#HuntLeads
LightNews LightNews
threatroundup.bsky.social
PHP2Shell plus a Linux kernel bug rooted 24 exposed Palo Alto firewalls and opened a tunnel into a U.S. government-linked network, Hunt.io and Dream Research say.
🎯 5 Hunt Leads inside, Junior to Elite #HuntLeads

threatroundup.com/news/php2she...
October 31, 2026 at 4:21 PM
threatroundup.bsky.social
Dating and AI-companion lures push iPhones into Safari, where hidden pages load the leaked Coruna toolkit or a DarkSword chain, Zimperium says. Updated iPhones are safe.
🎯 4 Hunt Leads inside, Junior to Elite #HuntLeads

threatroundup.com/news/coruna-...
October 31, 2026 at 5:51 PM
threatroundup.bsky.social
BITTER's new PapRAT arrives via diplomatic-invite lures that lean on Windows' ftp.exe and fake Microsoft installers, Fortinet says.
🎯 4 Hunt Leads inside, Junior to Elite #HuntLeads

threatroundup.com/news/bitter-...
November 3, 2026 at 9:15 PM
threatroundup.bsky.social
ExaTrack: APT28's PixyNetLoader has hidden implants inside PNG images since 2024, with about 23 versions so far. YARA rules and host indicators are out.
🎯 4 Hunt Leads inside, Junior to Elite #HuntLeads

threatroundup.com/news/apt28-p...
November 3, 2026 at 4:02 PM
threatroundup.bsky.social
CERT-UA: days after Microsoft disclosed CVE-2026-21509, APT28 sent Office exploit documents to Ukrainian government bodies and EU groups, planting a Covenant implant.
🎯 4 Hunt Leads inside, Junior to Elite #HuntLeads

threatroundup.com/news/apt28-c...
November 3, 2026 at 3:15 PM
threatroundup.bsky.social
Kaspersky says attackers let the open-source CyberStrikeAI framework drive real break-ins at schools, from a SQL Server foothold to domain admin in days.
🎯 4 Hunt Leads inside, Junior to Elite #HuntLeads

threatroundup.com/news/cyberst...
November 3, 2026 at 7:00 PM
threatroundup.bsky.social
Talos found NIK C2, a Windows RAT that steals passwords and wallets, fakes a ransom lock screen, and runs AI prompts on the victim's own OpenAI key.
🎯 6 Hunt Leads inside, Junior to Elite #HuntLeads

threatroundup.com/news/nik-c2-...
November 1, 2026 at 5:05 PM
threatroundup.bsky.social
Talos: the VOLTA infostealer has an AI model rank each victim's value, then digs through their Gmail and DoorDash orders to confirm a home address.
🎯 4 Hunt Leads inside, Junior to Elite #HuntLeads

threatroundup.com/news/volta-i...
November 3, 2026 at 2:45 AM
threatroundup.bsky.social
A fake DocuSign installer or Teams invite enrolls your PC in the attacker's device-management account, Huntress says. Then they install remote control.
🎯 4 Hunt Leads inside, Junior to Elite #HuntLeads

threatroundup.com/news/mdm-hex...
October 31, 2026 at 12:45 PM
threatroundup.bsky.social
NCSC says APT28 changed DNS settings on hacked home and office routers so Outlook logins went through attacker servers. Check your router's DNS and replace unsupported models.
🎯 4 Hunt Leads inside, Junior to Elite #HuntLeads

threatroundup.com/news/apt28-t...
November 3, 2026 at 4:45 PM
threatroundup.bsky.social
CrowdStrike says China-nexus VAPOR PANDA aimed ARTEX AI agents at 200+ organizations in 11 days, getting in mostly through old keys and unsigned SAML.
🎯 5 Hunt Leads inside, Junior to Elite #HuntLeads

threatroundup.com/news/vapor-p...
October 31, 2026 at 7:21 PM
threatroundup.bsky.social
MadApe phishing never asks for a password: it hands you a code to paste into Microsoft's real sign-in page, and the attacker gets your tokens. Group-IB found 155 domains.
🎯 4 Hunt Leads inside, Junior to Elite #HuntLeads

threatroundup.com/news/madape-...
October 31, 2026 at 6:36 PM
threatroundup.bsky.social
Amatera, likely the rebranded ACR Stealer, topped ESET's Latin America infostealer charts in H1 2026. Its main trick: getting you to paste a 'fix' command yourself.
🎯 5 Hunt Leads inside, Junior to Elite #HuntLeads

threatroundup.com/news/amatera...
November 1, 2026 at 12:45 PM
threatroundup.bsky.social
The Doorway botnet took over 11,363 routers, cameras and servers in a month, CloudSEK says, mostly by logging in to MikroTik routers with blank passwords. Set one.
🎯 6 Hunt Leads inside, Junior to Elite #HuntLeads

threatroundup.com/news/doorway...
October 31, 2026 at 12:01 PM
threatroundup.bsky.social
Cursor's marketplace served a fake Claude Code update that planted an SSH backdoor on up to 5,000 dev machines. Check authorized_keys for 'svc-telemetry'.
🎯 5 Hunt Leads inside, Junior to Elite #HuntLeads

threatroundup.com/news/claude-...
October 30, 2026 at 7:36 PM
threatroundup.bsky.social
Google and Mandiant: China-nexus ARMORY CASTLE has exploited BeyondTrust zero-day CVE-2026-102764 since August: webshell, root, vault dump, tunnel. Patching won't evict them.
🎯 8 Hunt Leads inside, Junior to Elite #HuntLeads

threatroundup.com/news/armory-...
October 22, 2026 at 3:08 PM
threatroundup.bsky.social
Amazon's honeypots caught a PHP2Shell exploit attempt Oct. 17, four days before disclosure. Exploitation is now broad, per Amazon.
🎯 7 Hunt Leads inside, Junior to Elite #HuntLeads

threatroundup.com/news/php2she...
October 22, 2026 at 5:57 PM
threatroundup.bsky.social
Stormshield's Slaiclind analysis: hacked sites pull C2 addresses from a Polygon smart contract, then a fake Cloudflare check talks Windows users into running a stealer.
🎯 7 Hunt Leads inside, Junior to Elite #HuntLeads

threatroundup.com/news/slaicli...
October 22, 2026 at 5:58 PM
threatroundup.bsky.social
Microsoft ties the ConnectWise Cloud Backup breach to China-linked Storm-0940, which used ARTEX AI agents that sometimes reached privileged access in under 3 hours.
🎯 7 Hunt Leads inside, Junior to Elite #HuntLeads

threatroundup.com/news/storm-0...
October 22, 2026 at 5:57 PM
threatroundup.bsky.social
ESET: a Russia-aligned group broke into a Ukrainian grain firm, then passed the keys to Sandworm, which wiped its data. The backdoor hid in the Yggdrasil mesh network.
🎯 6 Hunt Leads inside, Junior to Elite #HuntLeads

threatroundup.com/news/russian...
October 22, 2026 at 5:58 PM
threatroundup.bsky.social
Kaspersky says Lazarus abused South Korea's mandatory CrossWeb EX security plug-in to spy on at least three firms, hiding C2 in GitHub issues and using post-quantum ML-KEM keys.
🎯 9 Hunt Leads inside, Junior to Elite #HuntLeads

threatroundup.com/news/lazarus...
October 22, 2026 at 5:58 PM
threatroundup.bsky.social
SafePay ransomware has hit 600+ victims since 2024, per a new FBI/CISA advisory. Way in: stolen or guessed VPN logins and old Cisco ASA, SonicWall and Veeam bugs.
🎯 9 Hunt Leads inside, Junior to Elite #HuntLeads

threatroundup.com/news/cisa-sa...
October 22, 2026 at 5:58 PM
threatroundup.bsky.social
Unit 42: CL-UNK-1211 spent six months inside government Linux servers with AI-written scripts, a PHP backdoor, a sudo password trap and a new Go RAT. This week's free report.
🎯 12 Hunt Leads inside, Junior to Elite #HuntLeads

threatroundup.com/news/unit42-...
October 22, 2026 at 3:08 PM