Daily Hunt Feed - 2026-09-20

Threat Hunt Feed (2026-09-20)

Hacker News: Best

• Show HN: Cactus Needle 3: 8-29MB automation models can match DeepSeek V4 Flash — Fri, 18 Sep 2026 00:11:44 +0000
  • Matched TTPs: Cloud API (T1059.009), Tool (T1588.002), Python (T1059.006), At (T1053.002)

BleepingComputer

• North Korean WaterPlum hackers infected 30,000 devices worldwide — Sat, 19 Sep 2026 10:05:15 -0400
  • Matched TTPs: IP Addresses (T1590.005), JavaScript (T1059.007), Malware (T1588.001), Hardware (T1592.001), Private Keys (T1552.004), Financial Theft (T1657), Tool (T1588.002), Software (T1592.002), Credentials (T1589.001), Python (T1059.006), At (T1053.002)
• ShinyHunters hacks Clop leak site, threatens to extort ransomware gang — Sat, 19 Sep 2026 09:48:32 -0400
  • Matched TTPs: IP Addresses (T1590.005), Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Defacement (T1491), Web Shell (T1505.003), Private Keys (T1552.004), Server (T1584.004), Tool (T1588.002), Phishing (T1566), Software (T1592.002), At (T1053.002)

The Hacker News

• Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws — Sun, 20 Sep 2026 00:06:53 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), DNS (T1071.004), Malware (T1588.001), Databases (T1213.006), Vulnerabilities (T1588.006), Cloud Accounts (T1078.004), Server (T1584.004), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• Identity Visibility in 2026: The Foundation of Identity Security — Sat, 19 Sep 2026 18:58:41 +0530
  • Matched TTPs: DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Cloud Accounts (T1078.004), Server (T1584.004), Phishing (T1566), Valid Accounts (T1078), Multi-Factor Authentication (T1556.006), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002), Local Accounts (T1078.003)
• Google Gemini Broke Into Real Company Systems After Security Test Domain Mix-Up — Sat, 19 Sep 2026 13:21:34 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Cloud Accounts (T1078.004), Server (T1584.004), Phishing (T1566), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories — Sat, 19 Sep 2026 12:44:54 +0530
  • Matched TTPs: IP Addresses (T1590.005), DNS (T1071.004), Malware (T1588.001), Databases (T1213.006), Vulnerabilities (T1588.006), SSH (T1021.004), Cloud Accounts (T1078.004), Server (T1584.004), Email Addresses (T1589.002), Code Repositories (T1213.003), Phishing (T1566), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild — Sat, 19 Sep 2026 11:54:10 +0530
  • Matched TTPs: DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Cloud Accounts (T1078.004), Server (T1584.004), Phishing (T1566), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)

데일리시큐 - 최근인기기사

• 체크포인트 보안관리 서버 치명적 RCE…인증 없이 루트 권한 코드 실행 가능 — 2026-09-19 21:07:57
  • Matched TTPs: Server (T1584.004)