Threat Hunter: 2026-09-28
30 minutes in total
Canadian Centre for Cyber Security, 2026-09-27. Read, 5 min.
The Cyber Centre warns of two critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway, CVE-2026-88771 and CVE-2026-88772, and says reports indicate they are being exploited across multiple Citrix customer environments worldwide, although the full extent of the activity remains unknown. It asks organizations to review Citrix's September 27 bulletin, prioritize Internet-facing systems, and investigate for signs of compromise.
Why it matters for this role: Time windows for NetScaler hunts should reach back before Citrix's September 27 fixes, the period the Cyber Centre singles out when it asks for compromise investigations.
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
Google Cloud (Mandiant and Google Threat Intelligence Group), 2026-09-25. Read, 14 min.
Mandiant and Google Threat Intelligence Group report renewed mass exploitation of the Oracle PeopleSoft vulnerability CVE-2026-35273 by UNC6240 (ShinyHunters), which modified its exploit to bypass WAF rules blocking the vulnerable Environment Management Hub (PSEMHUB) endpoint, and say their analysis indicates web shells were deployed on dozens of systems globally, in sectors including higher education, healthcare, and government. Oracle released a Security Alert for the flaw on June 10, 2026, and the post says the campaign targets organizations that implemented WAF rules but did not patch.
Why it matters for this role: Hunt PeopleSoft access logs for POST requests to /hub and .jsp requests from external addresses, which Mandiant flags alongside any request to /PSEMHUB/ or a percent-encoded form of it.
Kothamine malware uses Tailscale's tailcat to evade network detection
Malwarebytes, 2026-09-25. Read, 11 min.
Malwarebytes reports an undocumented Windows remote-access Trojan, Kothamine Agent, that it found linked to malicious npm packages and that appears to have been in development or distribution since at least July. Recent versions receive commands through tailcat, an open-source tool from Tailscale, while earlier versions used the Tailscale VPN.
Why it matters for this role: Plan Kothamine hunts around installs of the malicious npm packages Malwarebytes links it to, because a tailcat channel leaves no conventional command-and-control domain to block.
Sign in to take it.