https://threatroundup.com/desk/hunt-leads/ Stories with detection-ready Hunt Lead reports for blue teams and threat hunters. en-us © 2026 ThreatRoundup.com ThreatRoundup.com Thu, 29 Oct 2026 20:13:09 +0000 30 https://threatroundup.com/wp-content/themes/tr/assets/icons/feed-logo.pnghttps://threatroundup.com/desk/hunt-leads/ https://threatroundup.com/news/aokigahara-infostealer-ai-coding-tools/ https://threatroundup.com/news/aokigahara-infostealer-ai-coding-tools/ Thu, 29 Oct 2026 12:45:00 +0000 Check Point says the new Aokigahara infostealer has a dedicated module for AI assistant and coding-tool sessions, plus cloud configs, SSH keys, browsers and crypto wallets. ThreatRoundup.com Check Point Research Threat Level: Medium Hunt Leads: 6 CVEs: 0 ThreatRoundup.com Check Point Research Medium 6 0 https://threatroundup.com/news/volt-typhoon-silent-train-zero-days-lumen/ https://threatroundup.com/news/volt-typhoon-silent-train-zero-days-lumen/ Thu, 29 Oct 2026 12:45:00 +0000 Lumen ties Volt Typhoon's Silent Train covert network to zero-days in N-able, Cisco SD-WAN, VeloCloud and likely Quest KACE, while Cisco Talos details KeyDrift malware stealing SD-WAN keys. ThreatRoundup.com Lumen Black Lotus Labs Threat Level: Critical Hunt Leads: 6 CVEs: 1 ThreatRoundup.com Lumen Black Lotus Labs Critical 6 1 https://threatroundup.com/news/yoba-fake-chatgpt-claude-installers-sideloading/ https://threatroundup.com/news/yoba-fake-chatgpt-claude-installers-sideloading/ Thu, 29 Oct 2026 12:45:00 +0000 Check Point's Yoba campaign pairs genuine signed OpenAI and Anthropic installers with a sideloaded DLL on fake GitHub AI-app pages, installing a hidden XMRig miner via a Telegram-seeded DGA. ThreatRoundup.com Check Point Research Threat Level: High Hunt Leads: 6 CVEs: 0 ThreatRoundup.com Check Point Research High 6 0 https://threatroundup.com/news/qilin-ransomware-acronis-esxi-deep-dive/ https://threatroundup.com/news/qilin-ransomware-acronis-esxi-deep-dive/ Thu, 29 Oct 2026 12:45:00 +0000 Acronis TRU dissects Qilin's Rust encryptor, its password gate and the PowerShell routine that resets ESXi root passwords and encrypts every host, as the gang passes 900 claimed victims in 2026. ThreatRoundup.com Acronis TRU Threat Level: High Hunt Leads: 6 CVEs: 0 ThreatRoundup.com Acronis TRU High 6 0 https://threatroundup.com/news/skyw4lker-device-code-phishing-m365/ https://threatroundup.com/news/skyw4lker-device-code-phishing-m365/ Thu, 29 Oct 2026 12:45:00 +0000 ANY.RUN tracked the SkyW4lker kit across 173 domains: password-protected lures send Microsoft 365 users to the real device login page, where one typed code hands the attacker a token. ThreatRoundup.com ANY.RUN Threat Level: High Hunt Leads: 5 CVEs: 0 ThreatRoundup.com ANY.RUN High 5 0 https://threatroundup.com/news/cyberdakait-android-banking-trojans-india/ https://threatroundup.com/news/cyberdakait-android-banking-trojans-india/ Thu, 29 Oct 2026 12:45:00 +0000 Group-IB tracked seven Android trojan families behind fake bank 'protection plan' calls in India: nearly 18,000 phones infected and 7.6 million texts, including OTPs, intercepted. ThreatRoundup.com Group-IB Threat Level: High Hunt Leads: 5 CVEs: 0 ThreatRoundup.com Group-IB High 5 0 https://threatroundup.com/news/m365-revoke-sessions-graph-ews-90-minutes/ https://threatroundup.com/news/m365-revoke-sessions-graph-ews-90-minutes/ Thu, 29 Oct 2026 12:45:00 +0000 Eye Security found that revoking sessions or resetting a password leaves Graph, EWS and ActiveSync mail access open for up to 90 minutes; only disabling the account cuts it off immediately. ThreatRoundup.com Eye Security Threat Level: Medium Hunt Leads: 4 CVEs: 0 ThreatRoundup.com Eye Security Medium 4 0 https://threatroundup.com/news/m365-token-replay-97-accounts-huntress/ https://threatroundup.com/news/m365-token-replay-97-accounts-huntress/ Thu, 29 Oct 2026 12:45:00 +0000 Huntress tracked a campaign that replayed stolen Microsoft 365 sign-in tokens to take over 97 accounts at 79 organizations, then planted rogue Entra devices, swapped MFA methods and hid payroll mail. ThreatRoundup.com Huntress Threat Level: High Hunt Leads: 6 CVEs: 0 ThreatRoundup.com Huntress High 6 0 https://threatroundup.com/news/convertr-plausible-magecart-checkout-skimmer/ https://threatroundup.com/news/convertr-plausible-magecart-checkout-skimmer/ Wed, 28 Oct 2026 22:28:00 +0000 Sansec says a Brazilian Magecart group planted a card skimmer in the Plausible analytics script every Convertr store loads, exposing checkouts at dozens of fashion brands Oct. 24 to 27. ThreatRoundup.com Sansec Threat Level: High Hunt Leads: 4 CVEs: 1 ThreatRoundup.com Sansec High 4 1 https://threatroundup.com/news/silent-ransom-group-leak-law-firms/ https://threatroundup.com/news/silent-ransom-group-leak-law-firms/ Wed, 28 Oct 2026 22:28:00 +0000 Ransom-ISAC's analysis of leaked Silent Ransom Group files shows callback-phishing extortion of mostly US law firms via AnyDesk, with at least $43.95 million confirmed received. ThreatRoundup.com Ransom-ISAC Threat Level: High Hunt Leads: 4 CVEs: 0 ThreatRoundup.com Ransom-ISAC High 4 0 https://threatroundup.com/news/trust-graft-wordpress-admin-plugin-backdoor/ https://threatroundup.com/news/trust-graft-wordpress-admin-plugin-backdoor/ Wed, 28 Oct 2026 22:28:00 +0000 Securonix found JavaScript on hijacked sites that uses a logged-in WordPress admin's session to install a backdoored plugin that persists in mu-plugins and hides from the plugin list. ThreatRoundup.com Securonix Threat Level: Medium Hunt Leads: 5 CVEs: 0 ThreatRoundup.com Securonix Medium 5 0 https://threatroundup.com/news/php2shell-exploited-before-disclosure-madpot/ https://threatroundup.com/news/php2shell-exploited-before-disclosure-madpot/ Thu, 22 Oct 2026 11:31:00 +0000 Amazon says a PHP2Shell exploit hit its MadPot honeypots on Oct. 17, four days before PHP disclosed CVE-2026-109618 and CVE-2026-109619. It now calls exploitation broad. ThreatRoundup.com Amazon Threat Intelligence (AWS Security Blog) Threat Level: Critical Hunt Leads: 7 CVEs: 2 ThreatRoundup.com Amazon Threat Intelligence (AWS Security Blog) Critical 7 2 https://threatroundup.com/news/storm-0940-artex-connectwise-supply-chain/ https://threatroundup.com/news/storm-0940-artex-connectwise-supply-chain/ Thu, 22 Oct 2026 11:30:00 +0000 Microsoft ties the ConnectWise Cloud Backup supply-chain attack to China-aligned Storm-0940, which used ARTEX AI agents to try sign-ins to more than 2,250 Microsoft 365 tenants at up to 2,900 a minute. ThreatRoundup.com Microsoft Threat Intelligence Threat Level: Critical Hunt Leads: 7 CVEs: 0 ThreatRoundup.com Microsoft Threat Intelligence Critical 7 0 https://threatroundup.com/news/cisa-safepay-ransomware-advisory-aa26-293a/ https://threatroundup.com/news/cisa-safepay-ransomware-advisory-aa26-293a/ Thu, 22 Oct 2026 11:28:00 +0000 A joint FBI, CISA and USSS advisory says SafePay ransomware has hit at least 600 victims since August 2024, getting in through stolen or guessed VPN logins and old Cisco ASA, SonicWall and Veeam flaws, then wiping backups before it encrypts. ThreatRoundup.com CISA Threat Level: High Hunt Leads: 9 CVEs: 5 ThreatRoundup.com CISA High 9 5 https://threatroundup.com/news/lazarus-operation-flashhole/ https://threatroundup.com/news/lazarus-operation-flashhole/ Thu, 22 Oct 2026 11:26:00 +0000 Kaspersky says Lazarus abused South Korea's mandatory INISAFE CrossWeb EX security plug-in to break into at least three firms, using fake résumé sites, GitHub-based C2 and a post-quantum key exchange. ThreatRoundup.com Kaspersky Securelist Threat Level: High Hunt Leads: 9 CVEs: 0 ThreatRoundup.com Kaspersky Securelist High 9 0 https://threatroundup.com/news/slaiclind-clickfix-etherhiding/ https://threatroundup.com/news/slaiclind-clickfix-etherhiding/ Thu, 22 Oct 2026 11:24:00 +0000 Stormshield says hacked WordPress sites read C2 addresses from a Polygon smart contract, then show Windows visitors a fake Cloudflare check that leads to a stealer loaded through the Deno runtime. ThreatRoundup.com Stormshield Threat Level: Medium Hunt Leads: 7 CVEs: 0 ThreatRoundup.com Stormshield Medium 7 0 https://threatroundup.com/news/russian-hackers-wipe-ukrainian-grain-firm/ https://threatroundup.com/news/russian-hackers-wipe-ukrainian-grain-firm/ Thu, 22 Oct 2026 11:22:00 +0000 ESET says UAC-0099 phished into a Ukrainian grain logistics company and handed access to Sandworm, which wiped data, while a new Go backdoor hid its C&C inside the Yggdrasil mesh network. ThreatRoundup.com The Record Threat Level: Medium Hunt Leads: 6 CVEs: 0 ThreatRoundup.com The Record Medium 6 0 https://threatroundup.com/news/armory-castle-beyondtrust-exploitation/ https://threatroundup.com/news/armory-castle-beyondtrust-exploitation/ Wed, 21 Oct 2026 12:39:44 +0000 Google and Mandiant say suspected Chinese espionage group ARMORY CASTLE has exploited a BeyondTrust Remote Support zero-day since late August. Once inside, it took root, dumped stored credentials and used the support tool to reach internal machines. ThreatRoundup.com Google Threat Intelligence Group / Mandiant Threat Level: Critical Hunt Leads: 8 CVEs: 1 ThreatRoundup.com Google Threat Intelligence Group / Mandiant Critical 8 1 https://threatroundup.com/news/unit42-ai-espionage-government-linux/ https://threatroundup.com/news/unit42-ai-espionage-government-linux/ Wed, 21 Oct 2026 12:37:44 +0000 Unit 42 says a cluster it calls CL-UNK-1211 spent six months in government Linux servers using AI-generated scripts, a new Go RAT and fake red-team markers, going after databases, mailboxes and linked social media accounts. ThreatRoundup.com Palo Alto Networks Unit 42 Threat Level: High Hunt Leads: 12 CVEs: 2 ThreatRoundup.com Palo Alto Networks Unit 42 High 12 2