https://amitvijayan.com/journal/ Threat hunting guides and daily cyber threat briefs by Amit Vijayan. en https://amitvijayan.com/journal/articles/daily-cyber-threat-brief-november-12-2026.htmlhttps://amitvijayan.com/journal/articles/daily-cyber-threat-brief-november-12-2026.htmlThu, 12 Nov 2026 12:00:00 -0000Attackers are abusing compromised ScreenConnect environments to push rogue remote-access clients onto customer devices — six MSPs and 286 endpoints hit so far, and the count is still climbing. https://amitvijayan.com/journal/articles/hunting-barracuda-esg-cve-2026-116606-111560.htmlhttps://amitvijayan.com/journal/articles/hunting-barracuda-esg-cve-2026-116606-111560.htmlWed, 11 Nov 2026 12:00:00 -0000Both Barracuda ESG flaws hit CISA KEV on November 10, due November 13: an unauthenticated backup restore plus a timezone injection gives attackers root. Hunt the upload, the restore, and the shell. https://amitvijayan.com/journal/articles/deep-dive-2026-11-11-kerberos-ticket-attacks.htmlhttps://amitvijayan.com/journal/articles/deep-dive-2026-11-11-kerberos-ticket-attacks.htmlWed, 11 Nov 2026 12:00:00 -0000The quietest domain compromise has no malware: a roasted service ticket, a DCSync, and a forged Golden Ticket, hunted with DC event IDs, KQL and Splunk queries, and a lab walkthrough. https://amitvijayan.com/journal/articles/daily-cyber-threat-brief-november-11-2026.htmlhttps://amitvijayan.com/journal/articles/daily-cyber-threat-brief-november-11-2026.htmlWed, 11 Nov 2026 12:00:00 -0000Japan's Nitori says an intruder who slipped in undetected in mid-October may have taken up to 37.62 million customer records — no passwords or card data, but names, addresses and birth dates. https://amitvijayan.com/journal/articles/daily-cyber-threat-brief-november-10-2026.htmlhttps://amitvijayan.com/journal/articles/daily-cyber-threat-brief-november-10-2026.htmlTue, 10 Nov 2026 12:00:00 -0000Vanderbilt told students and staff to shut down devices and leave campus Wi-Fi after an active cyberattack — while the BYOD gang claims it stole over a million Social Security numbers. https://amitvijayan.com/journal/articles/hunting-polyshell-cve-2026-48356-magento-adobe-commerce.htmlhttps://amitvijayan.com/journal/articles/hunting-polyshell-cve-2026-48356-magento-adobe-commerce.htmlMon, 09 Nov 2026 12:00:00 -0000CISA's fix deadline for PolyShell is tomorrow, and the campaign that hit 471 Magento stores in one hour is still rewriting CMS blocks. These Splunk and CrowdStrike hunts find its webshells. https://amitvijayan.com/journal/articles/daily-cyber-threat-brief-november-9-2026.htmlhttps://amitvijayan.com/journal/articles/daily-cyber-threat-brief-november-9-2026.htmlMon, 09 Nov 2026 12:00:00 -0000Attackers used a supplier's platform to reach Crédit Mutuel Arkéa's own account and move roughly €118 million into crypto — with no customer losing a euro. The bank confirmed the heist on November 4. https://amitvijayan.com/journal/articles/daily-cyber-threat-brief-november-8-2026.htmlhttps://amitvijayan.com/journal/articles/daily-cyber-threat-brief-november-8-2026.htmlSun, 08 Nov 2026 12:00:00 -0000Chainalysis says an AI-driven attack exposed names, usernames, password hashes and live tokens for all users — and two products are still offline a week after the intrusion was found. https://amitvijayan.com/journal/articles/daily-cyber-threat-brief-november-7-2026.htmlhttps://amitvijayan.com/journal/articles/daily-cyber-threat-brief-november-7-2026.htmlSat, 07 Nov 2026 12:00:00 -0000CISA has confirmed active exploitation of a SonicWall SSL-VPN flaw that lets attackers with stolen credentials skip SAML authentication — and the MFA enforced through it. https://amitvijayan.com/journal/articles/hunting-contagious-interview-fake-job-assignments.htmlhttps://amitvijayan.com/journal/articles/hunting-contagious-interview-fake-job-assignments.htmlFri, 06 Nov 2026 12:00:00 -0000Binance lost $6.3 billion to a fake job interview: a tampered installer in June, a poisoned coding assignment in September. Hunt the same lure on your developer endpoints before it lands. https://amitvijayan.com/journal/articles/daily-cyber-threat-brief-november-6-2026.htmlhttps://amitvijayan.com/journal/articles/daily-cyber-threat-brief-november-6-2026.htmlFri, 06 Nov 2026 12:00:00 -0000DigiCert has confirmed a breach of its archived customer records — including passports and driver's licenses — after a 2025 server migration left an internal system exposed to the internet. https://amitvijayan.com/journal/articles/daily-cyber-threat-brief-november-5-2026.htmlhttps://amitvijayan.com/journal/articles/daily-cyber-threat-brief-november-5-2026.htmlThu, 05 Nov 2026 12:00:00 -0000DreamHost says attackers lived in its File Manager for two months, stealing FTP and webmail logins — and the host still won't say how many accounts were hit. https://amitvijayan.com/journal/articles/hunting-mfa-fatigue-push-bombing.htmlhttps://amitvijayan.com/journal/articles/hunting-mfa-fatigue-push-bombing.htmlWed, 04 Nov 2026 12:00:00 -0000A user denied 14 push prompts in nine minutes, then approved the fifteenth at 2:47 a.m. That approval was the breach. This playbook hunts MFA fatigue bursts in Entra sign-in logs. https://amitvijayan.com/journal/articles/deep-dive-2026-11-04-exchange-after-the-last-update.htmlhttps://amitvijayan.com/journal/articles/deep-dive-2026-11-04-exchange-after-the-last-update.htmlWed, 04 Nov 2026 12:00:00 -0000October 2026 delivered the last updates Exchange 2016 and 2019 will ever get. Patch to Subscription Edition, pull old servers off the internet, then hunt the webshells and mail rules left behind. https://amitvijayan.com/journal/articles/daily-cyber-threat-brief-november-4-2026.htmlhttps://amitvijayan.com/journal/articles/daily-cyber-threat-brief-november-4-2026.htmlWed, 04 Nov 2026 12:00:00 -0000CISA has added a WordPress Core remote code execution flaw to its Known Exploited Vulnerabilities catalog after attackers began exploiting it in the wild. https://amitvijayan.com/journal/articles/daily-cyber-threat-brief-november-3-2026.htmlhttps://amitvijayan.com/journal/articles/daily-cyber-threat-brief-november-3-2026.htmlTue, 03 Nov 2026 12:00:00 -0000Have I Been Pwned confirmed Harvard's breach exposed 851,000 accounts, including donor and alumni records leaked by ShinyHunters after the university refused a ransom. https://amitvijayan.com/journal/articles/hunting-wordpress-core-rce-exploitation.htmlhttps://amitvijayan.com/journal/articles/hunting-wordpress-core-rce-exploitation.htmlMon, 02 Nov 2026 12:00:00 -0000Wordfence blocked 60,471 WordPress core RCE attempts in 24 hours after the 7.1.4 patch. The compromise signal is not the blocked probe — it is the new admin, shell or task left behind. https://amitvijayan.com/journal/articles/daily-cyber-threat-brief-november-2-2026.htmlhttps://amitvijayan.com/journal/articles/daily-cyber-threat-brief-november-2-2026.htmlMon, 02 Nov 2026 12:00:00 -0000The FBI has formally attributed the record $6.3 billion Binance theft to North Korea's TraderTraitor group, as the exchange says it has replenished about 90% of the stolen assets. https://amitvijayan.com/journal/articles/daily-cyber-threat-brief-november-1-2026.htmlhttps://amitvijayan.com/journal/articles/daily-cyber-threat-brief-november-1-2026.htmlSun, 01 Nov 2026 12:00:00 -0000Attackers hijacked at least 12 DeFi websites through registrar Name.com and replaced them with wallet-draining copies, stealing an estimated $138,000 before the domains were restored. https://amitvijayan.com/journal/articles/daily-cyber-threat-brief-october-31-2026.htmlhttps://amitvijayan.com/journal/articles/daily-cyber-threat-brief-october-31-2026.htmlSat, 31 Oct 2026 12:00:00 -0000Attackers used what Chainalysis calls 'offensive agentic techniques' to reach internal systems, exposing customer names, emails and role labels. No investigation data was touched, the firm says.