IOCs

////////////////////// // //////////////////////// // /// /////// ///// /////// /////// /////// /////// //////// //////// //////// //////// //////// //////// //////// //////// //////// //////// /////// /////// /////// /////// ///// // ////// // // ///////////////////////// ///////////////////////...

Lightdash v0.1024.6 - Server-Side Request Forgery

Server-Side Request Forgery “SSRF” in the export dashboard functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to obtain the session cookie of any user who exports a crafted dashboard. When they are exported, dashboards containing HTML elements can trigger HTTP...

Out-FINcodedCommand

Out-FINcodedCommand v1.0 परिचय Out-FINcodedCommand एक PowerShell v2.0+ संगत PowerShell POC स्क्रिप्ट है जो FIN खतरे के अभिनेताओं द्वारा उपयोग की जाने वाली कई अस्पष्टीकरण तकनीकों को उजागर करने के लिए डिज़ाइन की गई है। इस उपकरण में उजागर की गई प्रमुख अस्पष्टीकरण तकनीकें हैं: 1. cmd.exe की चर...

ThreatActors-TTPs

NOTA: Este é um fork do Crocodyli - Tudo o que estou fazendo é adicionar a ele para meus próprios propósitos. Estou usando para alimentar as páginas gapMATRIX em https://incidentbuddy.ai ATORES DE AMEAÇA E RANSOMWARES - TTPs Este repositório foi criado com o objetivo de auxiliar empresas e...

ThreatActors-TTPs

ATORES DE AMEAÇAS E RANSOMWARES - TTPs Este repositório foi criado com o objetivo de auxiliar empresas e pesquisadores independentes no estudo das Táticas, Técnicas e Procedimentos TTPs , baseadas no framework MITRE ATT &CK, adotadas por operadores/grupos de Ransomware ativos ou inativos e outros...

SupplyChainAttacks

Ataques à Cadeia de Suprimentos de Firmware Este repositório fornece uma coleção curada e abrangente de ataques documentados à cadeia de suprimentos de firmware, descobertos ou investigados pela equipe de pesquisa da Binarly. Mantido pela Binarly, o projeto serve como um recurso educacional e de...

CVE-2018-13379

IOCs para Cobalt Strike/CVE-2018-13379 Todo o crédito vai para Awake/Arista/https://www.linkedin.com/in/kevin-romano-48071a42/ IOCs copiados de DD: https://awakesecurity.com/blog/exploiting-cve-2018-13379-a-case-study-of-threat-actors-exploiting-years-old-cves/...

Claude Used to Automate Exploitation and Data Theft Across Multiple Victims

Anthropic has warned that cybercriminals and state-sponsored hackers alike are using its Claude models for cyber attacks, weapons design, propaganda, and mass surveillance between December 2025 and August 2026. The threat actors, which the artificial intelligence AI company has branded Generative...

AI across the Intrusion Lifecycle

Gambit has investigated three unrelated threat actors that illustrate how attackers are incorporating AI into real-world intrusions and the roles AI systems now play during offensive operations...

North Korean Remote Workers Are Infiltrating Government and Businesses: How to Expose Them Before Hiring

Companies are used to thinking about attackers as outsiders trying to break in. North Korean IT workers flip that model. They apply for jobs, pass interviews, receive legitimate credentials, and can end up inside the same systems companies spend millions trying to protect. That risk is no longer...

Russian Hackers Exploit Microsoft OWA Flaw to Keep Mailbox Access After Credential Rotation

The Russian threat actors recently linked to the exploitation of a now-patched vulnerability in Zimbra have been observed exploiting another vulnerability, this time in Microsoft Outlook Web Access OWA, to target U.S. and European government entities, as well as the telecommunications, financial,...

Microsoft SharePoint CVE-2026-50522 Post-Exploitation Payload Collection

A collection of payloads, webshells, and HTTP request artifacts observed following exploitation of the Microsoft SharePoint CVE-2026-50522 vulnerability. The repository documents real-world payloads deployed by multiple threat actors rather than providing an exploit for the underlying vulnerabili...

CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking

For years, phishing campaigns targeting financial institutions followed the same playbook. Victims were tricked into entering usernames and passwords, attackers collected the credentials, and accounts were compromised later when an opportunity arose. That model is changing. Recent investigations...

PYSEC-2026-3445

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows any authenticated user with KNOWLEDGEKNUPDATE permission to bypass Confidence Level validation and Object Marking...

PYSEC-2026-3445

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows any authenticated user with KNOWLEDGEKNUPDATE permission to bypass Confidence Level validation and Object Marking...

CVE-2026-35210

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows any authenticated user with KNOWLEDGEKNUPDATE permission to bypass Confidence Level validation and Object Marking...

CVE-2026-35210 OpenCTI: Authorization Bypass via `synchronized-upsert` HTTP Header Injection

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows any authenticated user with KNOWLEDGEKNUPDATE permission to bypass Confidence Level validation and Object Marking...

EUVD-2026-42430

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows any authenticated user with KNOWLEDGEKNUPDATE permission to bypass Confidence Level validation and Object Marking...

CVE-2026-35210

Summary: OpenCTI prior to version 7.260326.0 contains an authorization bypass via the synchronized-upsert: true HTTP header, exploitable by any authenticated user with KNOWLEDGE_KNUPDATE permission. This allows bypassing Confidence Level validation and Object Marking restrictions, enabling attack...

PT-2026-56601

Name of the Vulnerable Software and Affected Versions OpenCTI versions prior to 7.260326.0 Description An authorization bypass allows authenticated users with KNOWLEDGE KNUPDATE permission to circumvent Confidence Level validation and Object Marking restrictions. This is achieved by injecting the...