Each feed is checked for new posts. Every post is read, and those that belong here join the catalog. What Trove read and did not keep stays on file, not shown.
GTIG and Mandiant report on UNC7017, which tampered with AOMEI update servers in five to ten minute windows between April and July 2026. Edited down_html.ini and Notifycfg.ini files delivered the CROSSROAD downloader and SHINYROAD PocketPy backdoor, plus Adaptix C2 and WebDAV NTLM coercion. The post covers infrastructure shifts, YARA rules, IOCs, and vendor and SOC guidance on point-in-time triage failures.
AOMEI BackupperRadminAdaptix C2+3
UNC7017CROSSROADSHINYROAD+10
Supply Chain, Threat Intel, Malware & RE, Blue Team & Detection· 2026-10-15T11:00:00+00:00
Mandiant and GTIG report on exploitation of the Citrix NetScaler ADC and Gateway zero-day CVE-2026-88772, active since early September 2026, alongside CVE-2026-88771. It covers the DTLS-triggered NSPPE crash, httpd.conf persistence via .deb and .sig handlers, SUID /bin/sh, and the WHIPSHOT web shell and SLAPSHOT tunneler. It gives hunting commands, log artifacts, YARA rules, patched builds and containment steps.
Citrix NetScalerPHPPython+3
CVE-2026-88772CVE-2026-88771WHIPSHOT+6
Threat Intel, Blue Team & Detection, Malware & RE· 2026-09-29T14:00:00+00:00
Mandiant and GTIG report renewed mass exploitation of Oracle PeopleSoft CVE-2026-35273 by UNC6240 (ShinyHunters). The actor bypassed WAF rules by requesting /%50SEMHUB/ instead of /PSEMHUB/, then deployed JSP web shells (x.jsp, u.jsp), the SIDEEYE backdoor (Ple64.exe), Neo-reGeorg and MeshAgent on dozens of systems globally. The post gives host and log hunting guidance, remediation steps and detection rules.
Oracle PeopleSoftWebLogicJava+2
CVE-2026-35273UNC6240ShinyHunters+8
Threat Intel, Blue Team & Detection, Malware & RE· 2026-09-25T14:00:00+00:00
Mandiant's guidance for hardening the software supply chain across five pillars: endpoint, code repositories, artifact management, CI/CD and deployment. It covers a seven-day dependency cooldown, pinning images and actions by digest or commit SHA, ephemeral runners, OIDC short-lived tokens, build cache isolation, signed SBOMs, SLSA provenance and admission-time signature checks. It responds to campaigns using cache poisoning, OIDC token theft and mutable action tags.
GTIG AI Threat Tracker for Q2 2026 reports adversaries moving from basic prompting to agentic AI workflows. Cases include a cloud-hosted multi-agent credential harvesting campaign built in under six hours, the "Recon" framework holding over 23,800 stolen secrets, and UNC6780 (TeamPCP) supply chain attacks on PyPI, npm and Docker Hub with prompt injection aimed at LLM scanners. It also covers theft of proprietary AI models, LLMJacking, and Gemini misuse by PRC, Iranian, Russian and DPRK groups.
GeminiLLMPyPI+3
UNC6780TeamPCPDUSTMAKER+22
Threat Intel, AI Security, Supply Chain· 2026-09-08T14:00:00+00:00
BREEZE COMET (formerly UNC5669) is a financially motivated actor that Mandiant and GTIG track for intrusions into Brazilian banks, fintechs and retailers to make fraudulent Pix, STR and Boleto transfers. The report covers initial access (vishing, RMM tools, compromised government sites, rogue devices), custom backdoors COBALTSPIN, LIGHTPAINT, MILDFROST, KICKPLATE and BOATBEAM, and LLM-assisted scripting. It includes hardening guidance, SecOps rule names and YARA rules.
Active DirectoryKubernetesAnyDesk+3
BREEZE COMETUNC5669Plump Spider+16
Threat Intel, Malware & RE, Blue Team & Detection· 2026-09-01T14:00:00+00:00
GTIG report on three suspected Russian espionage clusters (UNC6293, UNC7005, UNC5976) that abuse legitimate authentication flows against academics, diplomats and defense personnel. It covers app password, OAuth and device code phishing, WhatsApp device linking, VIDAR and ATOMIC stealers, ENGINELIGHT, HEADRUSH and the hospitality captive portal campaign. It links UNC6293 and UNC7005 to ICE RELIC (formerly APT29) with moderate confidence and gives hardening advice.
UNC6671 is a vishing and extortion cluster that GTIG links to the BlackFile, Redact, Pink, Helix and Falcon brands through shared passkey-themed AiTM phishing domains and identical templates. Callers pose as IT helpdesk on personal phones, harvest credentials and MFA tokens, then script data theft from Microsoft 365 and Okta. The post covers targeting shifts to financial and legal firms, 141.65 BTC in ransom payments, hardening guidance and Okta/M365 detections.
Microsoft 365OktaMicrosoft Entra ID+3
UNC6671BlackFileRedact+9
Threat Intel, Identity & Access, Blue Team & Detection· 2026-08-06T14:00:00+00:00
cloud.google.comwriteup