Threat Hunters Journal for the week ending 2026-10-03.

Original analysis, Hunt Notes, and the week in review. Each item links to the page on the site.

Week in review

What the 2026 Microsoft Digital Defense Report Changes in a Hunt

Microsoft's 2026 Digital Defense Report says follow-on credential theft shows up in over half of intrusions, and that edge devices are part of the same path. The hunts those two findings imply.

Original analysis

Hunting Citrix NetScaler CVE-2026-88771 and CVE-2026-88772

Citrix's September 27, 2026 bulletin says CVE-2026-88771 and CVE-2026-88772 were exploited. The first affects a default NetScaler. Patching does not clear a box that was already compromised.

Hunting UAT-11985: Real-Time Google Session Theft Behind Event Invites

Talos's October 8, 2026 UAT-11985 report describes a real-time Google phishing relay hidden in event invites. How to hunt the mail, the proxy, and the stolen session.

Hunt Notes

What the BPFDoor backdoor tells us about attacks on the network edge (Help Net Security)

T1205 Traffic Signaling, T1571 Non-Standard Port, T1554 Compromise Host Software Binary

Search network traffic on mail gateways and edge devices for anomalous packet patterns that might represent BPFDoor magic packets triggering command execution.

Scans for Atlassian vulnerablity (CVE-2026-21589), (Wed, Oct 7th) (SANS Internet Storm Center)

T1005 Data from Local System, T1526 Cloud Service Discovery

Search web application access logs for requests to Atlassian products that attempt to read files outside the intended application directory or target configuration file paths.

Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details (The Hacker News)

T1083 File and Directory Discovery

Search Atlassian Data Center product logs for HTTP requests to CVE-2026-21589 exploit paths attempting to read sensitive files.

Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589) (Help Net Security)

T1190 Exploit Public-Facing Application

Check web server logs for CVE-2026-21589 exploitation attempts against Atlassian Data Center products, looking for suspicious file access requests or path traversal patterns.

Satel Netco Design (CISA Advisories)

T1059.007 JavaScript, T1190 Exploit Public-Facing Application

Search web application logs for Satel Netco Design for POST requests from Network Operator accounts to endpoints that store user content such as configuration or message fields.

Red Lion Controls N-Tron 700 Series (CISA Advisories)

T1078.001 Default Accounts, T1556 Modify Authentication Process, T1499.004 Application or System Exploitation

Check authentication logs from Red Lion Controls N-Tron 700 Series switches for successful logins using default factory credentials or administrative accounts without corresponding legitimate administrative activity.

International coalition seizes tools used by cyber firm behind Flax Typhoon (The Record)

T1595.002 Vulnerability Scanning, T1190 Exploit Public-Facing Application, T1583.006 Web Services

Search network logs for connections to Integrity Tech infrastructure used for vulnerability scanning associated with Flax Typhoon campaigns.

SonicWall fixes pre-auth SSRF flaw in SMA 1000 appliances (CVE-2026-102255) (Help Net Security)

T1090.001 Internal Proxy

Check SonicWall SMA 1000 appliance logs for HTTP requests to unexpected internal IP ranges or localhost addresses originating from unauthenticated sessions.

Read more at https://threathuntersjournal.com. Blog: https://blog.threathuntersjournal.com. Archive: https://buttondown.com/robbrydon.