{
 "schema_version": 1,
 "generated_at": "2026-11-07T06:38:45+00:00",
 "tlp": "CLEAR",
 "source": "https://tlpclear.fr/iocs",
 "terms": "https://tlpclear.fr/iocs#conditions",
 "count": 95,
 "indicators": [
  {
   "value": "CVE-2016-6210",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-07",
   "last_seen": "2026-11-07",
   "expires_at": "2027-02-05",
   "ttl_days": 90,
   "sightings": 1,
   "campaign": "SSHole (CVE-2026-123158) : OpenSSH sur musl accepte n'importe quel mot de passe long pour les comptes verrouillés",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 07/11, rubrique « Vulnérabilités et exploitation active » : SSHole (CVE-2026-123158) : OpenSSH sur musl accepte n'importe quel mot de passe long pour les comptes verrouillés",
   "ecosystem": null,
   "version": null,
   "source": "CERT-FR",
   "source_url": "https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-015/",
   "editions": [
    "2026-11-07"
   ],
   "note": null
  },
  {
   "value": "CVE-2024-27834",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-05",
   "last_seen": "2026-11-07",
   "expires_at": "2027-02-05",
   "ttl_days": 90,
   "sightings": 3,
   "campaign": "Apple iOS, macOS, Safari",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 07/11, rubrique « Vulnérabilités et exploitation active » : Apple iOS, macOS, Safari",
   "ecosystem": null,
   "version": null,
   "source": "CISA KEV",
   "source_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
   "editions": [
    "2026-11-05",
    "2026-11-06",
    "2026-11-07"
   ],
   "note": null
  },
  {
   "value": "CVE-2025-27038",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-06",
   "last_seen": "2026-11-06",
   "expires_at": "2027-02-04",
   "ttl_days": 90,
   "sightings": 1,
   "campaign": "APT29 « Poisoned Source » : watering holes et supply chain Plerdy vers des chaînes N-day iOS et Android",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 06/11, rubrique « Campagnes et threat actors » : APT29 « Poisoned Source » : watering holes et supply chain Plerdy vers des chaînes N-day iOS et Android",
   "ecosystem": null,
   "version": null,
   "source": "Sekoia",
   "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
   "editions": [
    "2026-11-06"
   ],
   "note": null
  },
  {
   "value": "CVE-2025-8088",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-04",
   "last_seen": "2026-11-04",
   "expires_at": "2027-02-02",
   "ttl_days": 90,
   "sightings": 1,
   "campaign": "Gorbag (ESET) : groupe aligné sur la Russie, WinRAR CVE-2025-8088 et BeautyStealer contre l'Ukraine",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 04/11, rubrique « Campagnes et threat actors » : Gorbag (ESET) : groupe aligné sur la Russie, WinRAR CVE-2025-8088 et BeautyStealer contre l'Ukraine",
   "ecosystem": null,
   "version": null,
   "source": "ESET WeLiveSecurity",
   "source_url": "https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/",
   "editions": [
    "2026-11-04"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-0257",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-01",
   "last_seen": "2026-11-01",
   "expires_at": "2027-01-30",
   "ttl_days": 90,
   "sightings": 1,
   "campaign": "The Gentlemen publie environ 50 victimes d'un coup, dont l'INED",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 01/11, rubrique « Ransomware et extorsion » : The Gentlemen publie environ 50 victimes d'un coup, dont l'INED",
   "ecosystem": null,
   "version": null,
   "source": "ransomware.live (The Gentlemen)",
   "source_url": "https://www.ransomware.live/group/Thegentlemen",
   "editions": [
    "2026-11-01"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-101767",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-01",
   "last_seen": "2026-11-01",
   "expires_at": "2027-01-30",
   "ttl_days": 90,
   "sightings": 1,
   "campaign": "Brotli « Node2Shell » (CVE-2026-111497) et Oracle EBS CVE-2026-101767 : rappels exploités",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 01/11, rubrique « Vulnérabilités et exploitation active » : Brotli « Node2Shell » (CVE-2026-111497) et Oracle EBS CVE-2026-101767 : rappels exploités",
   "ecosystem": null,
   "version": null,
   "source": "BleepingComputer",
   "source_url": "https://bleepingcomputer.com/news/security/cisa-warns-of-hackers-now-exploiting-critical-node2shell-flaw",
   "editions": [
    "2026-11-01"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-102764",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-02",
   "last_seen": "2026-11-02",
   "expires_at": "2027-01-31",
   "ttl_days": 90,
   "sightings": 1,
   "campaign": "Cisco ASA/FTD, Drupal Commerce Core et BeyondTrust Remote Support exploités",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 02/11, rubrique « Vulnérabilités et exploitation active » : Cisco ASA/FTD, Drupal Commerce Core et BeyondTrust Remote Support exploités",
   "ecosystem": null,
   "version": null,
   "source": "Cisco",
   "source_url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75",
   "editions": [
    "2026-11-02"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-102785",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-10-31",
   "last_seen": "2026-10-31",
   "expires_at": "2027-01-29",
   "ttl_days": 90,
   "sightings": 1,
   "campaign": "Web : Drupal Commerce exploité, WordPress Core RCE ciblée, YOOtheme Pro CVSS 10",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 31/10, rubrique « Vulnérabilités et exploitation active » : Web : Drupal Commerce exploité, WordPress Core RCE ciblée, YOOtheme Pro CVSS 10",
   "ecosystem": null,
   "version": null,
   "source": "The Hacker News",
   "source_url": "https://thehackernews.com/2026/10/hackers-actively-exploit-highly.html",
   "editions": [
    "2026-10-31"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-104935",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": true,
   "first_seen": "2026-10-31",
   "last_seen": "2026-11-07",
   "expires_at": "2027-02-05",
   "ttl_days": 90,
   "sightings": 8,
   "campaign": "Ivanti Connect Secure : la chaîne de zero-days d'UTA0576 reste la priorité (rappel)",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 07/11, rubrique « Vulnérabilités et exploitation active » : Ivanti Connect Secure : la chaîne de zero-days d'UTA0576 reste la priorité (rappel)",
   "ecosystem": null,
   "version": null,
   "source": "CERT-FR",
   "source_url": "https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-013/",
   "editions": [
    "2026-10-31",
    "2026-11-01",
    "2026-11-02",
    "2026-11-03",
    "2026-11-04",
    "2026-11-05",
    "2026-11-06",
    "2026-11-07"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-107441",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": true,
   "first_seen": "2026-11-06",
   "last_seen": "2026-11-07",
   "expires_at": "2027-02-05",
   "ttl_days": 90,
   "sightings": 2,
   "campaign": "Zyxel GS1900 : zero-day CVE-2026-107441 exploité, le correctif de CVE-2026-7273 était inopérant",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 07/11, rubrique « Vulnérabilités et exploitation active »",
   "ecosystem": null,
   "version": null,
   "source": "avis Zyxel",
   "source_url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026",
   "editions": [
    "2026-11-06",
    "2026-11-07"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-108142",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-05",
   "last_seen": "2026-11-05",
   "expires_at": "2027-02-03",
   "ttl_days": 90,
   "sightings": 1,
   "campaign": null,
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 05/11, rubrique « Institutionnel, régulation, forces de l'ordre »",
   "ecosystem": null,
   "version": null,
   "source": "CERT-FR",
   "source_url": "https://cert.cyber.gouv.fr/actualite/CERTFR-2026-ACT-046/",
   "editions": [
    "2026-11-05"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-109518",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": true,
   "first_seen": "2026-11-05",
   "last_seen": "2026-11-06",
   "expires_at": "2027-02-04",
   "ttl_days": 90,
   "sightings": 2,
   "campaign": "Linux : RCE TCP du noyau CVE-2026-98432 et substitution de paquets APT",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 06/11, rubrique « Vulnérabilités et exploitation active »",
   "ecosystem": null,
   "version": null,
   "source": "IT-Connect",
   "source_url": "https://www.it-connect.fr/faille-apt-cve-2026-109518-debian-ubuntu-root/",
   "editions": [
    "2026-11-05",
    "2026-11-06"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-109593",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-06",
   "last_seen": "2026-11-06",
   "expires_at": "2027-02-04",
   "ttl_days": 90,
   "sightings": 1,
   "campaign": "Cisco, WatchGuard, SonicWall : correctifs du 5 novembre et GMS abandonné",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 06/11, rubrique « Vulnérabilités et exploitation active » : Cisco, WatchGuard, SonicWall : correctifs du 5 novembre et GMS abandonné",
   "ecosystem": null,
   "version": null,
   "source": "SecurityWeek",
   "source_url": "https://www.securityweek.com/cisco-watchguard-release-patches-sonicwall-wont-fix-gms-flaws/",
   "editions": [
    "2026-11-06"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-109594",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-06",
   "last_seen": "2026-11-06",
   "expires_at": "2027-02-04",
   "ttl_days": 90,
   "sightings": 1,
   "campaign": "Cisco, WatchGuard, SonicWall : correctifs du 5 novembre et GMS abandonné",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 06/11, rubrique « Vulnérabilités et exploitation active » : Cisco, WatchGuard, SonicWall : correctifs du 5 novembre et GMS abandonné",
   "ecosystem": null,
   "version": null,
   "source": "SecurityWeek",
   "source_url": "https://www.securityweek.com/cisco-watchguard-release-patches-sonicwall-wont-fix-gms-flaws/",
   "editions": [
    "2026-11-06"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-109618",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": true,
   "first_seen": "2026-10-31",
   "last_seen": "2026-11-07",
   "expires_at": "2027-02-05",
   "ttl_days": 90,
   "sightings": 6,
   "campaign": "Rappel : PHP2Shell (CVE-2026-109618/109619), règles Sigma CISA et Elastic, chaîne PAN-OS documentée",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 07/11, rubrique « Vulnérabilités et exploitation active »",
   "ecosystem": null,
   "version": null,
   "source": "CERT-FR",
   "source_url": "https://cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1476/",
   "editions": [
    "2026-10-31",
    "2026-11-01",
    "2026-11-02",
    "2026-11-03",
    "2026-11-04",
    "2026-11-07"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-109619",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": true,
   "first_seen": "2026-10-31",
   "last_seen": "2026-11-02",
   "expires_at": "2027-01-31",
   "ttl_days": 90,
   "sightings": 3,
   "campaign": "PHP2Shell : root sur pare-feu PAN-OS à management exposé, et nouvelle RCE PHP non corrigée",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 02/11, rubrique « Vulnérabilités et exploitation active » : PHP2Shell : root sur pare-feu PAN-OS à management exposé, et nouvelle RCE PHP non corrigée",
   "ecosystem": null,
   "version": null,
   "source": "Unit 42",
   "source_url": "https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/",
   "editions": [
    "2026-10-31",
    "2026-11-01",
    "2026-11-02"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-110186",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-03",
   "last_seen": "2026-11-03",
   "expires_at": "2027-02-01",
   "ttl_days": 90,
   "sightings": 1,
   "campaign": null,
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 03/11, rubrique « Vulnérabilités et exploitation active »",
   "ecosystem": null,
   "version": null,
   "source": "The Hacker News",
   "source_url": "https://thehackernews.com/2026/11/critical-langflow-flaws-could-let.html",
   "editions": [
    "2026-11-03"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-111357",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": true,
   "first_seen": "2026-10-31",
   "last_seen": "2026-11-07",
   "expires_at": "2027-02-05",
   "ttl_days": 90,
   "sightings": 8,
   "campaign": "Ivanti Connect Secure : la chaîne de zero-days d'UTA0576 reste la priorité (rappel)",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 07/11, rubrique « Vulnérabilités et exploitation active » : Ivanti Connect Secure : la chaîne de zero-days d'UTA0576 reste la priorité (rappel)",
   "ecosystem": null,
   "version": null,
   "source": "CERT-FR",
   "source_url": "https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-013/",
   "editions": [
    "2026-10-31",
    "2026-11-01",
    "2026-11-02",
    "2026-11-03",
    "2026-11-04",
    "2026-11-05",
    "2026-11-06",
    "2026-11-07"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-111497",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": true,
   "first_seen": "2026-10-31",
   "last_seen": "2026-11-07",
   "expires_at": "2027-02-05",
   "ttl_days": 90,
   "sightings": 7,
   "campaign": "Cisco, WatchGuard, SonicWall : correctifs du 5 novembre et GMS abandonné",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 07/11, rubrique « Vulnérabilités et exploitation active »",
   "ecosystem": null,
   "version": null,
   "source": "CERT-FR",
   "source_url": "https://cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1474/",
   "editions": [
    "2026-10-31",
    "2026-11-01",
    "2026-11-02",
    "2026-11-03",
    "2026-11-05",
    "2026-11-06",
    "2026-11-07"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-111560",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": true,
   "first_seen": "2026-11-04",
   "last_seen": "2026-11-05",
   "expires_at": "2027-02-03",
   "ttl_days": 90,
   "sightings": 2,
   "campaign": "Barracuda ESG : contournement d'authentification et injection de commandes, root à distance",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 05/11, rubrique « Vulnérabilités et exploitation active » : Barracuda ESG : contournement d'authentification et injection de commandes, root à distance",
   "ecosystem": null,
   "version": null,
   "source": "Barracuda",
   "source_url": "https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection",
   "editions": [
    "2026-11-04",
    "2026-11-05"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-111585",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": true,
   "first_seen": "2026-10-31",
   "last_seen": "2026-11-02",
   "expires_at": "2027-01-31",
   "ttl_days": 90,
   "sightings": 3,
   "campaign": null,
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 02/11, rubrique « Vulnérabilités et exploitation active »",
   "ecosystem": null,
   "version": null,
   "source": "CERT-FR",
   "source_url": "https://cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1433/",
   "editions": [
    "2026-10-31",
    "2026-11-01",
    "2026-11-02"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-115560",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": true,
   "first_seen": "2026-11-01",
   "last_seen": "2026-11-05",
   "expires_at": "2027-02-03",
   "ttl_days": 90,
   "sightings": 2,
   "campaign": "PHP2Shell : exploitation des interfaces de management PAN-OS, root via Fragnesia",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 05/11, rubrique « Institutionnel, régulation, forces de l'ordre »",
   "ecosystem": null,
   "version": null,
   "source": "CERT-FR",
   "source_url": "https://cert.cyber.gouv.fr/actualite/CERTFR-2026-ACT-046/",
   "editions": [
    "2026-11-01",
    "2026-11-05"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-116606",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": true,
   "first_seen": "2026-11-04",
   "last_seen": "2026-11-05",
   "expires_at": "2027-02-03",
   "ttl_days": 90,
   "sightings": 2,
   "campaign": "Barracuda ESG : contournement d'authentification et injection de commandes, root à distance",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 05/11, rubrique « Vulnérabilités et exploitation active » : Barracuda ESG : contournement d'authentification et injection de commandes, root à distance",
   "ecosystem": null,
   "version": null,
   "source": "Barracuda",
   "source_url": "https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection",
   "editions": [
    "2026-11-04",
    "2026-11-05"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-118527",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": true,
   "first_seen": "2026-10-31",
   "last_seen": "2026-11-07",
   "expires_at": "2027-02-05",
   "ttl_days": 90,
   "sightings": 8,
   "campaign": "Ivanti Connect Secure : la chaîne de zero-days d'UTA0576 reste la priorité (rappel)",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 07/11, rubrique « Vulnérabilités et exploitation active » : Ivanti Connect Secure : la chaîne de zero-days d'UTA0576 reste la priorité (rappel)",
   "ecosystem": null,
   "version": null,
   "source": "CERT-FR",
   "source_url": "https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-013/",
   "editions": [
    "2026-10-31",
    "2026-11-01",
    "2026-11-02",
    "2026-11-03",
    "2026-11-04",
    "2026-11-05",
    "2026-11-06",
    "2026-11-07"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-118539",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": true,
   "first_seen": "2026-10-31",
   "last_seen": "2026-11-03",
   "expires_at": "2027-02-01",
   "ttl_days": 90,
   "sightings": 4,
   "campaign": "Cisco ASA/FTD, Drupal Commerce Core et BeyondTrust Remote Support exploités",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 03/11, rubrique « Vulnérabilités et exploitation active »",
   "ecosystem": null,
   "version": null,
   "source": "Check Point Research",
   "source_url": "https://research.checkpoint.com/2026/2nd-november-threat-intelligence-report/",
   "editions": [
    "2026-10-31",
    "2026-11-01",
    "2026-11-02",
    "2026-11-03"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-118696",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-01",
   "last_seen": "2026-11-01",
   "expires_at": "2027-01-30",
   "ttl_days": 90,
   "sightings": 1,
   "campaign": null,
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 01/11, rubrique « Vulnérabilités et exploitation active »",
   "ecosystem": null,
   "version": null,
   "source": "SecurityOnline",
   "source_url": "https://securityonline.info/jetbrains-ide-vulnerabilities-emudhra-certificates-patched/",
   "editions": [
    "2026-11-01"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-119977",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": true,
   "first_seen": "2026-11-01",
   "last_seen": "2026-11-07",
   "expires_at": "2027-02-05",
   "ttl_days": 90,
   "sightings": 5,
   "campaign": "WordPress core : la mise à jour corrective ouvre elle-même la fenêtre d'exploitation (CVE-2026-119977, rappel KEV)",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 07/11, rubrique « Vulnérabilités et exploitation active » : WordPress core : la mise à jour corrective ouvre elle-même la fenêtre d'exploitation (CVE-2026-119977, rappel KEV)",
   "ecosystem": null,
   "version": null,
   "source": "The Hacker News",
   "source_url": "https://thehackernews.com/2026/11/installing-fix-for-exploited-wordpress.html",
   "editions": [
    "2026-11-01",
    "2026-11-04",
    "2026-11-05",
    "2026-11-06",
    "2026-11-07"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-120422",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-05",
   "last_seen": "2026-11-05",
   "expires_at": "2027-02-03",
   "ttl_days": 90,
   "sightings": 1,
   "campaign": "SlippyNunchucks (ESET) : détournement DNS de Sogou Input pour livrer DarkVigil",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 05/11, rubrique « Campagnes et threat actors » : SlippyNunchucks (ESET) : détournement DNS de Sogou Input pour livrer DarkVigil",
   "ecosystem": null,
   "version": null,
   "source": "ESET WeLiveSecurity",
   "source_url": "https://www.welivesecurity.com/en/eset-research/slippynunchucks-hijacks-sogou-input-methods-brand-promotion-mechanism-to-distribute-malware/",
   "editions": [
    "2026-11-05"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-123158",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-06",
   "last_seen": "2026-11-07",
   "expires_at": "2027-02-05",
   "ttl_days": 90,
   "sightings": 2,
   "campaign": "SSHole (CVE-2026-123158) : OpenSSH sur musl accepte n'importe quel mot de passe long pour les comptes verrouillés",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 07/11, rubrique « Vulnérabilités et exploitation active » : SSHole (CVE-2026-123158) : OpenSSH sur musl accepte n'importe quel mot de passe long pour les comptes verrouillés",
   "ecosystem": null,
   "version": null,
   "source": "CERT-FR",
   "source_url": "https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-015/",
   "editions": [
    "2026-11-06",
    "2026-11-07"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-13639",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-04",
   "last_seen": "2026-11-04",
   "expires_at": "2027-02-02",
   "ttl_days": 90,
   "sightings": 1,
   "campaign": null,
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 04/11, rubrique « Vulnérabilités et exploitation active »",
   "ecosystem": null,
   "version": null,
   "source": "The Hacker News",
   "source_url": "https://thehackernews.com/2026/11/synology-nas-devices-targeted-in.html",
   "editions": [
    "2026-11-04"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-14269",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": true,
   "first_seen": "2026-11-02",
   "last_seen": "2026-11-06",
   "expires_at": "2027-02-04",
   "ttl_days": 90,
   "sightings": 2,
   "campaign": null,
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 06/11, rubrique « Vulnérabilités et exploitation active »",
   "ecosystem": null,
   "version": null,
   "source": "IT-Connect",
   "source_url": "https://www.it-connect.fr/faille-apt-cve-2026-109518-debian-ubuntu-root/",
   "editions": [
    "2026-11-02",
    "2026-11-06"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-14502",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-02",
   "last_seen": "2026-11-02",
   "expires_at": "2027-01-31",
   "ttl_days": 90,
   "sightings": 1,
   "campaign": null,
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 02/11, rubrique « Vulnérabilités et exploitation active »",
   "ecosystem": null,
   "version": null,
   "source": "CERT-FR",
   "source_url": "https://cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1433/",
   "editions": [
    "2026-11-02"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-14999",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-03",
   "last_seen": "2026-11-03",
   "expires_at": "2027-02-01",
   "ttl_days": 90,
   "sightings": 1,
   "campaign": null,
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 03/11, rubrique « Vulnérabilités et exploitation active »",
   "ecosystem": null,
   "version": null,
   "source": "Check Point Research",
   "source_url": "https://research.checkpoint.com/2026/2nd-november-threat-intelligence-report/",
   "editions": [
    "2026-11-03"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-19868",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-07",
   "last_seen": "2026-11-07",
   "expires_at": "2027-02-05",
   "ttl_days": 90,
   "sightings": 1,
   "campaign": "SonicWall SonicOS SSL-VPN : contournement SAML et MFA exploité (CVE-2026-19868), KEV le 6 novembre",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 07/11, rubrique « Vulnérabilités et exploitation active » : SonicWall SonicOS SSL-VPN : contournement SAML et MFA exploité (CVE-2026-19868), KEV le 6 novembre",
   "ecosystem": null,
   "version": null,
   "source": "BleepingComputer",
   "source_url": "https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks/",
   "editions": [
    "2026-11-07"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-3910",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-06",
   "last_seen": "2026-11-06",
   "expires_at": "2027-02-04",
   "ttl_days": 90,
   "sightings": 1,
   "campaign": "APT29 « Poisoned Source » : watering holes et supply chain Plerdy vers des chaînes N-day iOS et Android",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 06/11, rubrique « Campagnes et threat actors » : APT29 « Poisoned Source » : watering holes et supply chain Plerdy vers des chaînes N-day iOS et Android",
   "ecosystem": null,
   "version": null,
   "source": "Sekoia",
   "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
   "editions": [
    "2026-11-06"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-40217",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-04",
   "last_seen": "2026-11-07",
   "expires_at": "2027-02-05",
   "ttl_days": 90,
   "sightings": 2,
   "campaign": "LLMjacking : GTIG détaille UNC6993 et un « LLM Mixer » à 1 M$ de tokens par victime",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 07/11, rubrique « Supply chain, développeurs et IA »",
   "ecosystem": null,
   "version": null,
   "source": "Google Threat Intelligence",
   "source_url": "https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models",
   "editions": [
    "2026-11-04",
    "2026-11-07"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-41709",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": true,
   "first_seen": "2026-10-31",
   "last_seen": "2026-11-04",
   "expires_at": "2027-02-02",
   "ttl_days": 90,
   "sightings": 5,
   "campaign": "VMware ESX",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 04/11, rubrique « Vulnérabilités et exploitation active » : VMware ESX",
   "ecosystem": null,
   "version": null,
   "source": "CISA KEV",
   "source_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
   "editions": [
    "2026-10-31",
    "2026-11-01",
    "2026-11-02",
    "2026-11-03",
    "2026-11-04"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-46300",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": true,
   "first_seen": "2026-10-31",
   "last_seen": "2026-11-04",
   "expires_at": "2027-02-02",
   "ttl_days": 90,
   "sightings": 5,
   "campaign": "Rappel : PHP2Shell (CVE-2026-109618/109619), règles Sigma CISA et Elastic, chaîne PAN-OS documentée",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 04/11, rubrique « Vulnérabilités et exploitation active » : Rappel : PHP2Shell (CVE-2026-109618/109619), règles Sigma CISA et Elastic, chaîne PAN-OS documentée",
   "ecosystem": null,
   "version": null,
   "source": "Unit 42",
   "source_url": "https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/",
   "editions": [
    "2026-10-31",
    "2026-11-01",
    "2026-11-02",
    "2026-11-03",
    "2026-11-04"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-48356",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-10-31",
   "last_seen": "2026-11-03",
   "expires_at": "2027-02-01",
   "ttl_days": 90,
   "sightings": 4,
   "campaign": "Adobe Commerce / Magento (upload, RCE)",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 03/11, rubrique « Vulnérabilités et exploitation active » : Adobe Commerce / Magento (upload, RCE)",
   "ecosystem": null,
   "version": null,
   "source": "CISA KEV",
   "source_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
   "editions": [
    "2026-10-31",
    "2026-11-01",
    "2026-11-02",
    "2026-11-03"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-53595",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-01",
   "last_seen": "2026-11-01",
   "expires_at": "2027-01-30",
   "ttl_days": 90,
   "sightings": 1,
   "campaign": "Nouvelles exploitations relevées le 31/10 : Siemens IoT2050, FreeScout, WordPress core",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 01/11, rubrique « Vulnérabilités et exploitation active » : Nouvelles exploitations relevées le 31/10 : Siemens IoT2050, FreeScout, WordPress core",
   "ecosystem": null,
   "version": null,
   "source": "Exploit Bulletin",
   "source_url": "https://buttondown.com/exploit-bulletin/archive/the-exploit-bulletin-saturday-october-31-2026-6/",
   "editions": [
    "2026-11-01"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-58115",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": true,
   "first_seen": "2026-11-01",
   "last_seen": "2026-11-05",
   "expires_at": "2027-02-03",
   "ttl_days": 90,
   "sightings": 4,
   "campaign": "Node-RED CVE-2026-58115 : RCE non authentifiée exploitée pour déployer un bot Linux",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 05/11, rubrique « Vulnérabilités et exploitation active »",
   "ecosystem": null,
   "version": null,
   "source": "SANS ISC",
   "source_url": "https://isc.sans.edu/podcastdetail/10164",
   "editions": [
    "2026-11-01",
    "2026-11-03",
    "2026-11-04",
    "2026-11-05"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-7273",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-06",
   "last_seen": "2026-11-06",
   "expires_at": "2027-02-04",
   "ttl_days": 90,
   "sightings": 1,
   "campaign": "Zyxel GS1900 : zero-day CVE-2026-107441 exploité, le correctif de CVE-2026-7273 était inopérant",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 06/11, rubrique « Vulnérabilités et exploitation active » : Zyxel GS1900 : zero-day CVE-2026-107441 exploité, le correctif de CVE-2026-7273 était inopérant",
   "ecosystem": null,
   "version": null,
   "source": "SecurityWeek",
   "source_url": "https://www.securityweek.com/zyxel-switch-hacks-blamed-on-patched-flaw-actually-exploited-a-zero-day/",
   "editions": [
    "2026-11-06"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-76418",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": true,
   "first_seen": "2026-10-31",
   "last_seen": "2026-11-05",
   "expires_at": "2027-02-03",
   "ttl_days": 90,
   "sightings": 6,
   "campaign": "Cisco ASA / FTD",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 05/11, rubrique « Vulnérabilités et exploitation active » : Cisco ASA / FTD",
   "ecosystem": null,
   "version": null,
   "source": "CISA KEV",
   "source_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
   "editions": [
    "2026-10-31",
    "2026-11-01",
    "2026-11-02",
    "2026-11-03",
    "2026-11-04",
    "2026-11-05"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-76506",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-06",
   "last_seen": "2026-11-06",
   "expires_at": "2027-02-04",
   "ttl_days": 90,
   "sightings": 1,
   "campaign": "Cisco, WatchGuard, SonicWall : correctifs du 5 novembre et GMS abandonné",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 06/11, rubrique « Vulnérabilités et exploitation active » : Cisco, WatchGuard, SonicWall : correctifs du 5 novembre et GMS abandonné",
   "ecosystem": null,
   "version": null,
   "source": "SecurityWeek",
   "source_url": "https://www.securityweek.com/cisco-watchguard-release-patches-sonicwall-wont-fix-gms-flaws/",
   "editions": [
    "2026-11-06"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-85706",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-01",
   "last_seen": "2026-11-01",
   "expires_at": "2027-01-30",
   "ttl_days": 90,
   "sightings": 1,
   "campaign": "GitLab CVE-2026-97229 (CVSS 10) : due date KEV aujourd'hui, PoC public",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 01/11, rubrique « Vulnérabilités et exploitation active » : GitLab CVE-2026-97229 (CVSS 10) : due date KEV aujourd'hui, PoC public",
   "ecosystem": null,
   "version": null,
   "source": "rapid7.com",
   "source_url": "https://www.rapid7.com/blog/post/etr-cve-2026-97229-critical-unauthenticated-remote-code-execution-in-gitlab",
   "editions": [
    "2026-11-01"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-93680",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-03",
   "last_seen": "2026-11-03",
   "expires_at": "2027-02-01",
   "ttl_days": 90,
   "sightings": 1,
   "campaign": null,
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 03/11, rubrique « Vulnérabilités et exploitation active »",
   "ecosystem": null,
   "version": null,
   "source": "The Hacker News",
   "source_url": "https://thehackernews.com/2026/11/critical-langflow-flaws-could-let.html",
   "editions": [
    "2026-11-03"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-96652",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-07",
   "last_seen": "2026-11-07",
   "expires_at": "2027-02-05",
   "ttl_days": 90,
   "sightings": 1,
   "campaign": "QNAP confirme des NAS compromis via Plex2Shell (Plex Media Server, quatre CVE au KEV)",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 07/11, rubrique « Vulnérabilités et exploitation active » : QNAP confirme des NAS compromis via Plex2Shell (Plex Media Server, quatre CVE au KEV)",
   "ecosystem": null,
   "version": null,
   "source": "BleepingComputer",
   "source_url": "https://www.bleepingcomputer.com/news/security/qnap-says-hackers-breaching-nas-devices-in-plex2shell-attacks/",
   "editions": [
    "2026-11-07"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-97229",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": true,
   "first_seen": "2026-10-31",
   "last_seen": "2026-11-05",
   "expires_at": "2027-02-03",
   "ttl_days": 90,
   "sightings": 6,
   "campaign": "GitLab CE/EE CVE-2026-97229 : RCE via regex CI/CD, plus de 1 000 serveurs exposés",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 05/11, rubrique « Vulnérabilités et exploitation active » : GitLab CE/EE CVE-2026-97229 : RCE via regex CI/CD, plus de 1 000 serveurs exposés",
   "ecosystem": null,
   "version": null,
   "source": "Release GitLab",
   "source_url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/",
   "editions": [
    "2026-10-31",
    "2026-11-01",
    "2026-11-02",
    "2026-11-03",
    "2026-11-04",
    "2026-11-05"
   ],
   "note": null
  },
  {
   "value": "CVE-2026-98432",
   "type": "cve",
   "action": "info",
   "confidence": "medium",
   "corroborated": true,
   "first_seen": "2026-10-31",
   "last_seen": "2026-11-06",
   "expires_at": "2027-02-04",
   "ttl_days": 90,
   "sightings": 6,
   "campaign": "Cisco, WatchGuard, SonicWall : correctifs du 5 novembre et GMS abandonné",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 06/11, rubrique « Vulnérabilités et exploitation active » : Cisco, WatchGuard, SonicWall : correctifs du 5 novembre et GMS abandonné",
   "ecosystem": null,
   "version": null,
   "source": "SecurityWeek",
   "source_url": "https://www.securityweek.com/cisco-watchguard-release-patches-sonicwall-wont-fix-gms-flaws/",
   "editions": [
    "2026-10-31",
    "2026-11-01",
    "2026-11-03",
    "2026-11-04",
    "2026-11-05",
    "2026-11-06"
   ],
   "note": null
  },
  {
   "value": "a.plerdy.com",
   "type": "domain",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-05",
   "last_seen": "2026-11-06",
   "expires_at": "2026-12-06",
   "ttl_days": 30,
   "sightings": 2,
   "campaign": "APT29 « Poisoned Source » : watering holes et supply chain Plerdy vers des chaînes N-day iOS et Android",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 06/11, rubrique « Campagnes et threat actors » : APT29 « Poisoned Source » : watering holes et supply chain Plerdy vers des chaînes N-day iOS et Android",
   "ecosystem": null,
   "version": null,
   "source": "Sekoia",
   "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
   "editions": [
    "2026-11-05",
    "2026-11-06"
   ],
   "note": null
  },
  {
   "value": "ad-track.live",
   "type": "domain",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-05",
   "last_seen": "2026-11-06",
   "expires_at": "2026-12-06",
   "ttl_days": 30,
   "sightings": 2,
   "campaign": "APT29 « Poisoned Source » : watering holes et supply chain Plerdy vers des chaînes N-day iOS et Android",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 06/11, rubrique « Campagnes et threat actors » : APT29 « Poisoned Source » : watering holes et supply chain Plerdy vers des chaînes N-day iOS et Android",
   "ecosystem": null,
   "version": null,
   "source": "Sekoia",
   "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
   "editions": [
    "2026-11-05",
    "2026-11-06"
   ],
   "note": null
  },
  {
   "value": "ad.starx-net.com",
   "type": "domain",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-05",
   "last_seen": "2026-11-06",
   "expires_at": "2026-12-06",
   "ttl_days": 30,
   "sightings": 2,
   "campaign": "APT29 « Poisoned Source » : watering holes et supply chain Plerdy vers des chaînes N-day iOS et Android",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 06/11, rubrique « Campagnes et threat actors » : APT29 « Poisoned Source » : watering holes et supply chain Plerdy vers des chaînes N-day iOS et Android",
   "ecosystem": null,
   "version": null,
   "source": "Sekoia",
   "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
   "editions": [
    "2026-11-05",
    "2026-11-06"
   ],
   "note": null
  },
  {
   "value": "america250.holiday",
   "type": "domain",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-05",
   "last_seen": "2026-11-06",
   "expires_at": "2026-12-06",
   "ttl_days": 30,
   "sightings": 2,
   "campaign": "APT29 « Poisoned Source » : watering holes et supply chain Plerdy vers des chaînes N-day iOS et Android",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 06/11, rubrique « Campagnes et threat actors » : APT29 « Poisoned Source » : watering holes et supply chain Plerdy vers des chaînes N-day iOS et Android",
   "ecosystem": null,
   "version": null,
   "source": "Sekoia",
   "source_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
   "editions": [
    "2026-11-05",
    "2026-11-06"
   ],
   "note": null
  },
  {
   "value": "anyevonline.com",
   "type": "domain",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-03",
   "last_seen": "2026-11-03",
   "expires_at": "2026-12-03",
   "ttl_days": 30,
   "sightings": 1,
   "campaign": "GTIG : démantèlement du botnet XCPE, backdoor firmware dans 1,3 million d'Android TV",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 03/11, rubrique « Campagnes et threat actors » : GTIG : démantèlement du botnet XCPE, backdoor firmware dans 1,3 million d'Android TV",
   "ecosystem": null,
   "version": null,
   "source": "Google Threat Intelligence",
   "source_url": "https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet",
   "editions": [
    "2026-11-03"
   ],
   "note": null
  },
  {
   "value": "config.pinyin.sogou.com",
   "type": "domain",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-05",
   "last_seen": "2026-11-05",
   "expires_at": "2026-12-05",
   "ttl_days": 30,
   "sightings": 1,
   "campaign": null,
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 05/11, rubrique « Détection, recherche et veille »",
   "ecosystem": null,
   "version": null,
   "source": "ESET WeLiveSecurity",
   "source_url": "https://www.welivesecurity.com/en/eset-research/slippynunchucks-hijacks-sogou-input-methods-brand-promotion-mechanism-to-distribute-malware/",
   "editions": [
    "2026-11-05"
   ],
   "note": null
  },
  {
   "value": "estrosa.it",
   "type": "domain",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-02",
   "last_seen": "2026-11-02",
   "expires_at": "2026-12-02",
   "ttl_days": 30,
   "sightings": 1,
   "campaign": null,
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 02/11, rubrique « Underground et signaux faibles »",
   "ecosystem": null,
   "version": null,
   "source": "vx-underground",
   "source_url": "https://t.me/vxunderground/9541",
   "editions": [
    "2026-11-02"
   ],
   "note": null
  },
  {
   "value": "herlittlebit.com",
   "type": "domain",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": true,
   "first_seen": "2026-11-01",
   "last_seen": "2026-11-06",
   "expires_at": "2026-12-06",
   "ttl_days": 30,
   "sightings": 5,
   "campaign": null,
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 06/11, rubrique « Underground et signaux faibles »",
   "ecosystem": null,
   "version": null,
   "source": "vx-underground",
   "source_url": "https://t.me/vxunderground/9558",
   "editions": [
    "2026-11-01",
    "2026-11-02",
    "2026-11-03",
    "2026-11-04",
    "2026-11-06"
   ],
   "note": null
  },
  {
   "value": "newapi.pro",
   "type": "domain",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-04",
   "last_seen": "2026-11-04",
   "expires_at": "2026-12-04",
   "ttl_days": 30,
   "sightings": 1,
   "campaign": "LLMjacking : GTIG détaille UNC6993 et un « LLM Mixer » à 1 M$ de tokens par victime",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 04/11, rubrique « Supply chain, développeurs et IA » : LLMjacking : GTIG détaille UNC6993 et un « LLM Mixer » à 1 M$ de tokens par victime",
   "ecosystem": null,
   "version": null,
   "source": "Google Threat Intelligence",
   "source_url": "https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models",
   "editions": [
    "2026-11-04"
   ],
   "note": null
  },
  {
   "value": "openaigpt4v.com",
   "type": "domain",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-01",
   "last_seen": "2026-11-01",
   "expires_at": "2026-12-01",
   "ttl_days": 30,
   "sightings": 1,
   "campaign": null,
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 01/11, rubrique « Campagnes et threat actors »",
   "ecosystem": null,
   "version": null,
   "source": "Kaspersky Securelist",
   "source_url": "https://securelist.com/netamloader/121676/",
   "editions": [
    "2026-11-01"
   ],
   "note": null
  },
  {
   "value": "qmlab1.com",
   "type": "domain",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-02",
   "last_seen": "2026-11-02",
   "expires_at": "2026-12-02",
   "ttl_days": 30,
   "sightings": 1,
   "campaign": null,
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 02/11, rubrique « Underground et signaux faibles »",
   "ecosystem": null,
   "version": null,
   "source": "vx-underground",
   "source_url": "https://t.me/vxunderground/9544",
   "editions": [
    "2026-11-02"
   ],
   "note": null
  },
  {
   "value": "sogou-cdn.com",
   "type": "domain",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-05",
   "last_seen": "2026-11-05",
   "expires_at": "2026-12-05",
   "ttl_days": 30,
   "sightings": 1,
   "campaign": null,
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 05/11, rubrique « Détection, recherche et veille »",
   "ecosystem": null,
   "version": null,
   "source": "ESET WeLiveSecurity",
   "source_url": "https://www.welivesecurity.com/en/eset-research/slippynunchucks-hijacks-sogou-input-methods-brand-promotion-mechanism-to-distribute-malware/",
   "editions": [
    "2026-11-05"
   ],
   "note": null
  },
  {
   "value": "szbboys.com",
   "type": "domain",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-03",
   "last_seen": "2026-11-03",
   "expires_at": "2026-12-03",
   "ttl_days": 30,
   "sightings": 1,
   "campaign": "GTIG : démantèlement du botnet XCPE, backdoor firmware dans 1,3 million d'Android TV",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 03/11, rubrique « Campagnes et threat actors » : GTIG : démantèlement du botnet XCPE, backdoor firmware dans 1,3 million d'Android TV",
   "ecosystem": null,
   "version": null,
   "source": "Google Threat Intelligence",
   "source_url": "https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet",
   "editions": [
    "2026-11-03"
   ],
   "note": null
  },
  {
   "value": "zz.aiapi2025.top",
   "type": "domain",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-05",
   "last_seen": "2026-11-05",
   "expires_at": "2026-12-05",
   "ttl_days": 30,
   "sightings": 1,
   "campaign": null,
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 05/11, rubrique « Détection, recherche et veille »",
   "ecosystem": null,
   "version": null,
   "source": "Check Point Research",
   "source_url": "https://research.checkpoint.com/2026/free-the-model-sell-the-gateway-prompt-adware-hidden-in-jailbreak-bundles/",
   "editions": [
    "2026-11-05"
   ],
   "note": null
  },
  {
   "value": "103.122.245.194",
   "type": "ipv4",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-07",
   "last_seen": "2026-11-07",
   "expires_at": "2026-11-14",
   "ttl_days": 7,
   "sightings": 1,
   "campaign": null,
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 07/11, rubrique « Détection, recherche et veille »",
   "ecosystem": null,
   "version": null,
   "source": "BleepingComputer",
   "source_url": "https://www.bleepingcomputer.com/news/security/chainalysis-says-breach-exposed-credentials-for-all-customers/",
   "editions": [
    "2026-11-07"
   ],
   "note": null
  },
  {
   "value": "103.122.245.198",
   "type": "ipv4",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-07",
   "last_seen": "2026-11-07",
   "expires_at": "2026-11-14",
   "ttl_days": 7,
   "sightings": 1,
   "campaign": null,
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 07/11, rubrique « Détection, recherche et veille »",
   "ecosystem": null,
   "version": null,
   "source": "BleepingComputer",
   "source_url": "https://www.bleepingcomputer.com/news/security/chainalysis-says-breach-exposed-credentials-for-all-customers/",
   "editions": [
    "2026-11-07"
   ],
   "note": null
  },
  {
   "value": "104.168.112.237",
   "type": "ipv4",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-07",
   "last_seen": "2026-11-07",
   "expires_at": "2026-11-14",
   "ttl_days": 7,
   "sightings": 1,
   "campaign": null,
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 07/11, rubrique « Détection, recherche et veille »",
   "ecosystem": null,
   "version": null,
   "source": "BleepingComputer",
   "source_url": "https://www.bleepingcomputer.com/news/security/chainalysis-says-breach-exposed-credentials-for-all-customers/",
   "editions": [
    "2026-11-07"
   ],
   "note": null
  },
  {
   "value": "108.165.147.64",
   "type": "ipv4",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": true,
   "first_seen": "2026-11-01",
   "last_seen": "2026-11-03",
   "expires_at": "2026-11-10",
   "ttl_days": 7,
   "sightings": 2,
   "campaign": "Ivanti Connect Secure : chaîne de trois zero-days, UTA0576 sans webshell",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 03/11, rubrique « Vulnérabilités et exploitation active » : Ivanti Connect Secure : chaîne de trois zero-days, UTA0576 sans webshell",
   "ecosystem": null,
   "version": null,
   "source": "CERT-FR",
   "source_url": "https://cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1442/",
   "editions": [
    "2026-11-01",
    "2026-11-03"
   ],
   "note": null
  },
  {
   "value": "134.209.82.225",
   "type": "ipv4",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": true,
   "first_seen": "2026-10-31",
   "last_seen": "2026-11-06",
   "expires_at": "2026-11-13",
   "ttl_days": 7,
   "sightings": 4,
   "campaign": "Extension Claude Code trojanisée dans le miroir Open VSX de Cursor : backdoor SSH persistante (rappel, podcast OSM du jour)",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 06/11, rubrique « Supply chain, développeurs et IA » : Extension Claude Code trojanisée dans le miroir Open VSX de Cursor : backdoor SSH persistante (rappel, podcast OSM du jour)",
   "ecosystem": null,
   "version": null,
   "source": "OpenSourceMalware",
   "source_url": "https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor",
   "editions": [
    "2026-10-31",
    "2026-11-01",
    "2026-11-03",
    "2026-11-06"
   ],
   "note": null
  },
  {
   "value": "136.0.141.71",
   "type": "ipv4",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-07",
   "last_seen": "2026-11-07",
   "expires_at": "2026-11-14",
   "ttl_days": 7,
   "sightings": 1,
   "campaign": "CWPdoor : un cwpsrv trojanisé transforme Control Web Panel en backdoor passive",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 07/11, rubrique « Campagnes et threat actors » : CWPdoor : un cwpsrv trojanisé transforme Control Web Panel en backdoor passive",
   "ecosystem": null,
   "version": null,
   "source": "QiAnXin XLab",
   "source_url": "https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/",
   "editions": [
    "2026-11-07"
   ],
   "note": null
  },
  {
   "value": "142.111.194.73",
   "type": "ipv4",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-04",
   "last_seen": "2026-11-04",
   "expires_at": "2026-11-11",
   "ttl_days": 7,
   "sightings": 1,
   "campaign": "Gorbag (ESET) : groupe aligné sur la Russie, WinRAR CVE-2025-8088 et BeautyStealer contre l'Ukraine",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 04/11, rubrique « Campagnes et threat actors » : Gorbag (ESET) : groupe aligné sur la Russie, WinRAR CVE-2025-8088 et BeautyStealer contre l'Ukraine",
   "ecosystem": null,
   "version": null,
   "source": "ESET WeLiveSecurity",
   "source_url": "https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/",
   "editions": [
    "2026-11-04"
   ],
   "note": null
  },
  {
   "value": "154.91.0.103",
   "type": "ipv4",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-02",
   "last_seen": "2026-11-02",
   "expires_at": "2026-11-09",
   "ttl_days": 7,
   "sightings": 1,
   "campaign": "PolinRider (Corée du Nord) remonte à 2025 : paquets npm itsa-* détournés",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 02/11, rubrique « Supply chain, développeurs et IA » : PolinRider (Corée du Nord) remonte à 2025 : paquets npm itsa-* détournés",
   "ecosystem": null,
   "version": null,
   "source": "OpenSourceMalware",
   "source_url": "https://opensourcemalware.com/blog/polinrider-malware-found-in-2025-npm-packages",
   "editions": [
    "2026-11-02"
   ],
   "note": null
  },
  {
   "value": "157.22.126.128",
   "type": "ipv4",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-06",
   "last_seen": "2026-11-06",
   "expires_at": "2026-11-13",
   "ttl_days": 7,
   "sightings": 1,
   "campaign": "Microsoft : des agents IA offensifs passent d'un secret GitHub à Key Vault en cinq minutes",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 06/11, rubrique « Campagnes et threat actors » : Microsoft : des agents IA offensifs passent d'un secret GitHub à Key Vault en cinq minutes",
   "ecosystem": null,
   "version": null,
   "source": "Microsoft Threat Intelligence",
   "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/",
   "editions": [
    "2026-11-06"
   ],
   "note": null
  },
  {
   "value": "192.236.172.197",
   "type": "ipv4",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-07",
   "last_seen": "2026-11-07",
   "expires_at": "2026-11-14",
   "ttl_days": 7,
   "sightings": 1,
   "campaign": null,
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 07/11, rubrique « Détection, recherche et veille »",
   "ecosystem": null,
   "version": null,
   "source": "BleepingComputer",
   "source_url": "https://www.bleepingcomputer.com/news/security/chainalysis-says-breach-exposed-credentials-for-all-customers/",
   "editions": [
    "2026-11-07"
   ],
   "note": null
  },
  {
   "value": "198.44.123.66",
   "type": "ipv4",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-07",
   "last_seen": "2026-11-07",
   "expires_at": "2026-11-14",
   "ttl_days": 7,
   "sightings": 1,
   "campaign": null,
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 07/11, rubrique « Détection, recherche et veille »",
   "ecosystem": null,
   "version": null,
   "source": "BleepingComputer",
   "source_url": "https://www.bleepingcomputer.com/news/security/chainalysis-says-breach-exposed-credentials-for-all-customers/",
   "editions": [
    "2026-11-07"
   ],
   "note": null
  },
  {
   "value": "199.19.77.18",
   "type": "ipv4",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-06",
   "last_seen": "2026-11-06",
   "expires_at": "2026-11-13",
   "ttl_days": 7,
   "sightings": 1,
   "campaign": "Microsoft : des agents IA offensifs passent d'un secret GitHub à Key Vault en cinq minutes",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 06/11, rubrique « Campagnes et threat actors » : Microsoft : des agents IA offensifs passent d'un secret GitHub à Key Vault en cinq minutes",
   "ecosystem": null,
   "version": null,
   "source": "Microsoft Threat Intelligence",
   "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/",
   "editions": [
    "2026-11-06"
   ],
   "note": null
  },
  {
   "value": "199.19.77.84",
   "type": "ipv4",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-06",
   "last_seen": "2026-11-06",
   "expires_at": "2026-11-13",
   "ttl_days": 7,
   "sightings": 1,
   "campaign": "Microsoft : des agents IA offensifs passent d'un secret GitHub à Key Vault en cinq minutes",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 06/11, rubrique « Campagnes et threat actors » : Microsoft : des agents IA offensifs passent d'un secret GitHub à Key Vault en cinq minutes",
   "ecosystem": null,
   "version": null,
   "source": "Microsoft Threat Intelligence",
   "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/",
   "editions": [
    "2026-11-06"
   ],
   "note": null
  },
  {
   "value": "204.44.66.81",
   "type": "ipv4",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-07",
   "last_seen": "2026-11-07",
   "expires_at": "2026-11-14",
   "ttl_days": 7,
   "sightings": 1,
   "campaign": null,
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 07/11, rubrique « Détection, recherche et veille »",
   "ecosystem": null,
   "version": null,
   "source": "BleepingComputer",
   "source_url": "https://www.bleepingcomputer.com/news/security/chainalysis-says-breach-exposed-credentials-for-all-customers/",
   "editions": [
    "2026-11-07"
   ],
   "note": null
  },
  {
   "value": "219.134.163.210",
   "type": "ipv4",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-03",
   "last_seen": "2026-11-03",
   "expires_at": "2026-11-10",
   "ttl_days": 7,
   "sightings": 1,
   "campaign": "GTIG : démantèlement du botnet XCPE, backdoor firmware dans 1,3 million d'Android TV",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 03/11, rubrique « Campagnes et threat actors » : GTIG : démantèlement du botnet XCPE, backdoor firmware dans 1,3 million d'Android TV",
   "ecosystem": null,
   "version": null,
   "source": "Google Threat Intelligence",
   "source_url": "https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet",
   "editions": [
    "2026-11-03"
   ],
   "note": null
  },
  {
   "value": "45.194.90.57",
   "type": "ipv4",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": true,
   "first_seen": "2026-11-03",
   "last_seen": "2026-11-04",
   "expires_at": "2026-11-11",
   "ttl_days": 7,
   "sightings": 2,
   "campaign": "Node-RED CVE-2026-58115 : RCE non authentifiée exploitée pour déployer un bot Linux",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 04/11, rubrique « Vulnérabilités et exploitation active » : Node-RED CVE-2026-58115 : RCE non authentifiée exploitée pour déployer un bot Linux",
   "ecosystem": null,
   "version": null,
   "source": "Help Net Security",
   "source_url": "https://www.helpnetsecurity.com/2026/11/03/node-red-cve-2026-58115-exploitation/",
   "editions": [
    "2026-11-03",
    "2026-11-04"
   ],
   "note": null
  },
  {
   "value": "47.237.122.175",
   "type": "ipv4",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-05",
   "last_seen": "2026-11-05",
   "expires_at": "2026-11-12",
   "ttl_days": 7,
   "sightings": 1,
   "campaign": null,
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 05/11, rubrique « Détection, recherche et veille »",
   "ecosystem": null,
   "version": null,
   "source": "ESET WeLiveSecurity",
   "source_url": "https://www.welivesecurity.com/en/eset-research/slippynunchucks-hijacks-sogou-input-methods-brand-promotion-mechanism-to-distribute-malware/",
   "editions": [
    "2026-11-05"
   ],
   "note": null
  },
  {
   "value": "47.239.250.102",
   "type": "ipv4",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-05",
   "last_seen": "2026-11-05",
   "expires_at": "2026-11-12",
   "ttl_days": 7,
   "sightings": 1,
   "campaign": null,
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 05/11, rubrique « Détection, recherche et veille »",
   "ecosystem": null,
   "version": null,
   "source": "ESET WeLiveSecurity",
   "source_url": "https://www.welivesecurity.com/en/eset-research/slippynunchucks-hijacks-sogou-input-methods-brand-promotion-mechanism-to-distribute-malware/",
   "editions": [
    "2026-11-05"
   ],
   "note": null
  },
  {
   "value": "52.74.54.75",
   "type": "ipv4",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-01",
   "last_seen": "2026-11-06",
   "expires_at": "2026-11-13",
   "ttl_days": 7,
   "sightings": 3,
   "campaign": null,
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 06/11, rubrique « Underground et signaux faibles »",
   "ecosystem": null,
   "version": null,
   "source": "vx-underground",
   "source_url": "https://t.me/vxunderground/9544",
   "editions": [
    "2026-11-01",
    "2026-11-03",
    "2026-11-06"
   ],
   "note": null
  },
  {
   "value": "65.87.223.26",
   "type": "ipv4",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-06",
   "last_seen": "2026-11-06",
   "expires_at": "2026-11-13",
   "ttl_days": 7,
   "sightings": 1,
   "campaign": "Microsoft : des agents IA offensifs passent d'un secret GitHub à Key Vault en cinq minutes",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 06/11, rubrique « Campagnes et threat actors » : Microsoft : des agents IA offensifs passent d'un secret GitHub à Key Vault en cinq minutes",
   "ecosystem": null,
   "version": null,
   "source": "Microsoft Threat Intelligence",
   "source_url": "https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/",
   "editions": [
    "2026-11-06"
   ],
   "note": null
  },
  {
   "value": "85.215.73.250",
   "type": "ipv4",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": true,
   "first_seen": "2026-11-03",
   "last_seen": "2026-11-04",
   "expires_at": "2026-11-11",
   "ttl_days": 7,
   "sightings": 2,
   "campaign": "Node-RED CVE-2026-58115 : RCE non authentifiée exploitée pour déployer un bot Linux",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 04/11, rubrique « Vulnérabilités et exploitation active » : Node-RED CVE-2026-58115 : RCE non authentifiée exploitée pour déployer un bot Linux",
   "ecosystem": null,
   "version": null,
   "source": "Help Net Security",
   "source_url": "https://www.helpnetsecurity.com/2026/11/03/node-red-cve-2026-58115-exploitation/",
   "editions": [
    "2026-11-03",
    "2026-11-04"
   ],
   "note": null
  },
  {
   "value": "85.239.62.36",
   "type": "ipv4",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-02",
   "last_seen": "2026-11-02",
   "expires_at": "2026-11-09",
   "ttl_days": 7,
   "sightings": 1,
   "campaign": "PolinRider (Corée du Nord) remonte à 2025 : paquets npm itsa-* détournés",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 02/11, rubrique « Supply chain, développeurs et IA » : PolinRider (Corée du Nord) remonte à 2025 : paquets npm itsa-* détournés",
   "ecosystem": null,
   "version": null,
   "source": "OpenSourceMalware",
   "source_url": "https://opensourcemalware.com/blog/polinrider-malware-found-in-2025-npm-packages",
   "editions": [
    "2026-11-02"
   ],
   "note": null
  },
  {
   "value": "89.116.89.18",
   "type": "ipv4",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-07",
   "last_seen": "2026-11-07",
   "expires_at": "2026-11-14",
   "ttl_days": 7,
   "sightings": 1,
   "campaign": "SSHole (CVE-2026-123158) : OpenSSH sur musl accepte n'importe quel mot de passe long pour les comptes verrouillés",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 07/11, rubrique « Vulnérabilités et exploitation active » : SSHole (CVE-2026-123158) : OpenSSH sur musl accepte n'importe quel mot de passe long pour les comptes verrouillés",
   "ecosystem": null,
   "version": null,
   "source": "CERT-FR",
   "source_url": "https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-015/",
   "editions": [
    "2026-11-07"
   ],
   "note": null
  },
  {
   "value": "89.44.9.186",
   "type": "ipv4",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-04",
   "last_seen": "2026-11-04",
   "expires_at": "2026-11-11",
   "ttl_days": 7,
   "sightings": 1,
   "campaign": "Gorbag (ESET) : groupe aligné sur la Russie, WinRAR CVE-2025-8088 et BeautyStealer contre l'Ukraine",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 04/11, rubrique « Campagnes et threat actors » : Gorbag (ESET) : groupe aligné sur la Russie, WinRAR CVE-2025-8088 et BeautyStealer contre l'Ukraine",
   "ecosystem": null,
   "version": null,
   "source": "ESET WeLiveSecurity",
   "source_url": "https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/",
   "editions": [
    "2026-11-04"
   ],
   "note": null
  },
  {
   "value": "e505d4ffa21cf494a5dc2d7c8f4f1236",
   "type": "md5",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-07",
   "last_seen": "2026-11-07",
   "expires_at": "2027-05-06",
   "ttl_days": 180,
   "sightings": 1,
   "campaign": null,
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 07/11, rubrique « Détection, recherche et veille »",
   "ecosystem": null,
   "version": null,
   "source": "QiAnXin XLab",
   "source_url": "https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/",
   "editions": [
    "2026-11-07"
   ],
   "note": null
  },
  {
   "value": "33d60d42472a83d0d2cf4ee6640c615313c29b18ce1e8ab06e41f4bba558a34b",
   "type": "sha256",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-02",
   "last_seen": "2026-11-02",
   "expires_at": "2027-05-01",
   "ttl_days": 180,
   "sightings": 1,
   "campaign": null,
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 02/11, rubrique « Underground et signaux faibles »",
   "ecosystem": null,
   "version": null,
   "source": "vx-underground",
   "source_url": "https://t.me/vxunderground/9541",
   "editions": [
    "2026-11-02"
   ],
   "note": null
  },
  {
   "value": "57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279",
   "type": "sha256",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-01",
   "last_seen": "2026-11-01",
   "expires_at": "2027-04-30",
   "ttl_days": 180,
   "sightings": 1,
   "campaign": "VOLTA : un infostealer qui confie à un LLM le tri de ses victimes",
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 01/11, rubrique « Supply chain, développeurs et IA » : VOLTA : un infostealer qui confie à un LLM le tri de ses victimes",
   "ecosystem": null,
   "version": null,
   "source": "Cisco Talos",
   "source_url": "https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/",
   "editions": [
    "2026-11-01"
   ],
   "note": null
  },
  {
   "value": "c9dab995cf61a066db149c8d5d4ce171fb9d20d246994a1fa4f27a5885088bbb",
   "type": "sha256",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-01",
   "last_seen": "2026-11-01",
   "expires_at": "2027-04-30",
   "ttl_days": 180,
   "sightings": 1,
   "campaign": null,
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 01/11, rubrique « Détection, recherche et veille »",
   "ecosystem": null,
   "version": null,
   "source": "OpenSourceMalware",
   "source_url": "https://opensourcemalware.com/blog/polinrider-malware-found-in-2025-npm-packages",
   "editions": [
    "2026-11-01"
   ],
   "note": null
  },
  {
   "value": "ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15",
   "type": "sha256",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": true,
   "first_seen": "2026-10-31",
   "last_seen": "2026-11-06",
   "expires_at": "2027-05-05",
   "ttl_days": 180,
   "sightings": 3,
   "campaign": null,
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 06/11, rubrique « Détection, recherche et veille »",
   "ecosystem": null,
   "version": null,
   "source": "OpenSourceMalware",
   "source_url": "https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor",
   "editions": [
    "2026-10-31",
    "2026-11-01",
    "2026-11-06"
   ],
   "note": null
  },
  {
   "value": "fe4a5658080a612fde27044a68957d68c59fae3ca1bff42037da20c6d906acd1",
   "type": "sha256",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-02",
   "last_seen": "2026-11-04",
   "expires_at": "2027-05-03",
   "ttl_days": 180,
   "sightings": 2,
   "campaign": null,
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 04/11, rubrique « Underground et signaux faibles »",
   "ecosystem": null,
   "version": null,
   "source": "vx-underground",
   "source_url": "https://t.me/vxunderground/9555",
   "editions": [
    "2026-11-02",
    "2026-11-04"
   ],
   "note": null
  },
  {
   "value": "http://134.209.82.225:8099/beacon",
   "type": "url",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-01",
   "last_seen": "2026-11-06",
   "expires_at": "2026-11-20",
   "ttl_days": 14,
   "sightings": 2,
   "campaign": null,
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 06/11, rubrique « Détection, recherche et veille »",
   "ecosystem": null,
   "version": null,
   "source": "OpenSourceMalware",
   "source_url": "https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor",
   "editions": [
    "2026-11-01",
    "2026-11-06"
   ],
   "note": null
  },
  {
   "value": "http://136.0.141.71/static/cwpsrv_update.sh",
   "type": "url",
   "action": "hunt",
   "confidence": "medium",
   "corroborated": false,
   "first_seen": "2026-11-07",
   "last_seen": "2026-11-07",
   "expires_at": "2026-11-21",
   "ttl_days": 14,
   "sightings": 1,
   "campaign": null,
   "actor": null,
   "malware": null,
   "context": "Relevé dans l'édition du 07/11, rubrique « Détection, recherche et veille »",
   "ecosystem": null,
   "version": null,
   "source": "QiAnXin XLab",
   "source_url": "https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/",
   "editions": [
    "2026-11-07"
   ],
   "note": null
  }
 ]
}