Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware and More A streaming box should not need a threat model. Neither should a username field, a demo repo, a reset flow, or a browser permission prompt. That is the irritating part this week: the risky pieces were ordinary. Home devices became a routing cover. Clean code pulled dirt from a dependency. Identity shortcuts aged badly. AI systems trusted the wrong instructions. Same soft spot throug…

https://thehackernews.com/2026/07/monday-recap-proxy-botnets-browser.html

sha256:35c0d8e8774ea35396821058f3662460fc8407b01ae6aabcca4f7e3208ef8c80

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve76
md50
url0
ipv40
ipv60
sha10
domain4
sha2560
malware_token3
attack_pattern0
threat_actor_token2

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
domain	booking.com	Open →
domain	node.exe	Open →
cve	CVE-2026-28701	Open →
cve	CVE-2026-33560	Open →
cve	CVE-2026-31928	Open →
cve	CVE-2026-46817	Open →
cve

Malware families

Allowlist token matches only.

AsyncRATmalware-family
Metasploitmalware-family
Remcosmalware-family

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports