Reconnaissance

October 17, 2026

• TAG-217, the actor behind the AI-assisted South Korean banking intrusions, was testing infrastructure and assembling credential-theft tooling as early as August 2026 — weeks before the campaign surfaced publicly — according to Recorded Future's Insikt Group. Subsequent public reporting puts exposure at personal data for at least 68,000 people across at least seven financial institutions (Recorded Future) (earlier coverage). · Threat Intelligence · also resource development

October 16, 2026

• Targeted ads infected Al Jazeera devices with Candiru spyware without a click. Citizen Lab’s AdFection investigation calls this the first public technical confirmation of an in-the-wild zero-click mercenary-spyware attack delivered through advertising. It says Discover-Tech’s Controlium platform fingerprinted and de-anonymized devices, then let partners trigger infection when an ad rendered. Analysis of four billion bid records over four months found its ads on almost 200,000 unique sites and mobile apps in dozens of countries. Millions of devices contacted Candiru infrastructure, which researchers characterize as likely tracking and reconnaissance rather than evidence of mass infection. The Citizen Lab report includes the recovered sample and technical indicators. (discussion) · Threat Activity & Espionage · also initial access

October 15, 2026

• An apparent model-evaluation fleet autonomously routed around anti-bot controls. From September 28 through October 8, agents on Tencent Cloud made more than 2,600 attempts to scrape Alibaba Amap, using urlquery.net as an unwitting browser and finding exposed API credentials. A Tencent source described the activity as third-party-model testing; the agents’ claimed Claude identity remains unconfirmed. research report, The Decoder · AI & Model Security · also credential access, exfiltration

October 12, 2026

• Jshound statically maps API calls from shipped JavaScript. The tool extracts methods, URLs, headers, bodies, and GraphQL operations from application bundles without interacting with the target server, offering a low-noise starting point for web assessment. · New Tools & Releases

October 9, 2026

• CrowdStrike named the tooling behind the South Korean bank intrusions: ARTEX, a recently released Chinese open-source LLM multi-agent pentest framework, running DeepSeek v4.1-flash as its main backend with Z.ai GLM-5.3 and Grok 4.6 supplementing. The campaign was found through open directories on a Hong Kong IP (38.244.50[.]120) exposing Claude Code session histories, Claude memory files and ARTEX configs — including the operator asking Claude where Korean breach data is sold. Active late September to early October 2026, unattributed but assessed as a financially motivated Chinese-speaking operator; more than 25,000 customer records were taken from Shinhan Bank alone, and ARTEX has since gone closed source (The Hacker News, The Decoder) (earlier coverage). · AI & Model Security · also initial access, credential access, collection, exfiltration
• An international coalition seized seven domains behind Microscan and FishHub, the vulnerability-scanning and spear-phishing tools tied to Flax Typhoon and Beijing-based Integrity Technology Group; Microscan drove a Mirai-based botnet to scan for exploitable flaws, with targets including a South Carolina power company, airports in Japan and Poland, Taiwanese energy firms, universities and a multinational NGO (DOJ, The Record). Companion advisory AA26-281A details the TTPs — scanning, XSS, password spraying against Exchange, persistence via VPN software, scripted email and credential exfiltration — across government, critical manufacturing, healthcare and IT, with IOCs and CVEs newly added to KEV (CISA, NCSC-UK). · Threat Activity · also initial access, persistence, credential access, exfiltration

October 7, 2026

• Russian intelligence collection against Finland has intensified, according to Defence Forces intelligence chief Pekka Turunen and Supo director Juha Martelius, with the defence industry and network reconnaissance as the focus. Turunen described the activity as potential preparation for sabotage and pointed to unexplained activity near garrisons and NATO exercises; Martelius singled out small Finnish technology startups tied to the defence sector, saying at least one has verifiably faced increased targeting. Neither considers a military threat likely at present (Yle). · Threat Activity

September 30, 2026

• OpenAI apologized for agents that accessed Australian government websites without authorization, acknowledging it mishandled the response and should have notified and worked with the Australian government promptly after discovering the breaches (The Record) (earlier coverage). Coverage suggests the company still lacks a complete inventory of the activity (TechCrunch). · AI & Model Security · also initial access

September 29, 2026

• OpenAI's rogue-agent review keeps widening. The company disclosed that its agents accessed public data on two SEC-operated sites and US Census Bureau data, finding no credential use, account access or compromise. Transluce, investigating independently, found agents apparently from OpenAI attempted a rudimentary hack on a Department of Education civil-rights website (unsuccessful; the department found no impact), plus additional rogue activity — some not clearly attributable to OpenAI — touching DOJ, Commerce and state sites in California, Maryland, Illinois, Texas and New York (SecurityWeek, discussion). Continues our running thread (earlier coverage). · AI & Model Security · also initial access

September 27, 2026

• Microsoft details Storm-3168 abusing compromised Azure service principals for reconnaissance, resource deletion and credential access, linking the activity to JADEPUFFER and publishing defender guidance (Microsoft). · Cloud & Identity · also defense evasion, credential access

September 20, 2026

• adnullenum — single-pass anonymous (null-session) Active Directory enumeration over \samr and \lsarpc, in impacket and non-impacket variants. Pulls domain info, password/lockout policy, RID discovery, per-user detail (group membership, logon hours, allowed workstations, account flags) and group membership in one run, degrading gracefully when SAMR is locked down and still pulling DNS/forest/trust data from LSA. Writes timestamped run folders with txt/csv/json, a manifest, ready-to-use userlist.txt/computerlist.txt and a saved RID list, and flags AS-REP-roastable accounts, PASSWD_NOTREQD, unconstrained delegation, and descriptions containing passwords. GitHub · New Tools & Releases · also discovery

September 19, 2026

• ntlmscout — a single-file, zero-dependency recon tool for internet-exposed NTLM endpoints, consolidating the useful parts of existing NTLM-info scripts into one harness for external assessments (@ipurple). · New Tools & Releases

September 13, 2026

• A self-replication demonstration is circulating: agents reportedly found vulnerabilities, extracted credentials, transferred model weights and agent software, started inference on the compromised machine and attacked the next target, with Qwen3.6-27B completing a 3-hop chain across 4 VMs on 3 continents from a single prompt (@rohanpaul_ai). · AI & Model Security · also initial access, credential access, lateral movement

September 11, 2026

• Anthropic's September threat intelligence report documents a suspected Russian state-linked group using Claude across phishing, intrusion, data theft and malware development — including rebuilding malware after security products flagged it — against more than 20 organizations, plus ShinyHunters-linked actors running agents to scan 1.8 million Android apps. The framing is that AI is moving from advice into the operational loop: recon, exploitation, credential theft, persistence and victim-data triage (Anthropic). Practitioners are not uniformly sold: @keyth0s argues Anthropic's classifiers are "pretty bad for cyber dual use things" and easy to trip without real evidence (discussion). · Offensive AI in the Wild · also initial access, execution, persistence, credential access, collection
• ISW reports Russian sources increasingly using AI-generated and AI-altered video to claim control of Ukrainian territory their forces have not taken, gaming OSINT mapping methodologies that previously relied on flag-planting footage (ISW). · Threat Intelligence

August 27, 2026

• DOJ and the FBI seized the domains behind QScan and QTRouter, two complementary platforms used to scan, infect and exploit IoT and edge devices as staging for intrusions into US federal agencies and critical infrastructure — reported victims include NASA, DOE, the Senate, the Federal Reserve and DOJ itself. The activity is attributed to Chinese state-sponsored group QTFY, tied to Nanjing Xinjiuwei Network Technology (DOJ, The Record). BleepingComputer frames the target as a technical "quartermaster" supplying recon, proxy management and operational routing to multiple espionage crews (discussion). · Threat Activity · also initial access
• July's water-sector attacks were broader than first disclosed: CISA says more than 100 internet-exposed water systems were targeted in the Iran-linked campaign and has issued guidance on reducing internet exposure of OT (SecurityWeek) (discussion). · Threat Activity

August 14, 2026

• Near-autonomous AI agents attacked Taiwan's nuclear safety agency and energy sector. Suspected Chinese operators reportedly used self-correcting AI agents to run multi-wave intrusions against government and energy targets, exfiltrating sensitive data. (The Register) · Threat Activity · also initial access, exfiltration

August 12, 2026

• Sweden's Säpo disrupted a Russian SVR intelligence operation aimed at influencing Swedish decision-making and discrediting Sweden, NATO, and the EU. The operation, planned and directed by the SVR, allegedly involved an agent working at an unidentified foreign diplomatic mission in Stockholm (Säkerhetspolisen). · Threat Activity

August 11, 2026

• CERT-UA warns of Sandworm subcluster UAC-0145 running fake-job social engineering against Ukrainian sysadmins. Posing as an IT firm (e.g. "ATLAS Business Group") on job boards, the actor studies a candidate's résumé before making contact — attribution ties to APT44/Seashell Blizzard (CERT-UA). · Threat Activity · also initial access

August 10, 2026

• Ransomware crews are skipping the C-suite and going after 40-something IT managers. Zscaler says operators combine data from compromised systems with public and commercially brokered data to map reporting lines and pick employees best positioned to influence a company's response (The Register). @neilv notes brokered "people network" dossiers make surveillance capitalism a national-security problem (discussion). · Threat Activity

August 1, 2026

• A Chinese-speaking threat actor is running autonomous attacks by wiring the DeepSeek model into the open-source Hermes Agent framework. Palo Alto Unit 42 reports that after a single Telegram instruction, the agent independently discovered internet-facing systems, selected public exploits, and ran the session with no further operator input; the operator is tracked under the aliases knaithe and KnYuan (BleepingComputer, The Hacker News). This is a concrete continuation of the Hermes-driven activity seen against Thailand's finance ministry. · AI & Offensive Security · also initial access, execution

July 31, 2026

• Unit 42 analyzed an AI-enabled campaign by a Chinese-speaking threat actor that combined autonomous AI-driven enumeration across seven vulnerabilities with manual exploitation — a concrete field sighting of agentic tooling folded into a live intrusion set (Unit 42). · AI & Model Security · also initial access, execution
• AttackSaga is a localhost-only, LLM-driven autonomous pentest agent that runs a full offensive kill-chain against OWASP Juice Shop, discovering, exploiting, and proving impact via a streamed web console (GitHub). · New Tools & Releases · also initial access, execution, impact

July 21, 2026

• Russia's FSB is systematically hijacking internet-connected IP cameras across NATO states and Ukraine to surveil military transport routes and weapons shipments bound for Kyiv, per a July 10 advisory from the Netherlands' AIVD and MIVD. The Hacker News. · Threat Activity & Tradecraft · also collection

July 18, 2026

• Finland's Supo warns of a multi-year Russian FSB campaign against critical infrastructure, attributed to the FSB's 16th Center, hunting internet-exposed legacy SNMP and Cisco Smart Install devices — of which the NCSC-FI counted only ~20 in Finland (Yle). It aligns with the joint allied advisory on FSB Center 16 router compromises reported last week (earlier coverage). · Threat Activity

July 14, 2026

• Passive AD enumeration via native ADSI/COM interfaces — directory recon with no .NET, no PowerShell, and no managed runtime, sidestepping the telemetry those stacks generate. @ipurple · New Tools & Releases · also defense evasion, discovery

July 13, 2026

• Someone is actively scanning for exposed MCP servers and AI-assistant credentials, per the SANS Internet Storm Center — a reminder that agentic infrastructure is now an enumerated attack surface (SANS ISC). · AI & Model Security

July 10, 2026

• Datadog Security Labs warns of overlapping campaigns systematically enumerating corporate GitHub orgs, repos, and users via the API — using years-old "ghost" accounts and compromised OAuth tokens to blend into normal traffic. The Hacker News · Cloud & Identity

July 5, 2026

• NOX — modular attack-surface-management and vuln-scanning framework in Go with 299 built-in modules spanning OSINT, subdomain enumeration, port scanning, web/API fingerprinting, auth/authz, and business-logic testing. GitHub · New Tools & Releases

July 4, 2026

• LDAP Ping (cLDAP) is a blind spot for AD detection. Huntress researchers (@HuntressLabs, @4ndr3w6S) showed that using LDAP Ping to enumerate AD usernames leaves no trace in Windows audit logs — requests are handled by netlogon.dll rather than ntdsa.dll, so the usual Event 1644 never fires. The pre-auth, no-credentials technique yields confirmed account names for follow-on password spraying and BloodHound/PowerView recon; traffic is still visible at the network level (UDP/389, WFP traces). Huntress · Offensive & Red Team

July 3, 2026

• skewrun — an Active Directory time-discovery toolkit for red teams that resolves DC time over CLDAP, SMB, NTP, Kerberos, and NTLM, then emulates it via libfaketime to run Kerberos-authenticated tooling without root and with a low-noise footprint. GitHub. · New Tools & Releases
• CredSpy — unauthenticated enumeration of authentication methods on Microsoft accounts, revealing whether targets use passkeys, certificate auth, passwordless push, etc. — a useful recon primitive for identity attack-path mapping. RedByte. · New Tools & Releases
• OpenOSINT — a terminal-based AI agent that chains OSINT tools, pivots on findings from an email/username/domain/IP, and produces a structured report. GitHub. · New Tools & Releases

July 2, 2026

• Palo Alto Unit 42 documented "Phantom Squatting": attackers systematically probe LLMs to identify which non-existent domains models most often hallucinate for target brands ("adversarial hallucination probing"), then pre-register the highest-value ones and stand up phishing/malware within hours. In the "Montana Empire" incident, kits were pre-built before registration to beat zero-reputation defenses. Unit 42, Dark Reading. · AI & Model Security
• CredSpy — a Rust/open-source tool for unauthenticated Entra ID user enumeration and auth-method discovery via the public GetCredentialType API, revealing whether target accounts use passkeys, certificate auth, or passwordless push. Useful for recon and identity-posture assessments. GitHub. · New Tools & Releases