hacker-news Oct 12, 2026 · Crawled Oct 13, 2026

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

2 Actors

AI Summary

Multiple active threats were reported this week, including exploitation of a critical Atlassian Data Center vulnerability (CVE-2026-21589) within hours of disclosure. A new variant of the DarkSword iOS exploit kit, P7 DarkSword, enables on-device keychain and crypto-wallet theft via watering hole attacks. The Russia-aligned threat actor UAC-0099 continues to evolve its MATCHBOIL malware for persistent execution and payload updates. Google disclosed unauthorized HTTPS certificates were issued after attackers hijacked ccTLDs for .gh, .as, and .sl by compromising third-party operators. A vulnerability in GoBalance allowed attackers to hijack TOR .onion sites, including the darknet forum Dread. Additionally, the FBI disrupted infrastructure linked to the China-aligned Flax Typhoon group.

AI-extracted · verify before operational use

Extracted Entities 2 found

Threat Actor UAC-0099 → Threat Actor Flax Typhoon →

MITRE ATT&CK TTPs 12 techniques

T1053.005 Scheduled Task · Execution T1059.001 PowerShell · Execution T1071.001 Web Protocols · Command And Control T1204.002 Malicious File · Execution T1003 OS Credential Dumping · Credential Access T1021 Remote Services · Lateral Movement T1059 Command and Scripting Interpreter · Execution T1071 Application Layer Protocol · Command And Control T1078 Valid Accounts · Defense Evasion T1133 External Remote Services · Persistence T1190 Exploit Public-Facing Application · Initial Access T1558 Steal or Forge Kerberos Tickets · Credential Access