@2Workly

Helping SOC, detection, and CTI teams stay ahead with cybersecurity news, CTI reporting, and IOC coverage they can act on.

2workly.com
Joined August 2026
  • Tweets626
  • Following0
  • Followers2
Cameron Wagenius (kiberphant0m) received 70 months for hacking AT&T and Verizon using SSH brute-force tooling alongside Judische and John Erin Binns. securityweek.com/prison-sent… 2workly.com #2workly #CTI

Prison Sentence for Former US Soldier Who Hacked AT&T and Verizon

Cameron John Wagenius was sentenced to 70 months in prison for stealing information from the wireless carriers.

securityweek.com
Carbonato botnet compromises exposed Docker port 2375 daemons to drop the Hermes Agent framework, orchestrating credential theft and worm-like lateral scans via Telegram. Source: thehackernews.com/2026/09/ca… More: 2workly.com #2workly

Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent

Carbonato targets unauthenticated Docker daemons, installs Hermes Agent, and uses Telegram to run operator-directed AI-generated commands.

thehackernews.com
ShinyHunters leaked medical records and staff data linked to FBI recruitment systems in a non-financial extortion campaign. Details: malwarebytes.com/blog/data-b… Track threat actor campaigns and operationalize CTI: 2workly.com #2workly

FBI agents’ blood tests and doctors’ notes surface after breach

A “shellfish and banana allergy” is among the details in medical records hackers showed reporters. They claim to hold records on thousands of FBI staff.

malwarebytes.com
Kiteworks urged shutdowns of self-hosted servers after federal warnings of threat activity targeting a flaw in its Advanced Forms module. Review instances, isolate the module, and verify release 9.5.1 securityweek.com/kiteworks-u… 2workly.com

Kiteworks Urges Server Shutdown, Finds Advanced Forms Vulnerability

The company says the measure was precautionary and that it has no evidence of Kiteworks or customer systems being compromised.

securityweek.com
1
CISA added two critical Citrix NetScaler flaws to KEV (CVE-2026-88771 and CVE-2026-88772, CVSS 9.5) amid active global exploitation for unauthenticated RCE. Prioritize patching and inspect DTLS configs thehackernews.com/2026/09/ci… 2workly.com

CISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws Globally

CISA says attackers are actively exploiting two Citrix NetScaler flaws globally; Citrix has released fixed versions.

thehackernews.com
7
Citrix patched 2 NetScaler zero-days under active exploit: CVE-2026-88771 (unauth RCE) & CVE-2026-88772 (DTLS overflow). CVSS 9.5. Check IOCs before patching. Details: securityweek.com/citrix-conf… Intel to enforcement: 2workly.com #2workly

Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug

Citrix has released patches for the critical NetScaler vulnerabilities tracked as CVE-2026-88771 and CVE-2026-88772.

securityweek.com
8
Active exploitation observed for Microsoft SharePoint RCE (CVE-2026-65660), with actors deploying webshell backdoors. CISA added to KEV. Patch now and monitor SharePoint directories. Details: securityweek.com/microsoft-s… Intel: 2workly.com #2workly

Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attacks

CISA added CVE-2026-65660 to its KEV catalog, giving federal agencies a patching deadline of September 28.

securityweek.com
3
Two unpatched Citrix NetScaler RCE zero-days are under active exploitation with no fix yet released. Restrict management interfaces immediately and preserve logs/core dumps if investigating compromise thehackernews.com/2026/09/wa… 2workly.com

Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation

watchTowr says two unpatched NetScaler RCE flaws were exploited before fixes, while Citrix has yet to publish a bulletin or patch.

thehackernews.com
11
Lunex Stealer uses BYOVD via AMD driver PDFWKRNL.sys (CVE-2023-20598) to zero EDR kernel callbacks, blinding telemetry while bypassing default blocklists. Enforce custom WDAC driver rules. thehackernews.com/2026/09/lu… 2workly.com #2workly

Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials

Lunex uses BYOVD to disable kernel security callbacks before stealing browser credentials and cryptocurrency wallets.

thehackernews.com
3
UNC6240 exploits Oracle PeopleSoft CVE-2026-35273 via /%50SEMHUB/ WAF bypass to deploy web shells and SIDEEYE. Hunt WebLogic logs for encoded URI paths and block C2 162.219.30[.]165. Source: thehackernews.com/2026/09/at… 2workly.com #2workly

Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells

ShinyHunters-linked attackers exploit CVE-2026-35273 in Oracle PeopleSoft, bypassing WAF rules to deploy web shells on dozens of systems.

thehackernews.com
4
x47.c botnet uses xAI Grok for host persistence and introduces AI API draining attacks to burn victim credits via stolen keys. C2 uses fast-flux routing. Track and enforce IOCs with 2workly.com Source: securityweek.com/new-x47-c-w… #2workly

2Workly - Cyber Threat Intelligence Platform

2Workly pushes your threat intel to every security tool you run — firewalls, proxies, EDRs, SIEMs and SOAR — without the homegrown scripts your team maintains today. Anyone can set an integration up...

2workly.com
3
A CSRF flaw in Elementor 4.3.0/4.3.1 lets attackers create rogue WordPress admins via crafted REST API requests with "elementor/v1/events/" in the URI. Patch to 4.3.2 and monitor logs. Details: thehackernews.com/2026/09/el… More: 2workly.com #2workly

Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link

Elementor 4.3.0 and 4.3.1 contain a CSRF flaw that can create an admin account when a logged-in administrator opens a crafted link.

thehackernews.com
CISA added SharePoint CVE-2026-65660 & MikroTik CVE-2026-67279 to KEV. The MikroTrick chain enables unauthenticated admin takeover on exposed RouterOS devices. Patch perimeter assets now. Details: thehackernews.com/2026/09/sh… 2workly.com #2workly

SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild

CISA adds exploited SharePoint RCE and RouterOS flaws to KEV; the RouterOS chain can give unauthenticated administrative access.

thehackernews.com
6
Kiteworks urged customers to execute a 9-hour system shutdown after federal intel warned of imminent attacks. Ensure instances are updated to 9.5.1 and monitor edge logs. Details: thehackernews.com/2026/09/ki… More at 2workly.com #2workly

Kiteworks Urges Customers to Shut Down Systems for 9 Hours Over Possible Cyber Attack

Kiteworks urges a nine-hour precautionary shutdown after federal intelligence warned a threat actor may target some systems.

thehackernews.com
16
DOJ sentenced threat actor Cameron Wagenius (kiberphant0m) to 70 months for extortion campaigns tied to the 2024 Snowflake breaches and SSH credential theft. Track identity-based cloud threats: Source cyberscoop.com/cameron-wagen… 2workly.com

Army soldier sentenced for spree of attacks on AT&T, Snowflake and other major companies

Cameron Wagenius was involved in some of the most high-profile attacks of 2024 while on active duty.

cyberscoop.com
2
Compromised GitHub Actions tied to Mini Shai-Hulud resumed harvesting CI secrets after repos were re-enabled. Pin actions to full commit SHAs, rotate exposed secrets, and block t.m-kosche[.]com. Intel: More thehackernews.com/2026/09/co… 2workly.com

Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware

GitHub disabled two actions-cool Actions again after re-enabled repositories left malicious May 18 tags able to execute credential-stealing code.

thehackernews.com
Actor "Kiberphant0m" sentenced to 70 months for telecom extortions via compromised cloud credentials lacking MFA. Identity telemetry and mandatory MFA remain vital controls against bulk data exfiltration krebsonsecurity.com/2026/09/… 2workly.com
Kothamine RAT evades network blocks by using Tailscale tailcat to tunnel C2 traffic over local ports. Detect execution of tailcat.exe forward commands and Defender exclusions in AppData. Intel: Enforce via malwarebytes.com/blog/threat… 2workly.com

Kothamine malware uses Tailscale’s tailcat to evade network detection 

Kothamine uses a legitimate Tailscale tool to receive attackers’ commands through an encrypted connection with no malicious domain to block.

malwarebytes.com
1
Kiteworks urges customers to shut down internet-facing file transfer servers amid warnings of an imminent zero-day threat. Isolate edge instances and monitor logs. Details: techcrunch.com/2026/09/25/ki… Intel: 2workly.com #2workly

Kiteworks urges customers to shut down their servers amid 'imminent' threat of cyberattack |...

The tech giant, which allows companies to send large datasets over the internet, said it received a "credible threat" from law enforcement about an imminent attack.

techcrunch.com
35
Only 26% of detected CISA KEV flaws get remediated, with median fix times reaching 43 days. Attackers actively exploit cataloged CVEs left open for years. Connect CTI to enforcement faster at 2workly.com. Source: hackread.com/26-detected-cis… #2workly

2Workly - Cyber Threat Intelligence Platform

2Workly pushes your threat intel to every security tool you run — firewalls, proxies, EDRs, SIEMs and SOAR — without the homegrown scripts your team maintains today. Anyone can set an integration up...

2workly.com
Load more