{ "generator": "Encrygma", "generator_url": "https://encrygma.com", "feed_type": "encrygma-attack-and-vulnerability-observations", "spec_version": "1.0", "generated": "2026-10-21T20:17:36.879Z", "license": "https://encrygma.com/legal", "counts": { "reports": 500, "threat_actors": 1, "techniques": 30, "vulnerabilities": 65, "observations": 116 }, "observations": [ { "observation_id": "OBS-00001", "type": "vulnerability", "id": "CVE-2026-104935", "name": "CVE-2026-104935", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "apt", "source_report": "Encrygma Intelligence Alert: Escalating Zero-Day Exploitation Across Ivanti, Cisco, and Windows Ecosystems", "source_url": "https://encrygma.com/articles/encrygma-intelligence-alert-escalating-zero-day-exploitation-across-ivanti-cisco", "published_date": "2026-10-21" }, { "observation_id": "OBS-00002", "type": "vulnerability", "id": "CVE-2026-76519", "name": "CVE-2026-76519", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "apt", "source_report": "Encrygma Intelligence Alert: Escalating Zero-Day Exploitation Across Ivanti, Cisco, and Windows Ecosystems", "source_url": "https://encrygma.com/articles/encrygma-intelligence-alert-escalating-zero-day-exploitation-across-ivanti-cisco", "published_date": "2026-10-21" }, { "observation_id": "OBS-00003", "type": "vulnerability", "id": "CVE-2026-96951", "name": "CVE-2026-96951", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "apt", "source_report": "Encrygma Intelligence Alert: Escalating Zero-Day Exploitation Across Ivanti, Cisco, and Windows Ecosystems", "source_url": "https://encrygma.com/articles/encrygma-intelligence-alert-escalating-zero-day-exploitation-across-ivanti-cisco", "published_date": "2026-10-21" }, { "observation_id": "OBS-00004", "type": "vulnerability", "id": "CVE-2026-102764", "name": "CVE-2026-102764", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "apt", "source_report": "Encrygma Intelligence Alert: Escalating Zero-Day Exploitation Across Ivanti, Cisco, and Windows Ecosystems", "source_url": "https://encrygma.com/articles/encrygma-intelligence-alert-escalating-zero-day-exploitation-across-ivanti-cisco", "published_date": "2026-10-21" }, { "observation_id": "OBS-00005", "type": "vulnerability", "id": "CVE-2026-88771", "name": "CVE-2026-88771", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "nation_state", "source_report": "Critical Citrix NetScaler Zero-Day Exploitation Campaign Triggers Urgent Patch Mandates", "source_url": "https://encrygma.com/articles/critical-citrix-netscaler-zero-day-exploitation-campaign-triggers-urgent-patch-m", "published_date": "2026-10-21" }, { "observation_id": "OBS-00006", "type": "vulnerability", "id": "CVE-2026-88772", "name": "CVE-2026-88772", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "nation_state", "source_report": "Critical Citrix NetScaler Zero-Day Exploitation Campaign Triggers Urgent Patch Mandates", "source_url": "https://encrygma.com/articles/critical-citrix-netscaler-zero-day-exploitation-campaign-triggers-urgent-patch-m", "published_date": "2026-10-21" }, { "observation_id": "OBS-00007", "type": "vulnerability", "id": "CVE-2026-107406", "name": "CVE-2026-107406", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "nation_state", "source_report": "Critical Citrix NetScaler Zero-Day Exploitation Campaign Triggers Urgent Patch Mandates", "source_url": "https://encrygma.com/articles/critical-citrix-netscaler-zero-day-exploitation-campaign-triggers-urgent-patch-m", "published_date": "2026-10-21" }, { "observation_id": "OBS-00008", "type": "vulnerability", "id": "CVE-2026-63030", "name": "CVE-2026-63030", "tactic": null, "threat_level": "high", "geography": "Eastern Europe", "actor_type": "apt", "source_report": "CyberXero Leverages AI-Augmented Pipelines to Exfiltrate 628,000 Records from Ukrainian Infrastructure", "source_url": "https://encrygma.com/articles/cyberxero-leverages-ai-augmented-pipelines-to-exfiltrate-628-000-records-from-uk", "published_date": "2026-10-19" }, { "observation_id": "OBS-00009", "type": "vulnerability", "id": "CVE-2026-60137", "name": "CVE-2026-60137", "tactic": null, "threat_level": "high", "geography": "Eastern Europe", "actor_type": "apt", "source_report": "CyberXero Leverages AI-Augmented Pipelines to Exfiltrate 628,000 Records from Ukrainian Infrastructure", "source_url": "https://encrygma.com/articles/cyberxero-leverages-ai-augmented-pipelines-to-exfiltrate-628-000-records-from-uk", "published_date": "2026-10-19" }, { "observation_id": "OBS-00010", "type": "vulnerability", "id": "CVE-2026-0322", "name": "CVE-2026-0322", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "apt", "source_report": "Critical Zero-Day Surge: Cisco, Ivanti, and PAN-OS Under Active Exploitation", "source_url": "https://encrygma.com/articles/critical-zero-day-surge-cisco-ivanti-and-pan-os-under-active-exploitation", "published_date": "2026-10-19" }, { "observation_id": "OBS-00011", "type": "vulnerability", "id": "CVE-2024-21762", "name": "CVE-2024-21762", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "ransomware_group", "source_report": "SafePay Ransomware Group Escalates Global Attacks Amidst Record-Breaking Q3 2026 Ransomware Surge", "source_url": "https://encrygma.com/articles/safepay-ransomware-group-escalates-global-attacks-amidst-record-breaking-q3-2026", "published_date": "2026-10-16" }, { "observation_id": "OBS-00012", "type": "vulnerability", "id": "CVE-2025-8088", "name": "CVE-2025-8088", "tactic": null, "threat_level": "high", "geography": "Central Asia", "actor_type": "apt", "source_report": "UAT-6275 Espionage Campaign Targets CIS Government Infrastructure", "source_url": "https://encrygma.com/articles/uat-6275-espionage-campaign-targets-cis-government-infrastructure", "published_date": "2026-10-16" }, { "observation_id": "OBS-00013", "type": "vulnerability", "id": "CVE-2026-10520", "name": "CVE-2026-10520", "tactic": null, "threat_level": "high", "geography": "Western Europe", "actor_type": "cybercriminal", "source_report": "Canto Incognito Campaign: PoeLLM Malware Exploits AI Infrastructure to Power Global Botnet", "source_url": "https://encrygma.com/articles/canto-incognito-campaign-poellm-malware-exploits-ai-infrastructure-to-power-glob", "published_date": "2026-10-15" }, { "observation_id": "OBS-00014", "type": "vulnerability", "id": "CVE-2026-88779", "name": "CVE-2026-88779", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "apt", "source_report": "Critical October 2026 Patch Tuesday: Windows Shell Zero-Day Under Active Exploitation", "source_url": "https://encrygma.com/articles/critical-october-2026-patch-tuesday-windows-shell-zero-day-under-active-exploita", "published_date": "2026-10-15" }, { "observation_id": "OBS-00015", "type": "vulnerability", "id": "CVE-2026-104286", "name": "CVE-2026-104286", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "apt", "source_report": "Critical October 2026 Patch Tuesday: Windows Shell Zero-Day Under Active Exploitation", "source_url": "https://encrygma.com/articles/critical-october-2026-patch-tuesday-windows-shell-zero-day-under-active-exploita", "published_date": "2026-10-15" }, { "observation_id": "OBS-00016", "type": "vulnerability", "id": "CVE-2014-6278", "name": "CVE-2014-6278", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "nation_state", "source_report": "Flax Typhoon Escalates Espionage Operations via Integrity Technology Group Infrastructure", "source_url": "https://encrygma.com/articles/flax-typhoon-escalates-espionage-operations-via-integrity-technology-group-infra", "published_date": "2026-10-14" }, { "observation_id": "OBS-00017", "type": "vulnerability", "id": "CVE-2019-11510", "name": "CVE-2019-11510", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "nation_state", "source_report": "Flax Typhoon Escalates Espionage Operations via Integrity Technology Group Infrastructure", "source_url": "https://encrygma.com/articles/flax-typhoon-escalates-espionage-operations-via-integrity-technology-group-infra", "published_date": "2026-10-14" }, { "observation_id": "OBS-00018", "type": "vulnerability", "id": "CVE-2026-76504", "name": "CVE-2026-76504", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "apt", "source_report": "Critical Zero-Day Surge: Fortinet, Citrix, and Cisco Under Active Exploitation", "source_url": "https://encrygma.com/articles/critical-zero-day-surge-fortinet-citrix-and-cisco-under-active-exploitation", "published_date": "2026-10-13" }, { "observation_id": "OBS-00019", "type": "vulnerability", "id": "CVE-2026-105133", "name": "CVE-2026-105133", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "cybercriminal", "source_report": "Critical AhsayCBS Backup Server Zero-Day Exploitation Campaign Targets MSP Infrastructure", "source_url": "https://encrygma.com/articles/critical-ahsaycbs-backup-server-zero-day-exploitation-campaign-targets-msp-infra", "published_date": "2026-10-13" }, { "observation_id": "OBS-00020", "type": "vulnerability", "id": "CVE-2026-105134", "name": "CVE-2026-105134", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "cybercriminal", "source_report": "Critical AhsayCBS Backup Server Zero-Day Exploitation Campaign Targets MSP Infrastructure", "source_url": "https://encrygma.com/articles/critical-ahsaycbs-backup-server-zero-day-exploitation-campaign-targets-msp-infra", "published_date": "2026-10-13" }, { "observation_id": "OBS-00021", "type": "vulnerability", "id": "CVE-2025-49704", "name": "CVE-2025-49704", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "ransomware_group", "source_report": "Q3 2026 Ransomware Surge: The_Gentlemen and Qilin Lead Global Extortion Campaigns", "source_url": "https://encrygma.com/articles/q3-2026-ransomware-surge-the-gentlemen-and-qilin-lead-global-extortion-campaigns", "published_date": "2026-10-12" }, { "observation_id": "OBS-00022", "type": "vulnerability", "id": "CVE-2025-49706", "name": "CVE-2025-49706", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "ransomware_group", "source_report": "Q3 2026 Ransomware Surge: The_Gentlemen and Qilin Lead Global Extortion Campaigns", "source_url": "https://encrygma.com/articles/q3-2026-ransomware-surge-the-gentlemen-and-qilin-lead-global-extortion-campaigns", "published_date": "2026-10-12" }, { "observation_id": "OBS-00023", "type": "vulnerability", "id": "CVE-2025-53770", "name": "CVE-2025-53770", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "ransomware_group", "source_report": "Q3 2026 Ransomware Surge: The_Gentlemen and Qilin Lead Global Extortion Campaigns", "source_url": "https://encrygma.com/articles/q3-2026-ransomware-surge-the-gentlemen-and-qilin-lead-global-extortion-campaigns", "published_date": "2026-10-12" }, { "observation_id": "OBS-00024", "type": "vulnerability", "id": "CVE-2025-53771", "name": "CVE-2025-53771", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "ransomware_group", "source_report": "Q3 2026 Ransomware Surge: The_Gentlemen and Qilin Lead Global Extortion Campaigns", "source_url": "https://encrygma.com/articles/q3-2026-ransomware-surge-the-gentlemen-and-qilin-lead-global-extortion-campaigns", "published_date": "2026-10-12" }, { "observation_id": "OBS-00025", "type": "vulnerability", "id": "CVE-2026-0257", "name": "CVE-2026-0257", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "ransomware_group", "source_report": "Critical AhsayCBS Zero-Day Exploitation and Qilin Ransomware Surge: October 2026 Threat Brief", "source_url": "https://encrygma.com/articles/critical-ahsaycbs-zero-day-exploitation-and-qilin-ransomware-surge-october-2026-", "published_date": "2026-10-12" }, { "observation_id": "OBS-00026", "type": "vulnerability", "id": "CVE-2026-102489", "name": "CVE-2026-102489", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "unknown", "source_report": "Critical Zero-Day Vulnerability Chain Targets Zammad Helpdesk Systems", "source_url": "https://encrygma.com/articles/critical-zero-day-vulnerability-chain-targets-zammad-helpdesk-systems", "published_date": "2026-10-05" }, { "observation_id": "OBS-00027", "type": "vulnerability", "id": "CVE-2026-102490", "name": "CVE-2026-102490", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "unknown", "source_report": "Critical Zero-Day Vulnerability Chain Targets Zammad Helpdesk Systems", "source_url": "https://encrygma.com/articles/critical-zero-day-vulnerability-chain-targets-zammad-helpdesk-systems", "published_date": "2026-10-05" }, { "observation_id": "OBS-00028", "type": "vulnerability", "id": "CVE-2026-59310", "name": "CVE-2026-59310", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "ransomware_group", "source_report": "Surge in Ransomware Activity: Over 1,000 Organizations Hit in August 2026", "source_url": "https://encrygma.com/articles/surge-in-ransomware-activity-over-1-000-organizations-hit-in-august-2026", "published_date": "2026-10-03" }, { "observation_id": "OBS-00029", "type": "vulnerability", "id": "CVE-2026-86950", "name": "CVE-2026-86950", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "apt", "source_report": "Paragon Admits Inability to Monitor Graphite Spyware Misuse Amidst New CoreGraphics Zero-Day Exploitation", "source_url": "https://encrygma.com/articles/paragon-admits-inability-to-monitor-graphite-spyware-misuse-amidst-new-coregraph", "published_date": "2026-10-03" }, { "observation_id": "OBS-00030", "type": "vulnerability", "id": "CVE-2026-94127", "name": "CVE-2026-94127", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "apt", "source_report": "Critical Zero-Day Exploitation Wave: Citrix and F5 BIG-IP Under Siege", "source_url": "https://encrygma.com/articles/critical-zero-day-exploitation-wave-citrix-and-f5-big-ip-under-siege", "published_date": "2026-10-02" }, { "observation_id": "OBS-00031", "type": "technique", "id": "T1046", "name": "T1046", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "ransomware_group", "source_report": "Ransomware Surge: Emperador and SafePay Lead Record-Breaking September 2026 Extortion Wave", "source_url": "https://encrygma.com/articles/ransomware-surge-emperador-and-safepay-lead-record-breaking-september-2026-extor", "published_date": "2026-09-29" }, { "observation_id": "OBS-00032", "type": "technique", "id": "T1486", "name": "T1486", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "ransomware_group", "source_report": "Ransomware Surge: Emperador and SafePay Lead Record-Breaking September 2026 Extortion Wave", "source_url": "https://encrygma.com/articles/ransomware-surge-emperador-and-safepay-lead-record-breaking-september-2026-extor", "published_date": "2026-09-29" }, { "observation_id": "OBS-00033", "type": "vulnerability", "id": "CVE-2026-88778", "name": "CVE-2026-88778", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "apt", "source_report": "Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC and Gateway", "source_url": "https://encrygma.com/articles/critical-zero-day-vulnerabilities-exploited-in-citrix-netscaler-adc-and-gateway", "published_date": "2026-09-29" }, { "observation_id": "OBS-00034", "type": "vulnerability", "id": "CVE-2026-88773", "name": "CVE-2026-88773", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "apt", "source_report": "Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC and Gateway", "source_url": "https://encrygma.com/articles/critical-zero-day-vulnerabilities-exploited-in-citrix-netscaler-adc-and-gateway", "published_date": "2026-09-29" }, { "observation_id": "OBS-00035", "type": "vulnerability", "id": "CVE-2026-3869", "name": "CVE-2026-3869", "tactic": null, "threat_level": "critical", "geography": "Europe", "actor_type": "nation_state", "source_report": "European Energy Grid Operators Warn of Escalating Cyber and Physical Sabotage Threats", "source_url": "https://encrygma.com/articles/european-energy-grid-operators-warn-of-escalating-cyber-and-physical-sabotage-th", "published_date": "2026-09-28" }, { "observation_id": "OBS-00036", "type": "vulnerability", "id": "CVE-2026-35273", "name": "CVE-2026-35273", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "cybercriminal", "source_report": "ShinyHunters Resumes Exploitation of Oracle PeopleSoft via WAF Bypass Technique", "source_url": "https://encrygma.com/articles/shinyhunters-resumes-exploitation-of-oracle-peoplesoft-via-waf-bypass-technique", "published_date": "2026-09-27" }, { "observation_id": "OBS-00037", "type": "technique", "id": "T1204.002", "name": "T1204.002", "tactic": null, "threat_level": "high", "geography": "Middle East", "actor_type": "nation_state", "source_report": "Iranian Espionage Campaign Deploys 'CHOSEN BRICK' Trojan Against Nationals Abroad", "source_url": "https://encrygma.com/articles/iranian-espionage-campaign-deploys-chosen-brick-trojan-against-nationals-abroad", "published_date": "2026-09-27" }, { "observation_id": "OBS-00038", "type": "vulnerability", "id": "CVE-2026-42608", "name": "CVE-2026-42608", "tactic": null, "threat_level": "high", "geography": "Global", "actor_type": "ransomware_group", "source_report": "ShinyHunters Escalates Cyber-Conflict: Rival Ransomware Gangs Clop and ShinyHunters Engage in Digital Warfare", "source_url": "https://encrygma.com/articles/shinyhunters-escalates-cyber-conflict-rival-ransomware-gangs-clop-and-shinyhunte", "published_date": "2026-09-26" }, { "observation_id": "OBS-00039", "type": "vulnerability", "id": "CVE-2026-93616", "name": "CVE-2026-93616", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "apt", "source_report": "Critical Zero-Day Vulnerability CVE-2026-93616 Exploited in Check Point Security Management Infrastructure", "source_url": "https://encrygma.com/articles/critical-zero-day-vulnerability-cve-2026-93616-exploited-in-check-point-security", "published_date": "2026-09-26" }, { "observation_id": "OBS-00040", "type": "vulnerability", "id": "CVE-2025-39964", "name": "CVE-2025-39964", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "unknown", "source_report": "CISA Adds Three Linux Kernel Flaws to KEV Catalog Amid Active Exploitation Concerns", "source_url": "https://encrygma.com/articles/cisa-adds-three-linux-kernel-flaws-to-kev-catalog-amid-active-exploitation-conce", "published_date": "2026-09-25" }, { "observation_id": "OBS-00041", "type": "vulnerability", "id": "CVE-2026-50751", "name": "CVE-2026-50751", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "ransomware_group", "source_report": "Check Point Management Server Zero-Day Exploited by Ransomware Gangs", "source_url": "https://encrygma.com/articles/check-point-management-server-zero-day-exploited-by-ransomware-gangs", "published_date": "2026-09-24" }, { "observation_id": "OBS-00042", "type": "vulnerability", "id": "CVE-2026-16232", "name": "CVE-2026-16232", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "ransomware_group", "source_report": "Check Point Management Server Zero-Day Exploited by Ransomware Gangs", "source_url": "https://encrygma.com/articles/check-point-management-server-zero-day-exploited-by-ransomware-gangs", "published_date": "2026-09-24" }, { "observation_id": "OBS-00043", "type": "vulnerability", "id": "CVE-2026-58704", "name": "CVE-2026-58704", "tactic": null, "threat_level": "high", "geography": "Global", "actor_type": "unknown", "source_report": "Google Patches Actively Exploited Android Zero-Day CVE-2026-58704 Affecting Pixel Devices", "source_url": "https://encrygma.com/articles/google-patches-actively-exploited-android-zero-day-cve-2026-58704-affecting-pixe", "published_date": "2026-09-24" }, { "observation_id": "OBS-00044", "type": "vulnerability", "id": "CVE-2026-76461", "name": "CVE-2026-76461", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "apt", "source_report": "CISA Issues Emergency Directive Following Surge in Zero-Day Exploits Across Cisco and Google Pixel Ecosystems", "source_url": "https://encrygma.com/articles/cisa-issues-emergency-directive-following-surge-in-zero-day-exploits-across-cisc", "published_date": "2026-09-23" }, { "observation_id": "OBS-00045", "type": "vulnerability", "id": "CVE-2025-39682", "name": "CVE-2025-39682", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "apt", "source_report": "CISA Issues Emergency Directive Following Surge in Zero-Day Exploits Across Cisco and Google Pixel Ecosystems", "source_url": "https://encrygma.com/articles/cisa-issues-emergency-directive-following-surge-in-zero-day-exploits-across-cisc", "published_date": "2026-09-23" }, { "observation_id": "OBS-00046", "type": "vulnerability", "id": "CVE-2026-53266", "name": "CVE-2026-53266", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "apt", "source_report": "CISA Issues Emergency Directive Following Surge in Zero-Day Exploits Across Cisco and Google Pixel Ecosystems", "source_url": "https://encrygma.com/articles/cisa-issues-emergency-directive-following-surge-in-zero-day-exploits-across-cisc", "published_date": "2026-09-23" }, { "observation_id": "OBS-00047", "type": "vulnerability", "id": "CVE-2026-93952", "name": "CVE-2026-93952", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "apt", "source_report": "Arista Networks Issues Urgent Warning Over Actively Exploited VeloCloud Zero-Day Vulnerability", "source_url": "https://encrygma.com/articles/arista-networks-issues-urgent-warning-over-actively-exploited-velocloud-zero-day", "published_date": "2026-09-22" }, { "observation_id": "OBS-00048", "type": "vulnerability", "id": "CVE-2026-76460", "name": "CVE-2026-76460", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "apt", "source_report": "Cisco Under Siege: Critical Zero-Day Exploits Target ISE and Secure Email Gateway", "source_url": "https://encrygma.com/articles/cisco-under-siege-critical-zero-day-exploits-target-ise-and-secure-email-gateway", "published_date": "2026-09-21" }, { "observation_id": "OBS-00049", "type": "vulnerability", "id": "CVE-2026-84869", "name": "CVE-2026-84869", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "cybercriminal", "source_report": "Critical ScreenConnect Vulnerability Under Active Worm-Like Exploitation", "source_url": "https://encrygma.com/articles/critical-screenconnect-vulnerability-under-active-worm-like-exploitation", "published_date": "2026-09-18" }, { "observation_id": "OBS-00050", "type": "vulnerability", "id": "CVE-2026-39987", "name": "CVE-2026-39987", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "unknown", "source_report": "OpenAI Agent Swarm Incident: Autonomous AI Exploits RubyGems and Marimo Vulnerabilities", "source_url": "https://encrygma.com/articles/openai-agent-swarm-incident-autonomous-ai-exploits-rubygems-and-marimo-vulnerabi", "published_date": "2026-09-18" }, { "observation_id": "OBS-00051", "type": "vulnerability", "id": "CVE-2026-85706", "name": "CVE-2026-85706", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "unknown", "source_report": "Critical GitLab Path Traversal Vulnerability (CVE-2026-85706) Under Active Exploitation", "source_url": "https://encrygma.com/articles/critical-gitlab-path-traversal-vulnerability-cve-2026-85706-under-active-exploit", "published_date": "2026-09-17" }, { "observation_id": "OBS-00052", "type": "vulnerability", "id": "CVE-2026-87491", "name": "CVE-2026-87491", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "apt", "source_report": "BlueMoon Exploit Kit Leverages Chrome and Windows Zero-Days in Targeted Espionage Campaigns", "source_url": "https://encrygma.com/articles/bluemoon-exploit-kit-leverages-chrome-and-windows-zero-days-in-targeted-espionag", "published_date": "2026-09-16" }, { "observation_id": "OBS-00053", "type": "vulnerability", "id": "CVE-2026-85046", "name": "CVE-2026-85046", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "nation_state", "source_report": "Dual China-Linked APTs Deploy Identical Chrome Zero-Day Exploit Chain Against NGOs", "source_url": "https://encrygma.com/articles/dual-china-linked-apts-deploy-identical-chrome-zero-day-exploit-chain-against-ng", "published_date": "2026-09-16" }, { "observation_id": "OBS-00054", "type": "vulnerability", "id": "CVE-2026-85880", "name": "CVE-2026-85880", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "nation_state", "source_report": "Four Nation-State Threat Actors Deploy AI-Assisted 'BlueMoon' Chrome and Windows Zero-Day Exploit Chain", "source_url": "https://encrygma.com/articles/four-nation-state-threat-actors-deploy-ai-assisted-bluemoon-chrome-and-windows-z", "published_date": "2026-09-14" }, { "observation_id": "OBS-00055", "type": "vulnerability", "id": "CVE-2026-81963", "name": "CVE-2026-81963", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "nation_state", "source_report": "Four Nation-State Threat Actors Deploy AI-Assisted 'BlueMoon' Chrome and Windows Zero-Day Exploit Chain", "source_url": "https://encrygma.com/articles/four-nation-state-threat-actors-deploy-ai-assisted-bluemoon-chrome-and-windows-z", "published_date": "2026-09-14" }, { "observation_id": "OBS-00056", "type": "technique", "id": "T1059", "name": "Command and Scripting Interpreter", "tactic": "Execution", "threat_level": "critical", "geography": "Global", "actor_type": "unknown", "source_report": "DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval", "source_url": "https://encrygma.com/articles/deepseek-harness-flaw-let-ai-agents-disable-own-file-sandbox", "published_date": "2026-09-10" }, { "observation_id": "OBS-00057", "type": "technique", "id": "T1528", "name": "Steal Application Access Token", "tactic": "Credential Access", "threat_level": "high", "geography": "Global", "actor_type": "cybercriminal", "source_report": "Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA", "source_url": "https://encrygma.com/articles/infostealer-logs-expose-replayable-ai-tokens-bypass-mfa", "published_date": "2026-09-10" }, { "observation_id": "OBS-00058", "type": "technique", "id": "T1556", "name": "Modify Authentication Process", "tactic": "Credential Access", "threat_level": "high", "geography": "Global", "actor_type": "cybercriminal", "source_report": "Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA", "source_url": "https://encrygma.com/articles/infostealer-logs-expose-replayable-ai-tokens-bypass-mfa", "published_date": "2026-09-10" }, { "observation_id": "OBS-00059", "type": "technique", "id": "T1078", "name": "Valid Accounts", "tactic": "Defense Evasion", "threat_level": "high", "geography": "Global", "actor_type": "unknown", "source_report": "Your Agents Can Be Hacked by Other Agents: The Rise of Machine-vs-Machine Cyberattacks", "source_url": "https://encrygma.com/articles/your-agents-can-be-hacked-by-other-agents-machine-vs-machine", "published_date": "2026-09-10" }, { "observation_id": "OBS-00060", "type": "technique", "id": "T1078", "name": "Valid Accounts", "tactic": "Defense Evasion", "threat_level": "high", "geography": "Global", "actor_type": "unknown", "source_report": "The Models That Found 10,000 Zero-Days Broke Into Three Companies Using Weak Passwords", "source_url": "https://encrygma.com/articles/models-that-found-10000-zero-days-broke-into-three-companies-weak-passwords", "published_date": "2026-09-10" }, { "observation_id": "OBS-00061", "type": "technique", "id": "T1110", "name": "Brute Force", "tactic": "Credential Access", "threat_level": "high", "geography": "Global", "actor_type": "unknown", "source_report": "The Models That Found 10,000 Zero-Days Broke Into Three Companies Using Weak Passwords", "source_url": "https://encrygma.com/articles/models-that-found-10000-zero-days-broke-into-three-companies-weak-passwords", "published_date": "2026-09-10" }, { "observation_id": "OBS-00062", "type": "technique", "id": "T1528", "name": "Steal Application Access Token", "tactic": "Credential Access", "threat_level": "critical", "geography": "Global", "actor_type": "cybercriminal", "source_report": "Google GTIG Documents Evolution From Prompting to Autonomy in Adversarial AI Attack Workflows", "source_url": "https://encrygma.com/articles/google-gtig-from-prompting-to-autonomy-adversarial-ai-evolution", "published_date": "2026-09-10" }, { "observation_id": "OBS-00063", "type": "technique", "id": "T1078", "name": "Valid Accounts", "tactic": "Defense Evasion", "threat_level": "critical", "geography": "Global", "actor_type": "cybercriminal", "source_report": "Google GTIG Documents Evolution From Prompting to Autonomy in Adversarial AI Attack Workflows", "source_url": "https://encrygma.com/articles/google-gtig-from-prompting-to-autonomy-adversarial-ai-evolution", "published_date": "2026-09-10" }, { "observation_id": "OBS-00064", "type": "technique", "id": "T1528", "name": "Steal Application Access Token", "tactic": "Credential Access", "threat_level": "critical", "geography": "Global", "actor_type": "cybercriminal", "source_report": "Autonomous AI Agents Compromise Thousands of Credentials in Under Six Hours", "source_url": "https://encrygma.com/articles/autonomous-ai-agents-compromise-thousands-credentials-six-hours", "published_date": "2026-09-10" }, { "observation_id": "OBS-00065", "type": "technique", "id": "T1114", "name": "Email Collection", "tactic": "Collection", "threat_level": "critical", "geography": "Global", "actor_type": "cybercriminal", "source_report": "Autonomous AI Agents Compromise Thousands of Credentials in Under Six Hours", "source_url": "https://encrygma.com/articles/autonomous-ai-agents-compromise-thousands-credentials-six-hours", "published_date": "2026-09-10" }, { "observation_id": "OBS-00066", "type": "technique", "id": "T1566", "name": "Phishing", "tactic": "Initial Access", "threat_level": "critical", "geography": "Europe", "actor_type": "unknown", "source_report": "OpenAI Autonomous Agents Hijacked German Programming Wiki in Previously Undisclosed Spring Breakout", "source_url": "https://encrygma.com/articles/openai-agents-hijacked-german-programming-wiki-spring-breakout", "published_date": "2026-09-10" }, { "observation_id": "OBS-00067", "type": "technique", "id": "T1566", "name": "Phishing", "tactic": "Initial Access", "threat_level": "medium", "geography": "Global (commodity phishing)", "actor_type": "cybercriminal", "source_report": "Microsoft Documents ASCII Smuggling Crossing from Prompt-Injection Research into Phishing Evasion", "source_url": "https://encrygma.com/articles/microsoft-ascii-smuggling-unicode-tags-phishing-evasion", "published_date": "2026-09-05" }, { "observation_id": "OBS-00068", "type": "technique", "id": "T1027", "name": "Obfuscated Files or Information", "tactic": "Defense Evasion", "threat_level": "medium", "geography": "Global (commodity phishing)", "actor_type": "cybercriminal", "source_report": "Microsoft Documents ASCII Smuggling Crossing from Prompt-Injection Research into Phishing Evasion", "source_url": "https://encrygma.com/articles/microsoft-ascii-smuggling-unicode-tags-phishing-evasion", "published_date": "2026-09-05" }, { "observation_id": "OBS-00069", "type": "technique", "id": "T1566.001", "name": "Spearphishing Attachment", "tactic": "Initial Access", "threat_level": "medium", "geography": "Global (commodity phishing)", "actor_type": "cybercriminal", "source_report": "Microsoft Documents ASCII Smuggling Crossing from Prompt-Injection Research into Phishing Evasion", "source_url": "https://encrygma.com/articles/microsoft-ascii-smuggling-unicode-tags-phishing-evasion", "published_date": "2026-09-05" }, { "observation_id": "OBS-00070", "type": "technique", "id": "T1059", "name": "Command and Scripting Interpreter", "tactic": "Execution", "threat_level": "high", "geography": "United States (AI lab evaluation)", "actor_type": "unknown", "source_report": "OpenAI Evaluation-Agent Compromise of Hugging Face Resurfaces as Reference Case for Agentic Containment", "source_url": "https://encrygma.com/articles/openai-evaluation-agent-hugging-face-compromise-resurface", "published_date": "2026-09-05" }, { "observation_id": "OBS-00071", "type": "technique", "id": "T1078", "name": "Valid Accounts", "tactic": "Privilege Escalation", "threat_level": "high", "geography": "United States (AI lab evaluation)", "actor_type": "unknown", "source_report": "OpenAI Evaluation-Agent Compromise of Hugging Face Resurfaces as Reference Case for Agentic Containment", "source_url": "https://encrygma.com/articles/openai-evaluation-agent-hugging-face-compromise-resurface", "published_date": "2026-09-05" }, { "observation_id": "OBS-00072", "type": "technique", "id": "T1211", "name": "Exploitation for Defense Evasion", "tactic": "Defense Evasion", "threat_level": "high", "geography": "United States (AI lab evaluation)", "actor_type": "unknown", "source_report": "OpenAI Evaluation-Agent Compromise of Hugging Face Resurfaces as Reference Case for Agentic Containment", "source_url": "https://encrygma.com/articles/openai-evaluation-agent-hugging-face-compromise-resurface", "published_date": "2026-09-05" }, { "observation_id": "OBS-00073", "type": "technique", "id": "T1204", "name": "User Execution", "tactic": "Initial Access", "threat_level": "medium", "geography": "Global (developer targeting)", "actor_type": "cybercriminal", "source_report": "Fake \"Claude Opus 5 Free Desktop\" GitHub Repositories Deliver RevStealer Malware", "source_url": "https://encrygma.com/articles/fake-claude-opus-5-desktop-github-revstealer", "published_date": "2026-09-05" }, { "observation_id": "OBS-00074", "type": "technique", "id": "T1555", "name": "Credentials from Password Stores", "tactic": "Credential Access", "threat_level": "medium", "geography": "Global (developer targeting)", "actor_type": "cybercriminal", "source_report": "Fake \"Claude Opus 5 Free Desktop\" GitHub Repositories Deliver RevStealer Malware", "source_url": "https://encrygma.com/articles/fake-claude-opus-5-desktop-github-revstealer", "published_date": "2026-09-05" }, { "observation_id": "OBS-00075", "type": "technique", "id": "T1070", "name": "Indicator Removal", "tactic": "Defense Evasion", "threat_level": "medium", "geography": "Global (developer targeting)", "actor_type": "cybercriminal", "source_report": "Fake \"Claude Opus 5 Free Desktop\" GitHub Repositories Deliver RevStealer Malware", "source_url": "https://encrygma.com/articles/fake-claude-opus-5-desktop-github-revstealer", "published_date": "2026-09-05" }, { "observation_id": "OBS-00076", "type": "technique", "id": "T1059", "name": "Command and Scripting Interpreter", "tactic": "Execution", "threat_level": "low", "geography": "United States (lab evaluation)", "actor_type": "unknown", "source_report": "Lab Results: Claude Mythos Completes Full Cyber Kill Chain in Controlled Simulation; Hacker-Opus Reward-Hacking Documented", "source_url": "https://encrygma.com/articles/claude-mythos-lab-kill-chain-hacker-opus-reward-hacking", "published_date": "2026-09-05" }, { "observation_id": "OBS-00077", "type": "vulnerability", "id": "CVE-2026-1731", "name": "CVE-2026-1731", "tactic": null, "threat_level": "high", "geography": "Global", "actor_type": "cybercriminal", "source_report": "Storm-1175 Shifts to Custom StormEncryptor Ransomware in Rapid Exploitation Campaigns", "source_url": "https://encrygma.com/articles/storm-1175-shifts-to-custom-stormencryptor-ransomware-in-rapid-exploitation-camp", "published_date": "2026-09-04" }, { "observation_id": "OBS-00078", "type": "vulnerability", "id": "CVE-2023-27350", "name": "CVE-2023-27350", "tactic": null, "threat_level": "high", "geography": "Global", "actor_type": "cybercriminal", "source_report": "Storm-1175 Shifts to Custom StormEncryptor Ransomware in Rapid Exploitation Campaigns", "source_url": "https://encrygma.com/articles/storm-1175-shifts-to-custom-stormencryptor-ransomware-in-rapid-exploitation-camp", "published_date": "2026-09-04" }, { "observation_id": "OBS-00079", "type": "vulnerability", "id": "CVE-2023-27351", "name": "CVE-2023-27351", "tactic": null, "threat_level": "high", "geography": "Global", "actor_type": "cybercriminal", "source_report": "Storm-1175 Shifts to Custom StormEncryptor Ransomware in Rapid Exploitation Campaigns", "source_url": "https://encrygma.com/articles/storm-1175-shifts-to-custom-stormencryptor-ransomware-in-rapid-exploitation-camp", "published_date": "2026-09-04" }, { "observation_id": "OBS-00080", "type": "technique", "id": "T1059", "name": "Command and Scripting Interpreter", "tactic": "Command and Scripting Interpreter", "threat_level": "high", "geography": "Latin America (Mexico, Ecuador, Brazil)", "actor_type": "cybercriminal", "source_report": "Unit 42 Tracks Latin American Clusters Using Self-Hosted NextChat to Iterate AI-Assisted Tooling", "source_url": "https://encrygma.com/articles/unit-42-latam-clusters-nextchat-llm-iterative-tooling", "published_date": "2026-09-04" }, { "observation_id": "OBS-00081", "type": "technique", "id": "T1003", "name": "OS Credential Dumping", "tactic": "Credential Access", "threat_level": "high", "geography": "Latin America (Mexico, Ecuador, Brazil)", "actor_type": "cybercriminal", "source_report": "Unit 42 Tracks Latin American Clusters Using Self-Hosted NextChat to Iterate AI-Assisted Tooling", "source_url": "https://encrygma.com/articles/unit-42-latam-clusters-nextchat-llm-iterative-tooling", "published_date": "2026-09-04" }, { "observation_id": "OBS-00082", "type": "technique", "id": "T1090", "name": "Proxy", "tactic": "Command and Control", "threat_level": "high", "geography": "Latin America (Mexico, Ecuador, Brazil)", "actor_type": "cybercriminal", "source_report": "Unit 42 Tracks Latin American Clusters Using Self-Hosted NextChat to Iterate AI-Assisted Tooling", "source_url": "https://encrygma.com/articles/unit-42-latam-clusters-nextchat-llm-iterative-tooling", "published_date": "2026-09-04" }, { "observation_id": "OBS-00083", "type": "technique", "id": "T1071", "name": "Application Layer Protocol", "tactic": "Defense Evasion", "threat_level": "high", "geography": "Latin America (Mexico, Ecuador, Brazil)", "actor_type": "cybercriminal", "source_report": "Unit 42 Tracks Latin American Clusters Using Self-Hosted NextChat to Iterate AI-Assisted Tooling", "source_url": "https://encrygma.com/articles/unit-42-latam-clusters-nextchat-llm-iterative-tooling", "published_date": "2026-09-04" }, { "observation_id": "OBS-00084", "type": "technique", "id": "T1204", "name": "User Execution", "tactic": "Execution", "threat_level": "high", "geography": "Latin America (Mexico, Ecuador, Brazil)", "actor_type": "cybercriminal", "source_report": "Unit 42 Tracks Latin American Clusters Using Self-Hosted NextChat to Iterate AI-Assisted Tooling", "source_url": "https://encrygma.com/articles/unit-42-latam-clusters-nextchat-llm-iterative-tooling", "published_date": "2026-09-04" }, { "observation_id": "OBS-00085", "type": "vulnerability", "id": "CVE-2026-83548", "name": "CVE-2026-83548", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "apt", "source_report": "SonicWall Issues Emergency Hotfix for Actively Exploited SMA 1000 Zero-Day Chain", "source_url": "https://encrygma.com/articles/sonicwall-issues-emergency-hotfix-for-actively-exploited-sma-1000-zero-day-chain", "published_date": "2026-09-04" }, { "observation_id": "OBS-00086", "type": "vulnerability", "id": "CVE-2026-83549", "name": "CVE-2026-83549", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "apt", "source_report": "SonicWall Issues Emergency Hotfix for Actively Exploited SMA 1000 Zero-Day Chain", "source_url": "https://encrygma.com/articles/sonicwall-issues-emergency-hotfix-for-actively-exploited-sma-1000-zero-day-chain", "published_date": "2026-09-04" }, { "observation_id": "OBS-00087", "type": "vulnerability", "id": "CVE-2026-15409", "name": "CVE-2026-15409", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "apt", "source_report": "SonicWall Issues Emergency Hotfix for Actively Exploited SMA 1000 Zero-Day Chain", "source_url": "https://encrygma.com/articles/sonicwall-issues-emergency-hotfix-for-actively-exploited-sma-1000-zero-day-chain", "published_date": "2026-09-04" }, { "observation_id": "OBS-00088", "type": "vulnerability", "id": "CVE-2026-15410", "name": "CVE-2026-15410", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "apt", "source_report": "SonicWall Issues Emergency Hotfix for Actively Exploited SMA 1000 Zero-Day Chain", "source_url": "https://encrygma.com/articles/sonicwall-issues-emergency-hotfix-for-actively-exploited-sma-1000-zero-day-chain", "published_date": "2026-09-04" }, { "observation_id": "OBS-00089", "type": "technique", "id": "T1590", "name": "Gather Victim Host Information", "tactic": "Reconnaissance", "threat_level": "critical", "geography": "Unspecified (global enterprise)", "actor_type": "ransomware_group", "source_report": "Unit 42 Documents AI-Assisted Ransomware Intrusion Completed in Under 10 Hours", "source_url": "https://encrygma.com/articles/unit-42-ai-assisted-ransomware-intrusion-under-10-hours", "published_date": "2026-09-03" }, { "observation_id": "OBS-00090", "type": "technique", "id": "T1580", "name": "Cloud Infrastructure Discovery", "tactic": "Discovery", "threat_level": "critical", "geography": "Unspecified (global enterprise)", "actor_type": "ransomware_group", "source_report": "Unit 42 Documents AI-Assisted Ransomware Intrusion Completed in Under 10 Hours", "source_url": "https://encrygma.com/articles/unit-42-ai-assisted-ransomware-intrusion-under-10-hours", "published_date": "2026-09-03" }, { "observation_id": "OBS-00091", "type": "technique", "id": "T1552", "name": "Unsecured Credentials", "tactic": "Credential Access", "threat_level": "critical", "geography": "Unspecified (global enterprise)", "actor_type": "ransomware_group", "source_report": "Unit 42 Documents AI-Assisted Ransomware Intrusion Completed in Under 10 Hours", "source_url": "https://encrygma.com/articles/unit-42-ai-assisted-ransomware-intrusion-under-10-hours", "published_date": "2026-09-03" }, { "observation_id": "OBS-00092", "type": "technique", "id": "T1078", "name": "Valid Accounts", "tactic": "Defense Evasion, Persistence, Privilege Escalation", "threat_level": "critical", "geography": "Unspecified (global enterprise)", "actor_type": "ransomware_group", "source_report": "Unit 42 Documents AI-Assisted Ransomware Intrusion Completed in Under 10 Hours", "source_url": "https://encrygma.com/articles/unit-42-ai-assisted-ransomware-intrusion-under-10-hours", "published_date": "2026-09-03" }, { "observation_id": "OBS-00093", "type": "technique", "id": "T1555", "name": "Credentials from Password Stores", "tactic": "Credential Access", "threat_level": "critical", "geography": "Unspecified (global enterprise)", "actor_type": "ransomware_group", "source_report": "Unit 42 Documents AI-Assisted Ransomware Intrusion Completed in Under 10 Hours", "source_url": "https://encrygma.com/articles/unit-42-ai-assisted-ransomware-intrusion-under-10-hours", "published_date": "2026-09-03" }, { "observation_id": "OBS-00094", "type": "technique", "id": "T1059", "name": "Command and Scripting Interpreter", "tactic": "Execution", "threat_level": "critical", "geography": "Unspecified (global enterprise)", "actor_type": "ransomware_group", "source_report": "Unit 42 Documents AI-Assisted Ransomware Intrusion Completed in Under 10 Hours", "source_url": "https://encrygma.com/articles/unit-42-ai-assisted-ransomware-intrusion-under-10-hours", "published_date": "2026-09-03" }, { "observation_id": "OBS-00095", "type": "technique", "id": "T1199", "name": "Trusted Relationship", "tactic": "Initial Access", "threat_level": "critical", "geography": "Unspecified (global enterprise)", "actor_type": "ransomware_group", "source_report": "Unit 42 Documents AI-Assisted Ransomware Intrusion Completed in Under 10 Hours", "source_url": "https://encrygma.com/articles/unit-42-ai-assisted-ransomware-intrusion-under-10-hours", "published_date": "2026-09-03" }, { "observation_id": "OBS-00096", "type": "technique", "id": "T1486", "name": "Data Encrypted for Impact", "tactic": "Impact", "threat_level": "critical", "geography": "Unspecified (global enterprise)", "actor_type": "ransomware_group", "source_report": "Unit 42 Documents AI-Assisted Ransomware Intrusion Completed in Under 10 Hours", "source_url": "https://encrygma.com/articles/unit-42-ai-assisted-ransomware-intrusion-under-10-hours", "published_date": "2026-09-03" }, { "observation_id": "OBS-00097", "type": "technique", "id": "T1566", "name": "Phishing", "tactic": "Initial Access", "threat_level": "high", "geography": "United Kingdom", "actor_type": "unknown", "source_report": "UK AI Security Institute Reports Unsanctioned Agent Behaviour in Cyber Evaluation", "source_url": "https://encrygma.com/articles/uk-aisi-unsanctioned-agent-behaviour-cyber-evaluation", "published_date": "2026-09-03" }, { "observation_id": "OBS-00098", "type": "technique", "id": "T1656", "name": "Impersonation", "tactic": "Initial Access", "threat_level": "high", "geography": "United Kingdom", "actor_type": "unknown", "source_report": "UK AI Security Institute Reports Unsanctioned Agent Behaviour in Cyber Evaluation", "source_url": "https://encrygma.com/articles/uk-aisi-unsanctioned-agent-behaviour-cyber-evaluation", "published_date": "2026-09-03" }, { "observation_id": "OBS-00099", "type": "technique", "id": "T1059", "name": "Command and Scripting Interpreter", "tactic": "Execution", "threat_level": "high", "geography": "United Kingdom", "actor_type": "unknown", "source_report": "UK AI Security Institute Reports Unsanctioned Agent Behaviour in Cyber Evaluation", "source_url": "https://encrygma.com/articles/uk-aisi-unsanctioned-agent-behaviour-cyber-evaluation", "published_date": "2026-09-03" }, { "observation_id": "OBS-00100", "type": "technique", "id": "T1199", "name": "Trusted Relationship", "tactic": "Initial Access", "threat_level": "high", "geography": "United Kingdom", "actor_type": "unknown", "source_report": "UK AI Security Institute Reports Unsanctioned Agent Behaviour in Cyber Evaluation", "source_url": "https://encrygma.com/articles/uk-aisi-unsanctioned-agent-behaviour-cyber-evaluation", "published_date": "2026-09-03" }, { "observation_id": "OBS-00101", "type": "vulnerability", "id": "CVE-2026-82329", "name": "CVE-2026-82329", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "ransomware_group", "source_report": "SonicWall SMA1000 Zero-Day Chain (CVE-2026-83548/9) Under Active Exploitation by Ransomware Groups", "source_url": "https://encrygma.com/articles/sonicwall-sma1000-zero-day-chain-cve-2026-83548-9-under-active-exploitation-by-r", "published_date": "2026-09-02" }, { "observation_id": "OBS-00102", "type": "vulnerability", "id": "CVE-2026-68820", "name": "CVE-2026-68820", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "ransomware_group", "source_report": "SonicWall SMA1000 Zero-Day Chain (CVE-2026-83548/9) Under Active Exploitation by Ransomware Groups", "source_url": "https://encrygma.com/articles/sonicwall-sma1000-zero-day-chain-cve-2026-83548-9-under-active-exploitation-by-r", "published_date": "2026-09-02" }, { "observation_id": "OBS-00103", "type": "technique", "id": "T1437.001", "name": "Mobile Application Configuration", "tactic": "Persistence", "threat_level": "high", "geography": "Global", "actor_type": "cybercriminal", "source_report": "ZeroDayRAT: Defensive Intelligence Analysis of a Commoditized Mobile Surveillance Platform", "source_url": "https://encrygma.com/articles/zerodayrat-defensive-intelligence-analysis-commoditized-mobile-surveillance-platform", "published_date": "2026-09-02" }, { "observation_id": "OBS-00104", "type": "technique", "id": "T1437.002", "name": "Mobile Device Management (MDM) Profile", "tactic": "Persistence", "threat_level": "high", "geography": "Global", "actor_type": "cybercriminal", "source_report": "ZeroDayRAT: Defensive Intelligence Analysis of a Commoditized Mobile Surveillance Platform", "source_url": "https://encrygma.com/articles/zerodayrat-defensive-intelligence-analysis-commoditized-mobile-surveillance-platform", "published_date": "2026-09-02" }, { "observation_id": "OBS-00105", "type": "technique", "id": "T1195.002", "name": "Compromise Software Supply Chain", "tactic": "Initial Access", "threat_level": "high", "geography": "Global", "actor_type": "unknown", "source_report": "GitSpawn: Unsanitized Git Context Lets Attackers Hijack Claude Code, Cursor, Codex and Other AI Coding Agents", "source_url": "https://encrygma.com/articles/gitspawn-unsanitized-git-context-lets-attackers-hijack-ai-coding-agents", "published_date": "2026-09-02" }, { "observation_id": "OBS-00106", "type": "technique", "id": "T1059", "name": "Command and Scripting Interpreter", "tactic": "Execution", "threat_level": "high", "geography": "Global", "actor_type": "unknown", "source_report": "GitSpawn: Unsanitized Git Context Lets Attackers Hijack Claude Code, Cursor, Codex and Other AI Coding Agents", "source_url": "https://encrygma.com/articles/gitspawn-unsanitized-git-context-lets-attackers-hijack-ai-coding-agents", "published_date": "2026-09-02" }, { "observation_id": "OBS-00107", "type": "technique", "id": "T1595.002", "name": "Active Scanning: Vulnerability Scanning", "tactic": "Reconnaissance", "threat_level": "medium", "geography": "Global", "actor_type": "cybercriminal", "source_report": "Threat Actors Pose as OpenAI, Anthropic and Google AI Crawlers to Harvest .env Files, AWS Keys and Private Certificates", "source_url": "https://encrygma.com/articles/threat-actors-pose-as-openai-anthropic-google-ai-crawlers-to-harvest-credentials", "published_date": "2026-09-02" }, { "observation_id": "OBS-00108", "type": "technique", "id": "T1552.001", "name": "Unsecured Credentials: Credentials In Files", "tactic": "Credential Access", "threat_level": "medium", "geography": "Global", "actor_type": "cybercriminal", "source_report": "Threat Actors Pose as OpenAI, Anthropic and Google AI Crawlers to Harvest .env Files, AWS Keys and Private Certificates", "source_url": "https://encrygma.com/articles/threat-actors-pose-as-openai-anthropic-google-ai-crawlers-to-harvest-credentials", "published_date": "2026-09-02" }, { "observation_id": "OBS-00109", "type": "vulnerability", "id": "CVE-2023-25717", "name": "CVE-2023-25717", "tactic": null, "threat_level": "critical", "geography": "Global / Middle East and Asia", "actor_type": "nation_state", "source_report": "Fire Ant APT Leverages Compromised Cisco Infrastructure and SLEEPWALKER Backdoor for Stealthy Espionage", "source_url": "https://encrygma.com/articles/fire-ant-apt-leverages-compromised-cisco-infrastructure-and-sleepwalker-backdoor", "published_date": "2026-09-02" }, { "observation_id": "OBS-00110", "type": "vulnerability", "id": "CVE-2026-81578", "name": "CVE-2026-81578", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "apt", "source_report": "Critical PaperCut Zero-Day Exploits Under Active Attack: CISA Issues Urgent Patch Directive", "source_url": "https://encrygma.com/articles/critical-papercut-zero-day-exploits-under-active-attack-cisa-issues-urgent-patch", "published_date": "2026-09-01" }, { "observation_id": "OBS-00111", "type": "vulnerability", "id": "CVE-2026-82078", "name": "CVE-2026-82078", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "apt", "source_report": "Critical PaperCut Zero-Day Exploits Under Active Attack: CISA Issues Urgent Patch Directive", "source_url": "https://encrygma.com/articles/critical-papercut-zero-day-exploits-under-active-attack-cisa-issues-urgent-patch", "published_date": "2026-09-01" }, { "observation_id": "OBS-00112", "type": "technique", "id": "T1585", "name": "Establish Accounts", "tactic": "Resource Development", "threat_level": "high", "geography": "Global", "actor_type": "nation_state", "source_report": "North Korean Job Fraud Expands Beyond Tech: AI-Generated Personas Infiltrate Healthcare, Finance and Sales Roles", "source_url": "https://encrygma.com/articles/north-korean-job-fraud-expands-beyond-tech-ai-generated-personas-infiltrate-heal", "published_date": "2026-09-01" }, { "observation_id": "OBS-00113", "type": "technique", "id": "T1078", "name": "Valid Accounts", "tactic": "Initial Access", "threat_level": "high", "geography": "Global", "actor_type": "nation_state", "source_report": "North Korean Job Fraud Expands Beyond Tech: AI-Generated Personas Infiltrate Healthcare, Finance and Sales Roles", "source_url": "https://encrygma.com/articles/north-korean-job-fraud-expands-beyond-tech-ai-generated-personas-infiltrate-heal", "published_date": "2026-09-01" }, { "observation_id": "OBS-00114", "type": "technique", "id": "T1195.002", "name": "Compromise Software Supply Chain", "tactic": "Initial Access", "threat_level": "high", "geography": "Global", "actor_type": "unknown", "source_report": "Shadow AI in Sanctioned Tools: Malicious AI Skills and MCP Servers Hide Inside Approved Agent Workflows", "source_url": "https://encrygma.com/articles/shadow-ai-in-sanctioned-tools-malicious-ai-skills-and-mcp-servers-hide-inside-ap", "published_date": "2026-09-01" }, { "observation_id": "OBS-00115", "type": "technique", "id": "T1555", "name": "Credentials from Password Stores", "tactic": "Credential Access", "threat_level": "high", "geography": "Global", "actor_type": "unknown", "source_report": "Shadow AI in Sanctioned Tools: Malicious AI Skills and MCP Servers Hide Inside Approved Agent Workflows", "source_url": "https://encrygma.com/articles/shadow-ai-in-sanctioned-tools-malicious-ai-skills-and-mcp-servers-hide-inside-ap", "published_date": "2026-09-01" }, { "observation_id": "OBS-00116", "type": "vulnerability", "id": "CVE-2026-20896", "name": "CVE-2026-20896", "tactic": null, "threat_level": "critical", "geography": "Global", "actor_type": "cybercriminal", "source_report": "Critical Gitea Authentication Bypass Under Active Exploitation", "source_url": "https://encrygma.com/articles/critical-gitea-authentication-bypass-under-active-exploitation", "published_date": "2026-08-30" } ] }