Last Week in Threats Banner

Last Week in Threats: Week 41

Published on October 12, 2026 | By Focused Hunts

Bottom Line

What changed this week: Ransomware postings declined 8.4% to 197 victims while attacker infrastructure shifted toward hosting providers. The top 10 rankings added six new groups, and AI endpoint attacks reached 524 distinct addresses.

Who is most exposed: Manufacturing, professional services, and healthcare organizations face continued ransomware pressure. Organizations running ProFTPD, BIND, Apache Struts, ONLYOFFICE Docs, and Strapi face actively exploited vulnerabilities already past CISA's patching deadline.

Recommended action: Patch the five new KEV entries immediately, prioritize hunting for hosting-provider infrastructure abuse, and monitor AI endpoints for credential harvesting and Model Context Protocol scanning.

Week in Review

The week of October 5 to 11, 2026 saw ransomware postings fall to 197 victims, down from 215 the previous week (ransomware.live, pulled 2026-10-12). Despite the 8.4% decline, six new groups entered the top 10 rankings, suggesting operational churn among threat actors. The United States remained the dominant target with 63 victims, while 34 postings showed no identified country.

Attackers favored hosting infrastructure at 75%, with nine of 12 enriched addresses originating from data centers rather than residential or business networks (AbuseIPDB, RIPEstat, pulled 2026-10-12). CISA added five vulnerabilities to the Known Exploited Vulnerabilities catalog, all tied to decade-old flaws in ProFTPD, BIND, and Apache Struts, with due dates already past by the time this edition published. AI endpoints faced 524 distinct attacker addresses, with 159 new arrivals this week targeting Model Context Protocol implementations and credential stores.

Ransomware Activity

Most Active Groups

The group thegentlemen topped the week with 34 victim postings, unchanged from the prior week (ransomware.live, pulled 2026-10-12). Qilin surged 57.1% to 22 victims, up from 14 the previous week. The new group N0n, first observed on September 18, posted 17 victims and claimed third place. Safepay added 12 victims, and UmBra, active for only five days since its October 6 debut, posted 10.

This week's rankings included six new groups: N0n, UmBra, SilentRansomGroup, BYOD, Eclipse, and Panzer. Only four groups persisted from the prior week: thegentlemen, qilin, safepay, and incransom. The group incransom dropped 50% to five victims, and six prior-week groups fell out of the rankings entirely.

Victim Postings by Week

Ransomware postings declined 8.4% week over week, from 215 to 197. The nine-week trend shows volatility, with a low of 146 victims in week 39 and a peak of 242 in weeks 33 and 34.

Most Active Groups by Victim Postings

thegentlemen 34 qilin 22 N0n 17 safepay 12 UmBra 10 SilentRansomGroup 8 BYOD 7 Eclipse 6

Victim Postings by Week

242 W33 242 W34 207 W35 166 W36 162 W37 185 W38 146 W39 215 W40 197 W41

Industry and Technology

Manufacturing led with 27 victims, followed by professional services (26) and healthcare (24) (ransomware.live, pulled 2026-10-12). Technology organizations accounted for 20 victims, and education took 18. The feed marked 50 victims as unclassified, a substantial gap in sector attribution.

Technology classes hit this week included ProFTPD, BIND, Apache Struts, ONLYOFFICE Docs, and Strapi. All five tied directly to CISA's new KEV entries for the week.

Most-Targeted Industries

The distribution shows manufacturing and professional services nearly tied, with healthcare close behind. Transportation, financial services, and retail each drew fewer than 10 victims.

Most-Targeted Industries

Manufacturing 27 Professional Services 26 Healthcare 24 Technology 20 Education 18 Transportation 8 Financial Services 6 Retail Hospitality 6

Indicator Watch

AbuseIPDB listed 12 addresses with behavior dominated by email and credential brute-force, port and network scanning, SSH attacks, and web application exploitation. Sampled addresses showed uniform coverage, with six hitting all four threat categories plus exploited hosts and open proxies.

Attacker Infrastructure

Hosting providers dominated the attacker landscape, with AbuseIPDB categorizing nine of 12 enriched addresses as hosting infrastructure and RIPEstat providing network ownership data. Among the minority, two addresses originated from residential ISPs and one from a business network. The hosting concentration suggests deliberate infrastructure procurement rather than compromised consumer devices. None of the 12 addresses appeared in abuse.ch ThreatFox or URLhaus malware-infrastructure feeds.

Hosting Providers

  • AS48090 DMZHOST TECHOFF SRV LIMITED: 45.148.10.151, 195.178.110.30
  • AS209425 KOI CLOUD SERVICES (Pty) Ltd: 62.60.134.210
  • AS202412 Omegatech LTD: 178.16.54.197
  • AS37963 Hangzhou Alibaba Advertising Co.,Ltd.: 116.62.112.163
  • AS396982 Google LLC: 34.52.169.28, 34.77.5.56, 136.86.191.175
  • AS51167 Contabo GmbH: 80.241.217.38

Residential Networks

  • AS4134 No.31,Jin-rong Street: 221.229.220.180
  • AS328539 Giga for Telecommunication: 102.38.3.104

Business Networks

  • AS63961 Bangladesh Research and: 103.159.2.113

Vulnerability Watch

CISA added five vulnerabilities to the Known Exploited Vulnerabilities catalog on October 8, all with due dates of October 11 (CISA KEV, pulled 2026-10-12). By the time this edition published on October 12, all five were one day past the patching deadline. CVE-2015-3306 (ProFTPD improper access control), CVE-2015-5477 (ISC BIND data processing errors), and CVE-2016-3081 (Apache Struts command injection) each showed high FIRST EPSS exploitation probability scores above 96th percentile, with AlienVault OTX tracking eight to 10 threat intelligence pulses per CVE.

CVE-2021-3199 targets ONLYOFFICE Docs with a path traversal flaw, and CVE-2023-22894 exposes Strapi deployments to cleartext storage of sensitive information. All five entries show unknown ransomware-use status.

Malware Infrastructure

Abuse.ch ThreatFox recorded 3,190 total indicators of compromise in a three-day window ending October 12, 2026, with 944 fresh command-and-control addresses (abuse.ch ThreatFox, pulled 2026-10-12). The counts represent a floor, as the live pull may include days after the week closed. ClearFake led with 455 IOCs, followed by Mirai (404), Vidar (358), and IClickFix (339). Cobalt Strike accounted for 79 IOCs, while PHP.shin and VShell webshells contributed 146 and 144 respectively.

Cross-feed correlation showed one sampled C2 address from ThreatFox also appearing in AbuseIPDB reports (AbuseIPDB, pulled 2026-10-12).

  • Active C2 servers also reported for abuse: one server of one checked against AbuseIPDB

AI Infrastructure Attacks

AI endpoints faced 524 distinct attacker addresses in a 28-day window, with 159 new arrivals this week and 365 persistent from prior periods (AI Honeypot Observatory, pulled 2026-10-12). Network reconnaissance (MITRE ATT&CK T1046) covered all 524 addresses, followed by exploitation of public-facing applications (T1190, 168 addresses), credential access in unsecured stores (T1552.001, 120 addresses), and application layer protocol abuse (T1102, 104 addresses).

AI-Endpoint Attacker Categories

Mcp Scanner 168 Credential Harvester 114 Scanner Mass 107 Relay Customer 69 Scanner Enum 43 Identity Prober 12 Relay Verifier 6 Relay Cataloger 5

Hunting Takeaway

Organizations hosting internet-facing services should hunt for lateral movement and reconnaissance originating from known hosting-provider ASNs. The 75% hosting-infrastructure dominance in this week's attacker addresses suggests adversaries are procuring commercial infrastructure rather than relying on compromised residential endpoints. Focus on outbound connections from web servers, FTP services, and DNS resolvers that target internal networks or exfiltrate data to hosting providers.

Splunk SPL Query

| tstats summariesonly=false count from datamodel=Network_Traffic.All_Traffic where earliest=-7d (All_Traffic.src_category="dmz" OR All_Traffic.src_category="web_server") (All_Traffic.dest_category="internal" OR All_Traffic.dest_category!="dmz") by All_Traffic.src, All_Traffic.dest, All_Traffic.dest_port, All_Traffic.action
| rename All_Traffic.* AS *
| where action="allowed"
| stats count by src, dest, dest_port

Microsoft KQL Query

DeviceNetworkEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in ("proftpd", "named", "httpd", "apache2", "nginx")
| where RemoteIPType == "Public"
| summarize ConnectionCount = count(), UniqueDestinations = dcount(RemoteIP) by DeviceName, InitiatingProcessFileName, RemoteIP
| where UniqueDestinations > 5

Note: These queries were generated with AI assistance and are a starting point for threat hunting and detection rule considerations.

Environment Sweep

The checks below cover 15 risk-ranked IP addresses from this week's AbuseIPDB feed, with live command-and-control infrastructure prioritized first, followed by addresses confirmed by independent sources and high report volume. Known benign scanners and research infrastructure were removed. The queries also include 10 domains and 10 file hashes from abuse.ch ThreatFox, and a patch verification for the five new CISA KEV entries (CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2021-3199, CVE-2023-22894), ranked by ransomware linkage and overdue status.

No results from these queries does not mean no threat. These checks sweep for known indicators only; behavioral hunting and anomaly detection remain essential.

Sweep for this week's malicious IPs

Splunk (CIM Network_Traffic)

| tstats summariesonly=false count min(_time) AS first_seen max(_time) AS last_seen
    from datamodel=Network_Traffic.All_Traffic
    where earliest=-30d (All_Traffic.dest_ip IN ("50.16.16.211", "159.65.67.52", "206.189.164.5", "94.237.14.115", "77.42.10.33", "217.60.102.185", "212.147.244.162", "188.245.3.116", "45.148.10.151", "195.178.110.30", "221.229.220.180", "103.159.2.113", "62.60.134.210", "102.38.3.104", "178.16.54.197") OR All_Traffic.src_ip IN ("50.16.16.211", "159.65.67.52", "206.189.164.5", "94.237.14.115", "77.42.10.33", "217.60.102.185", "212.147.244.162", "188.245.3.116", "45.148.10.151", "195.178.110.30", "221.229.220.180", "103.159.2.113", "62.60.134.210", "102.38.3.104", "178.16.54.197"))
    by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.action
| rename All_Traffic.* AS *
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Microsoft Defender XDR (advanced hunting)

let SweepIPs = dynamic(["50.16.16.211", "159.65.67.52", "206.189.164.5", "94.237.14.115", "77.42.10.33", "217.60.102.185", "212.147.244.162", "188.245.3.116", "45.148.10.151", "195.178.110.30", "221.229.220.180", "103.159.2.113", "62.60.134.210", "102.38.3.104", "178.16.54.197"]);
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteIP in (SweepIPs)
| summarize Hits = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Processes = make_set(InitiatingProcessFileName, 10) by DeviceName, RemoteIP, RemotePort, ActionType
| order by Hits desc

Microsoft Sentinel (firewall and proxy logs via CEF)

let SweepIPs = dynamic(["50.16.16.211", "159.65.67.52", "206.189.164.5", "94.237.14.115", "77.42.10.33", "217.60.102.185", "212.147.244.162", "188.245.3.116", "45.148.10.151", "195.178.110.30", "221.229.220.180", "103.159.2.113", "62.60.134.210", "102.38.3.104", "178.16.54.197"]);
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where DestinationIP in (SweepIPs) or SourceIP in (SweepIPs)
| summarize Hits = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceVendor, DeviceProduct, SourceIP, DestinationIP, DestinationPort, DeviceAction
| order by Hits desc

Sweep for this week's C2 and payload domains

Splunk (CIM Network_Resolution)

| tstats summariesonly=false count min(_time) AS first_seen max(_time) AS last_seen
    from datamodel=Network_Resolution.DNS
    where earliest=-30d DNS.query IN ("eventation.site", "fwuepkv2.aryl.cloud", "drvto.site", "eyxiukwn.aryllabs.com", "careertools.in", "cap.camp-cantina.com", "wsl5y6zq.aryl.app", "rclop3ch.aryllab.com", "truenarrator.com", "bnr1b90s.kaarenorge.com")
    by DNS.src DNS.query DNS.answer
| rename DNS.* AS *
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Microsoft Defender XDR (advanced hunting)

let SweepDomains = dynamic(["eventation.site", "fwuepkv2.aryl.cloud", "drvto.site", "eyxiukwn.aryllabs.com", "careertools.in", "cap.camp-cantina.com", "wsl5y6zq.aryl.app", "rclop3ch.aryllab.com", "truenarrator.com", "bnr1b90s.kaarenorge.com"]);
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteUrl has_any (SweepDomains)
| summarize Hits = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Processes = make_set(InitiatingProcessFileName, 10) by DeviceName, RemoteUrl, RemoteIP
| order by Hits desc

Sweep for this week's malware hashes

Splunk (CIM Endpoint.Filesystem)

| tstats summariesonly=false count min(_time) AS first_seen max(_time) AS last_seen
    from datamodel=Endpoint.Filesystem
    where earliest=-30d Filesystem.file_hash IN ("8eea5c63a95c5ba54e08af8162ed6b09dbb35493050f27396fd924fd3f8c3798", "1bb4fbf5df215757d7a6b1f9601515ec4e12a41c4d695e17898793db2e5b38a8", "6ace19d81500192e18a25f9b42068e116c20f541ae51f49a1ac2638605081963", "b22e4c920695bb35526ff1173f8a8344190576228af1791d941c54ca60fc01e3", "7bd6aa495ec7595c0576d069e8274e2372f218b6e79ee71c9100cf5c541b24ed", "a45e7396cd5e64cf9ea7567f0e8d56d4a41c4b1b168981f8f0fb33e7e2a3dce5", "099b7a77393c03cc3c43e52ca4d0986c8130004942039d17dd8383ed3d44453f", "9a64950f2bb05730b62ce2be6324e9be31efee78b581bdcb609249a9077b75cd", "a034ecf08ffbe1edf05c172d81b0b3d995530736e79a38a12f9eb543cc7cc296", "ced646eeb7559d7e703025a689222719f43756c8b55d4c1f007a2b2f097fefb4")
    by Filesystem.dest Filesystem.file_path Filesystem.file_name Filesystem.file_hash
| rename Filesystem.* AS *
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Microsoft Defender XDR (advanced hunting)

let SweepHashes = dynamic(["8eea5c63a95c5ba54e08af8162ed6b09dbb35493050f27396fd924fd3f8c3798", "1bb4fbf5df215757d7a6b1f9601515ec4e12a41c4d695e17898793db2e5b38a8", "6ace19d81500192e18a25f9b42068e116c20f541ae51f49a1ac2638605081963", "b22e4c920695bb35526ff1173f8a8344190576228af1791d941c54ca60fc01e3", "7bd6aa495ec7595c0576d069e8274e2372f218b6e79ee71c9100cf5c541b24ed", "a45e7396cd5e64cf9ea7567f0e8d56d4a41c4b1b168981f8f0fb33e7e2a3dce5", "099b7a77393c03cc3c43e52ca4d0986c8130004942039d17dd8383ed3d44453f", "9a64950f2bb05730b62ce2be6324e9be31efee78b581bdcb609249a9077b75cd", "a034ecf08ffbe1edf05c172d81b0b3d995530736e79a38a12f9eb543cc7cc296", "ced646eeb7559d7e703025a689222719f43756c8b55d4c1f007a2b2f097fefb4"]);
union DeviceFileEvents, DeviceProcessEvents
| where Timestamp > ago(30d)
| where SHA256 in (SweepHashes)
| summarize Hits = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Paths = make_set(FolderPath, 10) by DeviceName, FileName, SHA256
| order by Hits desc

Check exposure to this week's KEV additions

Splunk (CIM Vulnerabilities, from your scanner add-on)

| tstats summariesonly=false count
    from datamodel=Vulnerabilities.Vulnerabilities
    where earliest=-30d Vulnerabilities.cve IN ("CVE-2015-3306", "CVE-2015-5477", "CVE-2016-3081", "CVE-2021-3199", "CVE-2023-22894")
    by Vulnerabilities.dest Vulnerabilities.cve Vulnerabilities.signature Vulnerabilities.severity
| rename Vulnerabilities.* AS *
| sort cve, dest

Microsoft Defender Vulnerability Management

let PatchCVEs = dynamic(["CVE-2015-3306", "CVE-2015-5477", "CVE-2016-3081", "CVE-2021-3199", "CVE-2023-22894"]);
DeviceTvmSoftwareVulnerabilities
| where CveId in (PatchCVEs)
| summarize Devices = dcount(DeviceId), DeviceNames = make_set(DeviceName, 20) by CveId, SoftwareVendor, SoftwareName, VulnerabilitySeverityLevel, RecommendedSecurityUpdate
| order by Devices desc

Note: These queries were generated with AI assistance and are a starting point for threat hunting and detection rule considerations.

Related Resources

Appendix: Raw Tables

Top Ransomware Groups

ransomware.live, pulled 2026-10-12

GroupVictim CountChange from Prior Week
thegentlemen340 (0.0%)
qilin22+8 (+57.1%)
N0n17new to the top ranks
safepay12+1 (+9.1%)
UmBra10new to the top ranks
SilentRansomGroup8new to the top ranks
BYOD7new to the top ranks
Eclipse6new to the top ranks
Panzer5new to the top ranks
incransom5-5 (-50.0%)

Most-Reported Malicious IPs

AbuseIPDB 100% confidence, pulled 2026-10-12; network ownership from RIPEstat (RIR registry data); scan verdict from GreyNoise Community

IP AddressCountryOrigin TypeASN / OwnerTotal ReportsReportersLast ReportedGreyNoise
45.148.10.151NLhostingAS48090 DMZHOST TECHOFF SRV LIMITED2097099662026-10-12lookup failed
195.178.110.30NLhostingAS48090 DMZHOST TECHOFF SRV LIMITED1067803672026-10-12lookup failed
103.159.2.113BDbusinessAS63961 Bangladesh Research and634310192026-10-12lookup failed
221.229.220.180CNresidentialAS4134 No.31,Jin-rong Street36119352026-10-12lookup failed
62.60.134.210LThostingAS209425 KOI CLOUD SERVICES (Pty) Ltd30683592026-10-12lookup failed
102.38.3.104LYresidentialAS328539 Giga for Telecommunication14692162026-10-12lookup failed
178.16.54.197NLhostingAS202412 Omegatech LTD4611862026-10-12lookup failed
116.62.112.163CNhostingAS37963 Hangzhou Alibaba Advertising Co.,Ltd.3931462026-10-12lookup failed
80.241.217.38FRhostingAS51167 Contabo GmbH113972026-10-12lookup failed
34.52.169.28BEhostingAS396982 Google LLC80652026-10-12lookup failed
34.77.5.56BEhostingAS396982 Google LLC51442026-10-12lookup failed
136.86.191.175UShostingAS396982 Google LLC28272026-10-12lookup failed

Attacker Networks

network ownership from RIPEstat (RIR registry data), report volume from AbuseIPDB, pulled 2026-10-12

ASNProvider / ISPOrigin ClassIP CountTotal Reports
AS396982Google LLChosting3159
AS48090DMZHOST TECHOFF SRV LIMITEDhosting2316489
AS63961Bangladesh Research andbusiness16343
AS4134No.31,Jin-rong Streetresidential13611
AS209425KOI CLOUD SERVICES (Pty) Ltdhosting13068
AS328539Giga for Telecommunicationresidential11469
AS202412Omegatech LTDhosting1461
AS37963Hangzhou Alibaba Advertising Co.,Ltd.hosting1393
AS51167Contabo GmbHhosting1113

New KEV Additions

CISA Known Exploited Vulnerabilities catalog, pulled 2026-10-12; in-the-wild pulse counts from AlienVault OTX; exploitation probability from FIRST EPSS, as of 2026-10-11

CVEVendor / ProductVulnerability TypeDate AddedDue DateEPSS
CVE-2015-3306ProFTPD ProFTPDProFTPD Improper Access Control Vulnerability (eight OTX pulses)2026-10-082026-10-110.99 (100th pct)
CVE-2015-5477ISC BIND ISC BIND Data Processing Errors Vulnerability (nine OTX pulses)2026-10-082026-10-110.99 (100th pct)
CVE-2016-3081Apache StrutsApache Struts Command Injection Vulnerability (10 OTX pulses)2026-10-082026-10-110.96 (100th pct)
CVE-2021-3199ONLYOFFICE DocsONLYOFFICE Docs Server Path Traversal Vulnerability (10 OTX pulses)2026-10-082026-10-110.19 (97th pct)
CVE-2023-22894Strapi StrapiStrapi Cleartext Storage of Sensitive Information Vulnerability (eight OTX pulses)2026-10-082026-10-110.04 (89th pct)

Top Malware Families

abuse.ch ThreatFox, three-day window ending 2026-10-12

FamilyIOC Count
ClearFake455
Mirai404
Vidar358
IClickFix339
Unknown malware242
php.shin_webshell146
VShell144
Cobalt Strike79
Unknown Loader76
DanaBot73

AI-Endpoint Attacker IOCs

AI Honeypot Observatory, 28-day feed window pulled 2026-10-12; INFRA-COLLISION rows excluded and Total Hits is the feed's rolling-window magnitude, not a per-week count; the feed returned its 1,000-row cap, so lower-volume attackers are missing and every count is a floor

IP AddressActor CategoryConfidenceMITRE TTPsTotal Hits (feed window)First SeenLast Seen
118.194.252.175RELAY-CUSTOMERvery-highT1046, T11021310472026-09-142026-10-11
154.37.208.58SCANNER-MASSvery-highT1046944712026-09-142026-10-12
43.156.79.80RELAY-CUSTOMERvery-highT1046, T1102515022026-09-142026-10-12
104.168.115.214IDENTITY-PROBERvery-highT1046, T1592250272026-09-142026-10-11
187.14.116.152RELAY-CUSTOMERvery-highT1046, T1102175902026-10-022026-10-05
20.5.41.14RELAY-CUSTOMERvery-highT1046, T1102117032026-09-182026-10-12
23.95.226.221SCANNER-ENUMvery-highT1046, T110267922026-09-142026-10-11
187.40.231.196RELAY-CUSTOMERvery-highT1046, T110263312026-10-052026-10-06
101.42.172.53RELAY-CUSTOMERvery-highT1046, T110240862026-09-142026-10-12
32.216.141.74SCANNER-ENUMvery-highT1046, T110237722026-09-262026-10-12
47.84.122.196SCANNER-MASSvery-highT104636152026-09-282026-10-09
149.28.142.11IDENTITY-PROBERvery-highT1046, T159226622026-09-142026-10-12
118.89.77.121SCANNER-ENUMvery-highT1046, T110224372026-09-182026-10-12
139.162.13.223MCP-SCANNERvery-highT1046, T1190, T1552.00123622026-10-042026-10-10
108.165.95.17SCANNER-MASSvery-highT104622742026-10-102026-10-12
108.186.84.69CREDENTIAL-HARVESTERvery-highT1046, T1552.00121092026-09-212026-10-12
185.177.72.29CREDENTIAL-HARVESTERhighT1046, T1552.00119192026-10-092026-10-09
84.247.152.177RELAY-CATALOGERhighT1046, T110218092026-09-192026-10-10
151.243.181.203RELAY-VERIFIERhighT1046, T1102, T107815732026-09-242026-10-12
193.32.204.199CREDENTIAL-HARVESTERhighT1046, T1552.00114802026-09-142026-10-07
108.186.84.20CREDENTIAL-HARVESTERhighT1046, T1552.00113282026-09-292026-10-12
130.210.17.176SCANNER-MASShighT104613172026-09-242026-10-12
209.112.91.74CREDENTIAL-HARVESTERhighT1046, T1552.00113052026-09-142026-10-12
185.177.72.67CREDENTIAL-HARVESTERhighT1046, T1552.00113012026-10-092026-10-09
5.83.129.153CREDENTIAL-HARVESTERhighT1046, T1552.00112272026-09-142026-10-11

Methodology and Sources

This report is built entirely from open-source threat intelligence: public ransomware leak-site activity, community IP-reputation data, registry network ownership and hosting-type classification of the reported addresses, the government catalog of actively exploited vulnerabilities, community exploitation-probability scores, malware and command-and-control indicator feeds, and honeypot observations of attacks on AI service endpoints. Figures are aggregated across these public sources, cross-referenced, and captured as a point-in-time snapshot. They are aggregate public statistics, not original Focused Hunts detections, and each traces back to its source and to the raw snapshot retained for this edition.

Confirmed listings are kept separate from actor claims, and partial counts are reported as a floor. Week-over-week trends are drawn once successive snapshots support them.

Reported addresses that belong to known benign infrastructure (internet-measurement scanners confirmed by forward DNS, search and AI crawlers inside their operators' published ranges, and addresses GreyNoise classifies benign) are left out of the attacker figures and listed under the IP table instead.

Feeds unavailable for this edition: RansomLook (corroborate_groups() missing 1 required positional argument: 'look_groups'). The affected sections are omitted rather than estimated.

← Back to Last Week in Threats