Daily Hunt Feed - 2026-04-18

Threat Hunt Feed (2026-04-18)

Guy builds AI driven hardware hacker arm from duct tape, old cam and CNC machine — Thu, 16 Apr 2026 21:56:37 +0000
- Matched TTPs: Hardware (T1592.001), Vulnerabilities (T1588.006), SSH (T1021.004), Tool (T1588.002), Software (T1592.002), Credentials (T1589.001), Python (T1059.006), At (T1053.002), Compression (T1027.015)
The “Passive Income” trap ate a generation of entrepreneurs — Thu, 16 Apr 2026 20:31:52 +0000
- Matched TTPs: Trap (T1546.005), Software (T1592.002), At (T1053.002)

Payouts King ransomware uses QEMU VMs to bypass endpoint security — Fri, 17 Apr 2026 15:10:19 -0400
- Matched TTPs: Scheduled Task (T1053.005), Malware (T1588.001), Hardware (T1592.001), Databases (T1213.006), Cron (T1053.003), SSH (T1021.004), DLL (T1574.001), Server (T1584.004), Trap (T1546.005), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Exploits (T1588.005), Credentials (T1589.001), NTDS (T1003.003), At (T1053.002)
Webinar: From phishing to fallout — Why MSPs must rethink both security and recovery — Fri, 17 Apr 2026 08:20:28 -0400
- Matched TTPs: Artificial Intelligence (T1588.007), Malware (T1588.001), Hardware (T1592.001), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Impersonation (T1656), At (T1053.002)
Recently leaked Windows zero-days now exploited in attacks — Fri, 17 Apr 2026 02:14:52 -0400
- Matched TTPs: Malware (T1588.001), Malicious File (T1204.002), Hardware (T1592.001), Vulnerabilities (T1588.006), Server (T1584.004), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Exploits (T1588.005), At (T1053.002)

Tycoon 2FA Phishers Scatter, Adopt Device Code Phishing — Fri, 17 Apr 2026 19:05:51 GMT
- Matched TTPs: Phishing (T1566)
NIST Revamps CVE Framework to Focus on High-Impact Vulnerabilities — Thu, 16 Apr 2026 21:47:31 GMT
- Matched TTPs: Vulnerabilities (T1588.006), Software (T1592.002)

Three Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched — Fri, 17 Apr 2026 18:51:00 +0530
- Matched TTPs: Malware (T1588.001), Cron (T1053.003), Vulnerabilities (T1588.006), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
NIST Limits CVE Enrichment After 263% Surge in Vulnerability Submissions — Fri, 17 Apr 2026 12:44:00 +0530
- Matched TTPs: Malware (T1588.001), Cron (T1053.003), Vulnerabilities (T1588.006), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
Operation PowerOFF Seizes 53 DDoS Domains, Exposes 3 Million Criminal Accounts — Fri, 17 Apr 2026 11:16:00 +0530
- Matched TTPs: Malware (T1588.001), Databases (T1213.006), Cron (T1053.003), Vulnerabilities (T1588.006), Botnet (T1584.005), Domains (T1584.001), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation — Fri, 17 Apr 2026 08:52:00 +0530
- Matched TTPs: Malware (T1588.001), Cron (T1053.003), Vulnerabilities (T1588.006), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)