INTEL DROP Top 20 tools in Total Insights detection pipeline, ranked by the number of distinct IPs observed today per family. C2 by IP count: 1,200+ CyberStrikeAI 500+ VShell 400+ PureRAT 300+ Cobalt Strike 300+ Sliver 200+ AdaptixC2 200+ XWorm 200+ Metasploit 200+ DarkSword 200+ OverlordRAT 200+ Hak5 Cloud C2 200+ Mirai 200+ RemcosRAT 100+ Mythic 90+ QuasarRAT 70+ PlugX 70+ Stealc 60+ Havoc 50+ SuperShell 50+ AsyncRAT Offensive-security tools by IP count: 2,000+ Nessus 1,400+ ARL 1,400+ GoPhish 1,200+ ARTEX 1,200+ Interactsh 1,200+ Acunetix 600+ Burp Collaborator 400+ PentAGI 200+ Kali Linux 200+ Scope Sentry 200+ Java-Chains 80+ DeepAudit 60+ Hashtopolis 60+ reNgine 50+ Ligolo-ng 50+ Evilginx 40+ Xingrin 20+ Modlishka 10+ HTTP-revshell 10+ JspSpy **This is not meant to convey a detection priorities ranking and is purely statistical observation (with unknowns). All organizations detection priorities are unique. #TotalInsights #ThreatIntel #ThreatHunting #C2 team-cymru.com/total-insight…

#APT28 is using weaponized Office documents to deliver the Covenant Grunt backdoor. We detected a cluster of seven malicious .docm and .xls files between July 8 and July 14, with some having AV detection ratios as low as 5/62 at the time of first submission. Our THOR APT Scanner's YARA rules caught what traditional engines missed. The documents use obfuscated VBA macros that assemble strings at runtime to evade static analysis, perform XOR-encoded host reconnaissance, and drop a 64-bit Covenant Grunt loader DLL disguised as a log file. The campaign uses Russian-language lures like "Прайс.xls" (Price List) and business-themed filenames like "accounts.xls", consistent with APT28 targeting patterns. Network analysis shows Dropbox being used as C2 infrastructure. This activity aligns with Zscaler's reporting on Operation NeuSploit (CVE-2026-21509). Analysis & IOCs: github.com/NextronSystems/io…

One of the biggest victims of the Ledger theft was a scammer themselves. They lost more than 60BTC, about $4.8M. The funds were from a task scam. In this task scam, people were paid to fake sales and reviews of real items. Then a "negative balance" appeared, and they were told to add their own money in order to get paid. On Sep 22, the person behind the scam moved the proceeds into three separate Ledger addresses. On Oct 9, thieves emptied all three. One transfer each, into the same wallet. The wallet is reported as stolen funds.

Want to be a part of Team Cymru's Detection Team which creates the network tracking, signatures, and data enrichment behind many of our posts? We are looking for a US-based teammate (remote) that is obsessed with infrastructure hunting and is excellent at building things. Create hard times for bad people in order to save and improve lives. 😃 Apply below 👇 teamcymru.applytojob.com/app…

INTEL DROP AI-native offensive tooling is stacking on single hosts. Total Insights Feed detection pipeline currently sees 1,989 IPs running an AI pentest framework, and 48 of them run two or more. Many share IPs with classic C2, stolen AI API relays, and exposed gen-AI apps. A sample of 8, in the US, China, Hong Kong, Singapore, and Iran: 192.236.166.73 cyberstrikeai + artex + mythic + scopesentry + ai-relay:grok2api 192.253.229.113 cyberstrikeai + artex + pentagi + xingrin 149.104.24.91 cyberstrikeai + artex + arl + ai-relay:sub2api 151.243.126.22 cyberstrikeai + sliver + gen-ai:n8n + gen-ai:openclaw + ai-relay:new-api 103.101.176.236 cyberstrikeai + pentagi + malware-hosting + open-dir 64.20.61.134 pentagi + ai-relay:sub2api + ai-relay:grok2api + open-dir 1.14.104.208 pentagi + adaptixc2 + cobaltstrike 119.45.122.90 deepaudit + gen-ai:ollama + gen-ai:open-webui + gen-ai:openclaw + scanner Several also expose a Known-Exploited-Vulnerability service (kev-vulnerable) on the same host that runs the attack tooling. Happy hunting! #TotalInsights #ThreatIntel #AI #OffensiveSecurity #CyberStrikeAI team-cymru.com/total-insight…

INTEL DROP *daily double ARTEX is an open-source autonomous AI pentest platform, multi-agent software that plans attack paths, maps assets, and validates vulnerabilities without an operator. Total Insights has it running on 52 hosts that are also stood up as AI relay stations, the LLM API gateways built on sub2api, new-api, and grok2api. The same boxes proxy model access and run autonomous offensive automation. ARTEX + ai-relay:sub2api, 40 hosts stepping through two adjacent /24s at regular intervals (United States): 38.11.173.1 38.11.173.5 38.11.173.10 38.11.173.14 38.11.173.19 38.11.173.23 38.11.173.28 38.11.173.32 38.11.173.37 38.11.173.41 38.11.173.46 38.11.173.50 38.11.173.59 38.11.173.68 38.11.173.77 38.11.173.86 38.11.173.95 38.11.173.104 38.11.173.108 38.11.173.113 38.11.173.117 38.11.173.122 38.11.221.9 38.11.221.18 38.11.221.27 38.11.221.36 38.11.221.45 38.11.221.49 38.11.221.54 38.11.221.58 38.11.221.63 38.11.221.72 38.11.221.76 38.11.221.81 38.11.221.85 38.11.221.90 38.11.221.94 38.11.221.103 38.11.221.112 38.11.221.121 ARTEX + AI relay, spread across the US, Hong Kong, and China: 198.46.198.206 ost:artex + ai-relay:sub2api + vps 173.254.220.78 ost:artex + ai-relay:sub2api + vps 47.253.69.182 ost:artex + ai-relay:sub2api 47.82.118.105 ost:artex + ai-relay:sub2api 103.117.121.13 ost:artex + ai-relay:sub2api + socks 198.200.59.86 ost:artex + ai-relay:sub2api 14.103.211.223 ost:artex + ai-relay:new-api 103.116.247.42 ost:artex + ai-relay:new-api 81.71.120.246 ost:artex + ai-relay:new-api 154.12.94.223 ost:artex + ai-relay:grok2api Also running AI-driven C2 and recon: 192.236.166.73 ost:artex + ai-relay:grok2api + controller:cyberstrikeai + controller:mythic + ost:scopesentry + vps 149.104.24.91 ost:artex + ai-relay:sub2api + controller:cyberstrikeai + ost:arl + risknet + vps Block the set. Prioritize the two hosts running AI-driven C2 and the two /24s. #TotalInsights #ThreatIntel #ARTEX #AIsecurity team-cymru.com/total-insight…

INTEL DROP FlowerStorm phishing, 1,354 domains in the Total Insights Feed, all malicious. The kit is phishing-as-a-service built for adversary-in-the-middle theft of Microsoft 365 logins and MFA tokens. Two naming patterns run side by side. Throwaway numeric strings on cheap TLDs: 1419993777[.]cyou 1606837286[.]cyou 1874912064[.]cyou 2071486361jhute45r[.]cyou 5043990463kjh[.]cyou 5044298614[.]cyou 5140390597[.]cyou 5247145664[.]cyou 2008377162[.]cfd 460595718[.]cfd 5889631857[.]cfd 1035362455[.]sbs 5767896359[.]sbs Lure-style business phrases, mostly on .de: adaptableinfrastructure[.]de architectureinnovationhub[.]de boostingcustomerjoy[.]de brandstrengththroughconsistency[.]de brewingwithoutagenda[.]de buildforgrowth[.]de chartwells-consulting[.]com Most carry low rep TLDs, and the random-suffix names also trip our high-entropy detection process. Block the set and check M365 sign-in logs for AiTM sessions against these domains. #TotalInsights #ThreatIntel #FlowerStorm #Phishing team-cymru.com/total-insight…

INTEL DROP DarkSword C2 controllers, 43 hosts in the Total Insights detection pipeline across 26 networks in Hong Kong, the United States, Singapore, China, Japan, Brazil, and South Korea. Hosting skews heavily to APAC. 8.210.67.79 35.203.134.133 38.60.125.123 38.181.56.130 43.98.165.114 43.108.57.27 43.136.35.215 43.160.231.87 43.165.167.94 43.255.28.208 45.192.110.60 47.236.83.240 47.254.120.61 64.90.13.176 89.125.43.163 103.27.79.231 103.30.78.49 103.52.153.142 103.230.240.83 103.242.2.144 103.254.148.169 107.149.129.212 107.175.49.181 112.213.103.111 112.213.108.85 112.213.110.214 118.107.35.196 118.107.35.248 154.18.187.160 154.23.141.210 154.36.167.198 156.238.120.147 157.119.103.204 162.4.136.30 162.251.94.208 167.104.101.115 186.244.231.115 191.40.37.39 192.253.229.191 206.238.20.42 208.87.200.68 209.222.251.117 210.126.235.135 Sharing the host with other C2 and tooling: 38.181.56.130 controller:darksword + controller:cyberstrikeai + ost:pentagi 47.236.83.240 controller:darksword + controller:cobaltstrike + malware-hosting Also flagged kev-vulnerable: 43.165.167.94 89.125.43.163 118.107.35.248 157.119.103.204 162.251.94.208 206.238.20.42 Two in the same /24: 118.107.35.196, 118.107.35.248 Block the set and hunt for beacons to these controllers. #TotalInsights #ThreatIntel #DarkSword #C2 team-cymru.com/total-insight…

Putin casts online vote in Russia’s State Duma elections.