Tag: IOCs
All articles about IOCs.
Actively exploited
BlackNevas ransomware wiped ESXi and backups after enabling SSH through vCenter Host Profiles
On 13 November 2026 Kaspersky GERT published its analysis of a BlackNevas ransomware intrusion that encrypted four ESXi hosts with every virtual machine on them, both vCenter appliances and the backup infrastructure. No VMware vulnerability was needed: credentials stolen from other systems and everyday vCenter features were enough. Here is how it unfolded, the indicators, and what to monitor.
Actively exploited
FBI disrupts North Korea's FaceStealer fake video call campaign as the US moves to seize $1.2 billion from the Binance theft
On 12 November 2026 the US Department of Justice announced two actions against North Korean cryptocurrency theft. The FBI disrupted cloud infrastructure behind FaceStealer, a campaign that lures crypto workers and open-source developers into fake video calls and installs malware disguised as a fix for an audio problem. Separately, a court authorised the seizure or restraint of more than $1.2 billion from the theft of over $6 billion from Binance on 29 October. Here is how the trick works and what to do if you joined one of these calls.
Actively exploited
SilentAir: a state-level actor reroutes calls and SMS through hijacked mobile operators, mainly targeting Taiwan
Mobile network security vendor Enea published research on 11 November 2026 into a threat actor it calls SilentAir. According to Enea, the group controls network elements inside operators in at least six Asian countries and injects signalling into the international interconnect that diverts selected people's calls and text messages to itself. Some victims received two-factor authentication codes right after interception. Here is what is confirmed, and what it means for operators and for everyday users.
Actively exploited
Attackers abuse GSocket for stealthy access to Linux servers
On 11 November 2026 Microsoft published an analysis of intrusions in which attackers, after breaking in through a vulnerable web application, install the legitimate open-source tool GSocket on Linux servers. The connection goes out through a shared relay network, so inbound firewall rules never see it, and the attackers keep access even after the original flaw is patched. The write-up includes paths, hashes, domains and hunting queries.
Actively exploited
Cairn: CL-STA-1238 let autonomous AI agents attack chipmakers, defense firms and nonprofits
On 12 November 2026 Unit 42 (Palo Alto Networks) published an analysis of a campaign in which a China-nexus actor used a customized fork of the open-source Cairn framework. In August and September 2026 its AI agents ran 25 operations against at least 19 organizations largely on their own, from reconnaissance to persistence. Nothing about it was novel: weak passwords, open registration endpoints and old bugs. Here is what is confirmed, the indicators, and what it means for defenders.
Actively exploited
ScreenConnect attacks on managed service providers: ConnectWise disables RMM+ extensions
Late on 11 November 2026 ConnectWise said it is investigating unauthorized access to certain partner ScreenConnect environments, mostly managed service providers (MSPs). Its working theory is that attackers abused third-party extensions from the RMM+ family, which can run remote commands, and used them to push their own remote-access clients into customer networks. ConnectWise says it has found no vulnerability in ScreenConnect itself.
Actively exploited
wfx-loot: attacker uses stolen GitHub tokens to plant a CI secret stealer in thousands of repositories
On 12 November 2026 researchers at Aikido Security and StepSecurity described a campaign that has been abusing stolen GitHub tokens since 10 November. From nearly 5,000 accounts the attacker opened more than 60,000 probe pull requests, then pushed a script that drains GitHub Actions secrets and cloud credentials into every repository the token could write to - and wiped the traces afterwards. Here is how to tell whether you are affected, the indicators, and what to do right now.
Actively exploited
Citrus ransomware gets in through contractor accounts and spreads Sn00py by Group Policy
On 11 November 2026 Kaspersky described Citrus, a previously undocumented Russian-speaking ransomware group. It logged in with low-privilege contractor accounts, hid its traffic in VLESS tunnels disguised as Yandex, impersonated a domain controller through an AD CS flaw patched in July and finally pushed its Go-based Sn00py encryptor to the whole domain through Group Policy.
Actively exploited
AhsayCBS intrusion: attackers left webshells, a cryptominer and a Python implant on backup servers
On 9 November 2026 Huntress published a deep dive into an intrusion that hit three AhsayCBS backup servers through CVE-2026-105133 and CVE-2026-105134. The flaws have been public and patched since October 2026 and are listed in CISA's KEV catalog. What's new is what the attacker left behind: five webshell families, a cryptominer, a Python implant talking to an unidentified C2, tunneling tools and theft of Veeam credentials. Patching does not remove any of it.
Actively exploited
ARTEX: attackers let AI agents hunt GitHub secrets and hit financial firms
Microsoft (5 and 6 November 2026) and Check Point (5 November) have described real-world attacks run by the ARTEX agentic AI framework. Agents mine GitHub for leaked keys, go from those to Azure Key Vault secrets within minutes, and the Storm-3358 group has been using them against financial organisations since October. What to look for in your logs and how to defend.
Actively exploited
Attackers exploit a critical Xen Orchestra flaw to take over XCP-ng virtualization
On 10 November 2026 Vates published security advisory VSA-2026-062 for a critical flaw in Xen Orchestra, the web management console for XCP-ng. An unauthenticated attacker can make REST API requests as the owner of a valid login token, typically an administrator, and from there run code on managed XCP-ng hosts as root. Vates says a threat actor is already exploiting it. Fixed xo-server 5.213.1 and 5.211.2 shipped the same day.
Actively exploited
Cisco BroadWorks: an August XXE flaw is now exploited, and attackers are stealing server private keys
Run Cisco BroadWorks? CVE-2026-20320 has been fixed since 19 August 2026, but CISA added it to its exploited list on 10 November. Malbear Labs has described an intrusion at a European telecoms provider in which the attacker used it to steal the server's private keys and certificates.
Actively exploited
CopperDragon supplies China-nexus spies with the Sparrow toolset
On 10 November 2026 Check Point Research published a year-long investigation into the Sparrow tool family and its likely developer, which it calls CopperDragon. According to CPR, several China-nexus espionage groups share the tools against telecoms, governments and the military – and one of the three campaigns it describes used compromised websites showing a fake Chrome certificate error.
Actively exploited
Fake ‘cracked software’ installers turn PCs into proxy and compute nodes
On 3 November 2026 Microsoft Threat Intelligence described a campaign that lures people to fake download pages for cracked software, game installers and activators. One run of the trojanized installer can quietly add proxyware, a BOINC-based compute client and adware, persisted through SYSTEM-level scheduled tasks. Here is what to look for on your endpoints.
Actively exploited
Gorbag harvests data from frontline Ukrainian agencies with an old WinRAR flaw
On 3 November 2026 ESET Research published its analysis of Gorbag, a previously underreported Russia-aligned group. Since February 2025 it has sent targeted emails to Ukrainian justice and law enforcement bodies, border-area city councils and defence organisations. Since early 2026 it has also exploited WinRAR flaw CVE-2025-8088, which was patched back in July 2025.
News
Haiou: a Codex “jailbreak” bundle quietly rewrites agent instructions to serve ads
On 3 November 2026 Check Point Research described Haiou, a freely shared bundle that strips guardrails from OpenAI's Codex coding agent and also writes an advert for a third-party LLM gateway into the agent's global instructions. There is no malicious binary – just plain-text instructions that conventional security tools don't look at. What it means for organisations whose developers use AI agents, and what to check.
Actively exploited
Turla's new Cereal toolset hides inside Exchange to steal government email
On 10 November 2026 ESET Research described Cereal, a previously undocumented modular toolset that it attributes to the Russia-aligned Turla group with high confidence. It sat on Exchange servers of national government bodies in Kazakhstan and Romania, filtered mail inside the transport service and took commands through ordinary-looking HTTPS requests – with no external command server at all.