Deirdre Hennigar

September 2026 Threat Landscape Abstract​

MITRE ATT&CK Techniques Observed This Month​

Top Risks & Findings This Month​

Infrastructure & Malicious Link Analysis​

The September dataset demonstrated a dramatic surge in links pointing to static Google Cloud Storage buckets (storage.googleapis.com), which threat actors use to host intermediate static HTML redirectors. Additionally, attackers routinely hotlink remote images from legitimate public hosts like Imgur (i.imgur.com) to bypass inline attachment filters:

Observed In-Message Link Infrastructure (September 2026)​

Primary Sender Registrar TLDs & Full URL Structure​

Threat actors heavily utilized dynamic subdomains and hash-appended bucket URLs to deliver payloads:

• Indonesian & Regional Subdomains (.web.id, .my.id, .biz.id):
  • xhtwlhmd.markif.lightworksa.web.id
  • xpysjlaa.teleso.barviko.my.id
  • pfgvdpzh.soibm.pravento.biz.id
  • vwwdtqtw.allied.metanova.biz.id
  • olyamzcr.samsung.kalqima.my.id
• Random String DGA .us Domains:
  • aax.lbxrvtstbtbdw.us
  • saq.hcdwqozyylqgc.us
  • mhz.kmvhompywgibm.us
  • 628mqiak.us

Unique Google Cloud Storage Bucket Paths (8 Paths / 901 Links)​

Every extracted storage.googleapis.com URL in the September telemetry mapped to one of eight distinct bucket/object paths:

Intercepted Phishing Case Studies & Evidence​

Below are key case studies highlighting major true phishing campaigns observed during the September collection window. Use the provided Gmail search terms to locate these exact lures in your spam folder.

Case Study A: Norton Anti-Virus Expiration & Infection Lure​

• Gmail Search Query: Your NORTON Subscription Has or Your device has been infected with (22) viruses
• Sender Domain: ukb.zhukxkxqvbeey.us
• Subject: Your NORTON Subscription Has Expired — Your device has been infected with (22) viruses
• Technique: Displays a fake urgent virus infection alert and subscriber ID, embedding static Google Cloud Storage redirector links (storage.googleapis.com/smalbus/salaminka.html).

Case Study B: Cloud Storage Deletion Extortion Threat​

• Gmail Search Query: ACCOUNT SUSPENDED YOUR ACCOUNT AND ALL DATA WILL BE DELETED or Claim your free renewal today
• Sender Domain: dawrnjdv.whatsapp.norquell.my.id
• Subject: Your account has been suspended! All your files and memories will be erased on 09-26-2026
• Technique: Leverages high-urgency loss-aversion threats claiming cloud storage backup files will be permanently erased, routing to static HTML buckets.

Case Study C: "VapoCept" 15-Second Vicks Memory Restoration Lure​

• Gmail Search Query: "I remembered my bank password again" — The 15-second Vicks video
• Sender Domain: udzeuwhi.info.guzojsone.biz
• Subject: "I remembered my bank password again" — The 15-second Vicks video
• Technique: Promotes an absurd pseudoscience "Vicks-based protocol" by "VapoCept Research" claiming to cure memory loss and restore bank passwords in 15 seconds.

Threat Community & Sandbox Correlation​

Our telemetry findings correlate directly with external threat intelligence repositories, automated sandbox submissions, and active phishing feeds tracking these exact Google Cloud Storage bucket redirectors:

🍻 The Defensive Playbook​

Apply these four security controls to protect organizational inboxes against cloud bucket redirection and DGA subdomain lures:

August 2026 Threat Landscape Abstract​

MITRE ATT&CK Techniques Observed This Month​

Top Risks & Findings This Month​

1. True Malicious Phishing Vector Taxonomy​

After filtering out legitimate marketing false positives, our telemetry isolated 95 true malicious phishing emails. Threat actors focused heavily on urgency, financial incentive, and brand impersonation.

True Malicious Payloads (95 Messages):
+------------------------------------+-------+-------------------+
| Category / Vector                  | Count | Share % (of 95)   |
+------------------------------------+-------+-------------------+
| Credential Harvesting Lures        | 62    | 65.3%             |
| Job / Work From Home Lures         | 62    | 65.3%             |
| Fake Invoice & Billing Lures       | 29    | 30.5%             |
| Account Suspension / Alert Lures   | 17    | 17.9%             |
| Package / Delivery Lures           | 9     | 9.5%              |
| Gift Cards & Sweepstakes Lures     | 6     | 6.3%              |
+------------------------------------+-------+-------------------+

Observed Payload Characteristics​

1. Account Login & Portal Lures (65.3%): Messages referencing account verification, sign-in alerts, or document access requiring user action.
2. Work-From-Home & Job Lures (65.3%): Recruitment notices promising $300–$800/day for remote roles, directing recipients to external contact links.
3. Storage & Service Expiration Alerts (17.9%): Urgent notices alleging cloud storage capacity limits or impending file deletion unless billing details are updated.

2. Infrastructure & Domain Distribution​

Threat actors in the August dataset relied heavily on regional domain registrars (.my.id, .web.id, .biz.id) and synthetic DGA hostnames:

Top Malicious Infrastructure Hostnames & TLDs​

3. Intercepted Phishing Case Studies & Evidence​

Below are screenshots of real phishing lures intercepted during the August collection window, highlighting observable header, sender, and body characteristics.

Case Study A: Anti-Virus & Tech Support Security Alert​

• Subject: FINAL WARNING — Virus Protection Turned OFF
• Sender Domain: [email protected]
• Observed In Payload: Contains a styled green text banner "- This message was sent from a trusted sender." and embeds links pointing to storage.googleapis.com.

Case Study B: Brand Impersonation & Free Gift Lure​

• Subject: Claim your free CAA Deluxe Roadside Emergency Kit
• Sender Domain: [email protected]
• Observed In Payload: HTML document title set to CAA Deluxe Roadside Emergency Kit Survey, containing links to storage.googleapis.com with base64 parameter go=1&s1=2342770&s3=CAA.

Case Study C: Casino Cash Lure​

• Subject: Daily Reward Inside: Log In to Claim Your Bonus Cash!
• Sender Domain: jhsmcmc.us
• Observed In Payload: Prompts recipient to click a yellow "Claim My Bonus Now" button leading to external links.

Case Study D: Cloud Storage Account Deletion Warning​

• Subject: We've blocked your account! 🚫 Your photos and videos will be deleted...
• Sender Domain: mvglerar.aseco.tanviro.biz.id
• Observed In Payload: Displays a red "Review billing" button and alert claiming cloud storage subscription expired and photos/videos will be deleted on a specified date.

🍻 The Defensive Playbook​

To protect your inbox from cloud redirect tricks, apply these four security controls:

July 2026 Threat Landscape Abstract​

Top Risks Observed This Month​

Sensor Fleet Threat Dossier​

1. Massive MySQL Database Reconnaissance​

Database infrastructure remains the primary target for automated credential stuffing and initial access broker (IAB) scripts.

• Port 3306 Volume: 46,354 connections representing 77.2% of all network service touches across the sensor fleet.
• Top Credential Pairs: Attackers focused heavily on default administrative accounts, led by cron (45,802 attempts), sa (816 attempts), root (170 attempts), and admin (158 attempts).
• Password Profiles: Over 58.7% of attempted passwords fell into simple alphanumeric patterns (1qaz2wsx, 12345678, password), highlighting that botnets continue to exploit weak credential management in cloud-hosted database instances.

Target Port: 3306 (MySQL)
Total Touches: 46,354
Top Usernames: cron (45,802), sa (816), root (170), admin (158)
Top Passwords: 1qaz2wsx (22), 12345678 (18), password (16), saadmin (15)

2. Emerging Threat Vector: LLM Proxy & AI Stack Reconnaissance​

One of the most notable telemetry developments is the shift toward harvesting credentials for Artificial Intelligence and Large Language Model (LLM) orchestration frameworks.

• Observed Credential Attempt: ishaan-litellm:langchain
• Analysis: Threat actors are actively updating wordlists to probe for exposed LLM proxy endpoints (such as LiteLLM proxy wrappers, LangChain agents, Ollama servers, and Open WebUI interfaces).
• Attacker Goal: Gaining unauthorized access to underlying OpenAI/Anthropic/AWS Bedrock API keys hosted within LLM proxies, or executing prompt-injection and agent hijacking attacks against internal model workflows.

3. Secret Extraction & Androxgh0st Botnet Scanning​

Attacker web probes continue to prioritize environment variable exposure to extract high-value cloud credentials:

• Androxgh0st Activity: Detections logged 1,142 androxgh0st_probe events designed to scrape .env files for AWS S3 credentials, SendGrid keys, Twilio auth tokens, and Laravel APP_KEY values.
• Environment File Probing: Over 3,000 requests specifically targeted web root secret files:
  • /.env (1,521 requests)
  • /.env.production (342 requests)
  • /.env.save (330 requests)
  • /.env.local (305 requests)
  • /api/.env (302 requests)
  • /backend/.env (301 requests)

4. Captured Malware Binary Analysis​

Sensors automatically captured and recorded raw malware binary payloads delivered during active exploitation attempts:

Defensive Takeaways & IoCs​

Key Recommendations​

1. Never Expose Port 3306 to Public Internet: Restrict MySQL and database management ports to internal VPCs or enforce strict IP allowlisting / VPN access.
2. Secure AI & LLM Proxy Endpoints: Enforce multi-factor authentication (MFA) and strong API key rotation on LiteLLM, LangChain, and self-hosted AI middleware.
3. Block .env Access at Reverse Proxy Level: Ensure Nginx, Apache, or Caddy rules block public HTTP access to all hidden files (location ~ /\. { deny all; }).

Technical Indicators of Compromise (IoCs)​

June 2026 Threat Landscape Abstract​

Threat Dossier: The Automation of Initial Access​

Europol’s flagship 2026 Internet Organised Crime Threat Assessment (IOCTA) report, titled "How encryption, proxies, and AI are expanding cybercrime," brought this shift into sharp focus. The assessment details an environment where malicious actors are actively closing the "velocity gap" against defenders by weaponizing automation.

Europol IOCTA 2026 Key Takeaway:

"Cybercriminals are rapidly exploiting advanced technologies, particularly AI tools, to enhance the speed, efficiency, and scope of their illicit activities. These tools not only enable automation in criminal processes but also blur the lines between legitimate and malicious uses of technology."

— Catherine De Bolle, Executive Director

The Four Pillars of AI-Accelerated Crime​

The June trends highlight how unfiltered, custom LLMs circulating on the dark web (alongside jailbroken public models) are expanding criminal capabilities across four specific vectors:

Technical Signals​

The intersection of AI, credential theft via infostealers, and the shifting tactics of major ransomware affiliates (like Qilin and Scattered Spider network fragments) shaped the primary attack paths throughout June.

Defensive Takeaways​

Because June’s threat landscape shows attackers optimizing how they improve their use of existing entry vectors rather than inventing new ones, defensive strategy needs to adapt away from static signature detection and focus heavily on identity behavior analysis.

References​

• Europol. (2026). The evolving threat landscape: how encryption, proxies and AI are expanding cybercrime – Internet Organised Crime Threat Assessment (IOCTA) 2026. Publications Office of the European Union, Luxembourg.
• Check Point Research / Coveware Trend Analysis. (May/June 2026 Data). Shifting Dynamics in the Ransomware Ecosystem: The Rise of Pure Exfiltration.

Spring 2026 Threat Landscape Abstract​

Top Risks Observed This Month​

Threat Actors Driving Activity​

Iranian-Aligned Activity​

North Korea-Aligned Activity​

China-Aligned Activity​

Supply Chain Attacks​

CI/CD Pipeline Compromise​

Observations & Conclusions​

Spring 2026 reinforces a continued shift toward identity-driven attacks, infrastructure-level compromise, and scalable supply chain exploitation.

Iran-focused groups emphasize disruption of critical infrastructure, North Korean actors blend financial operations with identity abuse, and China-aligned groups prioritize stealth and persistent espionage.

References​

• Cybersecurity and Infrastructure Security Agency (CISA). (2026). AA26-097A: IRGC-Affiliated Cyber Actors Exploit Internet-Facing PLCs in Water and Wastewater Systems. cisa.gov.
• Cybersecurity Dive. (2026). Iran-linked hackers targeting water, energy in US, FBI and CISA warn. cybersecuritydive.com.
• Tenable Research. (2026). What to Know About CyberAv3ngers, the IRGC-Linked Group Targeting Critical Infrastructure. tenable.com.
• Unit 42, Palo Alto Networks. (2026). Boggy Serpens Threat Assessment. paloaltonetworks.com.
• Chainalysis. (2026). OFAC Targets North Korean IT Workers and Cryptocurrency Networks. chainalysis.com.
• SC World. (2026). Drift Protocol crypto heist pinned on North Korean APT. scworld.com.
• CyberNews. (2026). Chinese spy group TA416 targets Europe, NATO. cybernews.com.
• Unit 42, Palo Alto Networks. (2026). Playbook of espionage campaigns against military targets. paloaltonetworks.com.