Daily Hunt Feed - 2026-08-21

Threat Hunt Feed (2026-08-21)

Hacker News: Best

• Felony charges for citizen deleting phone data at US Border — Fri, 21 Aug 2026 12:10:13 +0000
  • Matched TTPs: At (T1053.002)

BleepingComputer

• New SynkLoader malware pushed in Microsoft Teams phishing campaign — Fri, 21 Aug 2026 14:01:30 -0400
  • Matched TTPs: Scheduled Task (T1053.005), VNC (T1021.005), Malware (T1588.001), Hardware (T1592.001), Server (T1584.004), Proxy (T1090), PowerShell (T1059.001), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Credentials (T1589.001), Python (T1059.006), At (T1053.002)
• Hundreds of leaked AWS keys give full control over corporate accounts — Fri, 21 Aug 2026 11:55:15 -0400
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Databases (T1213.006), Domains (T1584.001), Code Repositories (T1213.003), Web Services (T1584.006), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• CISA orders feds to patch actively exploited TrueConf Server flaws — Fri, 21 Aug 2026 08:25:33 -0400
  • Matched TTPs: Sharepoint (T1213.002), Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Server (T1584.004), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• Hackers abuse FTP server banners to deliver new Windows malware — Fri, 21 Aug 2026 07:00:00 -0400
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Server (T1584.004), Web Services (T1584.006), PowerShell (T1059.001), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• SickKids data breach exposes employee and job applicant info — Fri, 21 Aug 2026 06:10:42 -0400
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Credentials (T1589.001), At (T1053.002)

The Hacker News

• 14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2 — Sat, 22 Aug 2026 00:23:00 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), SSH (T1021.004), Domains (T1584.001), Server (T1584.004), Proxy (T1090), Confluence (T1213.001), Tool (T1588.002), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• Microsoft Defender’s Own Driver Can Be Weaponized to Delete Security Software at Boot — Fri, 21 Aug 2026 21:22:10 +0530
  • Matched TTPs: DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), DLL (T1574.001), Domains (T1584.001), Server (T1584.004), Proxy (T1090), Confluence (T1213.001), Tool (T1588.002), Software (T1592.002), Social Media (T1593.001), At (T1053.002)
• Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet — Fri, 21 Aug 2026 21:11:44 +0530
  • Matched TTPs: JavaScript (T1059.007), DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Botnet (T1584.005), Domains (T1584.001), Server (T1584.004), Proxy (T1090), Confluence (T1213.001), Firmware (T1592.003), Software (T1592.002), Social Media (T1593.001), At (T1053.002)
• Wazuh and AI For Enhanced SOC Workflows — Fri, 21 Aug 2026 16:51:39 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), DNS (T1071.004), Network Devices (T1584.008), Malware (T1588.001), Databases (T1213.006), Vulnerabilities (T1588.006), Domains (T1584.001), Server (T1584.004), Proxy (T1090), Confluence (T1213.001), Social Media (T1593.001), Python (T1059.006), At (T1053.002)
• Cisco Patches Nine Crosswork and Secure Workload Flaws, Five Scoring CVSS 10.0 — Fri, 21 Aug 2026 15:33:11 +0530
  • Matched TTPs: DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Domains (T1584.001), Server (T1584.004), Proxy (T1090), Confluence (T1213.001), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM-5.3 AI Exploit, and More — Thu, 20 Aug 2026 22:53:48 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), JavaScript (T1059.007), DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), DLL (T1574.001), Email Accounts (T1585.002), Domains (T1584.001), Server (T1584.004), Proxy (T1090), Confluence (T1213.001), Tool (T1588.002), Phishing (T1566), Process Hollowing (T1055.012), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)