Threat Hunters Journal - week of 2026-10-10
Threat Hunters Journal for the week ending 2026-10-10.
Original analysis, Hunt Notes, and the week in review. Each item links to the page on the site.
Original analysis
What the 2026 Microsoft Digital Defense Report Changes in a Hunt
Microsoft's 2026 Digital Defense Report says follow-on credential theft shows up in over half of intrusions, and that edge devices are part of the same path. The hunts those two findings imply.
Hunting UAT-11985: Real-Time Google Session Theft Behind Event Invites
Talos's October 8, 2026 UAT-11985 report describes a real-time Google phishing relay hidden in event invites. How to hunt the mail, the proxy, and the stolen session.
This week's biggest lessons aren't about new exploits — they're about attackers and insiders abusing the trust placed in recovery firms, vendor accounts, notification channels, and domain registries.
CISA added five vulnerabilities spanning 2015 to 2023 to its Known Exploited Vulnerabilities catalog, tied to a China-linked actor's scan-and-exploit campaign against Exchange servers and VPN infrastructure.
Inside CyberXero: 51 Claude Code Agents, a Leaky Server, and 628,000 Stolen Ukrainian Records
A misconfigured open directory exposed a Russian-speaking initial access broker's entire AI-orchestrated playbook, revealing how 51 Claude Code agents and a Cobalt Strike-linked pentesting AI were used to breach Ukrainian energy infrastructure and global WordPress sites alike.
CVE-2026-102255: A CVSS 10.0 Pre-Auth SSRF in SonicWall SMA 1000 Is Already Being Exploited
A no-login SSRF in SonicWall SMA 1000 appliances went from disclosure to live exploitation in under a week, with researchers already logging hundreds of probe attempts against internet-facing Work Place interfaces.
A threat actor chained an auth bypass, a race-condition RCE, and an unpatched privilege escalation bug to get root on a fully patched Ivanti Connect Secure appliance, then spent days harvesting LAPS passwords and BitLocker keys before anyone noticed.
Make-Me-Root, Round Two: Cisco's Second Exploited Secure Email Gateway Flaw in a Month
CVE-2026-76519 lets an unauthenticated attacker turn a single crafted email attachment into root on a Cisco Secure Email Gateway, and Cisco says it's already happening in the wild.
This week's throughline is trusted infrastructure turned against its owners: a FortiManager-based implant reached 500 firewalls, a CIS-focused actor rode WinRAR into government networks, and the FBI dismantled laptop farms that let North Korean operators pose as remote IT staff.
Hunt Notes
Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies (SecurityWeek)
T1598 Phishing for Information
Monitor Android device logs for installation or execution of Hirudo malware and check for unexpected modifications to banking application packages on affected devices.
CISA Malcolm (CISA Advisories)
T1556 Modify Authentication Process, T1190 Exploit Public-Facing Application, T1021 Remote Services
Search nginx reverse proxy logs for requests to /iddash2ark/ or similar path variants with non-lowercase characters targeting the Dashboards-to-Arkime location in Malcolm deployments.
CISA Adds One Known Exploited Vulnerability to Catalog (CISA Advisories)
T1526 Cloud Service Discovery
Search Atlassian application logs for unusual file or directory access requests from external IP addresses targeting sensitive configuration or data directories.
Fake CAPTCHAs are tricking users into running malware on their own devices (Help Net Security)
T1566.002 Spearphishing Link, T1204.001 Malicious Link
Search web proxy or email gateway logs for phishing emails containing links that redirect to fake CAPTCHA pages, checking for domains that mimic legitimate verification services.
KGB RAT trojan packs webcam spying, password theft and a “fun” menu to terrorize victims (Help Net Security)
T1113 Screen Capture, T1123 Audio Capture, T1056 Input Capture, T1555 Credentials from Password Stores
Search for unexpected webcam and microphone device access by non-AV processes in Event Viewer or sysmon telemetry for KGB RAT.
New Aoki Infostealer Targets AI Coding Assistant Credentials (Infosecurity Magazine)
T1555 Credentials from Password Stores, T1187 Forced Authentication
Search file system access logs or EDR telemetry for Aoki infostealer process creation and check for reads from credential storage locations used by Claude or Gemini integrations.
Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules (The Hacker News)
T1190 Exploit Public-Facing Application, T1059 Command and Scripting Interpreter
Search web server access logs for POST or GET requests to admin paths containing Field UI parameters on Drupal sites running contributed modules that extend Field UI functionality.
Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing (The Hacker News)
T1190 Exploit Public-Facing Application, T1499 Endpoint Denial of Service
Search web server logs and application logs for unauthenticated POST or GET requests to Next.js React Server Components endpoints that succeed despite lacking authentication tokens.
Weekly threat landscape: https://threathuntersjournal.com/landscape/2026-10-10
Read more at https://threathuntersjournal.com. Blog: https://blog.threathuntersjournal.com. Archive: https://buttondown.com/robbrydon.