Last Week in Threats Banner

Last Week in Threats: Week 42

Published on October 19, 2026 | By Focused Hunts

Bottom Line

What changed this week: The N0n ransomware group posted 84 victims between October 12 and 18, 2026, up from 17 the prior week. CISA added nine new vulnerabilities to the Known Exploited Vulnerabilities catalog, seven of which were already past their remediation deadlines when this edition published.

Who is most exposed: Transportation operators faced the most ransomware postings, followed by technology, manufacturing, professional services and healthcare organizations. Remote access, network edge and collaboration tools used across critical infrastructure are targeted by seven KEV entries.

Recommended action: Patch the nine KEV entries immediately, prioritizing Ivanti Connect Secure and Palo Alto Networks PAN-OS. Hunt for unusual outbound connections from affected services and monitor AI infrastructure for mass scanning and credential harvesting.

Week in Review

The week of October 12 to 18, 2026 delivered a sharp surge in ransomware activity, with 292 victims posted across public leak sites, up 48.2% from 197 the prior week (ransomware.live, pulled 2026-10-19). The N0n group drove the increase, posting 84 victims after listing just 17 in the previous seven days. CISA added nine vulnerabilities to the KEV catalog, targeting VPN gateways, firewalls, email security and collaboration platforms. Attackers probed AI infrastructure at scale, with 1,277 distinct addresses targeting model endpoints and embedding services, primarily through mass scanning and credential harvesting.

Ransomware Activity

N0n claimed 84 victims this week, up 394.1% from 17 the prior week (ransomware.live, pulled 2026-10-19). The group's first observed activity dates to September 18, 2026, with 120 total victims recorded through October 19. Thegentlemen posted 39 victims, up from 34, and Qilin posted 28, up from 22. Wallstreet, akira, play, lockbit5, iah6477 and Orova entered the top 10 for the first time. The United States led victim geography with 93 postings, followed by 41 victims whose country could not be determined, South Korea with 16, Brazil with 16 and Sweden with 10.

Most Active Groups by Victim Postings

N0n 84 thegentlemen 39 qilin 28 Wallstreet 15 akira 9 play 9 lockbit5 9 iah6477 8

Victim Postings by Week

242 W33 242 W34 207 W35 166 W36 162 W37 185 W38 146 W39 215 W40 197 W41 292 W42

Sector and Technology Watch

Transportation operators faced 43 ransomware victim postings this week, the highest of any industry (ransomware.live, pulled 2026-10-19). Technology, manufacturing, professional services and healthcare organizations each recorded 32 postings. Retail and hospitality saw 13, financial services 12, and energy and utilities 10. Education recorded nine, agriculture and food eight, and government four. A total of 65 victims could not be classified by sector. The week's KEV additions target remote access and VPN (Ivanti Connect Secure), operating systems (Windows), network edge and firewall (PAN-OS, Fortinet), backup (AhsayCBS), email security (Cisco Secure Email Gateway), collaboration (Atlassian) and remote support (BeyondTrust).

Most-Targeted Industries

Transportation 43 Technology 32 Manufacturing 32 Professional Services 32 Healthcare 32 Retail Hospitality 13 Financial Services 12 Energy Utilities 10

IOC Watch

AbuseIPDB listed 12 addresses with elevated abuse confidence this week. The dominant behaviours were email and credential brute-force attacks and port scanning, each observed across five distinct addresses. SSH brute-force and web application attacks each appeared across four addresses.

  • 45.148.10.151 (NL): AS48090 DMZHOST TECHOFF SRV LIMITED, hosting, 209,261 reports, also flagged by GreyNoise Community (malicious)
  • 80.94.92.234 (RO): AS47890 UNMANAGED LTD, ISP TECHOFF SRV LIMITED, hosting, 47,334 reports, also flagged by GreyNoise Community (malicious)
  • 51.75.27.218 (FR): AS16276 OVH SAS, hosting, 7,952 reports, also flagged by GreyNoise Community (malicious)
  • 216.219.89.86 (US): AS19318 Interserver, Inc, ISP Host Department NJ, LLC, hosting, 3,849 reports, also flagged by GreyNoise Community (malicious)
  • 104.237.156.209 (US): AS63949 Akamai Connected Cloud, ISP Linode, hosting, 3,418 reports, also flagged by SANS ISC DShield sensors
  • 203.205.37.233 (VN): AS45903 CMC Telecom Infrastructure Company, residential, 3,372 reports, also flagged by GreyNoise Community (malicious)
  • 218.0.63.25 (CN): AS58461 No.288,Fu-chun Road, ISP CHINANET Zhejiang province network, hosting, 3,140 reports, also flagged by GreyNoise Community (malicious)
  • 172.234.192.12 (US): AS63949 Akamai Connected Cloud, ISP Linode, hosting, 3,100 reports
  • 109.160.32.144 (DE): AS198364 BANATSYNC SRL, ISP Global Communication Net Plc, hosting, 2,817 reports, also flagged by GreyNoise Community (malicious)
  • 103.113.170.231 (ID): AS137352 PT. Cloudata Indonesia, ISP Cloudata Indonesia, PT, hosting, 1,043 reports, also flagged by GreyNoise Community (malicious) and SANS ISC DShield sensors
  • 152.32.172.191 (HK): AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, hosting, 623 reports, also flagged by GreyNoise Community (malicious)
  • 49.124.147.253 (MY): AS4818 DiGi Telecommunications Sdn. Bhd., residential, 353 reports

Attacker Infrastructure

Hosting providers accounted for 10 of the 12 addresses, with two from residential ISPs. The hosting concentration suggests provider-side infrastructure rather than compromised consumer endpoints. None of the 12 addresses checked against abuse.ch ThreatFox and URLhaus databases were also listed as malware command-and-control or distribution infrastructure (abuse.ch, checked 2026-10-19). Network ownership data from RIPEstat shows two addresses under Akamai Connected Cloud (AS63949), with the remaining 10 distributed across separate autonomous systems.

Hosting Providers

  • AS48090 DMZHOST TECHOFF SRV LIMITED: 45.148.10.151
  • AS47890 UNMANAGED LTD: 80.94.92.234
  • AS16276 OVH SAS: 51.75.27.218
  • AS63949 Akamai Connected Cloud: 104.237.156.209, 172.234.192.12
  • AS19318 Interserver, Inc: 216.219.89.86
  • AS58461 No.288,Fu-chun Road: 218.0.63.25
  • AS198364 BANATSYNC SRL: 109.160.32.144
  • AS137352 PT. Cloudata Indonesia: 103.113.170.231
  • AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED: 152.32.172.191

Residential Networks

  • AS45903 CMC Telecom Infrastructure Company: 203.205.37.233
  • AS4818 DiGi Telecommunications Sdn. Bhd.: 49.124.147.253

Vulnerability Watch

CISA added nine vulnerabilities to the KEV catalog between October 13 and 16, 2026. The catalog listed seven vulnerabilities already past their remediation deadlines when this edition published: CVE-2026-104935 (Ivanti Connect Secure authentication bypass, three days overdue), CVE-2026-96951 (Microsoft Windows command injection, three days overdue), CVE-2026-0322 (Palo Alto Networks PAN-OS code injection, two days overdue), CVE-2026-105133 and CVE-2026-105134 (Ahsay AhsayCBS improper authentication and command injection, both two days overdue), CVE-2026-76519 (Cisco Secure Email Gateway path traversal, two days overdue) and CVE-2026-21589 (Atlassian multiple products, one day overdue). The remaining entries were due on the publish date: CVE-2025-61624 (Fortinet multiple products path traversal) and CVE-2026-102764 (BeyondTrust Remote Support authentication bypass). AlienVault OTX tracked 16 threat intelligence pulses for CVE-2026-104935, 16 for CVE-2026-105133 and CVE-2026-105134, 15 for CVE-2026-0322 and 14 for CVE-2025-61624. CVE-2026-104935 scored a 97.967 percentile on FIRST EPSS as of October 19, indicating high predicted exploitation probability (FIRST EPSS, as of 2026-10-19).

Malware and C2 Infrastructure

Abuse.ch ThreatFox recorded 12,345 malware indicators during ISO week 2026-W42 (October 12 to 18, first-seen date), including 6,661 fresh command-and-control addresses. The Vidar stealer accounted for 4,593 indicators, followed by Mirai with 1,251, Unknown Loader with 728, IClickFix with 661, Unknown malware with 564, VShell with 564, AMOS with 462 and php.shin_webshell with 294. Of the 10 C2 addresses checked against AbuseIPDB, two were also reported for abuse activity (abuse.ch ThreatFox, AbuseIPDB cross-reference checked 2026-10-19).

  • Active C2 servers also reported for abuse: two servers of 10 checked against AbuseIPDB

AI Infrastructure Attacks

A total of 1,277 distinct addresses attacked AI model endpoints and embedding services during the week of October 12 to 18, 2026 (AI Honeypot Observatory, local running record). The top MITRE ATT&CK technique was T1046 (Network Service Discovery), observed across all 1,277 addresses. T1552.001 (Unsecured Credentials in Files) appeared across 313 addresses, T1190 (Exploit Public-Facing Application) across 232 and T1102 (Web Service as C2 channel) across 193. Mass scanning with 678 addresses and credential harvesting with 261 addresses dominated the observed activity.

AI-Endpoint Attacker Categories

Scanner Mass 678 Credential Harvester 261 Mcp Scanner 150 Relay Customer 88 Scanner Enum 85 Identity Prober 11 Relay Cataloger 3 Relay Verifier 1

Hunting Takeaway

Hunt for authentication bypass attempts and unusual outbound connections from VPN gateways and network edge devices. The week's KEV additions include authentication and command injection flaws in remote access and firewall products; successful exploitation enables lateral movement and persistent access. Look for service accounts created outside normal provisioning windows, new scheduled tasks initiated from edge devices and unexpected SMB or RDP connections originating from perimeter infrastructure.

Splunk SPL Query

index=* earliest=-7d (source="XmlWinEventLog:Security" OR source="WinEventLog:Security") EventCode=4624 LogonType=3
| eval edge_device=if(match(Computer, "(?i)(vpn|firewall|gateway|edge)"), 1, 0)
| where edge_device=1
| stats count by Computer, user, IpAddress
| where count > 5

Microsoft KQL Query

SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4624 and LogonType == 3
| where Computer has_any ("vpn", "firewall", "gateway", "edge")
| summarize Count = count() by Computer, Account, IpAddress, bin(TimeGenerated, 1h)
| where Count > 5

Note: These queries were generated with AI assistance and are a starting point for threat hunting and detection rule considerations.

Environment Sweep

The queries below check for 15 risk-ranked attacker addresses (live command-and-control infrastructure first, then by independent-source agreement and report volume, with benign research scanners removed), 10 domains and 10 file hashes from abuse.ch ThreatFox, and the nine KEV entries added this week, prioritized by ransomware linkage and overdue status. Addresses flagged as GreyNoise benign service traffic (two in total) were excluded from the sweep. No query results does not mean no threat; it confirms only that these specific indicators were not observed in the searched data sources during the specified time window.

Sweep for this week's malicious IPs

Splunk (CIM Network_Traffic)

| tstats summariesonly=false count min(_time) AS first_seen max(_time) AS last_seen
    from datamodel=Network_Traffic.All_Traffic
    where earliest=-30d (All_Traffic.dest_ip IN ("45.148.10.151", "80.94.92.234", "50.16.16.211", "89.167.123.84", "217.60.103.223", "172.237.117.11", "172.233.54.153", "139.162.142.22", "139.162.142.16", "139.162.142.13", "51.75.27.218", "216.219.89.86", "203.205.37.233", "103.113.170.231", "218.0.63.25") OR All_Traffic.src_ip IN ("45.148.10.151", "80.94.92.234", "50.16.16.211", "89.167.123.84", "217.60.103.223", "172.237.117.11", "172.233.54.153", "139.162.142.22", "139.162.142.16", "139.162.142.13", "51.75.27.218", "216.219.89.86", "203.205.37.233", "103.113.170.231", "218.0.63.25"))
    by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.action
| rename All_Traffic.* AS *
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Microsoft Defender XDR (advanced hunting)

let SweepIPs = dynamic(["45.148.10.151", "80.94.92.234", "50.16.16.211", "89.167.123.84", "217.60.103.223", "172.237.117.11", "172.233.54.153", "139.162.142.22", "139.162.142.16", "139.162.142.13", "51.75.27.218", "216.219.89.86", "203.205.37.233", "103.113.170.231", "218.0.63.25"]);
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteIP in (SweepIPs)
| summarize Hits = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Processes = make_set(InitiatingProcessFileName, 10) by DeviceName, RemoteIP, RemotePort, ActionType
| order by Hits desc

Microsoft Sentinel (firewall and proxy logs via CEF)

let SweepIPs = dynamic(["45.148.10.151", "80.94.92.234", "50.16.16.211", "89.167.123.84", "217.60.103.223", "172.237.117.11", "172.233.54.153", "139.162.142.22", "139.162.142.16", "139.162.142.13", "51.75.27.218", "216.219.89.86", "203.205.37.233", "103.113.170.231", "218.0.63.25"]);
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where DestinationIP in (SweepIPs) or SourceIP in (SweepIPs)
| summarize Hits = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceVendor, DeviceProduct, SourceIP, DestinationIP, DestinationPort, DeviceAction
| order by Hits desc

Sweep for this week's C2 and payload domains

Splunk (CIM Network_Resolution)

| tstats summariesonly=false count min(_time) AS first_seen max(_time) AS last_seen
    from datamodel=Network_Resolution.DNS
    where earliest=-30d DNS.query IN ("e.88idr.org", "o7.9kio.org", "t7.88idn.net", "gd.88idn.net", "t.99rtp.net", "9win.cyou", "if.88idn.net", "e.88idn.net", "yuw.88idn.net", "y7.88idn.net")
    by DNS.src DNS.query DNS.answer
| rename DNS.* AS *
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Microsoft Defender XDR (advanced hunting)

let SweepDomains = dynamic(["e.88idr.org", "o7.9kio.org", "t7.88idn.net", "gd.88idn.net", "t.99rtp.net", "9win.cyou", "if.88idn.net", "e.88idn.net", "yuw.88idn.net", "y7.88idn.net"]);
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteUrl has_any (SweepDomains)
| summarize Hits = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Processes = make_set(InitiatingProcessFileName, 10) by DeviceName, RemoteUrl, RemoteIP
| order by Hits desc

Sweep for this week's malware hashes

Splunk (CIM Endpoint.Filesystem)

| tstats summariesonly=false count min(_time) AS first_seen max(_time) AS last_seen
    from datamodel=Endpoint.Filesystem
    where earliest=-30d Filesystem.file_hash IN ("59db0e5c4b7c4224bef5b52bbed2b2bcaf615dc2862275984a161f096c608928", "1f7a31315c822ea415d628c73a24bae47c191b1a933e3672bc7d7eec46fdc98b", "8dcd02094df461a66a0f15ef26b58bb5cad6a2e4dcf30783eb7e43a422f7c5bc", "7dc728e4b3a8333935be5cbdd83334afc45d4c689645a5951247d9c65e6ffae1", "646d11f69c230d2cf348561b6426d6c69382cc9c36715a87a4dbcdf6ed79b291", "f5b1cd0523a28117759fa2eed0e8666843febb4dd77ba85de544dac96d9c60b4", "e6faa9b088f4bf2425faebe05b1fce1e3ec3178ebf4d889b655d087a913dd4c9", "82b2bc35df93e3cabb6b415eb848fd9e35eb241902e5278e6debe5e00bd47eda", "e0ddcf5346201f21a24a30395d996c7e1c33a2ac8c6b36beffcfef4d30e4f447", "227f6b2c16a0be122e817c1688273d6a5aa218e1321a44c9e3efed64c74fec2e")
    by Filesystem.dest Filesystem.file_path Filesystem.file_name Filesystem.file_hash
| rename Filesystem.* AS *
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Microsoft Defender XDR (advanced hunting)

let SweepHashes = dynamic(["59db0e5c4b7c4224bef5b52bbed2b2bcaf615dc2862275984a161f096c608928", "1f7a31315c822ea415d628c73a24bae47c191b1a933e3672bc7d7eec46fdc98b", "8dcd02094df461a66a0f15ef26b58bb5cad6a2e4dcf30783eb7e43a422f7c5bc", "7dc728e4b3a8333935be5cbdd83334afc45d4c689645a5951247d9c65e6ffae1", "646d11f69c230d2cf348561b6426d6c69382cc9c36715a87a4dbcdf6ed79b291", "f5b1cd0523a28117759fa2eed0e8666843febb4dd77ba85de544dac96d9c60b4", "e6faa9b088f4bf2425faebe05b1fce1e3ec3178ebf4d889b655d087a913dd4c9", "82b2bc35df93e3cabb6b415eb848fd9e35eb241902e5278e6debe5e00bd47eda", "e0ddcf5346201f21a24a30395d996c7e1c33a2ac8c6b36beffcfef4d30e4f447", "227f6b2c16a0be122e817c1688273d6a5aa218e1321a44c9e3efed64c74fec2e"]);
union DeviceFileEvents, DeviceProcessEvents
| where Timestamp > ago(30d)
| where SHA256 in (SweepHashes)
| summarize Hits = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Paths = make_set(FolderPath, 10) by DeviceName, FileName, SHA256
| order by Hits desc

Check exposure to this week's KEV additions

Splunk (CIM Vulnerabilities, from your scanner add-on)

| tstats summariesonly=false count
    from datamodel=Vulnerabilities.Vulnerabilities
    where earliest=-30d Vulnerabilities.cve IN ("CVE-2026-104935", "CVE-2026-96951", "CVE-2026-105134", "CVE-2026-76519", "CVE-2026-0322", "CVE-2026-105133", "CVE-2026-21589", "CVE-2026-102764", "CVE-2025-61624")
    by Vulnerabilities.dest Vulnerabilities.cve Vulnerabilities.signature Vulnerabilities.severity
| rename Vulnerabilities.* AS *
| sort cve, dest

Microsoft Defender Vulnerability Management

let PatchCVEs = dynamic(["CVE-2026-104935", "CVE-2026-96951", "CVE-2026-105134", "CVE-2026-76519", "CVE-2026-0322", "CVE-2026-105133", "CVE-2026-21589", "CVE-2026-102764", "CVE-2025-61624"]);
DeviceTvmSoftwareVulnerabilities
| where CveId in (PatchCVEs)
| summarize Devices = dcount(DeviceId), DeviceNames = make_set(DeviceName, 20) by CveId, SoftwareVendor, SoftwareName, VulnerabilitySeverityLevel, RecommendedSecurityUpdate
| order by Devices desc

Note: These queries were generated with AI assistance and are a starting point for threat hunting and detection rule considerations.

Related Resources

Appendix: Raw Tables

Top Ransomware Groups

ransomware.live, pulled 2026-10-19

GroupVictim CountChange from Prior Week
N0n84+67 (+394.1%)
thegentlemen39+5 (+14.7%)
qilin28+6 (+27.3%)
Wallstreet15new to the top ranks
akira9new to the top ranks
play9new to the top ranks
lockbit59new to the top ranks
iah64778new to the top ranks
incransom7+2 (+40.0%)
Orova7new to the top ranks

Most-Reported Malicious IPs

AbuseIPDB 100% confidence, pulled 2026-10-19; network ownership from RIPEstat (RIR registry data); scan verdict from GreyNoise Community

IP AddressCountryOrigin TypeASN / OwnerTotal ReportsReportersLast ReportedGreyNoise
45.148.10.151NLhostingAS48090 DMZHOST TECHOFF SRV LIMITED2092619672026-10-19malicious
80.94.92.234ROhostingAS47890 UNMANAGED LTD4733416282026-10-19malicious
51.75.27.218FRhostingAS16276 OVH SAS795214272026-10-19malicious
216.219.89.86UShostingAS19318 Interserver, Inc38492842026-10-19malicious
104.237.156.209UShostingAS63949 Akamai Connected Cloud34181642026-10-19unknown
203.205.37.233VNresidentialAS45903 CMC Telecom Infrastructure Company33728902026-10-19malicious
218.0.63.25CNhostingAS58461 No.288,Fu-chun Road31408422026-10-19malicious
172.234.192.12UShostingAS63949 Akamai Connected Cloud31001602026-10-19unknown
109.160.32.144DEhostingAS198364 BANATSYNC SRL28178312026-10-19malicious
103.113.170.231IDhostingAS137352 PT. Cloudata Indonesia10432132026-10-19malicious
152.32.172.191HKhostingAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED6231732026-10-19malicious
49.124.147.253MYresidentialAS4818 DiGi Telecommunications Sdn. Bhd.353872026-10-19unknown

Left out as known benign infrastructure, not counted in any attacker figure: 65.49.1.81 (classified benign by GreyNoise Community (ShadowServer.org)); 85.217.149.51 (classified benign by GreyNoise Community (Modat)).

Attacker Networks

network ownership from RIPEstat (RIR registry data), report volume from AbuseIPDB, pulled 2026-10-19

ASNProvider / ISPOrigin ClassIP CountTotal Reports
AS63949Akamai Connected Cloudhosting26518
AS48090DMZHOST TECHOFF SRV LIMITEDhosting1209261
AS47890UNMANAGED LTDhosting147334
AS16276OVH SAShosting17952
AS19318Interserver, Inchosting13849
AS45903CMC Telecom Infrastructure Companyresidential13372
AS58461No.288,Fu-chun Roadhosting13140
AS198364BANATSYNC SRLhosting12817
AS137352PT. Cloudata Indonesiahosting11043
AS135377UCLOUD INFORMATION TECHNOLOGY (HK) LIMITEDhosting1623
AS4818DiGi Telecommunications Sdn. Bhd.residential1353

New KEV Additions

CISA Known Exploited Vulnerabilities catalog, pulled 2026-10-19; in-the-wild pulse counts from AlienVault OTX; exploitation probability from FIRST EPSS, as of 2026-10-18

CVEVendor / ProductVulnerability TypeDate AddedDue DateEPSS
CVE-2026-104935Ivanti Connect SecureIvanti Connect Secure Authentication Bypass by Spoofing Vulnerability (16 OTX pulses)2026-10-132026-10-160.26 (98th pct)
CVE-2026-96951Microsoft WindowsMicrosoft Windows Command Injection Vulnerability (12 OTX pulses)2026-10-132026-10-160.02 (74th pct)
CVE-2026-0322Palo Alto Networks PAN-OSPalo Alto Networks PAN-OS Code Injection Vulnerability (15 OTX pulses)2026-10-142026-10-170.01 (68th pct)
CVE-2026-105133Ahsay AhsayCBSAhsay AhsayCBS Improper Authentication Vulnerability (16 OTX pulses)2026-10-142026-10-170.01 (58th pct)
CVE-2026-105134Ahsay AhsayCBSAhsay AhsayCBS Command Injection Vulnerability (16 OTX pulses)2026-10-142026-10-170.05 (92th pct)
CVE-2026-76519Cisco Secure Email GatewayCisco Secure Email Gateway Relative Path Traversal Vulnerability (10 OTX pulses)2026-10-142026-10-170.02 (75th pct)
CVE-2026-21589Atlassian Multiple ProductsAtlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability (16 OTX pulses)2026-10-152026-10-18–
CVE-2025-61624Fortinet Multiple ProductsFortinet Multiple Products Path Traversal Vulnerability (14 OTX pulses)2026-10-162026-10-190.01 (65th pct)
CVE-2026-102764BeyondTrust Remote SupportBeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability (10 OTX pulses)2026-10-162026-10-190.01 (67th pct)

Top Malware Families

abuse.ch ThreatFox, ISO week 2026-W42 (2026-10-12 to 2026-10-18), first-seen date

FamilyIOC Count
Vidar4593
Mirai1251
Unknown Loader728
IClickFix661
Unknown malware564
VShell564
AMOS462
php.shin_webshell294
ClearFake267
Remcos209

AI-Endpoint Attacker IOCs

AI Honeypot Observatory, Focused Hunts running record of 1-day pulls, pulled 2026-10-19; INFRA-COLLISION rows excluded; Peak Daily Hits is the single busiest day this week

IP AddressActor CategoryConfidenceMITRE TTPsThis WeekPeak Daily HitsFirst Observed
146.70.184.178RELAY-CUSTOMERvery-highT1046, T1102–49372026-10-11
83.228.229.77SCANNER-ENUMvery-highT1046, T1102–45012026-10-13
154.37.208.58SCANNER-MASSvery-highT1046–38082026-09-10
172.245.252.109SCANNER-ENUMvery-highT1046, T1102–29062026-10-12
43.156.79.80RELAY-CUSTOMERvery-highT1046, T1102–26092026-09-10
23.26.237.119RELAY-CUSTOMERvery-highT1046, T1102–6862026-10-18
104.168.115.214IDENTITY-PROBERvery-highT1046, T1592–6752026-09-10
32.216.141.74SCANNER-MASSvery-highT1046, T1102–2842026-09-26
20.5.41.14RELAY-CUSTOMERvery-highT1046, T1102–2502026-09-18
101.42.172.53RELAY-CUSTOMERvery-highT1046, T1102–1472026-09-10
149.28.142.11SCANNER-ENUMvery-highT1046, T1592, T1102–1242026-09-11
23.95.226.221SCANNER-ENUMvery-highT1046, T1592, T1102–1162026-09-10
47.84.122.196SCANNER-MASSvery-highT1046–62026-09-28
112.134.194.243SCANNER-MASShighT1046–18502026-10-17
189.152.157.195SCANNER-MASShighT1046, T1102, T1592–18472026-10-09
137.23.38.53CREDENTIAL-HARVESTERhighT1046, T1552.001–15602026-10-17
99.18.125.136SCANNER-MASShighT1046, T1102, T1592–14822026-10-12
144.124.251.24SCANNER-MASShighT1046–13342026-10-11
185.177.72.31CREDENTIAL-HARVESTERhighT1046, T1552.001–13262026-10-17
185.177.72.17CREDENTIAL-HARVESTERhighT1046, T1552.001–13202026-09-21
185.177.72.70CREDENTIAL-HARVESTERhighT1046, T1552.001–13192026-10-17
185.177.72.49CREDENTIAL-HARVESTERhighT1046, T1552.001–12062026-10-18
108.165.95.17SCANNER-MASShighT1046–10982026-10-10
151.243.181.203RELAY-CUSTOMERhighT1046, T1102, T1078–9912026-09-24
178.107.169.51RELAY-CUSTOMERhighT1046, T1102–8812026-10-14

Methodology and Sources

This report is built entirely from open-source threat intelligence: public ransomware leak-site activity, community IP-reputation data, internet-scanner context, registry network ownership and hosting-type classification of the reported addresses, the government catalog of actively exploited vulnerabilities, community exploitation-probability scores, malware and command-and-control indicator feeds, and honeypot observations of attacks on AI service endpoints. Figures are aggregated across these public sources, cross-referenced, and captured as a point-in-time snapshot. They are aggregate public statistics, not original Focused Hunts detections, and each traces back to its source and to the raw snapshot retained for this edition.

Confirmed listings are kept separate from actor claims, and partial counts are reported as a floor. Week-over-week trends are drawn once successive snapshots support them.

Reported addresses that belong to known benign infrastructure (internet-measurement scanners confirmed by forward DNS, search and AI crawlers inside their operators' published ranges, and addresses GreyNoise classifies benign) are left out of the attacker figures and listed under the IP table instead.

Feeds unavailable for this edition: RansomLook (corroborate_groups() missing 1 required positional argument: 'look_groups'). The affected sections are omitted rather than estimated.

← Back to Last Week in Threats