Threat Hunter: 2026-09-25

1. Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments

   Microsoft Threat Intelligence, 2026-09-24. Leer, 17 min.

   Microsoft Threat Intelligence has observed Storm-2570, a ransomware affiliate it has tracked since April 2025, using consistent post-compromise tools and techniques, infrastructure overlaps, and the same remote access and cloud exfiltration tooling across deployments of Qilin, DragonForce, Anubis, and BERT ransomware. Microsoft argues that tracking ransomware attacks by payload alone can obscure the affiliates carrying out the intrusions, and the post includes detections and hunting queries.

   Por qué importa para este rol: Hunts built on Storm-2570's recurring tools, such as s5cmd or Rclone for exfiltration, aim at the affiliate itself, whichever of Qilin, DragonForce, Anubis, or BERT it goes on to deploy.

2. Introducing CAIRN: Frontier tracking for AI-integrated malware

   Cisco Talos, 2026-09-22. Leer, 10 min.

   Cisco Talos released CAIRN (Cognitive Artifact Intelligence Research Network), a research toolkit for hunting, classifying, and tracking AI-integrated malware. It works from artifacts attackers leave in their tooling, such as prompt templates, provider endpoints, API keys, and jailbreak terms, which Talos says can be extracted, related, and classified without touching the underlying binary.

   Por qué importa para este rol: Strings like hardcoded provider endpoints and jailbreak terms let you search sample metadata for AI-integrated malware without running anything.

3. Security Advisory: Action Required: Active Exploitation of CVE-2026-85102 and a Management Pre-Authentication Vulnerability, CVE-2026-93616

   Check Point, 2026-09-22. Leer, 3 min.

   Check Point reports a wave of exploitation attempts since September 12 against Spark customers using CVE-2026-85102, a pre-authentication remote code execution flaw in Security Gateway VPN certificate handling that it fixed on September 9. Separately, it identified a handful of pinpointed attacks on July 23, 2026 exploiting CVE-2026-93616, a newly discovered pre-authentication path traversal in the Security Management web service, and made a fix available with this advisory.

   Por qué importa para este rol: Widen your Mobile Access hunt since September 12 beyond the three published certificate subjects, which Check Point says are only the ones it has seen so far.

Threat Hunter