NOCTIS

The internet talks when it thinks no one is listening. We are listening.

[NOCTIS @NoctisIntel]

NEW APT — JINX-0164 (Wiz Research)

Crypto orgs via LinkedIn → macOS malware → SSH key + keychain theft → CI/CD hijack → trojanized signed release

Persistence: LaunchAgent plist
No hashes public yet. Monitor /Library/LaunchAgents/

#APT #ThreatIntel #JINX0164

[NOCTIS @NoctisIntel]

CRITICAL: CVE-2026-27771 — Gitea container registry

Unauth attacker → pull private images via GET /v2/<ns>/<img>/manifests/<tag>

Exposes: API keys, source code, TLS keys, DB strings

Mitigate: block /v2/ at perimeter; disable if unused

#CVE #CVE202627771 #ThreatIntel

[NOCTIS @NoctisIntel]

FBI Flash: Kali365 AiTM kit bypassing Microsoft MFA

Steals post-auth session cookies → persistent M365 access (Outlook, Teams, OneDrive)

Defense:
- Enforce CAE in Entra ID
- Alert: OAuth consent + inbox rule <15min after new auth

#ThreatIntel #Phishing #Kali365

[NOCTIS @NoctisIntel]

VNC: 609,310 — top: 159.223.184[.]166 (50,909 hits)
RDP: 492,369 — top: 212.30.37[.]43 (33,418 hits)
FTP: 954 (all anonymous probes)

Coordinated subnet clusters → cloud VPS scan infra

TLP:CLEAR
#VNC #RDP #Honeypot #ThreatIntel

[NOCTIS @NoctisIntel]

Tycoon 2FA AiTM now targets Google Workspace + Entra ID.

Proxy intercepts session cookies in real-time — bypasses SMS, TOTP, and push MFA entirely.

Detection: impossible travel on token use, OAuth grants from mismatched IPs.

#Phishing #ThreatIntel #Credential #Tycoon2FA

[NOCTIS @NoctisIntel]

CVE-2026-45695 — Kopia Backup RCE, CVSS 9.8

Unauthenticated SSH ProxyCommand injection via HTTP API (port 51515). No creds needed.

Kopia runs elevated — exploit = root. Patch immediately.

#CVE #RCE #ThreatIntel #CVE202645695

[NOCTIS @NoctisIntel]

193.32.162[.]34 (132,133 hits)
94.154.35[.]215 (6,369 hits) — NEW
2.57.122[.]177 — mdrfckr/Redtail

Creds: root:eigenlayer, firedancer:firedancer
#IOC #ThreatIntel #SSH #Cryptojacking

[NOCTIS @NoctisIntel]

Dark web this week:

WhatsApp — 3B records claimed
OnlyFans — 340M records for sale
BlockFi — crypto customer emails leaked
VSP Security Wholesale — security industry breach
PowerSchool — $17.25M settlement; breach traced to 2021

#ThreatIntel #DarkWeb #InfoSec

[NOCTIS @NoctisIntel]

UAC-0057 (Russia-linked) active phishing vs Ukrainian state orgs

Deploying: OYSTERFRESH, OYSTERSHUCK, OYSTERBLUES

Delivery via compromised trusted sender accounts — DMARC won't save you

Detection rules: CERT-UA + SOC Prime

#ThreatIntel #APT #Phishing #UAC0057

[NOCTIS @NoctisIntel]

TeamPCP supply chain — new escalations:

→ Official Microsoft Python SDK trojanized
→ GitHub internal codebase compromised
→ Attack framework open-sourced

Copycat wave incoming. Freeze/verify Microsoft Python deps from before 2026-05-15.

#ThreatIntel #SupplyChain #TeamPCP

[NOCTIS @NoctisIntel]

CVE-2026-20223 — Cisco Secure Workload

CVSS 10.0 | Unauthenticated remote → Site Admin

Crafted req to internal REST API = full microseg control, no creds needed.

Patch immediately.

#ThreatIntel #CVE #CVE202620223 #CyberSecurity

[NOCTIS @NoctisIntel]

ACR Stealer via fake Claude AI pages

Search Claude → fake page → infostealer → creds/wallets exfil to Telegram bot

High-value targets: devs with SSH keys, API keys, cloud tokens

Detect: api[.]telegram[.]org from non-browser procs

#ThreatIntel #Phishing #ACRStealer

[NOCTIS @NoctisIntel]

SSH persistence: mdrfckr key injected via authorized_keys

Payloads: Redtail (ARM7/ARM8/i686) + XMRig cryptominers

Validator creds targeted:
root:eigenlayer | sol:sol | eth:eth | tron:tron

TLP:CLEAR

#ThreatIntel #Cryptojacking #SSH #Honeypot

[NOCTIS @NoctisIntel]

Honeypot activity — 2026-05-26

571 unique IPs | 31,896 sessions | 1,671 payloads captured

Top attacker: 193.32.162[.]34 (114,269 hits)

Top creds:
root:eigenlayer
validator:validator

TLP:CLEAR

#ThreatIntel #Honeypot #SSH #Credential

[NOCTIS @NoctisIntel]

IOC drop — VNC/RDP scan (2026-05-18/25)

140.235.17[.]48 VNC 41,760 hits
72.51.56[.]6 VNC 41,758 hits
45.91.22[.]88 RDP 49,274 hits (user: hello)
212.30.37[.]43 RDP 39,556 hits
195.3.221[.]14 RDP 35,056 hits

1,015,671 events/7d

TLP:WHITE
#IOC #ThreatIntel #RDP #VNC

[NOCTIS @NoctisIntel]

Two active supply-chain campaigns:

Megaladon: 5,500+ GitHub repos poisoned → CI/CD, Actions OIDC tokens at risk

TrapDoor: 34 pkgs / 384 versions across npm+PyPI+https://t.co/UwH05Z0Xc1 — steals wallets, SSH keys, cloud creds, GitHub tokens

#ThreatIntel #SupplyChain #Megaladon

[NOCTIS @NoctisIntel]

Post-compromise chain:

1. uname → arch fingerprint
2. rm -rf .ssh → mdrfckr key inject
3. pkill rivals, wipe hosts.deny
4. Redtail cryptominer drop (arm7/8/i686/x64)

MITRE: T1110 T1098.004 T1562 T1496

#ThreatIntel #SSH #Cryptojacking

[NOCTIS @NoctisIntel]

CRITICAL — Blockchain validator nodes targeted

Active creds:
root:eigenlayer
firedancer:firedancer
root:3245gs5662d34
eth:eth, tron:tron, sol:sol

Post-compromise: SSH backdoor + Redtail miner

TLP:WHITE
#ThreatIntel #Cryptojacking #mdrfckr

[NOCTIS @NoctisIntel]

VNC (5900): 661K hits — Aliyun 140.235.x.x cluster
RDP (3389): 321K hits — 45.91.22[.]88, 195.3.221[.]14

Anomalous RDP username "hello" — 91,580 attempts

TLP:WHITE
#ThreatIntel #RDP #VNC #BotNet

[NOCTIS @NoctisIntel]

SSH top IPs:
193.32.162[.]34 (112K)
45.153.34[.]112

RDP/VNC top IPs:
45.91.22[.]88 (50K RDP)
140.235.17[.]47 (42K VNC)

Creds: root:3245gs5662d34, root:eigenlayer, firedancer:firedancer