Last Week in Threats: Week 36

The Hunting Takeaway

This week's exploitation of developer and AI tooling (LiteLLM, Starlette) and the surge in browser-based delivery mechanisms (IClickFix, ClearFake) point to a single behavioral hunting angle: anomalous outbound connections from trusted internal applications. When an attacker compromises a Python web service via CVE-2026-48710 or establishes an unauthenticated session in an AI platform via CVE-2026-59822, the next step is lateral movement or data exfiltration, both of which produce network connections from processes that normally only listen for inbound traffic or communicate with a narrow set of internal dependencies.

Hunt for outbound connections from developer tooling, AI frameworks, and Python web services to unexpected external destinations, especially to known hosting networks (DigitalOcean, Linode, Driftnet) or to IP addresses with no prior communication history. Focus on processes running under service accounts or application pools, and look for connections to non-standard ports (anything other than 80, 443, or documented API endpoints). This behavioral pattern catches post-exploitation activity regardless of the specific CVE or malware family.

Splunk SPL

index=network sourcetype=firewall OR sourcetype=proxy OR sourcetype=pan:traffic
| where match(src_process, "(?i)(python|uvicorn|gunicorn|litellm|starlette)")
| where NOT (dest_ip="10.0.0.0/8" OR dest_ip="172.16.0.0/12" OR dest_ip="192.168.0.0/16")
| where dest_port!=80 AND dest_port!=443
| stats count by src_host, src_process, dest_ip, dest_port, dest_country
| where count < 5
| sort - count

Microsoft KQL

CommonSecurityLog
| where DeviceVendor has_any ("Palo Alto", "Cisco", "Fortinet", "Check Point")
| where ProcessName has_any ("python", "uvicorn", "gunicorn", "litellm", "starlette")
| where DestinationIP !startswith "10." and DestinationIP !startswith "172.16." and DestinationIP !startswith "192.168."
| where DestinationPort != 80 and DestinationPort != 443
| summarize ConnectionCount = count() by SourceIP, ProcessName, DestinationIP, DestinationPort, DestinationCountry
| where ConnectionCount < 5
| order by ConnectionCount desc

Note: These queries were generated with AI assistance and are a starting point, not a verdict. A query that returns no results does not mean the threat is absent. Confirm that the referenced indexes, sourcetypes, and field names exist in your environment, that the relevant data is actually being ingested, and that names match your schema (watch for spelling and naming drift). Validate against your own ingest and audit trails before drawing conclusions.