Daily Hunt Feed - 2026-10-20

Threat Hunt Feed (2026-10-20)

Hacker News: Best

• Mercury 3: Diffusion at scale — Mon, 19 Oct 2026 17:27:11 +0000
  • Matched TTPs: At (T1053.002)
• Ask HN: How to deal with shipping AI-written code you don’t understand? — Mon, 19 Oct 2026 11:24:34 +0000
  • Matched TTPs: Software (T1592.002), At (T1053.002)
• If you don’t run your own LLM proxy, how do you know whats going on? — Sun, 18 Oct 2026 21:09:12 +0000
  • Matched TTPs: Proxy (T1090)

Krebs on Security

• Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site — Mon, 19 Oct 2026 13:48:56 +0000
  • Matched TTPs: Phishing (T1566), Credentials (T1589.001), At (T1053.002)

BleepingComputer

• WordPress SEO plugin Rank Math compromised to backdoor websites — Mon, 19 Oct 2026 17:24:51 -0400
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Databases (T1213.006), Cron (T1053.003), Vulnerabilities (T1588.006), SSH (T1021.004), Server (T1584.004), Email Addresses (T1589.002), Tool (T1588.002), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• Hackers hijack AOMEI update servers to secretly spread malware — Mon, 19 Oct 2026 15:40:58 -0400
  • Matched TTPs: Scheduled Task (T1053.005), IP Addresses (T1590.005), Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Server (T1584.004), Tool (T1588.002), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• Bullhorn takes staffing platform offline to contain cyberattack — Mon, 19 Oct 2026 14:51:13 -0400
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Server (T1584.004), Tool (T1588.002), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• F5 releases out-of-band patches for critical NGINX vulnerabilities — Mon, 19 Oct 2026 09:49:24 -0400
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Server (T1584.004), Tool (T1588.002), Software (T1592.002), Credentials (T1589.001)
• Microsoft: October Windows Server updates break Exchange sign-in, mail flow — Mon, 19 Oct 2026 04:58:41 -0400
  • Matched TTPs: Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Server (T1584.004), Tool (T1588.002), Software (T1592.002), Credentials (T1589.001)

Darkreading

• ConnectWise Disables Cloud Backups Amid Concerns for Downstream MSPs — Mon, 19 Oct 2026 19:19:33 GMT
  • Matched TTPs: Sharepoint (T1213.002), Vulnerabilities (T1588.006), Botnet (T1584.005), Phishing (T1566), Software (T1592.002), Credentials (T1589.001), At (T1053.002)
• The Evolving Cybersecurity Lexicon: Vulnerability Discovery to Resilience — Mon, 19 Oct 2026 14:00:00 GMT
  • Matched TTPs: Vulnerabilities (T1588.006), Software (T1592.002), Social Media (T1593.001), At (T1053.002)

The Hacker News

• Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor — Mon, 19 Oct 2026 23:02:13 +0530
  • Matched TTPs: IP Addresses (T1590.005), DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Botnet (T1584.005), Server (T1584.004), Trap (T1546.005), Proxy (T1090), Software (T1592.002), Social Media (T1593.001), Python (T1059.006), At (T1053.002)
• Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor — Mon, 19 Oct 2026 21:58:47 +0530
  • Matched TTPs: DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), SSH (T1021.004), Control Panel (T1218.002), Server (T1584.004), Trap (T1546.005), Email Addresses (T1589.002), Social Media (T1593.001), Credentials (T1589.001), Python (T1059.006), At (T1053.002)
• ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More — Mon, 19 Oct 2026 19:44:07 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), IP Addresses (T1590.005), DNS (T1071.004), Malware (T1588.001), Malicious File (T1204.002), Hardware (T1592.001), Databases (T1213.006), Vulnerabilities (T1588.006), Web Shell (T1505.003), Private Keys (T1552.004), Server (T1584.004), Trap (T1546.005), Code Repositories (T1213.003), Proxy (T1090), Tool (T1588.002), Phishing (T1566), Firmware (T1592.003), Software (T1592.002), Social Media (T1593.001), Credentials (T1589.001), Python (T1059.006), At (T1053.002)
• GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories — Mon, 19 Oct 2026 18:35:45 +0530
  • Matched TTPs: IP Addresses (T1590.005), JavaScript (T1059.007), DNS (T1071.004), Malware (T1588.001), Cron (T1053.003), Vulnerabilities (T1588.006), SSH (T1021.004), Private Keys (T1552.004), Server (T1584.004), Trap (T1546.005), Proxy (T1090), Phishing (T1566), Social Media (T1593.001), Credentials (T1589.001), Python (T1059.006), At (T1053.002)
• From Email-to-Case to the Boardroom: How Inherited Agents Break Governance Built for Software — Mon, 19 Oct 2026 17:20:00 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Server (T1584.004), Trap (T1546.005), Software (T1592.002), Social Media (T1593.001), Python (T1059.006), At (T1053.002)
• Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic — Mon, 19 Oct 2026 15:36:40 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), DNS (T1071.004), Bypass User Account Control (T1548.002), Malware (T1588.001), Hardware (T1592.001), Browser Extensions (T1176.001), Vulnerabilities (T1588.006), DLL (T1574.001), Domains (T1584.001), Server (T1584.004), Trap (T1546.005), PowerShell (T1059.001), Tool (T1588.002), Social Media (T1593.001), Hidden Window (T1564.003), Python (T1059.006), At (T1053.002)
• Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers — Mon, 19 Oct 2026 11:59:44 +0530
  • Matched TTPs: DNS (T1071.004), Malware (T1588.001), Hardware (T1592.001), Vulnerabilities (T1588.006), Server (T1584.004), Trap (T1546.005), Firmware (T1592.003), Software (T1592.002), Exploits (T1588.005), Social Media (T1593.001), Python (T1059.006), At (T1053.002)
• OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys — Mon, 19 Oct 2026 11:37:08 +0530
  • Matched TTPs: Artificial Intelligence (T1588.007), DNS (T1071.004), Malware (T1588.001), Vulnerabilities (T1588.006), Server (T1584.004), Trap (T1546.005), Tool (T1588.002), Social Media (T1593.001), Credentials (T1589.001), Python (T1059.006), At (T1053.002)