Last Week in Threats: Week 43
Bottom Line
What changed this week: CISA added eight vulnerabilities to the Known Exploited Vulnerabilities catalog, and three were already past their remediation deadlines when this edition published. Ransomware victim postings fell 30.5% from the prior week as N0n's activity dropped by half.
Who is most exposed: Organizations running Plex Media Server, EG Secure Solutions SiteGuard Server Edition, Collabora Online built-in CODE Server, or Arista VeloCloud Orchestrator face confirmed exploitation risk. AI infrastructure operators saw 1,760 attacker addresses targeting Model Context Protocol endpoints.
Recommended action: Audit the eight new KEV entries against deployed assets and remediate past-due vulnerabilities immediately. Monitor outbound connections from vulnerable services and review AI endpoint access logs for reconnaissance activity.
The Week in Review
The week of October 19 to 25, 2026 brought eight new entries to CISA's Known Exploited Vulnerabilities catalog, including critical flaws in widely deployed services like Plex Media Server and network edge infrastructure. Of the eight new entries, three were already past their Federal Civilian Executive Branch remediation deadlines by the time this edition published, signaling active exploitation ahead of vendor patch deployment.
Ransomware activity declined sharply, with victim postings dropping 30.5% from the prior week. The decline reflected N0n's activity falling by nearly half, from 84 postings in Week 42 to 44 this week. Meanwhile, attackers targeted AI infrastructure at scale, with 1,760 addresses probing Model Context Protocol endpoints for credential harvesting and exploitation.
Ransomware Activity
N0n led ransomware victim postings with 44 organizations, down 47.6% from the prior week's 84 (ransomware.live, pulled 2026-10-26). Qilin posted 31 victims, up 10.7% from 28 in Week 42. The top 10 welcomed six new groups for the first time: SilentRansomGroup (10 victims), emperador (nine), BrainCipher (eight), lamashtu (seven), Booba Project (six), and krybit (six). Meanwhile, four groups dropped out of the top ranks after appearing in Week 42.
The United States accounted for 75 victim postings, followed by 37 with unknown country codes, 17 in Germany, and six each in the United Kingdom and Argentina. Manufacturing absorbed 30 postings, professional services 27, and healthcare 23.
Most Active Groups by Victim Postings
Victim Postings by Week
Industry and Technology Watch
Manufacturing led with 30 victim postings, followed by professional services with 27, healthcare with 23, and technology with 21 (ransomware.live, pulled 2026-10-26). Retail and hospitality combined for 15 postings. The feed left 57 victims unclassified, representing 28.1% of the week's total.
Targeted technologies included SiteGuard Server Edition, Siemens Software Center, Plex Media Server, Collabora Online built-in CODE Server, and Arista VeloCloud Orchestrator. These products span web application firewalls, industrial software distribution, media serving, office collaboration, and network edge infrastructure.
Most-Targeted Industries
Attacker Infrastructure Watch
AbuseIPDB listed 12 addresses with combined report volumes exceeding 27,000 entries. Email and credential brute-force attacks dominated behavior categories, alongside exploited host activity, port scanning, and SSH brute-force.
- 51.254.103.32 (FR): AS16276 OVH SAS, hosting, 7,746 reports, also flagged by GreyNoise Community (malicious)
- 91.191.209.198 (BG): AS57509 L&L Investment Ltd., ISP VDS and Hosting, hosting, 6,690 reports
- 43.155.134.4 (KR): AS132203 Tencent Building, Kejizhongyi Avenue, ISP Asia Pacific Network, hosting, 5,208 reports, also flagged by GreyNoise Community (malicious)
- 109.160.32.129 (DE): AS198364 BANATSYNC SRL, ISP Global Communication Net Plc, hosting, 3,174 reports, also flagged by GreyNoise Community (malicious)
- 79.124.58.158 (BG): AS50360 Tamatiya EOOD, hosting, 1,567 reports
- 167.88.168.121 (US): AS14956 RouterHosting LLC, hosting, 1,301 reports
- 146.19.248.35 (NL): AS218878 SpectraIP B.V., hosting, 679 reports, also flagged by GreyNoise Community (malicious)
- 43.173.103.103 (US): AS132203 Tencent Building, Kejizhongyi Avenue, ISP ACEVILLE PTE.LTD., hosting, 605 reports, also flagged by GreyNoise Community (malicious)
- 217.154.120.73 (DE): AS8560 IONOS SE, hosting, 477 reports
- 118.26.39.102 (HK): AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, hosting, 118 reports, also flagged by GreyNoise Community (malicious)
- 34.14.105.160 (BE): AS396982 Google LLC, hosting, 72 reports
- 27.25.101.145 (CN): AS4134 No.31,Jin-rong Street, ISP CHINANET Hubei province network, residential, 22 reports, also flagged by GreyNoise Community (malicious)
Network Ownership Trends
Hosting providers supplied infrastructure for 11 of the 12 addresses. The concentration in commercial hosting reflects attacker preference for cloud and VPS infrastructure over compromised residential endpoints. None of the 11 checked addresses appeared in abuse.ch malware or command-and-control databases.
Hosting Providers
- AS16276 OVH SAS: 51.254.103.32
- AS57509 L&L Investment Ltd.: 91.191.209.198
- AS132203 Tencent Building, Kejizhongyi Avenue: 43.155.134.4, 43.173.103.103
- AS198364 BANATSYNC SRL: 109.160.32.129
- AS50360 Tamatiya EOOD: 79.124.58.158
- AS14956 RouterHosting LLC: 167.88.168.121
- AS218878 SpectraIP B.V.: 146.19.248.35
- AS8560 IONOS SE: 217.154.120.73
- AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED: 118.26.39.102
- AS396982 Google LLC: 34.14.105.160
Residential Networks
- AS4134 No.31,Jin-rong Street: 27.25.101.145
Vulnerability Watch
CISA added eight vulnerabilities to the Known Exploited Vulnerabilities catalog this week (CISA KEV, pulled 2026-10-26). Of the eight, three CVEs were already past their Federal Civilian Executive Branch remediation deadlines when this edition published: CVE-2026-106931 (EG Secure Solutions SiteGuard Server Edition OS command injection, three days overdue), CVE-2026-96654 (Plex Media Server URI scheme vulnerability, three days overdue), and CVE-2026-96656 (Plex Media Server file path control, three days overdue). The publication date of October 26 also marked the remediation deadline for two additional entries.
CVE-2026-110447, an OS command injection in Collabora Online built-in CODE Server, carried the highest exploitation probability at 12.3% over 30 days, placing it in the 96th percentile (FIRST EPSS, as of 2026-10-26). AlienVault OTX recorded 12 threat intelligence pulses referencing CVE-2026-106931, and 16 pulses for CVE-2026-110936, a Siemens Software Center search path vulnerability.
Malware Infrastructure Watch
Abuse.ch ThreatFox recorded 5,672 fresh command-and-control indicators during ISO week 2026-W43 (October 19 to 25, 2026, first-seen date), drawn from a total dataset of 15,960 IOCs (abuse.ch ThreatFox, pulled 2026-10-26). VShell led with 2,146 indicators, followed by 1,836 for unclassified malware families, 1,746 for Vidar stealer, and 1,680 each for AMOS stealer and IClickFix clickjacking campaigns. Mirai botnet infrastructure accounted for 1,245 entries.
- Active C2 servers also reported for abuse: five servers of 10 checked against AbuseIPDB
AI Infrastructure Attacks
Attackers targeted AI endpoints from 1,760 addresses, with 1,142 new to the observation record this week and 470 maintaining persistent activity across multiple days (AI Honeypot Observatory, pulled 2026-10-26). MITRE ATT&CK technique T1046 (network service discovery) appeared in all 1,760 addresses, T1552.001 (credentials in files) in 480 addresses, and T1190 (exploit public-facing application) in 314 addresses. The AI Honeypot Observatory is a Focused Hunts running record of Model Context Protocol scanner and exploitation activity.
- New this week: 1,142 addresses
- Persistent from last week: 470 addresses
- Returning after a gap: 148 addresses
- Gone quiet since last week: 807 addresses
AI-Endpoint Attacker Categories
Hunting Takeaway
Organizations running services affected by this week's KEV entries should hunt for anomalous outbound network connections that could signal post-exploitation command-and-control activity. The queries below detect unexpected egress traffic from web and application server processes, a common indicator that a vulnerability has been weaponized to establish persistent access.
Splunk SPL Query
| tstats summariesonly=false count from datamodel=Network_Traffic.All_Traffic where earliest=-7d All_Traffic.dest_port IN (443, 80, 8080, 4444, 1337, 22) by All_Traffic.src, All_Traffic.dest, All_Traffic.dest_port
| rename All_Traffic.* AS *
| stats dc(dest) as unique_destinations count by src, dest_port
| where unique_destinations > 20Microsoft KQL Query
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemotePort in (443, 80, 8080, 4444, 1337, 22)
| where InitiatingProcessFileName has_any ("w3wp.exe", "java.exe", "python.exe", "httpd.exe", "nginx.exe")
| summarize UniqueDestinations=dcount(RemoteIP), ConnectionCount=count() by DeviceName, InitiatingProcessFileName, RemotePort
| where UniqueDestinations > 20 or ConnectionCount > 100Note: These queries were generated with AI assistance and are a starting point for threat hunting and detection rule considerations.
Environment Sweep
The queries below check for contact with 15 risk-ranked attacker addresses, 10 malicious domains, and 10 file hashes from abuse.ch ThreatFox, then verify patching status for the eight CISA KEV entries added this week in Microsoft Defender Vulnerability Management. Teams on other platforms should run the same CVE list through their vulnerability scanner. The address list prioritizes live command-and-control infrastructure, followed by sources flagged by multiple independent threat feeds and those with high AbuseIPDB report volumes. GreyNoise-identified benign scanners are excluded. No query results does not mean no threat: these checks surface known indicators, not all attacker activity.
Sweep for this week's malicious IPs
Splunk (CIM Network_Traffic)
| tstats summariesonly=false count min(_time) AS first_seen max(_time) AS last_seen
from datamodel=Network_Traffic.All_Traffic
where earliest=-30d (All_Traffic.dest_ip IN ("116.62.81.149", "50.16.16.211", "47.100.187.173", "8.148.29.180", "123.57.30.209", "39.103.98.161", "154.94.237.203", "103.236.85.116", "51.254.103.32", "43.155.134.4", "109.160.32.129", "146.19.248.35", "43.173.103.103", "118.26.39.102", "91.191.209.198") OR All_Traffic.src_ip IN ("116.62.81.149", "50.16.16.211", "47.100.187.173", "8.148.29.180", "123.57.30.209", "39.103.98.161", "154.94.237.203", "103.236.85.116", "51.254.103.32", "43.155.134.4", "109.160.32.129", "146.19.248.35", "43.173.103.103", "118.26.39.102", "91.191.209.198"))
by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.action
| rename All_Traffic.* AS *
| sort - count
| convert ctime(first_seen) ctime(last_seen)Microsoft Defender XDR (advanced hunting)
let SweepIPs = dynamic(["116.62.81.149", "50.16.16.211", "47.100.187.173", "8.148.29.180", "123.57.30.209", "39.103.98.161", "154.94.237.203", "103.236.85.116", "51.254.103.32", "43.155.134.4", "109.160.32.129", "146.19.248.35", "43.173.103.103", "118.26.39.102", "91.191.209.198"]);
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteIP in (SweepIPs)
| summarize Hits = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Processes = make_set(InitiatingProcessFileName, 10) by DeviceName, RemoteIP, RemotePort, ActionType
| order by Hits descMicrosoft Sentinel (firewall and proxy logs via CEF)
let SweepIPs = dynamic(["116.62.81.149", "50.16.16.211", "47.100.187.173", "8.148.29.180", "123.57.30.209", "39.103.98.161", "154.94.237.203", "103.236.85.116", "51.254.103.32", "43.155.134.4", "109.160.32.129", "146.19.248.35", "43.173.103.103", "118.26.39.102", "91.191.209.198"]);
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where DestinationIP in (SweepIPs) or SourceIP in (SweepIPs)
| summarize Hits = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceVendor, DeviceProduct, SourceIP, DestinationIP, DestinationPort, DeviceAction
| order by Hits descSweep for this week's C2 and payload domains
Splunk (CIM Network_Resolution)
| tstats summariesonly=false count min(_time) AS first_seen max(_time) AS last_seen
from datamodel=Network_Resolution.DNS
where earliest=-30d DNS.query IN ("z.amo98.org", "ww.adilawa99.org", "u6.adilawa99.org", "dku.adilawa99.org", "im.adilawa99.org", "c.amo98.org", "we.adilawa99.org", "jtf.adilawa99.org", "c.adilawa99.org", "v.getpi.su")
by DNS.src DNS.query DNS.answer
| rename DNS.* AS *
| sort - count
| convert ctime(first_seen) ctime(last_seen)Microsoft Defender XDR (advanced hunting)
let SweepDomains = dynamic(["z.amo98.org", "ww.adilawa99.org", "u6.adilawa99.org", "dku.adilawa99.org", "im.adilawa99.org", "c.amo98.org", "we.adilawa99.org", "jtf.adilawa99.org", "c.adilawa99.org", "v.getpi.su"]);
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteUrl has_any (SweepDomains)
| summarize Hits = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Processes = make_set(InitiatingProcessFileName, 10) by DeviceName, RemoteUrl, RemoteIP
| order by Hits descSweep for this week's malware hashes
Splunk (CIM Endpoint.Filesystem)
| tstats summariesonly=false count min(_time) AS first_seen max(_time) AS last_seen
from datamodel=Endpoint.Filesystem
where earliest=-30d Filesystem.file_hash IN ("b21d4981713a317783abd4cbda94e650336e94fcb843e1cccc61476a60eb78f3", "a03e2ff45870713f71047b394ca2bd5a16a4893b4da8c149ddcf34752d8cb2a1", "9686623974b2709d38d5d75f51af2f7184cdce4786531c1e846d7514849abea8", "7fb78a0cac53df92dffc6dee0f491ae19813a31632a5ad4989f4483acd6a50d1", "13f70041e3d9920c90a11c52affc5789dfb3de8dc489b520f71e28a5293e9fdc", "ff64e329587a2695f056d8700269018a5ebfafbf5cf84dca0659eab1c5f5a436", "fbb506be190de5bb5b45e1675d7fff01ed0a2734512dc7a91bba6f533c3c5d88", "edb1eef678596da686dca624c262f2c4338c40dbb76060aa9d3548bd64639f88", "ed83166ae65736875eb6c4eb98085ae45555b1d66b33442a2150c520f0934913", "e92a24f50b06c4f1060570839b2804ba4dbe7629a51e311e4869d112eb98d45c")
by Filesystem.dest Filesystem.file_path Filesystem.file_name Filesystem.file_hash
| rename Filesystem.* AS *
| sort - count
| convert ctime(first_seen) ctime(last_seen)Microsoft Defender XDR (advanced hunting)
let SweepHashes = dynamic(["b21d4981713a317783abd4cbda94e650336e94fcb843e1cccc61476a60eb78f3", "a03e2ff45870713f71047b394ca2bd5a16a4893b4da8c149ddcf34752d8cb2a1", "9686623974b2709d38d5d75f51af2f7184cdce4786531c1e846d7514849abea8", "7fb78a0cac53df92dffc6dee0f491ae19813a31632a5ad4989f4483acd6a50d1", "13f70041e3d9920c90a11c52affc5789dfb3de8dc489b520f71e28a5293e9fdc", "ff64e329587a2695f056d8700269018a5ebfafbf5cf84dca0659eab1c5f5a436", "fbb506be190de5bb5b45e1675d7fff01ed0a2734512dc7a91bba6f533c3c5d88", "edb1eef678596da686dca624c262f2c4338c40dbb76060aa9d3548bd64639f88", "ed83166ae65736875eb6c4eb98085ae45555b1d66b33442a2150c520f0934913", "e92a24f50b06c4f1060570839b2804ba4dbe7629a51e311e4869d112eb98d45c"]);
union DeviceFileEvents, DeviceProcessEvents
| where Timestamp > ago(30d)
| where SHA256 in (SweepHashes)
| summarize Hits = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Paths = make_set(FolderPath, 10) by DeviceName, FileName, SHA256
| order by Hits descCheck exposure to this week's KEV additions
Microsoft Defender Vulnerability Management
let PatchCVEs = dynamic(["CVE-2026-106931", "CVE-2026-96654", "CVE-2026-96656", "CVE-2026-110447", "CVE-2026-96652", "CVE-2026-96655", "CVE-2026-114625", "CVE-2026-110936"]);
DeviceTvmSoftwareVulnerabilities
| where CveId in (PatchCVEs)
| summarize Devices = dcount(DeviceId), DeviceNames = make_set(DeviceName, 20) by CveId, SoftwareVendor, SoftwareName, VulnerabilitySeverityLevel, RecommendedSecurityUpdate
| order by Devices descNote: These queries were generated with AI assistance and are a starting point for threat hunting and detection rule considerations.
Appendix: Raw Tables
Top Ransomware Groups
ransomware.live, pulled 2026-10-26
| Group | Victim Count | Change from Prior Week |
|---|---|---|
| N0n | 44 | -40 (-47.6%) |
| qilin | 31 | +3 (+10.7%) |
| SilentRansomGroup | 10 | new to the top ranks |
| emperador | 9 | new to the top ranks |
| akira | 8 | -1 (-11.1%) |
| BrainCipher | 8 | new to the top ranks |
| lamashtu | 7 | new to the top ranks |
| lockbit5 | 6 | -3 (-33.3%) |
| Booba Project | 6 | new to the top ranks |
| krybit | 6 | new to the top ranks |
Most-Reported Malicious IPs
AbuseIPDB 100% confidence, pulled 2026-10-26; network ownership from RIPEstat (RIR registry data); scan verdict from GreyNoise Community
| IP Address | Country | Origin Type | ASN / Owner | Total Reports | Reporters | Last Reported | GreyNoise |
|---|---|---|---|---|---|---|---|
| 51.254.103.32 | FR | hosting | AS16276 OVH SAS | 7746 | 1428 | 2026-10-26 | malicious |
| 91.191.209.198 | BG | hosting | AS57509 L&L Investment Ltd. | 6690 | 216 | 2026-10-26 | unknown |
| 43.155.134.4 | KR | hosting | AS132203 Tencent Building, Kejizhongyi Avenue | 5208 | 1163 | 2026-10-26 | malicious |
| 109.160.32.129 | DE | hosting | AS198364 BANATSYNC SRL | 3174 | 830 | 2026-10-26 | malicious |
| 79.124.58.158 | BG | hosting | AS50360 Tamatiya EOOD | 1567 | 74 | 2026-10-26 | unknown |
| 167.88.168.121 | US | hosting | AS14956 RouterHosting LLC | 1301 | 81 | 2026-10-26 | suspicious |
| 146.19.248.35 | NL | hosting | AS218878 SpectraIP B.V. | 679 | 238 | 2026-10-26 | malicious |
| 43.173.103.103 | US | hosting | AS132203 Tencent Building, Kejizhongyi Avenue | 605 | 401 | 2026-10-26 | malicious |
| 217.154.120.73 | DE | hosting | AS8560 IONOS SE | 477 | 287 | 2026-10-26 | unknown |
| 118.26.39.102 | HK | hosting | AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED | 118 | 105 | 2026-10-26 | malicious |
| 34.14.105.160 | BE | hosting | AS396982 Google LLC | 72 | 56 | 2026-10-26 | unknown |
| 27.25.101.145 | CN | residential | AS4134 No.31,Jin-rong Street | 22 | 20 | 2026-10-26 | malicious |
Attacker Networks
network ownership from RIPEstat (RIR registry data), report volume from AbuseIPDB, pulled 2026-10-26
| ASN | Provider / ISP | Origin Class | IP Count | Total Reports |
|---|---|---|---|---|
| AS132203 | Tencent Building, Kejizhongyi Avenue | hosting | 2 | 5813 |
| AS16276 | OVH SAS | hosting | 1 | 7746 |
| AS57509 | L&L Investment Ltd. | hosting | 1 | 6690 |
| AS198364 | BANATSYNC SRL | hosting | 1 | 3174 |
| AS50360 | Tamatiya EOOD | hosting | 1 | 1567 |
| AS14956 | RouterHosting LLC | hosting | 1 | 1301 |
| AS218878 | SpectraIP B.V. | hosting | 1 | 679 |
| AS8560 | IONOS SE | hosting | 1 | 477 |
| AS135377 | UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED | hosting | 1 | 118 |
| AS396982 | Google LLC | hosting | 1 | 72 |
| AS4134 | No.31,Jin-rong Street | residential | 1 | 22 |
New KEV Additions
CISA Known Exploited Vulnerabilities catalog, pulled 2026-10-26; in-the-wild pulse counts from AlienVault OTX; exploitation probability from FIRST EPSS, as of 2026-10-25
| CVE | Vendor / Product | Vulnerability Type | Date Added | Due Date | EPSS |
|---|---|---|---|---|---|
| CVE-2026-106931 | EG Secure Solutions SiteGuard Server Edition | EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability (12 OTX pulses) | 2026-10-20 | 2026-10-23 | 0.03 (85th pct) |
| CVE-2026-110936 | Siemens Software Center | Siemens Software Center Uncontrolled Search Path Element Vulnerability (16 OTX pulses) | 2026-10-20 | 2026-11-03 | 0.01 (61th pct) |
| CVE-2026-96652 | Plex Media Server | Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability (six OTX pulses) | 2026-10-20 | 2026-11-03 | 0.02 (79th pct) |
| CVE-2026-96654 | Plex Media Server | Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability (six OTX pulses) | 2026-10-20 | 2026-10-23 | 0.02 (80th pct) |
| CVE-2026-96655 | Plex Media Server | Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability (six OTX pulses) | 2026-10-20 | 2026-11-03 | 0.02 (76th pct) |
| CVE-2026-96656 | Plex Media Server | Plex Media Server External Control of File Name or Path Vulnerability (six OTX pulses) | 2026-10-20 | 2026-10-23 | 0.02 (78th pct) |
| CVE-2026-110447 | Collabora Collabora Online – Built-in CODE Server | Collabora Online – Built-in CODE Server OS Command Injection Vulnerability (eight OTX pulses) | 2026-10-23 | 2026-10-26 | 0.12 (96th pct) |
| CVE-2026-114625 | Arista VeloCloud Orchestrator | Arista VeloCloud Orchestrator SQL Injection Vulnerability (six OTX pulses) | 2026-10-23 | 2026-10-26 | 0.01 (63th pct) |
Top Malware Families
abuse.ch ThreatFox, ISO week 2026-W43 (2026-10-19 to 2026-10-25), first-seen date
| Family | IOC Count |
|---|---|
| VShell | 2146 |
| Unknown malware | 1836 |
| Vidar | 1746 |
| AMOS | 1680 |
| IClickFix | 1680 |
| Mirai | 1245 |
| ClearFake | 887 |
| Unknown Loader | 794 |
| StrelaStealer | 517 |
| Cobalt Strike | 340 |
AI-Endpoint Attacker IOCs
AI Honeypot Observatory, Focused Hunts running record of 1-day pulls, pulled 2026-10-26; INFRA-COLLISION rows excluded; Peak Daily Hits is the single busiest day this week
| IP Address | Actor Category | Confidence | MITRE TTPs | This Week | Peak Daily Hits | First Observed |
|---|---|---|---|---|---|---|
| 23.26.237.119 | RELAY-CUSTOMER | very-high | T1046, T1102 | persistent | 24022 | 2026-10-18 |
| 147.139.178.214 | CREDENTIAL-HARVESTER | very-high | T1046, T1552.001 | new | 5048 | 2026-10-20 |
| 83.228.229.77 | SCANNER-ENUM | very-high | T1046, T1102 | persistent | 4166 | 2026-10-13 |
| 154.37.208.58 | SCANNER-MASS | very-high | T1046 | persistent | 3561 | 2026-09-10 |
| 176.144.10.198 | SCANNER-ENUM | very-high | T1046, T1102 | new | 3116 | 2026-10-22 |
| 43.156.79.80 | RELAY-VERIFIER | very-high | T1046, T1102, T1078 | persistent | 3065 | 2026-09-10 |
| 51.79.191.234 | RELAY-CUSTOMER | very-high | T1046, T1102, T1078 | new | 3060 | 2026-10-21 |
| 204.76.203.7 | SCANNER-MASS | very-high | T1046, T1190, T1552.001 | returning | 2802 | 2026-09-11 |
| 159.26.103.33 | IDENTITY-PROBER | very-high | T1046, T1592 | new | 2471 | 2026-10-21 |
| 93.152.221.96 | CREDENTIAL-HARVESTER | very-high | T1046, T1552.001 | new | 2344 | 2026-10-22 |
| 172.245.252.109 | RELAY-CUSTOMER | very-high | T1046, T1102, T1592 | persistent | 1879 | 2026-10-12 |
| 149.28.142.11 | RELAY-CUSTOMER | very-high | T1046, T1592, T1102 | persistent | 825 | 2026-09-11 |
| 104.168.115.214 | IDENTITY-PROBER | very-high | T1046, T1592 | persistent | 701 | 2026-09-10 |
| 146.70.184.178 | SCANNER-MASS | very-high | T1046, T1102 | persistent | 396 | 2026-10-11 |
| 32.216.141.74 | SCANNER-MASS | very-high | T1046, T1102 | persistent | 274 | 2026-09-26 |
| 23.95.226.221 | SCANNER-ENUM | very-high | T1046, T1592, T1102 | persistent | 150 | 2026-09-10 |
| 101.42.172.53 | RELAY-CUSTOMER | very-high | T1046, T1102 | persistent | 144 | 2026-09-10 |
| 87.58.197.242 | RELAY-CUSTOMER | high | T1046, T1102 | new | 1905 | 2026-10-19 |
| 112.134.192.14 | SCANNER-MASS | high | T1046 | new | 1514 | 2026-10-21 |
| 185.195.233.188 | RELAY-CUSTOMER | high | T1046, T1102 | new | 1465 | 2026-10-21 |
| 23.226.70.138 | CREDENTIAL-HARVESTER | high | T1046, T1102, T1552.001 | new | 1458 | 2026-10-18 |
| 185.177.72.49 | CREDENTIAL-HARVESTER | high | T1046, T1552.001 | persistent | 1345 | 2026-10-18 |
| 109.65.3.207 | IDENTITY-PROBER | high | T1046, T1592 | new | 1143 | 2026-10-23 |
| 112.134.198.243 | SCANNER-MASS | high | T1046 | new | 1063 | 2026-10-21 |
| 23.19.231.52 | CREDENTIAL-HARVESTER | high | T1046, T1552.001 | new | 1055 | 2026-10-19 |
Methodology and Sources
This report is built entirely from open-source threat intelligence: public ransomware leak-site activity, community IP-reputation data, internet-scanner context, registry network ownership and hosting-type classification of the reported addresses, the government catalog of actively exploited vulnerabilities, community exploitation-probability scores, malware and command-and-control indicator feeds, and honeypot observations of attacks on AI service endpoints. Figures are aggregated across these public sources, cross-referenced, and captured as a point-in-time snapshot. They are aggregate public statistics, not original Focused Hunts detections, and each traces back to its source and to the raw snapshot retained for this edition.
Confirmed listings are kept separate from actor claims, and partial counts are reported as a floor. Week-over-week trends are drawn once successive snapshots support them.
Reported addresses that belong to known benign infrastructure (internet-measurement scanners confirmed by forward DNS, search and AI crawlers inside their operators' published ranges, and addresses GreyNoise classifies benign) are left out of the attacker figures and listed under the IP table instead.
Feeds unavailable for this edition: RansomLook (corroborate_groups() missing 1 required positional argument: 'look_groups'). The affected sections are omitted rather than estimated.