Stories with detection-ready Hunt Lead reports for blue teams and threat hunters. https://threatroundup.com/desk/hunt-leads/ https://threatroundup.com/news/aokigahara-infostealer-ai-coding-tools/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com Check Point Research Medium 6 0

Check Point says the new Aokigahara infostealer has a dedicated module for AI assistant and coding-tool sessions, plus cloud configs, SSH keys, browsers and crypto wallets.

https://threatroundup.com/news/volt-typhoon-silent-train-zero-days-lumen/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com Lumen Black Lotus Labs Critical 6 1

Lumen ties Volt Typhoon's Silent Train covert network to zero-days in N-able, Cisco SD-WAN, VeloCloud and likely Quest KACE, while Cisco Talos details KeyDrift malware stealing SD-WAN keys.

https://threatroundup.com/news/yoba-fake-chatgpt-claude-installers-sideloading/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com Check Point Research High 6 0

Check Point's Yoba campaign pairs genuine signed OpenAI and Anthropic installers with a sideloaded DLL on fake GitHub AI-app pages, installing a hidden XMRig miner via a Telegram-seeded DGA.

https://threatroundup.com/news/qilin-ransomware-acronis-esxi-deep-dive/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com Acronis TRU High 6 0

Acronis TRU dissects Qilin's Rust encryptor, its password gate and the PowerShell routine that resets ESXi root passwords and encrypts every host, as the gang passes 900 claimed victims in 2026.

https://threatroundup.com/news/skyw4lker-device-code-phishing-m365/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com ANY.RUN High 5 0

ANY.RUN tracked the SkyW4lker kit across 173 domains: password-protected lures send Microsoft 365 users to the real device login page, where one typed code hands the attacker a token.

https://threatroundup.com/news/cyberdakait-android-banking-trojans-india/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com Group-IB High 5 0

Group-IB tracked seven Android trojan families behind fake bank 'protection plan' calls in India: nearly 18,000 phones infected and 7.6 million texts, including OTPs, intercepted.

https://threatroundup.com/news/m365-revoke-sessions-graph-ews-90-minutes/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com Eye Security Medium 4 0

Eye Security found that revoking sessions or resetting a password leaves Graph, EWS and ActiveSync mail access open for up to 90 minutes; only disabling the account cuts it off immediately.

https://threatroundup.com/news/m365-token-replay-97-accounts-huntress/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com Huntress High 6 0

Huntress tracked a campaign that replayed stolen Microsoft 365 sign-in tokens to take over 97 accounts at 79 organizations, then planted rogue Entra devices, swapped MFA methods and hid payroll mail.

https://threatroundup.com/news/gheist-github-tokens-actions-logs-secrets/ 2026-10-29T12:45:00+00:00 ThreatRoundup.com Wiz High 6 0

Wiz says the Gheist campaign used stolen GitHub tokens to plant 13,500+ branches across 850+ accounts, each running a workflow that dumps repository secrets into Actions logs and deletes the run.

https://threatroundup.com/news/convertr-plausible-magecart-checkout-skimmer/ 2026-10-28T22:28:00+00:00 ThreatRoundup.com Sansec High 4 1

Sansec says a Brazilian Magecart group planted a card skimmer in the Plausible analytics script every Convertr store loads, exposing checkouts at dozens of fashion brands Oct. 24 to 27.

https://threatroundup.com/news/silent-ransom-group-leak-law-firms/ 2026-10-28T22:28:00+00:00 ThreatRoundup.com Ransom-ISAC High 4 0

Ransom-ISAC's analysis of leaked Silent Ransom Group files shows callback-phishing extortion of mostly US law firms via AnyDesk, with at least $43.95 million confirmed received.

https://threatroundup.com/news/trust-graft-wordpress-admin-plugin-backdoor/ 2026-10-28T22:28:00+00:00 ThreatRoundup.com Securonix Medium 5 0

Securonix found JavaScript on hijacked sites that uses a logged-in WordPress admin's session to install a backdoored plugin that persists in mu-plugins and hides from the plugin list.

https://threatroundup.com/news/wiz-artex-storm-0940-expands-targeting/ 2026-10-27T15:01:00+00:00 ThreatRoundup.com Wiz Research High 6 0

Wiz says ARTEX AI agents tied to Storm-0940 spent October probing IT and software vendors' Okta, Entra ID and Cognito sign-ins. Most attempts failed.

https://threatroundup.com/news/etherrat-teams-fake-it-support-ethereum-c2/ 2026-10-27T14:53:00+00:00 ThreatRoundup.com bluecyber.hashnode.dev Medium 6 0

A Teams caller posing as IT talks victims into installing remote-access tools, then drops EtherRAT, a Node.js backdoor that looks up its command server in an Ethereum smart contract.

https://threatroundup.com/news/vbscript-malware-brazil-portugal-trusted-tools/ 2026-10-27T14:52:00+00:00 ThreatRoundup.com WatchGuard Medium 5 0

WatchGuard details three Brazil-linked campaigns, Overlord RAT, Lampion and a newdev.dll RAT, that start with VBScript and lean on built-in Windows tools and signed programs to stay hidden.

https://threatroundup.com/news/php2shell-exploited-before-disclosure-madpot/ 2026-10-22T11:31:00+00:00 ThreatRoundup.com Amazon Threat Intelligence (AWS Security Blog) Critical 7 2

Amazon says a PHP2Shell exploit hit its MadPot honeypots on Oct. 17, four days before PHP disclosed CVE-2026-109618 and CVE-2026-109619. It now calls exploitation broad.

https://threatroundup.com/news/storm-0940-artex-connectwise-supply-chain/ 2026-10-22T11:30:00+00:00 ThreatRoundup.com Microsoft Threat Intelligence Critical 7 0

Microsoft ties the ConnectWise Cloud Backup supply-chain attack to China-aligned Storm-0940, which used ARTEX AI agents to try sign-ins to more than 2,250 Microsoft 365 tenants at up to 2,900 a minute.

https://threatroundup.com/news/cisa-safepay-ransomware-advisory-aa26-293a/ 2026-10-22T11:28:00+00:00 ThreatRoundup.com CISA High 9 5

A joint FBI, CISA and USSS advisory says SafePay ransomware has hit at least 600 victims since August 2024, getting in through stolen or guessed VPN logins and old Cisco ASA, SonicWall and Veeam flaws, then wiping backups before it encrypts.

https://threatroundup.com/news/lazarus-operation-flashhole/ 2026-10-22T11:26:00+00:00 ThreatRoundup.com Kaspersky Securelist High 9 0

Kaspersky says Lazarus abused South Korea's mandatory INISAFE CrossWeb EX security plug-in to break into at least three firms, using fake résumé sites, GitHub-based C2 and a post-quantum key exchange.

https://threatroundup.com/news/slaiclind-clickfix-etherhiding/ 2026-10-22T11:24:00+00:00 ThreatRoundup.com Stormshield Medium 7 0

Stormshield says hacked WordPress sites read C2 addresses from a Polygon smart contract, then show Windows visitors a fake Cloudflare check that leads to a stealer loaded through the Deno runtime.

https://threatroundup.com/news/russian-hackers-wipe-ukrainian-grain-firm/ 2026-10-22T11:22:00+00:00 ThreatRoundup.com The Record Medium 6 0

ESET says UAC-0099 phished into a Ukrainian grain logistics company and handed access to Sandworm, which wiped data, while a new Go backdoor hid its C&C inside the Yggdrasil mesh network.

https://threatroundup.com/news/armory-castle-beyondtrust-exploitation/ 2026-10-21T12:39:44+00:00 ThreatRoundup.com Google Threat Intelligence Group / Mandiant Critical 8 1

Google and Mandiant say suspected Chinese espionage group ARMORY CASTLE has exploited a BeyondTrust Remote Support zero-day since late August. Once inside, it took root, dumped stored credentials and used the support tool to reach internal machines.

https://threatroundup.com/news/unit42-ai-espionage-government-linux/ 2026-10-21T12:37:44+00:00 ThreatRoundup.com Palo Alto Networks Unit 42 High 12 2

Unit 42 says a cluster it calls CL-UNK-1211 spent six months in government Linux servers using AI-generated scripts, a new Go RAT and fake red-team markers, going after databases, mailboxes and linked social media accounts.