Hello there 👋
Welcome back to the Kraven Security weekly newsletter, triaging the week. We round up the week’s top news stories, highlight our featured article, give you some learning resources, and finish with a few personal notes about what’s happening at the company. Enjoy!
Top News Stories
AI Goes on Offense
Stories
🗞️ The AI Infrastructure Behind INC and The Gentlemen Ransomware (SOCRadar) – An exposed C2 server leaked the AI session databases, knowledge base, and source code for “Phantom”, an autonomous kill-chain framework that INC and The Gentlemen affiliates use to automate and scale attacks on edge and remote-access systems. 🔎 Threat Hunting Package
🗞️ Advanced AI Used in Japanese Cyberattacks (TrendAI) – Frameworks like CyberStrikeAI now run the whole attack workflow on their own, from recon to exfiltration, against legacy web systems, Yamaha VPNs, and WebLogic servers. Even so, the attacks still depend on opportunistic scanning for basic, unpatched flaws.
🗞️ Markdown is the New Executable: AI Agents Tricked by ‘AGENTS.md’ (Forever) – Any website can silently drop an AGENTS.md file into ~/Downloads. A coding agent like Codex or Claude Code run from that folder will follow it, installing malware or handing over tokens without the user approving anything.
🗞️ ‘Yoba’ Campaign Weaponizes Fake ChatGPT & Claude Apps via DLL Sideloading (Check Point Research) – SEO poisoning sends victims to fake GitHub pages offering AI desktop apps. The malware then sideloads through legitimately signed OpenAI and Anthropic binaries and hides its C2 traffic in Telegram, Tor, Catbox, and DoH. 🔎 Threat Hunting Package
🗞️ Cisco’s Project Quarry: The New Open-Source Shield Against Rogue AI Agents (The Register) – Cisco open-sourced a framework and DSL that analyzes an AI agent’s full session (messages, tool calls, event sequences) to catch multi-step data theft or credential misuse before it executes.
Recommendations
☑️ Harden your external attack surface against machine-speed attackers: patch internet-facing legacy systems and VPN appliances, restrict edge and remote-access systems, enforce MFA, and run continuous attack surface management.
☑️ Hunt for INC/The Gentlemen and YobaLoader activity. Watch for odd network connections, child processes, or dropped files from signed binaries like Setup.exe, and restrict outbound traffic to Tor, the Telegram API, and Catbox.
☑️ Never run AI coding agents from ~/Downloads. Inspect stray AGENTS.md/CLAUDE.md files and check agent configs for unexpected server registrations or modified API endpoints.
☑️ Leave agent approval gates and sandboxing on, enforce zero-trust authorization and human-in-the-loop oversight, and keep full session logs. Try Project Quarry in a sandbox against your own agent telemetry.
☑️ Train staff to download AI apps only from official vendor sites, never from unofficial GitHub repos or search results.
Securing the AI Frontier: Labs, Models & Government
Stories
🗞️ OpenAI Hardens Security: Training Frontier Models in an “Offline World” (OpenAI) – After recent misalignments, OpenAI now trains frontier models in isolated environments and uses its own most capable models (like GPT-6 Astra Cyber) to red-team its infrastructure before attackers can.
🗞️ Major Flaw Found: Extracting OpenAI’s Hidden Thoughts (Xint) – The “Compaction Smuggling” bug turned OpenAI’s conversation-compaction feature into a decryption oracle. Swapping spaces for tabs bypassed classifiers, and the encrypted gpt-5.6-sol reasoning traces echoed out through weaker models.
🗞️ Google Unveils Gemini 4 Carbon: A New Frontier in AI-Driven Cybersecurity (Google) – Google’s new security model scores 88.2% on vulnerability discovery and more than doubles its predecessor’s secure-code success rate. Access is restricted to selected security professionals.
🗞️ Britain Bets Big on AI to Defend Against AI Threats (GOV.UK) – The new UK AI Security Institute will build AI-powered defenses for critical infrastructure, on the premise that human defenders alone can no longer keep pace with AI-driven attacks.
🗞️ UK Government Proposes Historic Shift: Holding Software Vendors Liable for Cyber Breaches (The Record) – A consultation would extend the Consumer Protection Act to cover software and AI. This would replace voluntary codes with legal liability and bring the UK in line with the EU Cyber Resilience Act.
Recommendations
☑️ If you build or host AI, layer your containment (sandboxes, microVMs, strict network perimeters) and set up monitoring that can automatically pause runs when a boundary is crossed.
☑️ Sanitize and restrict output formatting on any server-side feature that handles decrypted sensitive data. Monitor API usage for extraction patterns, such as generation followed by forced compaction and then echoing through weaker models.
☑️ Make continuous, high-compute red-teaming and AI-assisted vulnerability discovery part of DevSecOps, but keep independent human review of every AI-generated patch.
☑️ Look for parts of your security stack where AI/ML can speed up detection and response, and move from reactive to proactive, intelligence-led defense.
☑️ Vendors: run secure-by-design gap assessments against both the coming UK rules and the EU CRA. Buyers: update procurement contracts to reflect the shift in liability.
Trusted Tools Turned Against You
Stories
🗞️ Threat Actors Weaponize Microsoft Teams External Chat for Initial Access (Arctic Wolf) – In 400+ incidents, attackers email-bombed victims and then reached out as fake “IT Support” over Teams’ default-on external chat, bypassing email defenses entirely. 🔎 Threat Hunting Package
🗞️ Microsoft Teams Rolling Out AI-Powered Context-Aware Phishing Detection (BleepingComputer) – Starting in early November, Teams will analyze conversation context in high-risk chats, such as external first contacts. It can flag deceptive intent even without malicious links or files.
🗞️ Demystifying the Threat Landscape: Inside the Huntress Tragic Quadrant (Huntress) – The biggest SMB threats abuse legitimate tooling rather than zero-days: RMM abuse accounted for 45% of Q1 2026 endpoint incidents and AiTM for almost 19% of identity threats.
🗞️ Unpatched Tailscale SSH Flaws Could Expose Entire Networks to Root Access (Cyberdione Labs Corporation) – One compromised device can abuse device identity and port forwarding to get fleet-wide root in seconds. No stolen passwords or keys are needed.
🗞️ Critical Flaw in Telegram for Android Enables Zero-Click Remote Code Execution During Voice Calls (The Hacker News) – Chained with two other bugs, a MediaState memory-handling flaw gives full device compromise just from answering a call. It affects versions 8.6.2–12.10.3 on ARM64.
Recommendations
☑️ Lock down external collaboration. Restrict Teams federation to managed external accounts, block external bots, and limit Telegram calls to “Nobody” or “My Contacts”.
☑️ Monitor the Teams ChatCreated event for suspicious external first contact. Train staff to spot fake “(Internal)” display names, IT-themed accounts, and trust emojis, and remind them that the new AI detection won’t catch everything.
☑️ Audit and allowlist all RMM tools. Watch M365 for unusual inbox rules and session anomalies, and go beyond basic MFA to ITDR to catch token theft and device-code phishing.
☑️ Tighten Tailscale: use single source-to-destination SSH rules, disable port forwarding, strip unneeded app connector permissions, turn on node-key expiry and Tailnet Lock, and delete compromised devices at the control plane.
☑️ Patch Telegram for Android to 12.10.4 or later, and verify unknown callers through another channel before answering.
Software Supply Chain Under Siege
Stories
🗞️ Gheist Campaign Automates GitHub Token Abuse to Steal Cloud & AI Secrets (Wiz) – Stolen PATs are used to plant secret-dumping workflows across thousands of repos, with the data exfiltrated through GitHub’s own API. No C2, and nothing suspicious leaves the network.
🗞️ Magecart Group Hijacks Convertr Checkouts via Plausible Analytics (Sansec) – Attackers exploited CVE-2026-8467 in a self-hosted Plausible server and injected a skimmer into a script loaded on every Convertr checkout. Attackers stole card data and CPF numbers from dozens of Brazilian fashion brands. 🔎 Threat Hunting Package
🗞️ Polymarket Halts Trading After 3rd-Party Breach Triggers $2.5M Crypto Drain (BleepingComputer) – A compromised DebugBear RUM embed served malicious JavaScript that hijacked logged-in sessions, liquidated positions, and drained about $2.5M, using the vendor’s own infrastructure as C2.
🗞️ GitHub Deploys npm Firewall to Fortify Software Supply Chains Against Malicious Packages (GitHub) – A new install-time gatekeeper checks npm requests from endpoints, CI runners, and AI agents against policy, including a “cooldown” minimum publish age that gives scanners time to catch poisoned updates.
Recommendations
☑️ Revoke compromised GitHub tokens and rotate every repo, org, and environment secret. Search audit logs for ci-sync- branches, and check token owners’ devices for infostealers.
☑️ Move from PATs to GitHub Apps or short-lived, fine-grained tokens, and require reviewer approval for workflows in environments that hold production secrets.
☑️ Enforce CSP, Subresource Integrity, and continuous file monitoring on every third-party and self-hosted script. Pull the DebugBear RUM embed until it’s cleared, and upgrade Plausible CE to 3.2.1+ while checking logs for /storybook requests.
☑️ Require step-up or out-of-band confirmation for high-risk actions so an injected script can’t act on its own.
☑️ Turn on the npm firewall: block known malware and high-severity packages, stop attestation downgrades, flag newly added preinstall/postinstall hooks, and set a 1–7 day minimum package age.
Nation-States, Mega-Heists & Hitting Back
Stories
🗞️ New BlackX UEFI Bootkit Exploits ‘Baton Drop’ for Stealthy Cyberespionage (Kaspersky) – APT41 is targeting Central Asian diplomatic agencies with a BlackLotus-style bootkit. It works on “fully patched” systems where the manual certificate-revocation step for CVE-2022-21894 was never done.
🗞️ Volt Typhoon Unveils ‘Silent Train’ Network for Strategic Zero-Day Exploitation (Black Lotus Labs) – Volt Typhoon builds throwaway multi-hop chains of SOHO and IoT devices that last about four hours each to zero-day management systems at US telecoms, defense, and critical infrastructure.
🗞️ Belarusian Hackers Act as Proxies for Russia in Ukraine War (ESET) – GhostWriter’s first documented wiper attack against a Ukrainian manufacturer shows Belarus-linked groups moving from espionage to destructive operations in support of Russia.
🗞️ Binance Hit by Record $6.36 Billion Hack Linked to North Korean Threat Actors (BBC News) – TraderTraitor bundled 50 pre-signed EIP-7702 authorizations to trick Binance’s hot wallet into delegating to a sweeper contract. It is the largest crypto theft on record.
🗞️ Australia Hacks the Hackers: ASD Disrupts Amadey Malware Operations (ABC News) – ASD got into an Amadey C2 backend and cut off 180,000 infected machines. Criminals still have the data already stolen.
🗞️ FBI Seizes Virtualine Domain in Major Cybercrime and Bulletproof Hosting Takedown (U.S. Department of Justice) – This bulletproof host for ransomware, phishing, and infostealers took unhosted Bitcoin and even sold a “protection plan” to move infrastructure quickly when law enforcement came asking.
Recommendations
☑️ Check that the Baton Drop mitigation is actually complete (revoke “Windows Production PCA 2011”), and change patch processes so manual advisory steps get applied and verified.
☑️ Reduce exposure of management platforms, out-of-band interfaces, and SD-WAN orchestrators, speed up edge patching, and keep long-term telemetry so short-lived multi-hop intrusions can be detected.
☑️ Widen threat models to cover proxy actors like Belarus and DPRK, and keep offline, immutable backups against wipers.
☑️ Custodians and exchanges: audit hot-wallet signing paths, alert on bulk delegation signatures and simultaneous multi-chain outflows, and check what a transaction does, not just whether the signature is valid.
☑️ Assume infostealer data is still out there after a takedown. Reset passwords, invalidate sessions, enforce phishing-resistant MFA (FIDO2), and block and retro-hunt AS209800 (Virtualine).
Feature Livesream
Most people use MISP for one thing: storing events.
But the MISP ecosystem has quietly grown side projects that each solve one annoying job really well.
In the latest MISP From Scratch episode, I walk through five of them using one synthetic incident:
🌐 misp-scraper: turn a threat report into a MISP event and report, with candidate indicators extracted
🔁 CTI-Transmute: convert MISP to STIX and back again when two tools need different formats
🧠 misp-mcp: give an MCP client read-only, bounded query access to your MISP data
📢 MISP Fleet Commander: see health, version, and connections across several MISP instances in one place
💂 misp-guard: enforce policy on sync traffic, blocking events by tag, distribution, or data type before they leave
You don’t need all five. Pick the one that matches the task that wastes the most time in your week, then try it in a lab.
Feature Course
Learning Resources
Cyber Training
- Zero-Point Security: Advanced training in red team operations, adversary simulation, and offensive development.
- TCM Academy: A comprehensive suite of courses with a hands-on, practical approach to training that equips students with the real-world skills needed to succeed in cyber.
- Blue Cape Security: A specialist in Digital Forensics and Incident Response (DFIR) training, offering courses to take you from complete beginner to expert.
Tools
- Octoparse: A no-code solution that will save you time, energy, and money. Let me show you how to use it to build your own custom cyber threat intelligence web-scraping tool!
