Last Week in Threats Banner

Last Week in Threats: Week 44

Published on November 2, 2026 | By Focused Hunts

Bottom Line

What changed this week: Booba Project ransomware postings surged 167% from six to 16 victims, while Qilin claimed 42 postings and six new groups entered the top 10 (ransomware.live, pulled 2026-11-02). CISA added 10 vulnerabilities to the Known Exploited Vulnerabilities catalog, with four already past their remediation due dates at publication.

Who is most exposed: Professional services firms faced the heaviest targeting with 32 victim postings, followed by technology providers, manufacturers and healthcare organizations. PHP installations, Adobe Commerce, VMware ESX, GitLab and Ivanti Connect Secure are all under active exploitation through the week's new KEV entries.

Recommended action: Prioritize patching the four past-due KEV entries, starting with the two PHP memory corruption vulnerabilities. Hunt for anomalous outbound connections from web servers and developer tooling, and review authentication logs for credential harvesting patterns across AI-enabled endpoints.

Week in Review

The week of October 26 to November 1, 2026 delivered sharp shifts in ransomware operator activity, a sustained KEV addition pace and intensified attacker focus on AI infrastructure. Booba Project, a relatively new group first observed in July 2026, claimed 16 victims this week compared to six the week prior, marking a 167% surge that vaulted the operation into the second-most-active slot behind Qilin. The top 10 welcomed six groups for the first time, including Whitearmor, genesis, rhysida, thegentlemen, safepay and payload, displacing six others that dropped out entirely. Total postings reached 221, up nine percent from the prior week.

CISA added 10 vulnerabilities to the KEV catalog, spanning PHP, Google Brotli, Adobe Commerce, VMware ESX, Linux Kernel, Cisco firewalls, GitLab and Ivanti Connect Secure. At publication time, four of the 10 were already past their remediation due dates, with the two PHP vulnerabilities overdue by four days each. Attackers targeted AI-enabled infrastructure at scale, with 2,130 distinct addresses probing LLM endpoints during the week, 1,321 of them newly observed. Mass scanning led the activity categories, followed by credential harvesting and relay verification.

Ransomware Activity

Most Active Groups by Victim Postings

Qilin led the week with 42 victim postings, maintaining its position from the prior week with an 11-victim increase (ransomware.live, pulled 2026-11-02). Booba Project claimed 16 postings, up from six, while Whitearmor posted 14 victims in only its second week in the top ranks, having first appeared October 23. SilentRansomGroup posted 12 victims, genesis claimed 10, and rhysida, thegentlemen and safepay each posted nine. Among the top performers, four groups persisted in the top 10 across both weeks: Qilin, Booba Project, SilentRansomGroup and emperador.

Victim Postings by Week

United States organizations accounted for 73 of the 221 postings, followed by 51 victims whose country could not be classified from available data (ransomware.live, pulled 2026-11-02). Germany recorded 15 postings, Mexico 10 and Great Britain eight. The unclassified count represents 23% of the week's total, a gap in the feed's geographic attribution.

Most Active Groups by Victim Postings

qilin 42 Booba Project 16 Whitearmor 14 SilentRansomGroup 12 genesis 10 rhysida 9 thegentlemen 9 safepay 9

Victim Postings by Week

242 W33 242 W34 207 W35 166 W36 162 W37 185 W38 146 W39 215 W40 197 W41 292 W42 203 W43 221 W44

Industry and Technology Targeting

Most-Targeted Industries

Professional services firms drew the heaviest targeting with 32 victim postings, followed by technology providers with 25, manufacturers with 24 and healthcare organizations with 23 (ransomware.live, pulled 2026-11-02). Retail and hospitality recorded 16 postings, education 14 and financial services 12. Transportation, energy and utilities, and government sectors each recorded between seven and 11 postings. Agriculture and food processing saw two postings. The feed left 45 victims unclassified, representing 20% of the week's total.

The week's KEV additions exposed PHP installations, Google Brotli compression libraries, Adobe Commerce and Magento platforms, VMware ESX hypervisors, Linux Kernel deployments, Cisco Secure Firewall ASA and FTD software, GitLab Community and Enterprise editions, and Ivanti Connect Secure VPN appliances to confirmed exploitation.

Most-Targeted Industries

Professional Services 32 Technology 25 Manufacturing 24 Healthcare 23 Retail Hospitality 16 Education 14 Financial Services 12 Transportation 11

IP Addresses Under Watch

AbuseIPDB flagged 12 addresses for sustained malicious activity during the week. Email and credential brute-force attacks, exploited hosts running bad bots, and port scanning dominated the observed behavior, each accounting for six of the sampled addresses. SSH brute-force, DDoS and web application attacks rounded out the activity profile.

  • 80.94.92.234 (RO): AS47890 UNMANAGED LTD, ISP TECHOFF SRV LIMITED, hosting, 47,144 reports, also flagged by GreyNoise Community (malicious)
  • 120.48.175.69 (CN): AS38365 Beijing Baidu Netcom, hosting, 3,290 reports, also flagged by GreyNoise Community (malicious)
  • 177.207.250.1 (BR): AS18881 TELEFONICA BRASIL S.A, ISP TELEFĂ”NICA BRASIL S.A, residential, 1,439 reports, also flagged by GreyNoise Community (malicious)
  • 192.42.116.17 (NL): AS215125 Church of Cyberology, ISP SURF B.V., Tor exit, 935 reports
  • 31.25.236.40 (DE): AS49683 MASSIVEGRID LTD, hosting, 836 reports
  • 174.79.114.145 (US): AS22773 Cox Communications Inc., residential, 634 reports
  • 47.251.62.188 (US): AS45102 Alibaba (US) Technology Co., Ltd., ISP Alibaba Cloud - US, hosting, 602 reports
  • 199.165.159.171 (US): AS22168 The Shadowserver Foundation, Inc., hosting, 200 reports, also flagged by GreyNoise Community (malicious)
  • 70.81.127.119 (CA): AS5769 Videotron Ltee, residential, 170 reports, also flagged by GreyNoise Community (malicious)
  • 23.134.88.60 (US): AS924 Cloudie Networks LLC, Tor exit, 160 reports
  • 124.29.194.238 (PK): AS9541 Cyber Internet Services (Pvt) Ltd., ISP Broadband Services, residential, 60 reports
  • 91.106.36.29 (IQ): AS210402 Hala Al Rafidain, ISP Hala Al Rafidain Telecom Ltd., residential, 58 reports

Attacker Infrastructure

Network analysis showed seven of the 12 addresses resolved to hosting infrastructure, with five originating from residential ISPs (network ownership from RIPEstat, usage type from AbuseIPDB, pulled 2026-11-02). The hosting addresses represent provider-side infrastructure, while the residential IPs indicate compromised endpoints within consumer networks. None of the 12 addresses cross-referenced to known command-and-control servers or malware-hosting infrastructure when checked against abuse.ch ThreatFox and URLhaus (pulled 2026-11-02).

Hosting Providers

  • AS47890 UNMANAGED LTD: 80.94.92.234
  • AS38365 Beijing Baidu Netcom: 120.48.175.69
  • AS49683 MASSIVEGRID LTD: 31.25.236.40
  • AS45102 Alibaba (US) Technology Co., Ltd.: 47.251.62.188
  • AS22168 The Shadowserver Foundation, Inc.: 199.165.159.171

Residential Networks

  • AS18881 TELEFONICA BRASIL S.A: 177.207.250.1
  • AS22773 Cox Communications Inc.: 174.79.114.145
  • AS5769 Videotron Ltee: 70.81.127.119
  • AS9541 Cyber Internet Services (Pvt) Ltd.: 124.29.194.238
  • AS210402 Hala Al Rafidain: 91.106.36.29

Tor Exit Nodes

  • AS215125 Church of Cyberology: 192.42.116.17
  • AS924 Cloudie Networks LLC: 23.134.88.60

Vulnerability Watch

CISA added 10 vulnerabilities to the Known Exploited Vulnerabilities catalog between October 26 and October 30 (CISA KEV, pulled 2026-11-02). The overdue entries included two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, already four days past their October 29 remediation deadline when this edition published. Both carried FIRST EPSS exploitation probabilities above the 99.9th percentile, with CVE-2026-109619 drawing 77 AlienVault OTX threat intelligence pulses. A Linux Kernel vulnerability, CVE-2026-46300, was two days overdue, while a Cisco Secure Firewall vulnerability, CVE-2026-76418, and a GitLab vulnerability, CVE-2026-97229, were each one day past due.

Google Brotli CVE-2026-111497 and Adobe Commerce CVE-2026-48356, both added October 27, remain open with due dates of November 10. Broadcom VMware ESX CVE-2026-41709, added October 28, is due November 11. Ivanti's footprint expanded with two Connect Secure vulnerabilities, CVE-2026-111357 and CVE-2026-118527, added October 30 with due dates of November 2 and November 13 respectively. AlienVault OTX recorded between two and 77 threat intelligence pulses for eight of the 10 entries, indicating active reconnaissance and discussion within the threat research community.

Malware C2 Infrastructure

Abuse.ch ThreatFox recorded 4,009 fresh command-and-control indicators during ISO week 2026-W44, October 26 to November 1, based on first-seen date (abuse.ch ThreatFox, pulled 2026-11-02). IClickFix led with 2,298 IOCs, followed by AMOS stealer with 1,773, Vidar with 1,572 and ClearFake with 1,570. Unknown malware accounted for 1,433 indicators. SalatStealer contributed 978 IOCs, Mirai added 857 and AsyncRAT recorded 603. The total IOC count for the week reached 14,452 when counting all malware families.

  • Active C2 servers also reported for abuse: two servers of 10 checked against AbuseIPDB

AI Infrastructure Under Attack

Attackers probed AI-enabled endpoints from 2,130 distinct IP addresses during the week, with 1,321 newly observed, 649 persistent from prior weeks and 160 returning after a period of inactivity (AI Honeypot Observatory, local running record, pulled 2026-11-02). MITRE ATT&CK technique T1046 Network Service Discovery led with 1,940 addresses, followed by T1552.001 Credentials in Files with 671, T1595.002 Vulnerability Scanning with 469, T1102 Web Service with 420, T1190 Exploit Public-Facing Application with 330 and T1496.001 Resource Hijacking with 189. Mass scanning accounted for 888 of the categorized addresses, credential harvesting for 473 and relay operations for 300.

  • New this week: 1,321 addresses
  • Persistent from last week: 649 addresses
  • Returning after a gap: 160 addresses
  • Gone quiet since last week: 1,111 addresses
  • Active three or more weeks running: 311 addresses

AI-Endpoint Attacker Categories

Scanner Mass 888 Credential Harvester 473 Relay Customer 288 Scanner Enum 183 Research Scanner 154 Mcp Scanner 117 Relay Verifier 12 Relay Cataloger 9

Hunting Takeaway

Hunt for anomalous outbound connections from web servers and developer tooling platforms, targeting the behavior Booba Project and the week's KEV-listed technologies enable. Focus on unexpected external connections from PHP application servers, GitLab instances, Adobe Commerce platforms and Ivanti Connect Secure appliances, particularly to non-standard ports or newly registered domains. Look for process execution chains that bypass normal application workflows, service account creation outside maintenance windows, and authentication attempts against administrative interfaces from internal segments that should not reach them.

Splunk SPL Query

index=* earliest=-7d (source="XmlWinEventLog:Security" OR source="WinEventLog:Security" OR source="XmlWinEventLog:System" OR source="WinEventLog:System")
| tstats summariesonly=false count from datamodel=Network_Traffic.All_Traffic where earliest=-7d All_Traffic.src_category=web_server OR All_Traffic.src_category=collaboration_tool by All_Traffic.src All_Traffic.dest All_Traffic.dest_port All_Traffic.action
| rename All_Traffic.* AS *
| where dest_port NOT IN (80, 443, 53) AND action="allowed"
| stats count by src dest dest_port
| where count < 5

Microsoft KQL Query

DeviceNetworkEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("php.exe", "php-cgi.exe", "httpd.exe", "nginx.exe", "w3wp.exe", "gitlab-runner.exe")
| where RemotePort !in (80, 443, 53)
| summarize ConnectionCount = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort
| where ConnectionCount < 5
| order by FirstSeen desc

Note: These queries were generated with AI assistance and are a starting point for threat hunting and detection rule considerations.

Environment Sweep

The queries below check for connections to 15 risk-ranked IP addresses, 10 domains and 10 file hashes from abuse.ch ThreatFox, and patch status for the week's 10 KEV entries. The IP list is ranked by live command-and-control correlation, independent source agreement and report volume, with benign research scanners removed. The CVE list is ordered by ransomware linkage and overdue status first, then by FIRST EPSS score. No results from these queries does not mean your environment is clean: these are point-in-time indicators from one week's activity, and absence of matches only confirms these specific observables are not present in your logs during the search window.

Sweep for this week's malicious IPs

Splunk (CIM Network_Traffic)

| tstats summariesonly=false count min(_time) AS first_seen max(_time) AS last_seen
    from datamodel=Network_Traffic.All_Traffic
    where earliest=-30d (All_Traffic.dest_ip IN ("80.94.92.234", "50.16.16.211", "77.42.9.174", "37.27.4.38", "37.27.4.20", "204.168.137.221", "104.105.4.229", "37.27.9.42", "45.61.145.161", "120.48.175.69", "177.207.250.1", "70.81.127.119", "199.165.159.171", "192.42.116.17", "47.251.62.188") OR All_Traffic.src_ip IN ("80.94.92.234", "50.16.16.211", "77.42.9.174", "37.27.4.38", "37.27.4.20", "204.168.137.221", "104.105.4.229", "37.27.9.42", "45.61.145.161", "120.48.175.69", "177.207.250.1", "70.81.127.119", "199.165.159.171", "192.42.116.17", "47.251.62.188"))
    by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.action
| rename All_Traffic.* AS *
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Microsoft Defender XDR (advanced hunting)

let SweepIPs = dynamic(["80.94.92.234", "50.16.16.211", "77.42.9.174", "37.27.4.38", "37.27.4.20", "204.168.137.221", "104.105.4.229", "37.27.9.42", "45.61.145.161", "120.48.175.69", "177.207.250.1", "70.81.127.119", "199.165.159.171", "192.42.116.17", "47.251.62.188"]);
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteIP in (SweepIPs)
| summarize Hits = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Processes = make_set(InitiatingProcessFileName, 10) by DeviceName, RemoteIP, RemotePort, ActionType
| order by Hits desc

Microsoft Sentinel (firewall and proxy logs via CEF)

let SweepIPs = dynamic(["80.94.92.234", "50.16.16.211", "77.42.9.174", "37.27.4.38", "37.27.4.20", "204.168.137.221", "104.105.4.229", "37.27.9.42", "45.61.145.161", "120.48.175.69", "177.207.250.1", "70.81.127.119", "199.165.159.171", "192.42.116.17", "47.251.62.188"]);
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where DestinationIP in (SweepIPs) or SourceIP in (SweepIPs)
| summarize Hits = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceVendor, DeviceProduct, SourceIP, DestinationIP, DestinationPort, DeviceAction
| order by Hits desc

Sweep for this week's C2 and payload domains

Splunk (CIM Network_Resolution)

| tstats summariesonly=false count min(_time) AS first_seen max(_time) AS last_seen
    from datamodel=Network_Resolution.DNS
    where earliest=-30d DNS.query IN ("silverrogpuia.pro", "quiet-orbit-zephyr-tie.pro", "birch-nuiis-d9q37.xyz", "securetds.beer", "34234342342rerr.beer", "coffiimg.beer", "ncheck-brows.beer", "ubbrobccheck20.cc", "verifyidentrob01.cc", "codes.caffe-img.com")
    by DNS.src DNS.query DNS.answer
| rename DNS.* AS *
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Microsoft Defender XDR (advanced hunting)

let SweepDomains = dynamic(["silverrogpuia.pro", "quiet-orbit-zephyr-tie.pro", "birch-nuiis-d9q37.xyz", "securetds.beer", "34234342342rerr.beer", "coffiimg.beer", "ncheck-brows.beer", "ubbrobccheck20.cc", "verifyidentrob01.cc", "codes.caffe-img.com"]);
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteUrl has_any (SweepDomains)
| summarize Hits = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Processes = make_set(InitiatingProcessFileName, 10) by DeviceName, RemoteUrl, RemoteIP
| order by Hits desc

Sweep for this week's malware hashes

Splunk (CIM Endpoint.Filesystem)

| tstats summariesonly=false count min(_time) AS first_seen max(_time) AS last_seen
    from datamodel=Endpoint.Filesystem
    where earliest=-30d Filesystem.file_hash IN ("8900da021b9d7b95a84ad6fa9ec1ed703bf6f93f785825cbca7c8e053e9b98f8", "3d0f12177f0bc02cbcefdabb27c6dd714049baf1a0f9f1ee4e9990644168c4b7", "31bcc872fc7bc2881ea4ae109a74ed191bbca863edab49115be8f7f80eb6bdfb", "9bcbdbe99c7838fb876ac952a5da2eed4d9e58de47e75048c4ac9dd726848528", "5e230b17bd205ce17aec0b2cafe6fc3621437d95ce5a5407f13d37b37775c7e5", "707e6cbbd1f312fac8966581b4e31493b4a598ef40367d921a7997925792a08a", "4045aea019d1834b62759ffb1e0603c0998714cefcf25da06b0b0d5b038d1dea", "58fc43de4f894fc97138bc60973446cd6c947578264868220fce4e6c3adea574", "2760a83300ecd395ddee95d725e4b76aaeb450144ce281110c6647dd05d01d31", "777dff4579c27c6a60bd2f14981a01ce5502378fe9cd5ad98a027a20d0c5697b")
    by Filesystem.dest Filesystem.file_path Filesystem.file_name Filesystem.file_hash
| rename Filesystem.* AS *
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Microsoft Defender XDR (advanced hunting)

let SweepHashes = dynamic(["8900da021b9d7b95a84ad6fa9ec1ed703bf6f93f785825cbca7c8e053e9b98f8", "3d0f12177f0bc02cbcefdabb27c6dd714049baf1a0f9f1ee4e9990644168c4b7", "31bcc872fc7bc2881ea4ae109a74ed191bbca863edab49115be8f7f80eb6bdfb", "9bcbdbe99c7838fb876ac952a5da2eed4d9e58de47e75048c4ac9dd726848528", "5e230b17bd205ce17aec0b2cafe6fc3621437d95ce5a5407f13d37b37775c7e5", "707e6cbbd1f312fac8966581b4e31493b4a598ef40367d921a7997925792a08a", "4045aea019d1834b62759ffb1e0603c0998714cefcf25da06b0b0d5b038d1dea", "58fc43de4f894fc97138bc60973446cd6c947578264868220fce4e6c3adea574", "2760a83300ecd395ddee95d725e4b76aaeb450144ce281110c6647dd05d01d31", "777dff4579c27c6a60bd2f14981a01ce5502378fe9cd5ad98a027a20d0c5697b"]);
union DeviceFileEvents, DeviceProcessEvents
| where Timestamp > ago(30d)
| where SHA256 in (SweepHashes)
| summarize Hits = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Paths = make_set(FolderPath, 10) by DeviceName, FileName, SHA256
| order by Hits desc

Check exposure to this week's KEV additions

Splunk (CIM Vulnerabilities, from your scanner add-on)

| tstats summariesonly=false count
    from datamodel=Vulnerabilities.Vulnerabilities
    where earliest=-30d Vulnerabilities.cve IN ("CVE-2026-109619", "CVE-2026-109618", "CVE-2026-46300", "CVE-2026-97229", "CVE-2026-76418", "CVE-2026-111497", "CVE-2026-48356", "CVE-2026-41709", "CVE-2026-111357", "CVE-2026-118527")
    by Vulnerabilities.dest Vulnerabilities.cve Vulnerabilities.signature Vulnerabilities.severity
| rename Vulnerabilities.* AS *
| sort cve, dest

Microsoft Defender Vulnerability Management

let PatchCVEs = dynamic(["CVE-2026-109619", "CVE-2026-109618", "CVE-2026-46300", "CVE-2026-97229", "CVE-2026-76418", "CVE-2026-111497", "CVE-2026-48356", "CVE-2026-41709", "CVE-2026-111357", "CVE-2026-118527"]);
DeviceTvmSoftwareVulnerabilities
| where CveId in (PatchCVEs)
| summarize Devices = dcount(DeviceId), DeviceNames = make_set(DeviceName, 20) by CveId, SoftwareVendor, SoftwareName, VulnerabilitySeverityLevel, RecommendedSecurityUpdate
| order by Devices desc

Note: These queries were generated with AI assistance and are a starting point for threat hunting and detection rule considerations.

Related Resources

Appendix: Raw Tables

Top Ransomware Groups

ransomware.live, pulled 2026-11-02

GroupVictim CountChange from Prior Week
qilin42+11 (+35.5%)
Booba Project16+10 (+166.7%)
Whitearmor14new to the top ranks
SilentRansomGroup12+2 (+20.0%)
genesis10new to the top ranks
rhysida9new to the top ranks
thegentlemen9new to the top ranks
safepay9new to the top ranks
payload8new to the top ranks
emperador8-1 (-11.1%)

Most-Reported Malicious IPs

AbuseIPDB 100% confidence, pulled 2026-11-02; network ownership from RIPEstat (RIR registry data); scan verdict from GreyNoise Community

IP AddressCountryOrigin TypeASN / OwnerTotal ReportsReportersLast ReportedGreyNoise
80.94.92.234ROhostingAS47890 UNMANAGED LTD4714416732026-11-02malicious
120.48.175.69CNhostingAS38365 Beijing Baidu Netcom32909282026-11-02malicious
177.207.250.1BRresidentialAS18881 TELEFONICA BRASIL S.A14392422026-11-02malicious
192.42.116.17NLhostingAS215125 Church of Cyberology9352772026-11-02lookup failed
31.25.236.40DEhostingAS49683 MASSIVEGRID LTD836432026-11-02unknown
174.79.114.145USresidentialAS22773 Cox Communications Inc.6341792026-11-02unknown
47.251.62.188UShostingAS45102 Alibaba (US) Technology Co., Ltd.6021142026-11-02lookup failed
199.165.159.171UShostingAS22168 The Shadowserver Foundation, Inc.200912026-11-02malicious
70.81.127.119CAresidentialAS5769 Videotron Ltee1701512026-11-02malicious
23.134.88.60UShostingAS924 Cloudie Networks LLC160552026-11-02lookup failed
124.29.194.238PKresidentialAS9541 Cyber Internet Services (Pvt) Ltd.60382026-11-02lookup failed
91.106.36.29IQresidentialAS210402 Hala Al Rafidain58352026-11-02lookup failed

Attacker Networks

network ownership from RIPEstat (RIR registry data), report volume from AbuseIPDB, pulled 2026-11-02

ASNProvider / ISPOrigin ClassIP CountTotal Reports
AS47890UNMANAGED LTDhosting147144
AS38365Beijing Baidu Netcomhosting13290
AS18881TELEFONICA BRASIL S.Aresidential11439
AS215125Church of Cyberologyhosting1935
AS49683MASSIVEGRID LTDhosting1836
AS22773Cox Communications Inc.residential1634
AS45102Alibaba (US) Technology Co., Ltd.hosting1602
AS22168The Shadowserver Foundation, Inc.hosting1200
AS5769Videotron Lteeresidential1170
AS924Cloudie Networks LLChosting1160
AS9541Cyber Internet Services (Pvt) Ltd.residential160
AS210402Hala Al Rafidainresidential158

New KEV Additions

CISA Known Exploited Vulnerabilities catalog, pulled 2026-11-02; in-the-wild pulse counts from AlienVault OTX; exploitation probability from FIRST EPSS, as of 2026-11-01

CVEVendor / ProductVulnerability TypeDate AddedDue DateEPSS
CVE-2026-109618PHP Group PHPPHP Memory Corruption Vulnerability2026-10-262026-10-291.00 (100th pct)
CVE-2026-109619PHP Group PHPPHP Stale Internal Request-State Vulnerability (77 OTX pulses)2026-10-262026-10-291.00 (100th pct)
CVE-2026-111497Google BrotliGoogle Brotli Unchecked Return Value Vulnerability (28 OTX pulses)2026-10-272026-11-100.83 (100th pct)
CVE-2026-48356Adobe Commerce and MagentoAdobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability (nine OTX pulses)2026-10-272026-11-100.45 (99th pct)
CVE-2026-41709Broadcom VMware ESXBroadcom VMWare ESX Insufficient Logging Vulnerability (12 OTX pulses)2026-10-282026-11-110.01 (53th pct)
CVE-2026-46300Linux KernelLinux Kernel Missing Initialization of a Variable Vulnerability (17 OTX pulses)2026-10-282026-10-310.16 (97th pct)
CVE-2026-76418Cisco Secure Firewall ASA Software and Cisco Secure FTD SoftwareCisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability (nine OTX pulses)2026-10-292026-11-010.01 (57th pct)
CVE-2026-97229GitLab Community Edition and Enterprise EditionGitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability (20 OTX pulses)2026-10-292026-11-010.27 (98th pct)
CVE-2026-111357Ivanti Connect SecureIvanti Connect Secure Missing Authentication for Critical Function Vulnerability (10 OTX pulses)2026-10-302026-11-020.01 (45th pct)
CVE-2026-118527Ivanti Connect SecureIvanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability (two OTX pulses)2026-10-302026-11-13–

Top Malware Families

abuse.ch ThreatFox, ISO week 2026-W44 (2026-10-26 to 2026-11-01), first-seen date

FamilyIOC Count
IClickFix2298
AMOS1773
Vidar1572
ClearFake1570
Unknown malware1433
SalatStealer978
Mirai857
AsyncRAT603
VShell357
Unknown Loader313

AI-Endpoint Attacker IOCs

AI Honeypot Observatory, Focused Hunts running record of 1-day pulls, pulled 2026-11-02; INFRA-COLLISION rows excluded; Peak Daily Hits is the single busiest day this week

IP AddressActor CategoryConfidenceMITRE TTPsThis WeekPeak Daily HitsFirst Observed
78.174.210.99SCANNER-ENUMvery-highT1046, T1102, T1595.002, T1496.001new580262026-10-28
93.152.221.96CREDENTIAL-HARVESTERvery-highT1046, T1552.001persistent179352026-10-22
94.121.81.240MCP-SCANNERvery-highT1046, T1552.001, T1190new52352026-10-28
51.79.191.234RELAY-CUSTOMERvery-highT1046, T1102, T1078, T1496.001persistent43512026-10-21
83.228.229.77SCANNER-ENUMvery-highT1046, T1102, T1595.002persistent38612026-10-13
154.37.208.58SCANNER-MASSvery-highT1046, T1595.002persistent32712026-09-10
176.144.10.198SCANNER-ENUMvery-highT1046, T1102, T1595.002persistent32572026-10-22
43.156.79.80RELAY-VERIFIERvery-highT1046, T1102, T1078, T1496.001persistent28092026-09-10
38.55.133.49SCANNER-ENUMvery-highT1046, T1102, T1595.002persistent26682026-10-12
45.112.149.170SCANNER-MASSvery-highT1046, T1102, T1496.001persistent23602026-10-11
103.39.108.200SCANNER-MASSvery-highT1046, T1102, T1078, T1496.001, T1595.002, T1595.003new22112026-10-29
89.35.130.127SCANNER-MASSvery-highT1595.002, T1595.003new19892026-11-01
102.220.163.241CREDENTIAL-HARVESTERvery-highT1046, T1552.001new13482026-10-26
104.168.115.214RELAY-VERIFIERvery-highT1046, T1592, T1102, T1078, T1592.002persistent7262026-09-10
32.216.141.74SCANNER-MASSvery-highT1046, T1102, T1595.002, T1496.001persistent3062026-09-26
101.42.172.53RELAY-CUSTOMERvery-highT1046, T1102, T1595.002persistent1442026-09-10
149.28.142.11SCANNER-ENUMvery-highT1046, T1592, T1102, T1595.002, T1496.001persistent1332026-09-11
47.84.122.196SCANNER-MASSvery-highT1046returning132026-09-28
43.199.190.130RELAY-CUSTOMERhighT1046, T1102, T1078, T1496.001persistent19692026-10-24
113.57.27.55CREDENTIAL-HARVESTERhighT1046, T1552.001new17822026-10-30
194.180.49.41CREDENTIAL-HARVESTERhighT1046, T1552.001new17542026-10-27
185.195.233.188RELAY-CUSTOMERhighT1046, T1102persistent14132026-10-21
185.195.233.186RELAY-CUSTOMERhighT1046, T1102, T1496.001new14032026-10-30
117.63.160.189RELAY-CUSTOMERhighT1046, T1102persistent13462026-10-25
212.107.30.203RELAY-CUSTOMERhighT1046, T1102, T1552.001, T1496.001returning13342026-09-11

Methodology and Sources

This report is built entirely from open-source threat intelligence: public ransomware leak-site activity, community IP-reputation data, internet-scanner context, registry network ownership and hosting-type classification of the reported addresses, the government catalog of actively exploited vulnerabilities, community exploitation-probability scores, malware and command-and-control indicator feeds, and honeypot observations of attacks on AI service endpoints. Figures are aggregated across these public sources, cross-referenced, and captured as a point-in-time snapshot. They are aggregate public statistics, not original Focused Hunts detections, and each traces back to its source and to the raw snapshot retained for this edition.

Confirmed listings are kept separate from actor claims, and partial counts are reported as a floor. Week-over-week trends are drawn once successive snapshots support them.

Reported addresses that belong to known benign infrastructure (internet-measurement scanners confirmed by forward DNS, search and AI crawlers inside their operators' published ranges, and addresses GreyNoise classifies benign) are left out of the attacker figures and listed under the IP table instead.

Feeds unavailable for this edition: RansomLook (corroborate_groups() missing 1 required positional argument: 'look_groups'). The affected sections are omitted rather than estimated.

← Back to Last Week in Threats