Daily Hunt Feed - 2026-07-21

Threat Hunt Feed (2026-07-21)

BleepingComputer

• SonicWall SMA1000 flaws exploited as zero-days to push custom malware — Mon, 20 Jul 2026 18:23:23 -0400
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Server (T1584.004), Proxy (T1090), Tool (T1588.002), Software (T1592.002), Exploits (T1588.005), At (T1053.002)
• JadePuffer agentic attacks now target AI model data with ransomware — Mon, 20 Jul 2026 17:08:02 -0400
  • Matched TTPs: Artificial Intelligence (T1588.007), Malware (T1588.001), Hardware (T1592.001), Databases (T1213.006), Tool (T1588.002), Software (T1592.002), Exploits (T1588.005), Credentials (T1589.001), Python (T1059.006)
• New HollowGraph malware uses Microsoft Graph for stealthy C2 comms — Mon, 20 Jul 2026 13:43:01 -0400
  • Matched TTPs: DNS (T1071.004), Malware (T1588.001), Hardware (T1592.001), Tool (T1588.002), Software (T1592.002), Exploits (T1588.005), At (T1053.002)
• Hugging Face warns an autonomous AI agent hacked its network — Mon, 20 Jul 2026 07:56:28 -0400
  • Matched TTPs: Artificial Intelligence (T1588.007), Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Tool (T1588.002), Software (T1592.002), Exploits (T1588.005), Credentials (T1589.001), Template Injection (T1221)
• Microsoft confirms Windows Server Update Services sync delays — Mon, 20 Jul 2026 06:47:28 -0400
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Server (T1584.004), Tool (T1588.002), Software (T1592.002), Exploits (T1588.005)

Darkreading

• Remediating Vulnerabilities With LLMs: Inside Ivanti’s Automation Push — Mon, 20 Jul 2026 20:26:56 GMT
  • Matched TTPs: Artificial Intelligence (T1588.007), Malvertising (T1583.008), Hardware (T1592.001), Vulnerabilities (T1588.006), Software (T1592.002), At (T1053.002)
• Attackers Combo Up Evasion Tactics for BEC Phishing — Mon, 20 Jul 2026 18:30:22 GMT
  • Matched TTPs: JavaScript (T1059.007), Malware (T1588.001), Vulnerabilities (T1588.006), Trap (T1546.005), Phishing (T1566), Lua (T1059.011), Software (T1592.002), Credentials (T1589.001), Impersonation (T1656), At (T1053.002)

The Hacker News

• FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware — Mon, 20 Jul 2026 23:53:03 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), Malware (T1588.001), Vulnerabilities (T1588.006), Botnet (T1584.005), Domains (T1584.001), Server (T1584.004), Phishing (T1566), Lua (T1059.011), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), Malicious Link (T1204.001), At (T1053.002)
• Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign — Mon, 20 Jul 2026 22:59:50 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), JavaScript (T1059.007), Malware (T1588.001), Vulnerabilities (T1588.006), InstallUtil (T1218.004), DLL (T1574.001), Botnet (T1584.005), Domains (T1584.001), Server (T1584.004), Right-to-Left Override (T1036.002), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050 — Mon, 20 Jul 2026 20:03:43 +0530
  • Matched TTPs: DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), DLL (T1574.001), Botnet (T1584.005), Domains (T1584.001), Server (T1584.004), Phishing (T1566), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• ⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More — Mon, 20 Jul 2026 19:02:26 +0530
  • Matched TTPs: VNC (T1021.005), Sharepoint (T1213.002), Artificial Intelligence (T1588.007), IP Addresses (T1590.005), Malware (T1588.001), Browser Extensions (T1176.001), Cron (T1053.003), Vulnerabilities (T1588.006), SSH (T1021.004), Botnet (T1584.005), Domains (T1584.001), Process Injection (T1055), Server (T1584.004), Phishing (T1566), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), Python (T1059.006), At (T1053.002)
• Russian Intelligence Hacks IP Cameras to Spy on Military Logistics Across NATO States and Ukraine — Mon, 20 Jul 2026 17:43:39 +0530
  • Matched TTPs: Vulnerabilities (T1588.006), SSH (T1021.004), Botnet (T1584.005), Domains (T1584.001), Server (T1584.004), Tool (T1588.002), Phishing (T1566), Firmware (T1592.003), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• Mythos Didn’t Break Your Security Program. Your Exposure Window Could. — Mon, 20 Jul 2026 17:00:00 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), Vulnerabilities (T1588.006), Botnet (T1584.005), Domains (T1584.001), Server (T1584.004), Phishing (T1566), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• Russian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCs — Mon, 20 Jul 2026 14:37:11 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), Password Cracking (T1110.002), Malware (T1588.001), Vulnerabilities (T1588.006), Botnet (T1584.005), Virtual Private Server (T1583.003), Domains (T1584.001), Server (T1584.004), Proxy (T1090), PowerShell (T1059.001), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• World’s Largest AI Model Repository Hugging Face Breached by Autonomous AI Agent — Mon, 20 Jul 2026 10:57:26 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), Vulnerabilities (T1588.006), Botnet (T1584.005), Domains (T1584.001), Server (T1584.004), Phishing (T1566), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), Template Injection (T1221), At (T1053.002)
• SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines — Mon, 20 Jul 2026 10:45:39 +0530
  • Matched TTPs: JavaScript (T1059.007), Malware (T1588.001), Cron (T1053.003), Vulnerabilities (T1588.006), SSH (T1021.004), Botnet (T1584.005), Domains (T1584.001), Private Keys (T1552.004), Server (T1584.004), PowerShell (T1059.001), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)