Daily Hunt Feed - 2026-07-29

Threat Hunt Feed (2026-07-29)

BleepingComputer

• CubePilot drone software dev hit by DNS hijacking to intercept traffic — Tue, 28 Jul 2026 17:17:39 -0400
  • Matched TTPs: JavaScript (T1059.007), DNS (T1071.004), Malware (T1588.001), Hardware (T1592.001), Botnet (T1584.005), Domains (T1584.001), Tool (T1588.002), Phishing (T1566), Firmware (T1592.003), Software (T1592.002), Credentials (T1589.001)
• OpenAI models used Artifactory zero-days to escape to the internet — Tue, 28 Jul 2026 16:37:06 -0400
  • Matched TTPs: JavaScript (T1059.007), DNS (T1071.004), Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Server (T1584.004), Proxy (T1090), Tool (T1588.002), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• vBulletin fixes critical pre-auth RCE flaw with public exploit — Tue, 28 Jul 2026 14:08:50 -0400
  • Matched TTPs: Sharepoint (T1213.002), JavaScript (T1059.007), DNS (T1071.004), Malware (T1588.001), Hardware (T1592.001), Tool (T1588.002), Software (T1592.002)
• Is Your SSO Protected Against Modern Credential Attacks? — Tue, 28 Jul 2026 10:00:10 -0400
  • Matched TTPs: Sharepoint (T1213.002), JavaScript (T1059.007), DNS (T1071.004), Malware (T1588.001), Hardware (T1592.001), Tool (T1588.002), Phishing (T1566), Multi-Factor Authentication (T1556.006), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• Over 24,000 exposed server BMCs leak password hash via decades-old flaw — Tue, 28 Jul 2026 08:10:23 -0400
  • Matched TTPs: JavaScript (T1059.007), DNS (T1071.004), Malware (T1588.001), Hardware (T1592.001), Server (T1584.004), Tool (T1588.002), Brute Force (T1110), Firmware (T1592.003), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• Data breach at medical billing firm MCBS affects 1.26 million people — Tue, 28 Jul 2026 05:10:03 -0400
  • Matched TTPs: JavaScript (T1059.007), DNS (T1071.004), Malware (T1588.001), Hardware (T1592.001), Databases (T1213.006), Tool (T1588.002), Software (T1592.002), At (T1053.002)

Darkreading

• Ghost Credentials Expose Cloud Systems to Hidden Identity Risks — Tue, 28 Jul 2026 21:33:23 GMT
  • Matched TTPs: Browser Extensions (T1176.001), Vulnerabilities (T1588.006), Cloud Account (T1136.003), Tool (T1588.002), Phishing (T1566), Credentials (T1589.001), At (T1053.002)
• Thousands of Data Center Controllers Open to Takeover — Tue, 28 Jul 2026 21:07:55 GMT
  • Matched TTPs: Hardware (T1592.001), Vulnerabilities (T1588.006), Server (T1584.004), Brute Force (T1110), Firmware (T1592.003), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• AI Agent Drives Espionage Attack on Thai Ministry of Finance — Tue, 28 Jul 2026 01:00:00 GMT
  • Matched TTPs: Malware (T1588.001), Vulnerabilities (T1588.006), Web Services (T1584.006), Tool (T1588.002), Exploits (T1588.005), Credentials (T1589.001), At (T1053.002)

The Hacker News

• Claude AI Just Cracked a Post-Quantum Test Scheme and Found a Faster 7-Round AES Attack — Wed, 29 Jul 2026 00:29:07 +0530
  • Matched TTPs: Sharepoint (T1213.002), Artificial Intelligence (T1588.007), Malvertising (T1583.008), Malware (T1588.001), Vulnerabilities (T1588.006), Server (T1584.004), Phishing (T1566), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Python (T1059.006), At (T1053.002)
• Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process — Tue, 28 Jul 2026 20:31:33 +0530
  • Matched TTPs: Sharepoint (T1213.002), Malvertising (T1583.008), Malware (T1588.001), Hardware (T1592.001), Cron (T1053.003), Vulnerabilities (T1588.006), Botnet (T1584.005), Server (T1584.004), Proxy (T1090), Phishing (T1566), Brute Force (T1110), Firmware (T1592.003), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), RC Scripts (T1037.004), Systemd Service (T1543.002), At (T1053.002)
• 24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login — Tue, 28 Jul 2026 20:11:36 +0530
  • Matched TTPs: Password Guessing (T1110.001), Sharepoint (T1213.002), Rootkit (T1014), Malvertising (T1583.008), Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Server (T1584.004), Phishing (T1566), Valid Accounts (T1078), Firmware (T1592.003), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), At (T1053.002)
• JFrog Confirms OpenAI Models Exploited Artifactory Zero-Day Before Hugging Face Breach — Tue, 28 Jul 2026 19:03:47 +0530
  • Matched TTPs: Sharepoint (T1213.002), Artificial Intelligence (T1588.007), Malvertising (T1583.008), Malware (T1588.001), Vulnerabilities (T1588.006), Proxy (T1090), Phishing (T1566), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root — Tue, 28 Jul 2026 18:26:14 +0530
  • Matched TTPs: Sharepoint (T1213.002), Artificial Intelligence (T1588.007), Malvertising (T1583.008), Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Server (T1584.004), Proxy (T1090), Phishing (T1566), Firmware (T1592.003), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), Python (T1059.006), At (T1053.002)
• Researcher Says AI Helped Develop Linux Traffic-Control Race Into Root Exploit — Tue, 28 Jul 2026 13:34:44 +0530
  • Matched TTPs: Sharepoint (T1213.002), Artificial Intelligence (T1588.007), Malvertising (T1583.008), Malware (T1588.001), Vulnerabilities (T1588.006), Phishing (T1566), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), At (T1053.002)
• Microsoft Says New Cybersecurity AI Model Helps MDASH Score 95.95% at Half the Cost — Tue, 28 Jul 2026 11:37:22 +0530
  • Matched TTPs: Sharepoint (T1213.002), Artificial Intelligence (T1588.007), Malvertising (T1583.008), Malware (T1588.001), Vulnerabilities (T1588.006), Phishing (T1566), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), At (T1053.002)