![Threat Research | Weekly Recap [11 Oct 2026]](https://www.hendryadrian.com/tweet/image/WeeklyRecap.png "Threat Research | Weekly Recap [11 Oct 2026]")
Cybersecurity Threat Research ‘Weekly’ Recap. The report highlights increasing abuse of AI agents and MCP-related access paths, including attempts to validate stolen AWS keys for Amazon Bedrock and token probing tied to Claude, alongside broader social engineering such as the WhatsApp “ballerina” scam. It also covers ransomware/extortion evolution with IronChain acting like a wiper, The Gentlemen ecosystem theft by Azazel, state-aligned intrusions like Iran-backed CL-STA-1178’s Blinder Tunnel targeting, and stealth malware such as SectopRAT embedded in legitimate software, while noting Kubernetes RBAC risks from built-in principals.
#MCP #AmazonBedrock #Claude #IronChain #Azazel #ShinyHunters #CL-STA-1178 #BlinderTunnel #ShelbyLoaderV2 #Blackwood #SectopRAT #systemanonymous #systemauthenticated
#MCP #AmazonBedrock #Claude #IronChain #Azazel #ShinyHunters #CL-STA-1178 #BlinderTunnel #ShelbyLoaderV2 #Blackwood #SectopRAT #systemanonymous #systemauthenticated
AI Agents, MCP, and Cloud AI Abuse
- Growing use of AI agents on endpoints, with limited but risky MCP exposure that can enable untracked access to business systems — Acronis AI agents at work
- Attackers are validating stolen AWS keys for Amazon Bedrock access and checking Claude-related tokens, model access, and billing value — Bedrock access testing
- September reporting also flagged rogue AI agent activity and abuse of research systems alongside fast-moving extortion campaigns — Security briefing: September 2026
- Ransomware affiliate activity included MCP-based tooling and internet-wide scanning to support large-scale intrusion and exfiltration — The Gentlemen Files
Phishing, Account Takeover, and Social Engineering
- WhatsApp “ballerina” scam uses fake voting pages and verification-code abuse to hijack accounts and spread through compromised contacts — Fake WhatsApp contest scam
- Security briefing noted wider social engineering activity, including campaigns targeting financial and enterprise users — Security briefing: September 2026
Ransomware, Extortion, and Data Theft
- IronChain behaves more like a wiper than reliable ransomware, using kernel drivers, SYSTEM persistence, and flawed encryption that can cause permanent data loss — IronChain ransomware analysis
- ShinyHunters-linked extortion and theft campaigns continued, with rapid execution and delayed detection compounding impact — Security briefing: September 2026
- CloudSEK tracked Azazel of the Gentlemen ransomware ecosystem stealing over 6TB of data, operating an independent leak site, and bypassing the operator’s revenue model — The Gentlemen Files
State-Aligned Intrusions and Critical Infrastructure Targeting
- Iranian-aligned CL-STA-1178 targeted Iraqi critical infrastructure using trojanized coding challenges, GitHub C2, DLL sideloading, and custom malware — Blinder Tunnel campaign
- The same campaign overlapped with credential-harvesting against an Israeli entity and reusable infrastructure tied to ShelbyLoader V2 and Blackwood — Blinder Tunnel campaign
Malware, RATs, and Stealthy Delivery
- SectopRAT was embedded in legitimate software, using tampered DLL loading and in-memory decryption to steal credentials, cookies, wallet data, and screenshots — SectopRAT in legitimate software
Cloud and Kubernetes Security Posture
- Large-scale Kubernetes study found system:anonymous and system:authenticated still receive risky RBAC permissions across major clouds — Kubernetes built-in principals permissions