2026-10-29T20:12:47+00:00 ThreatRoundup.com

Group-IB tracked seven Android trojan families behind fake bank 'protection plan' calls in India: nearly 18,000 phones infected and 7.6 million texts, including OTPs, intercepted.

ThreatRoundup.com Group-IB High 5 0 https://threatroundup.com/news/m365-revoke-sessions-graph-ews-90-minutes/ 2026-10-29T12:45:00+00:00 2026-10-29T20:12:48+00:00 ThreatRoundup.com

Eye Security found that revoking sessions or resetting a password leaves Graph, EWS and ActiveSync mail access open for up to 90 minutes; only disabling the account cuts it off immediately.

ThreatRoundup.com Eye Security Medium 4 0 https://threatroundup.com/news/m365-token-replay-97-accounts-huntress/ 2026-10-29T12:45:00+00:00 2026-10-29T20:12:57+00:00 ThreatRoundup.com

Huntress tracked a campaign that replayed stolen Microsoft 365 sign-in tokens to take over 97 accounts at 79 organizations, then planted rogue Entra devices, swapped MFA methods and hid payroll mail.

ThreatRoundup.com Huntress High 6 0 https://threatroundup.com/news/convertr-plausible-magecart-checkout-skimmer/ 2026-10-28T22:28:00+00:00 2026-10-29T20:12:51+00:00 ThreatRoundup.com

Sansec says a Brazilian Magecart group planted a card skimmer in the Plausible analytics script every Convertr store loads, exposing checkouts at dozens of fashion brands Oct. 24 to 27.

ThreatRoundup.com Sansec High 4 1 https://threatroundup.com/news/silent-ransom-group-leak-law-firms/ 2026-10-28T22:28:00+00:00 2026-10-29T20:12:52+00:00 ThreatRoundup.com

Ransom-ISAC's analysis of leaked Silent Ransom Group files shows callback-phishing extortion of mostly US law firms via AnyDesk, with at least $43.95 million confirmed received.

ThreatRoundup.com Ransom-ISAC High 4 0 https://threatroundup.com/news/trust-graft-wordpress-admin-plugin-backdoor/ 2026-10-28T22:28:00+00:00 2026-10-29T20:12:52+00:00 ThreatRoundup.com

Securonix found JavaScript on hijacked sites that uses a logged-in WordPress admin's session to install a backdoored plugin that persists in mu-plugins and hides from the plugin list.

ThreatRoundup.com Securonix Medium 5 0 https://threatroundup.com/news/php2shell-exploited-before-disclosure-madpot/ 2026-10-22T11:31:00+00:00 2026-10-29T20:13:03+00:00 ThreatRoundup.com

Amazon says a PHP2Shell exploit hit its MadPot honeypots on Oct. 17, four days before PHP disclosed CVE-2026-109618 and CVE-2026-109619. It now calls exploitation broad.

ThreatRoundup.com Amazon Threat Intelligence (AWS Security Blog) Critical 7 2 https://threatroundup.com/news/storm-0940-artex-connectwise-supply-chain/ 2026-10-22T11:30:00+00:00 2026-10-29T20:13:03+00:00 ThreatRoundup.com

Microsoft ties the ConnectWise Cloud Backup supply-chain attack to China-aligned Storm-0940, which used ARTEX AI agents to try sign-ins to more than 2,250 Microsoft 365 tenants at up to 2,900 a minute.

ThreatRoundup.com Microsoft Threat Intelligence Critical 7 0 https://threatroundup.com/news/cisa-safepay-ransomware-advisory-aa26-293a/ 2026-10-22T11:28:00+00:00 2026-10-29T20:13:04+00:00 ThreatRoundup.com

A joint FBI, CISA and USSS advisory says SafePay ransomware has hit at least 600 victims since August 2024, getting in through stolen or guessed VPN logins and old Cisco ASA, SonicWall and Veeam flaws, then wiping backups before it encrypts.

ThreatRoundup.com CISA High 9 5 https://threatroundup.com/news/lazarus-operation-flashhole/ 2026-10-22T11:26:00+00:00 2026-10-29T20:13:04+00:00 ThreatRoundup.com

Kaspersky says Lazarus abused South Korea's mandatory INISAFE CrossWeb EX security plug-in to break into at least three firms, using fake résumé sites, GitHub-based C2 and a post-quantum key exchange.

ThreatRoundup.com Kaspersky Securelist High 9 0 https://threatroundup.com/news/slaiclind-clickfix-etherhiding/ 2026-10-22T11:24:00+00:00 2026-10-29T20:13:05+00:00 ThreatRoundup.com

Stormshield says hacked WordPress sites read C2 addresses from a Polygon smart contract, then show Windows visitors a fake Cloudflare check that leads to a stealer loaded through the Deno runtime.

ThreatRoundup.com Stormshield Medium 7 0 https://threatroundup.com/news/russian-hackers-wipe-ukrainian-grain-firm/ 2026-10-22T11:22:00+00:00 2026-10-29T20:13:05+00:00 ThreatRoundup.com

ESET says UAC-0099 phished into a Ukrainian grain logistics company and handed access to Sandworm, which wiped data, while a new Go backdoor hid its C&C inside the Yggdrasil mesh network.

ThreatRoundup.com The Record Medium 6 0 https://threatroundup.com/news/armory-castle-beyondtrust-exploitation/ 2026-10-21T12:39:44+00:00 2026-10-29T20:13:08+00:00 ThreatRoundup.com

Google and Mandiant say suspected Chinese espionage group ARMORY CASTLE has exploited a BeyondTrust Remote Support zero-day since late August. Once inside, it took root, dumped stored credentials and used the support tool to reach internal machines.

ThreatRoundup.com Google Threat Intelligence Group / Mandiant Critical 8 1 https://threatroundup.com/news/unit42-ai-espionage-government-linux/ 2026-10-21T12:37:44+00:00 2026-10-29T20:13:09+00:00 ThreatRoundup.com

Unit 42 says a cluster it calls CL-UNK-1211 spent six months in government Linux servers using AI-generated scripts, a new Go RAT and fake red-team markers, going after databases, mailboxes and linked social media accounts.

ThreatRoundup.com Palo Alto Networks Unit 42 High 12 2