Daily Hunt Feed - 2026-09-29

Threat Hunt Feed (2026-09-29)

Hacker News: Best

• Jeff – Jev-compatible 0.8B decision models, trained at home, ~30 ms — Mon, 28 Sep 2026 20:23:36 +0000
  • Matched TTPs: Hardware (T1592.001), Vulnerabilities (T1588.006), Software (T1592.002), Python (T1059.006), At (T1053.002)

BleepingComputer

• Over 16,000 Supabase databases expose PII, passwords, auth tokens — Mon, 28 Sep 2026 14:50:59 -0400
  • Matched TTPs: Artificial Intelligence (T1588.007), Malware (T1588.001), Hardware (T1592.001), Databases (T1213.006), Domains (T1584.001), Server (T1584.004), Tool (T1588.002), Software (T1592.002), At (T1053.002)
• JadePuffer agentic AI attacks target Azure, destroy cloud resources — Mon, 28 Sep 2026 11:49:27 -0400
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Databases (T1213.006), Domains (T1584.001), Server (T1584.004), Tool (T1588.002), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• 80,000+ Organizations Had AI Logins Stolen: From Shadow AI to LLMjacking — Mon, 28 Sep 2026 10:00:10 -0400
  • Matched TTPs: Artificial Intelligence (T1588.007), Malware (T1588.001), Hardware (T1592.001), Databases (T1213.006), Domains (T1584.001), Server (T1584.004), Email Addresses (T1589.002), Code Repositories (T1213.003), Tool (T1588.002), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• US soldier gets 70 months in prison for extorting 10 tech, telecom firms — Mon, 28 Sep 2026 03:30:15 -0400
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Databases (T1213.006), SSH (T1021.004), Domains (T1584.001), Server (T1584.004), Tool (T1588.002), Multi-Factor Authentication (T1556.006), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• CISA orders feds to patch exploited Citrix flaws by Wednesday — Mon, 28 Sep 2026 02:24:19 -0400
  • Matched TTPs: IP Addresses (T1590.005), Malware (T1588.001), Hardware (T1592.001), Databases (T1213.006), Vulnerabilities (T1588.006), Domains (T1584.001), Server (T1584.004), Search Engines (T1593.002), Tool (T1588.002), Software (T1592.002), At (T1053.002)

Darkreading

• Carbonato Botnet Puts an AI Agent on Hacked Docker Hosts — Mon, 28 Sep 2026 20:23:58 GMT
  • Matched TTPs: Malware (T1588.001), Databases (T1213.006), Vulnerabilities (T1588.006), SSH (T1021.004), Botnet (T1584.005), Phishing (T1566), Exploits (T1588.005), Credentials (T1589.001), At (T1053.002)
• JadePuffer AI Actor Compromises Azure Tenant in Destructive Cloud Attack — Mon, 28 Sep 2026 15:33:21 GMT
  • Matched TTPs: Databases (T1213.006), Vulnerabilities (T1588.006), Phishing (T1566), Exploits (T1588.005), Credentials (T1589.001), At (T1053.002)

The Hacker News

• Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks — Tue, 29 Sep 2026 00:05:42 +0530
  • Matched TTPs: Sharepoint (T1213.002), Malware (T1588.001), Malicious File (T1204.002), Vulnerabilities (T1588.006), SSH (T1021.004), DLL (T1574.001), Domains (T1584.001), Server (T1584.004), Tool (T1588.002), Social Media (T1593.001), At (T1053.002)
• Bitget Says Attacker Exploited Third-Party Security Product Flaw to Steal $388M — Mon, 28 Sep 2026 23:12:18 +0530
  • Matched TTPs: Sharepoint (T1213.002), Vulnerabilities (T1588.006), SSH (T1021.004), Private Keys (T1552.004), Server (T1584.004), Tool (T1588.002), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims — Mon, 28 Sep 2026 23:08:33 +0530
  • Matched TTPs: Screen Capture (T1113), Sharepoint (T1213.002), Artificial Intelligence (T1588.007), IP Addresses (T1590.005), Malware (T1588.001), Vulnerabilities (T1588.006), SSH (T1021.004), Domains (T1584.001), Server (T1584.004), Tool (T1588.002), Social Media (T1593.001), At (T1053.002)
• ⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats — Mon, 28 Sep 2026 19:30:53 +0530
  • Matched TTPs: Scheduled Task (T1053.005), Sharepoint (T1213.002), Artificial Intelligence (T1588.007), IP Addresses (T1590.005), JavaScript (T1059.007), Malware (T1588.001), Vulnerabilities (T1588.006), SSH (T1021.004), Botnet (T1584.005), Email Accounts (T1585.002), Domains (T1584.001), Masquerading (T1036), Private Keys (T1552.004), Server (T1584.004), Trap (T1546.005), PowerShell (T1059.001), Tool (T1588.002), Phishing (T1566), Firmware (T1592.003), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent — Mon, 28 Sep 2026 17:16:00 +0530
  • Matched TTPs: Sharepoint (T1213.002), Artificial Intelligence (T1588.007), Malware (T1588.001), Cron (T1053.003), Vulnerabilities (T1588.006), SSH (T1021.004), Botnet (T1584.005), Masquerading (T1036), Server (T1584.004), Tool (T1588.002), Process Hollowing (T1055.012), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)
• CISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws Globally — Mon, 28 Sep 2026 12:51:49 +0530
  • Matched TTPs: Sharepoint (T1213.002), Local Account (T1136.001), Vulnerabilities (T1588.006), SSH (T1021.004), Server (T1584.004), Tool (T1588.002), Firmware (T1592.003), Social Media (T1593.001), Credentials (T1589.001), At (T1053.002)