Daily Hunt Feed - 2026-09-26

Threat Hunt Feed (2026-09-26)

Hacker News: Best

• Pentium II at 600Mhz with Voodoo 3 Emulated on 86Box with M6 Mac Mini — Fri, 25 Sep 2026 07:27:45 +0000
  • Matched TTPs: Hardware (T1592.001), Software (T1592.002), At (T1053.002)
• Show HN: Koi.rest – watch some fish and regain your balance — Thu, 24 Sep 2026 21:33:03 +0000
  • Matched TTPs: JavaScript (T1059.007), At (T1053.002)
• Opus 5.5 is good at explainer videos — Thu, 24 Sep 2026 20:28:47 +0000
  • Matched TTPs: Serverless (T1584.007), Server (T1584.004), Tool (T1588.002), At (T1053.002)
• Show HN: Whiteboard (YC W26) – An open-source IDE for thoughtful software design — Thu, 24 Sep 2026 17:21:36 +0000
  • Matched TTPs: Vulnerabilities (T1588.006), Tool (T1588.002), Software (T1592.002), At (T1053.002)
• GitHub has not removed malicious imitation software after 3 weeks — Thu, 24 Sep 2026 15:50:26 +0000
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Software (T1592.002), At (T1053.002)

Krebs on Security

• U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions — Fri, 25 Sep 2026 21:44:40 +0000
  • Matched TTPs: Vulnerabilities (T1588.006), Botnet (T1584.005), Domains (T1584.001), Email Account (T1087.003), Tool (T1588.002), Multi-Factor Authentication (T1556.006), Credentials (T1589.001), At (T1053.002)

BleepingComputer

• Kiteworks urges 6-hour server shutdown over potential zero-day attacks — Fri, 25 Sep 2026 17:41:07 -0400
  • Matched TTPs: Sharepoint (T1213.002), Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Server (T1584.004), Tool (T1588.002), Software (T1592.002), At (T1053.002)
• ShinyHunters hacked Clop leak site using Grav CMS path traversal flaw — Fri, 25 Sep 2026 16:57:55 -0400
  • Matched TTPs: Sharepoint (T1213.002), Malware (T1588.001), Hardware (T1592.001), Defacement (T1491), Private Keys (T1552.004), Server (T1584.004), Tool (T1588.002), Software (T1592.002), At (T1053.002)
• CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks — Fri, 25 Sep 2026 13:24:20 -0400
  • Matched TTPs: Sharepoint (T1213.002), Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), SSH (T1021.004), Server (T1584.004), Tool (T1588.002), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• With the Rise of AI Agents, SOC 2 Should Adapt or Risk Irrelevance — Fri, 25 Sep 2026 10:51:10 -0400
  • Matched TTPs: Sharepoint (T1213.002), Artificial Intelligence (T1588.007), Malware (T1588.001), Hardware (T1592.001), Server (T1584.004), Tool (T1588.002), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• Microsoft plans to deprecate Windows Deployment Services — Fri, 25 Sep 2026 08:40:59 -0400
  • Matched TTPs: Sharepoint (T1213.002), Malware (T1588.001), Hardware (T1592.001), Server (T1584.004), Tool (T1588.002), Software (T1592.002), At (T1053.002)
• Rydox marketplace admin pleads guilty, faces 22 years in prison — Fri, 25 Sep 2026 07:35:14 -0400
  • Matched TTPs: Sharepoint (T1213.002), Malware (T1588.001), Hardware (T1592.001), Server (T1584.004), Tool (T1588.002), Software (T1592.002), Credentials (T1589.001), At (T1053.002)

The Hacker News

• Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware — Fri, 25 Sep 2026 20:14:41 +0530
  • Matched TTPs: DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Cloud Accounts (T1078.004), Server (T1584.004), Phishing (T1566), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence — Fri, 25 Sep 2026 18:48:06 +0530
  • Matched TTPs: JavaScript (T1059.007), DNS (T1071.004), Keychain (T1555.001), Malware (T1588.001), Vulnerabilities (T1588.006), AppleScript (T1059.002), Cloud Accounts (T1078.004), Masquerading (T1036), Server (T1584.004), Phishing (T1566), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• The SOC Doesn’t Need to Start Over with Every Alert — Fri, 25 Sep 2026 17:00:00 +0530
  • Matched TTPs: Adversary-in-the-Middle (T1557), Sharepoint (T1213.002), Artificial Intelligence (T1588.007), DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Cloud Accounts (T1078.004), Server (T1584.004), Cloud Account (T1136.003), Tool (T1588.002), Phishing (T1566), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise — Fri, 25 Sep 2026 16:05:55 +0530
  • Matched TTPs: DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Cloud Accounts (T1078.004), Server (T1584.004), Phishing (T1566), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• Cloudflare Fixes Flaw That Let One Container Read Another Customer’s Leftover Disk Data — Fri, 25 Sep 2026 10:19:22 +0530
  • Matched TTPs: DNS (T1071.004), Malware (T1588.001), Databases (T1213.006), Vulnerabilities (T1588.006), Cloud Accounts (T1078.004), Server (T1584.004), Tool (T1588.002), Phishing (T1566), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV — Fri, 25 Sep 2026 10:16:34 +0530
  • Matched TTPs: DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Cloud Accounts (T1078.004), Server (T1584.004), Phishing (T1566), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)