📊 By the numbers: 60 reports · 27 CVEs · 20 exploited in the wild 16 CVEs unpatched · 758 IOCs Supply chain in the top TTPs for 32 consecutive issues New Agentic Report: The Agentic AI Attack Wave, September 2026 → ti-mindmap-hub.com/analytics…

🟡 sckit: a new Go implant found in compromised MemTensor MemOS packages on npm and PyPI. It steals npm/PyPI publish tokens and CI credentials. The OpenClaw plugin also passes user prompts to the implant. C2: skyleen[.]fr, registered 8 days before discovery.

🔴 Gambit Security: one operator ran 3 open-source AI agent frameworks against online retailers. 27+ orgs breached in under a week. 600K+ cards taken from two victims. Mean cost: $25.46 per completed scan. The exploits weren't novel. The speed was.

🧵 Weekly Threat Brief #36 is live. One operator ran AI agents against e-commerce at ~$25 a target. Four China-nexus clusters adopted the BlueMoon exploit kit in days. A new implant steals npm and PyPI publish tokens. 🔽 medium.com/ti-mindmap-hub-re…

📊 By the numbers: 54 reports · 27 CVEs · 12 exploited in the wild 16 of 27 CVEs unpatched 630 IOCs · Supply chain: 29 consecutive weeks Also: North Korea's WaterPlum steals $10.7M+ via fake job interviews. 30,000 devices infected across 100+ countries. ti-mindmap-hub.com

🟡 BlueKeep (CVE-2019-0708) is still being actively exploited. Seven years old. Oldest CVE we've flagged as under active exploitation in this series. Patch coverage, not patch age, is the actual variable.

🟠 Supply chain leads this week's TTPs. Three different vectors in the same week: DPRK's PolinRider adds a new npm loader (GHAPPIER), a fresh Gitea CVE weaponized within days of disclosure, and a 100K+ site WordPress compromise via a hijacked CDN/DNS account.

🔴 CHOSEN BRICK (Iran): social engineering over WhatsApp/Telegram, impersonating trusted contacts, against dissidents, activists, journalists in UK/US/Netherlands. Victim data then appears on pro-Iranian leak sites. Documented precursor to coercion, sometimes physical harm.

🧵 Weekly Threat Brief #35 is live. Iran's CHOSEN BRICK targets dissidents with physical-harm risk. Supply chain hits three different vectors in the same week. BlueKeep, a 2019 CVE, is still being actively exploited. medium.com/ti-mindmap-hub-re…

📊 By the numbers: 62 reports · 29 CVEs · 15 exploited in the wild 1,058 IOCs · Financial sector: 35.5% Supply chain: 28 consecutive weeks Langflow gets hit by miners, botnets, and AdaptixC2 simultaneously via a new RCE. medium.com/ti-mindmap-hub-re… #ai #agent #timindmaphub #ioc

🟠 BREEZE COMET drains Pix and Boleto payments in Brazil. Stages malware on compromised .gov.br domains — so security tools that trust government traffic are blind to it. Physical hardware implants in retail stores. AI-written recon scripts. Now expanding into Nigeria, Ghana...

🔴 Fire Ant (UNC3886-adjacent) doesn't attack your systems anymore. It attacks what your systems trust. Routers. TACACS auth servers. Linux jump hosts. Inject into the auth server itself and every credential it validates is yours in real time.

🔴 MikroTrick isn't one CVE. It's 6 chained vulnerabilities in MikroTik RouterOS. An attacker who knows an authorized RSA modulus can forge an SSH key and walk in — no private key needed. CERT Polska patched Sept 3. This issue publishes Sept 7.

🧵 Weekly Threat Brief #33 is live. MikroTrick's patches are 4 days old. Fire Ant now lives inside your routers and auth servers, not just your hypervisor. A Brazilian fraud group stages malware on hijacked .gov domains 🔽 medium.com/ti-mindmap-hub-re… #cti #threatintelligence #cyber

Did you know TI Mindmap HUB has a "Threat Entities" section? Threat actors, malware, tools, campaigns — aggregated across the whole Knowledge Graph. See an actor's toolkit evolve. How campaigns connect. How infrastructure gets reused ti-mindmap-hub.com/entities #cti #agent #ai #cyber

📊 By the numbers: 59 reports · 29 CVEs · 14 exploited in the wild 13 of 29 CVEs have NO patch — highest unpatched ratio in weeks 846 IOCs · Phishing: 27 incidents, series high Supply chain: 26 consecutive weeks medium.com/ti-mindmap-hub-re…

🟡 ITG27/Mustang Panda caught almost live via deception tech. Researchers watched operators make actual typos and correct commands in real time — confirmed manual, hands-on-keyboard espionage, not automation. New backdoor: Havencode. Hidden + active VNC.

🟠 Criminals now sell stolen Claude and GPT session cookies specifically to launder activity through infrastructure that isn't theirs. Direct response to the account-banning enforcement that caught China's GTG-1002 (Issue #29).