[{"indicator": "CVE-2016-6210", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-07", "lastSeen": "2026-11-07", "expiration": "2027-02-05", "campaign": "SSHole (CVE-2026-123158) : OpenSSH sur musl accepte n'importe quel mot de passe long pour les comptes verrouillés", "actor": null, "malware": null, "source": "CERT-FR", "sourceUrl": "https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-015/", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2024-27834", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-05", "lastSeen": "2026-11-07", "expiration": "2027-02-05", "campaign": "Apple iOS, macOS, Safari", "actor": null, "malware": null, "source": "CISA KEV", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2025-27038", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-06", "lastSeen": "2026-11-06", "expiration": "2027-02-04", "campaign": "APT29 « Poisoned Source » : watering holes et supply chain Plerdy vers des chaînes N-day iOS et Android", "actor": null, "malware": null, "source": "Sekoia", "sourceUrl": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2025-8088", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-04", "lastSeen": "2026-11-04", "expiration": "2027-02-02", "campaign": "Gorbag (ESET) : groupe aligné sur la Russie, WinRAR CVE-2025-8088 et BeautyStealer contre l'Ukraine", "actor": null, "malware": null, "source": "ESET WeLiveSecurity", "sourceUrl": "https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-0257", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-01", "lastSeen": "2026-11-01", "expiration": "2027-01-30", "campaign": "The Gentlemen publie environ 50 victimes d'un coup, dont l'INED", "actor": null, "malware": null, "source": "ransomware.live (The Gentlemen)", "sourceUrl": "https://www.ransomware.live/group/Thegentlemen", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-101767", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-01", "lastSeen": "2026-11-01", "expiration": "2027-01-30", "campaign": "Brotli « Node2Shell » (CVE-2026-111497) et Oracle EBS CVE-2026-101767 : rappels exploités", "actor": null, "malware": null, "source": "BleepingComputer", "sourceUrl": "https://bleepingcomputer.com/news/security/cisa-warns-of-hackers-now-exploiting-critical-node2shell-flaw", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-102764", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-02", "lastSeen": "2026-11-02", "expiration": "2027-01-31", "campaign": "Cisco ASA/FTD, Drupal Commerce Core et BeyondTrust Remote Support exploités", "actor": null, "malware": null, "source": "Cisco", "sourceUrl": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-102785", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-10-31", "lastSeen": "2026-10-31", "expiration": "2027-01-29", "campaign": "Web : Drupal Commerce exploité, WordPress Core RCE ciblée, YOOtheme Pro CVSS 10", "actor": null, "malware": null, "source": "The Hacker News", "sourceUrl": "https://thehackernews.com/2026/10/hackers-actively-exploit-highly.html", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-104935", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-10-31", "lastSeen": "2026-11-07", "expiration": "2027-02-05", "campaign": "Ivanti Connect Secure : la chaîne de zero-days d'UTA0576 reste la priorité (rappel)", "actor": null, "malware": null, "source": "CERT-FR", "sourceUrl": "https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-013/", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-107441", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-06", "lastSeen": "2026-11-07", "expiration": "2027-02-05", "campaign": "Zyxel GS1900 : zero-day CVE-2026-107441 exploité, le correctif de CVE-2026-7273 était inopérant", "actor": null, "malware": null, "source": "avis Zyxel", "sourceUrl": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-108142", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-05", "lastSeen": "2026-11-05", "expiration": "2027-02-03", "campaign": null, "actor": null, "malware": null, "source": "CERT-FR", "sourceUrl": "https://cert.cyber.gouv.fr/actualite/CERTFR-2026-ACT-046/", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-109518", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-05", "lastSeen": "2026-11-06", "expiration": "2027-02-04", "campaign": "Linux : RCE TCP du noyau CVE-2026-98432 et substitution de paquets APT", "actor": null, "malware": null, "source": "IT-Connect", "sourceUrl": "https://www.it-connect.fr/faille-apt-cve-2026-109518-debian-ubuntu-root/", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-109593", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-06", "lastSeen": "2026-11-06", "expiration": "2027-02-04", "campaign": "Cisco, WatchGuard, SonicWall : correctifs du 5 novembre et GMS abandonné", "actor": null, "malware": null, "source": "SecurityWeek", "sourceUrl": "https://www.securityweek.com/cisco-watchguard-release-patches-sonicwall-wont-fix-gms-flaws/", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-109594", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-06", "lastSeen": "2026-11-06", "expiration": "2027-02-04", "campaign": "Cisco, WatchGuard, SonicWall : correctifs du 5 novembre et GMS abandonné", "actor": null, "malware": null, "source": "SecurityWeek", "sourceUrl": "https://www.securityweek.com/cisco-watchguard-release-patches-sonicwall-wont-fix-gms-flaws/", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-109618", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-10-31", "lastSeen": "2026-11-07", "expiration": "2027-02-05", "campaign": "Rappel : PHP2Shell (CVE-2026-109618/109619), règles Sigma CISA et Elastic, chaîne PAN-OS documentée", "actor": null, "malware": null, "source": "CERT-FR", "sourceUrl": "https://cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1476/", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-109619", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-10-31", "lastSeen": "2026-11-02", "expiration": "2027-01-31", "campaign": "PHP2Shell : root sur pare-feu PAN-OS à management exposé, et nouvelle RCE PHP non corrigée", "actor": null, "malware": null, "source": "Unit 42", "sourceUrl": "https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-110186", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-03", "lastSeen": "2026-11-03", "expiration": "2027-02-01", "campaign": null, "actor": null, "malware": null, "source": "The Hacker News", "sourceUrl": "https://thehackernews.com/2026/11/critical-langflow-flaws-could-let.html", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-111357", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-10-31", "lastSeen": "2026-11-07", "expiration": "2027-02-05", "campaign": "Ivanti Connect Secure : la chaîne de zero-days d'UTA0576 reste la priorité (rappel)", "actor": null, "malware": null, "source": "CERT-FR", "sourceUrl": "https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-013/", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-111497", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-10-31", "lastSeen": "2026-11-07", "expiration": "2027-02-05", "campaign": "Cisco, WatchGuard, SonicWall : correctifs du 5 novembre et GMS abandonné", "actor": null, "malware": null, "source": "CERT-FR", "sourceUrl": "https://cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1474/", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-111560", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-04", "lastSeen": "2026-11-05", "expiration": "2027-02-03", "campaign": "Barracuda ESG : contournement d'authentification et injection de commandes, root à distance", "actor": null, "malware": null, "source": "Barracuda", "sourceUrl": "https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-111585", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-10-31", "lastSeen": "2026-11-02", "expiration": "2027-01-31", "campaign": null, "actor": null, "malware": null, "source": "CERT-FR", "sourceUrl": "https://cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1433/", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-115560", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-01", "lastSeen": "2026-11-05", "expiration": "2027-02-03", "campaign": "PHP2Shell : exploitation des interfaces de management PAN-OS, root via Fragnesia", "actor": null, "malware": null, "source": "CERT-FR", "sourceUrl": "https://cert.cyber.gouv.fr/actualite/CERTFR-2026-ACT-046/", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-116606", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-04", "lastSeen": "2026-11-05", "expiration": "2027-02-03", "campaign": "Barracuda ESG : contournement d'authentification et injection de commandes, root à distance", "actor": null, "malware": null, "source": "Barracuda", "sourceUrl": "https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-118527", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-10-31", "lastSeen": "2026-11-07", "expiration": "2027-02-05", "campaign": "Ivanti Connect Secure : la chaîne de zero-days d'UTA0576 reste la priorité (rappel)", "actor": null, "malware": null, "source": "CERT-FR", "sourceUrl": "https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-013/", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-118539", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-10-31", "lastSeen": "2026-11-03", "expiration": "2027-02-01", "campaign": "Cisco ASA/FTD, Drupal Commerce Core et BeyondTrust Remote Support exploités", "actor": null, "malware": null, "source": "Check Point Research", "sourceUrl": "https://research.checkpoint.com/2026/2nd-november-threat-intelligence-report/", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-118696", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-01", "lastSeen": "2026-11-01", "expiration": "2027-01-30", "campaign": null, "actor": null, "malware": null, "source": "SecurityOnline", "sourceUrl": "https://securityonline.info/jetbrains-ide-vulnerabilities-emudhra-certificates-patched/", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-119977", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-01", "lastSeen": "2026-11-07", "expiration": "2027-02-05", "campaign": "WordPress core : la mise à jour corrective ouvre elle-même la fenêtre d'exploitation (CVE-2026-119977, rappel KEV)", "actor": null, "malware": null, "source": "The Hacker News", "sourceUrl": "https://thehackernews.com/2026/11/installing-fix-for-exploited-wordpress.html", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-120422", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-05", "lastSeen": "2026-11-05", "expiration": "2027-02-03", "campaign": "SlippyNunchucks (ESET) : détournement DNS de Sogou Input pour livrer DarkVigil", "actor": null, "malware": null, "source": "ESET WeLiveSecurity", "sourceUrl": "https://www.welivesecurity.com/en/eset-research/slippynunchucks-hijacks-sogou-input-methods-brand-promotion-mechanism-to-distribute-malware/", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-123158", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-06", "lastSeen": "2026-11-07", "expiration": "2027-02-05", "campaign": "SSHole (CVE-2026-123158) : OpenSSH sur musl accepte n'importe quel mot de passe long pour les comptes verrouillés", "actor": null, "malware": null, "source": "CERT-FR", "sourceUrl": "https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-015/", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-13639", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-04", "lastSeen": "2026-11-04", "expiration": "2027-02-02", "campaign": null, "actor": null, "malware": null, "source": "The Hacker News", "sourceUrl": "https://thehackernews.com/2026/11/synology-nas-devices-targeted-in.html", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-14269", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-02", "lastSeen": "2026-11-06", "expiration": "2027-02-04", "campaign": null, "actor": null, "malware": null, "source": "IT-Connect", "sourceUrl": "https://www.it-connect.fr/faille-apt-cve-2026-109518-debian-ubuntu-root/", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-14502", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-02", "lastSeen": "2026-11-02", "expiration": "2027-01-31", "campaign": null, "actor": null, "malware": null, "source": "CERT-FR", "sourceUrl": "https://cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1433/", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-14999", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-03", "lastSeen": "2026-11-03", "expiration": "2027-02-01", "campaign": null, "actor": null, "malware": null, "source": "Check Point Research", "sourceUrl": "https://research.checkpoint.com/2026/2nd-november-threat-intelligence-report/", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-19868", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-07", "lastSeen": "2026-11-07", "expiration": "2027-02-05", "campaign": "SonicWall SonicOS SSL-VPN : contournement SAML et MFA exploité (CVE-2026-19868), KEV le 6 novembre", "actor": null, "malware": null, "source": "BleepingComputer", "sourceUrl": "https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks/", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-3910", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-06", "lastSeen": "2026-11-06", "expiration": "2027-02-04", "campaign": "APT29 « Poisoned Source » : watering holes et supply chain Plerdy vers des chaînes N-day iOS et Android", "actor": null, "malware": null, "source": "Sekoia", "sourceUrl": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-40217", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-04", "lastSeen": "2026-11-07", "expiration": "2027-02-05", "campaign": "LLMjacking : GTIG détaille UNC6993 et un « LLM Mixer » à 1 M$ de tokens par victime", "actor": null, "malware": null, "source": "Google Threat Intelligence", "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-41709", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-10-31", "lastSeen": "2026-11-04", "expiration": "2027-02-02", "campaign": "VMware ESX", "actor": null, "malware": null, "source": "CISA KEV", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-46300", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-10-31", "lastSeen": "2026-11-04", "expiration": "2027-02-02", "campaign": "Rappel : PHP2Shell (CVE-2026-109618/109619), règles Sigma CISA et Elastic, chaîne PAN-OS documentée", "actor": null, "malware": null, "source": "Unit 42", "sourceUrl": "https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-48356", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-10-31", "lastSeen": "2026-11-03", "expiration": "2027-02-01", "campaign": "Adobe Commerce / Magento (upload, RCE)", "actor": null, "malware": null, "source": "CISA KEV", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-53595", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-01", "lastSeen": "2026-11-01", "expiration": "2027-01-30", "campaign": "Nouvelles exploitations relevées le 31/10 : Siemens IoT2050, FreeScout, WordPress core", "actor": null, "malware": null, "source": "Exploit Bulletin", "sourceUrl": "https://buttondown.com/exploit-bulletin/archive/the-exploit-bulletin-saturday-october-31-2026-6/", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-58115", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-01", "lastSeen": "2026-11-05", "expiration": "2027-02-03", "campaign": "Node-RED CVE-2026-58115 : RCE non authentifiée exploitée pour déployer un bot Linux", "actor": null, "malware": null, "source": "SANS ISC", "sourceUrl": "https://isc.sans.edu/podcastdetail/10164", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-7273", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-06", "lastSeen": "2026-11-06", "expiration": "2027-02-04", "campaign": "Zyxel GS1900 : zero-day CVE-2026-107441 exploité, le correctif de CVE-2026-7273 était inopérant", "actor": null, "malware": null, "source": "SecurityWeek", "sourceUrl": "https://www.securityweek.com/zyxel-switch-hacks-blamed-on-patched-flaw-actually-exploited-a-zero-day/", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-76418", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-10-31", "lastSeen": "2026-11-05", "expiration": "2027-02-03", "campaign": "Cisco ASA / FTD", "actor": null, "malware": null, "source": "CISA KEV", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-76506", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-06", "lastSeen": "2026-11-06", "expiration": "2027-02-04", "campaign": "Cisco, WatchGuard, SonicWall : correctifs du 5 novembre et GMS abandonné", "actor": null, "malware": null, "source": "SecurityWeek", "sourceUrl": "https://www.securityweek.com/cisco-watchguard-release-patches-sonicwall-wont-fix-gms-flaws/", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-85706", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-01", "lastSeen": "2026-11-01", "expiration": "2027-01-30", "campaign": "GitLab CVE-2026-97229 (CVSS 10) : due date KEV aujourd'hui, PoC public", "actor": null, "malware": null, "source": "rapid7.com", "sourceUrl": "https://www.rapid7.com/blog/post/etr-cve-2026-97229-critical-unauthenticated-remote-code-execution-in-gitlab", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-93680", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-03", "lastSeen": "2026-11-03", "expiration": "2027-02-01", "campaign": null, "actor": null, "malware": null, "source": "The Hacker News", "sourceUrl": "https://thehackernews.com/2026/11/critical-langflow-flaws-could-let.html", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-96652", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-11-07", "lastSeen": "2026-11-07", "expiration": "2027-02-05", "campaign": "QNAP confirme des NAS compromis via Plex2Shell (Plex Media Server, quatre CVE au KEV)", "actor": null, "malware": null, "source": "BleepingComputer", "sourceUrl": "https://www.bleepingcomputer.com/news/security/qnap-says-hackers-breaching-nas-devices-in-plex2shell-attacks/", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-97229", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-10-31", "lastSeen": "2026-11-05", "expiration": "2027-02-03", "campaign": "GitLab CE/EE CVE-2026-97229 : RCE via regex CI/CD, plus de 1 000 serveurs exposés", "actor": null, "malware": null, "source": "Release GitLab", "sourceUrl": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/", "tags": ["info", "medium", "cve"]}, {"indicator": "CVE-2026-98432", "type": "CVE", "action": "info", "score": 2, "firstSeen": "2026-10-31", "lastSeen": "2026-11-06", "expiration": "2027-02-04", "campaign": "Cisco, WatchGuard, SonicWall : correctifs du 5 novembre et GMS abandonné", "actor": null, "malware": null, "source": "SecurityWeek", "sourceUrl": "https://www.securityweek.com/cisco-watchguard-release-patches-sonicwall-wont-fix-gms-flaws/", "tags": ["info", "medium", "cve"]}, {"indicator": "a.plerdy.com", "type": "Domain", "action": "hunt", "score": 2, "firstSeen": "2026-11-05", "lastSeen": "2026-11-06", "expiration": "2026-12-06", "campaign": "APT29 « Poisoned Source » : watering holes et supply chain Plerdy vers des chaînes N-day iOS et Android", "actor": null, "malware": null, "source": "Sekoia", "sourceUrl": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "tags": ["hunt", "medium", "domain"]}, {"indicator": "ad-track.live", "type": "Domain", "action": "hunt", "score": 2, "firstSeen": "2026-11-05", "lastSeen": "2026-11-06", "expiration": "2026-12-06", "campaign": "APT29 « Poisoned Source » : watering holes et supply chain Plerdy vers des chaînes N-day iOS et Android", "actor": null, "malware": null, "source": "Sekoia", "sourceUrl": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "tags": ["hunt", "medium", "domain"]}, {"indicator": "ad.starx-net.com", "type": "Domain", "action": "hunt", "score": 2, "firstSeen": "2026-11-05", "lastSeen": "2026-11-06", "expiration": "2026-12-06", "campaign": "APT29 « Poisoned Source » : watering holes et supply chain Plerdy vers des chaînes N-day iOS et Android", "actor": null, "malware": null, "source": "Sekoia", "sourceUrl": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "tags": ["hunt", "medium", "domain"]}, {"indicator": "america250.holiday", "type": "Domain", "action": "hunt", "score": 2, "firstSeen": "2026-11-05", "lastSeen": "2026-11-06", "expiration": "2026-12-06", "campaign": "APT29 « Poisoned Source » : watering holes et supply chain Plerdy vers des chaînes N-day iOS et Android", "actor": null, "malware": null, "source": "Sekoia", "sourceUrl": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits", "tags": ["hunt", "medium", "domain"]}, {"indicator": "anyevonline.com", "type": "Domain", "action": "hunt", "score": 2, "firstSeen": "2026-11-03", "lastSeen": "2026-11-03", "expiration": "2026-12-03", "campaign": "GTIG : démantèlement du botnet XCPE, backdoor firmware dans 1,3 million d'Android TV", "actor": null, "malware": null, "source": "Google Threat Intelligence", "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet", "tags": ["hunt", "medium", "domain"]}, {"indicator": "config.pinyin.sogou.com", "type": "Domain", "action": "hunt", "score": 2, "firstSeen": "2026-11-05", "lastSeen": "2026-11-05", "expiration": "2026-12-05", "campaign": null, "actor": null, "malware": null, "source": "ESET WeLiveSecurity", "sourceUrl": "https://www.welivesecurity.com/en/eset-research/slippynunchucks-hijacks-sogou-input-methods-brand-promotion-mechanism-to-distribute-malware/", "tags": ["hunt", "medium", "domain"]}, {"indicator": "estrosa.it", "type": "Domain", "action": "hunt", "score": 2, "firstSeen": "2026-11-02", "lastSeen": "2026-11-02", "expiration": "2026-12-02", "campaign": null, "actor": null, "malware": null, "source": "vx-underground", "sourceUrl": "https://t.me/vxunderground/9541", "tags": ["hunt", "medium", "domain"]}, {"indicator": "herlittlebit.com", "type": "Domain", "action": "hunt", "score": 2, "firstSeen": "2026-11-01", "lastSeen": "2026-11-06", "expiration": "2026-12-06", "campaign": null, "actor": null, "malware": null, "source": "vx-underground", "sourceUrl": "https://t.me/vxunderground/9558", "tags": ["hunt", "medium", "domain"]}, {"indicator": "newapi.pro", "type": "Domain", "action": "hunt", "score": 2, "firstSeen": "2026-11-04", "lastSeen": "2026-11-04", "expiration": "2026-12-04", "campaign": "LLMjacking : GTIG détaille UNC6993 et un « LLM Mixer » à 1 M$ de tokens par victime", "actor": null, "malware": null, "source": "Google Threat Intelligence", "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models", "tags": ["hunt", "medium", "domain"]}, {"indicator": "openaigpt4v.com", "type": "Domain", "action": "hunt", "score": 2, "firstSeen": "2026-11-01", "lastSeen": "2026-11-01", "expiration": "2026-12-01", "campaign": null, "actor": null, "malware": null, "source": "Kaspersky Securelist", "sourceUrl": "https://securelist.com/netamloader/121676/", "tags": ["hunt", "medium", "domain"]}, {"indicator": "qmlab1.com", "type": "Domain", "action": "hunt", "score": 2, "firstSeen": "2026-11-02", "lastSeen": "2026-11-02", "expiration": "2026-12-02", "campaign": null, "actor": null, "malware": null, "source": "vx-underground", "sourceUrl": "https://t.me/vxunderground/9544", "tags": ["hunt", "medium", "domain"]}, {"indicator": "sogou-cdn.com", "type": "Domain", "action": "hunt", "score": 2, "firstSeen": "2026-11-05", "lastSeen": "2026-11-05", "expiration": "2026-12-05", "campaign": null, "actor": null, "malware": null, "source": "ESET WeLiveSecurity", "sourceUrl": "https://www.welivesecurity.com/en/eset-research/slippynunchucks-hijacks-sogou-input-methods-brand-promotion-mechanism-to-distribute-malware/", "tags": ["hunt", "medium", "domain"]}, {"indicator": "szbboys.com", "type": "Domain", "action": "hunt", "score": 2, "firstSeen": "2026-11-03", "lastSeen": "2026-11-03", "expiration": "2026-12-03", "campaign": "GTIG : démantèlement du botnet XCPE, backdoor firmware dans 1,3 million d'Android TV", "actor": null, "malware": null, "source": "Google Threat Intelligence", "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet", "tags": ["hunt", "medium", "domain"]}, {"indicator": "zz.aiapi2025.top", "type": "Domain", "action": "hunt", "score": 2, "firstSeen": "2026-11-05", "lastSeen": "2026-11-05", "expiration": "2026-12-05", "campaign": null, "actor": null, "malware": null, "source": "Check Point Research", "sourceUrl": "https://research.checkpoint.com/2026/free-the-model-sell-the-gateway-prompt-adware-hidden-in-jailbreak-bundles/", "tags": ["hunt", "medium", "domain"]}, {"indicator": "103.122.245.194", "type": "IP", "action": "hunt", "score": 2, "firstSeen": "2026-11-07", "lastSeen": "2026-11-07", "expiration": "2026-11-14", "campaign": null, "actor": null, "malware": null, "source": "BleepingComputer", "sourceUrl": "https://www.bleepingcomputer.com/news/security/chainalysis-says-breach-exposed-credentials-for-all-customers/", "tags": ["hunt", "medium", "ipv4"]}, {"indicator": "103.122.245.198", "type": "IP", "action": "hunt", "score": 2, "firstSeen": "2026-11-07", "lastSeen": "2026-11-07", "expiration": "2026-11-14", "campaign": null, "actor": null, "malware": null, "source": "BleepingComputer", "sourceUrl": "https://www.bleepingcomputer.com/news/security/chainalysis-says-breach-exposed-credentials-for-all-customers/", "tags": ["hunt", "medium", "ipv4"]}, {"indicator": "104.168.112.237", "type": "IP", "action": "hunt", "score": 2, "firstSeen": "2026-11-07", "lastSeen": "2026-11-07", "expiration": "2026-11-14", "campaign": null, "actor": null, "malware": null, "source": "BleepingComputer", "sourceUrl": "https://www.bleepingcomputer.com/news/security/chainalysis-says-breach-exposed-credentials-for-all-customers/", "tags": ["hunt", "medium", "ipv4"]}, {"indicator": "108.165.147.64", "type": "IP", "action": "hunt", "score": 2, "firstSeen": "2026-11-01", "lastSeen": "2026-11-03", "expiration": "2026-11-10", "campaign": "Ivanti Connect Secure : chaîne de trois zero-days, UTA0576 sans webshell", "actor": null, "malware": null, "source": "CERT-FR", "sourceUrl": "https://cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1442/", "tags": ["hunt", "medium", "ipv4"]}, {"indicator": "134.209.82.225", "type": "IP", "action": "hunt", "score": 2, "firstSeen": "2026-10-31", "lastSeen": "2026-11-06", "expiration": "2026-11-13", "campaign": "Extension Claude Code trojanisée dans le miroir Open VSX de Cursor : backdoor SSH persistante (rappel, podcast OSM du jour)", "actor": null, "malware": null, "source": "OpenSourceMalware", "sourceUrl": "https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor", "tags": ["hunt", "medium", "ipv4"]}, {"indicator": "136.0.141.71", "type": "IP", "action": "hunt", "score": 2, "firstSeen": "2026-11-07", "lastSeen": "2026-11-07", "expiration": "2026-11-14", "campaign": "CWPdoor : un cwpsrv trojanisé transforme Control Web Panel en backdoor passive", "actor": null, "malware": null, "source": "QiAnXin XLab", "sourceUrl": "https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/", "tags": ["hunt", "medium", "ipv4"]}, {"indicator": "142.111.194.73", "type": "IP", "action": "hunt", "score": 2, "firstSeen": "2026-11-04", "lastSeen": "2026-11-04", "expiration": "2026-11-11", "campaign": "Gorbag (ESET) : groupe aligné sur la Russie, WinRAR CVE-2025-8088 et BeautyStealer contre l'Ukraine", "actor": null, "malware": null, "source": "ESET WeLiveSecurity", "sourceUrl": "https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/", "tags": ["hunt", "medium", "ipv4"]}, {"indicator": "154.91.0.103", "type": "IP", "action": "hunt", "score": 2, "firstSeen": "2026-11-02", "lastSeen": "2026-11-02", "expiration": "2026-11-09", "campaign": "PolinRider (Corée du Nord) remonte à 2025 : paquets npm itsa-* détournés", "actor": null, "malware": null, "source": "OpenSourceMalware", "sourceUrl": "https://opensourcemalware.com/blog/polinrider-malware-found-in-2025-npm-packages", "tags": ["hunt", "medium", "ipv4"]}, {"indicator": "157.22.126.128", "type": "IP", "action": "hunt", "score": 2, "firstSeen": "2026-11-06", "lastSeen": "2026-11-06", "expiration": "2026-11-13", "campaign": "Microsoft : des agents IA offensifs passent d'un secret GitHub à Key Vault en cinq minutes", "actor": null, "malware": null, "source": "Microsoft Threat Intelligence", "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/", "tags": ["hunt", "medium", "ipv4"]}, {"indicator": "192.236.172.197", "type": "IP", "action": "hunt", "score": 2, "firstSeen": "2026-11-07", "lastSeen": "2026-11-07", "expiration": "2026-11-14", "campaign": null, "actor": null, "malware": null, "source": "BleepingComputer", "sourceUrl": "https://www.bleepingcomputer.com/news/security/chainalysis-says-breach-exposed-credentials-for-all-customers/", "tags": ["hunt", "medium", "ipv4"]}, {"indicator": "198.44.123.66", "type": "IP", "action": "hunt", "score": 2, "firstSeen": "2026-11-07", "lastSeen": "2026-11-07", "expiration": "2026-11-14", "campaign": null, "actor": null, "malware": null, "source": "BleepingComputer", "sourceUrl": "https://www.bleepingcomputer.com/news/security/chainalysis-says-breach-exposed-credentials-for-all-customers/", "tags": ["hunt", "medium", "ipv4"]}, {"indicator": "199.19.77.18", "type": "IP", "action": "hunt", "score": 2, "firstSeen": "2026-11-06", "lastSeen": "2026-11-06", "expiration": "2026-11-13", "campaign": "Microsoft : des agents IA offensifs passent d'un secret GitHub à Key Vault en cinq minutes", "actor": null, "malware": null, "source": "Microsoft Threat Intelligence", "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/", "tags": ["hunt", "medium", "ipv4"]}, {"indicator": "199.19.77.84", "type": "IP", "action": "hunt", "score": 2, "firstSeen": "2026-11-06", "lastSeen": "2026-11-06", "expiration": "2026-11-13", "campaign": "Microsoft : des agents IA offensifs passent d'un secret GitHub à Key Vault en cinq minutes", "actor": null, "malware": null, "source": "Microsoft Threat Intelligence", "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/", "tags": ["hunt", "medium", "ipv4"]}, {"indicator": "204.44.66.81", "type": "IP", "action": "hunt", "score": 2, "firstSeen": "2026-11-07", "lastSeen": "2026-11-07", "expiration": "2026-11-14", "campaign": null, "actor": null, "malware": null, "source": "BleepingComputer", "sourceUrl": "https://www.bleepingcomputer.com/news/security/chainalysis-says-breach-exposed-credentials-for-all-customers/", "tags": ["hunt", "medium", "ipv4"]}, {"indicator": "219.134.163.210", "type": "IP", "action": "hunt", "score": 2, "firstSeen": "2026-11-03", "lastSeen": "2026-11-03", "expiration": "2026-11-10", "campaign": "GTIG : démantèlement du botnet XCPE, backdoor firmware dans 1,3 million d'Android TV", "actor": null, "malware": null, "source": "Google Threat Intelligence", "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet", "tags": ["hunt", "medium", "ipv4"]}, {"indicator": "45.194.90.57", "type": "IP", "action": "hunt", "score": 2, "firstSeen": "2026-11-03", "lastSeen": "2026-11-04", "expiration": "2026-11-11", "campaign": "Node-RED CVE-2026-58115 : RCE non authentifiée exploitée pour déployer un bot Linux", "actor": null, "malware": null, "source": "Help Net Security", "sourceUrl": "https://www.helpnetsecurity.com/2026/11/03/node-red-cve-2026-58115-exploitation/", "tags": ["hunt", "medium", "ipv4"]}, {"indicator": "47.237.122.175", "type": "IP", "action": "hunt", "score": 2, "firstSeen": "2026-11-05", "lastSeen": "2026-11-05", "expiration": "2026-11-12", "campaign": null, "actor": null, "malware": null, "source": "ESET WeLiveSecurity", "sourceUrl": "https://www.welivesecurity.com/en/eset-research/slippynunchucks-hijacks-sogou-input-methods-brand-promotion-mechanism-to-distribute-malware/", "tags": ["hunt", "medium", "ipv4"]}, {"indicator": "47.239.250.102", "type": "IP", "action": "hunt", "score": 2, "firstSeen": "2026-11-05", "lastSeen": "2026-11-05", "expiration": "2026-11-12", "campaign": null, "actor": null, "malware": null, "source": "ESET WeLiveSecurity", "sourceUrl": "https://www.welivesecurity.com/en/eset-research/slippynunchucks-hijacks-sogou-input-methods-brand-promotion-mechanism-to-distribute-malware/", "tags": ["hunt", "medium", "ipv4"]}, {"indicator": "52.74.54.75", "type": "IP", "action": "hunt", "score": 2, "firstSeen": "2026-11-01", "lastSeen": "2026-11-06", "expiration": "2026-11-13", "campaign": null, "actor": null, "malware": null, "source": "vx-underground", "sourceUrl": "https://t.me/vxunderground/9544", "tags": ["hunt", "medium", "ipv4"]}, {"indicator": "65.87.223.26", "type": "IP", "action": "hunt", "score": 2, "firstSeen": "2026-11-06", "lastSeen": "2026-11-06", "expiration": "2026-11-13", "campaign": "Microsoft : des agents IA offensifs passent d'un secret GitHub à Key Vault en cinq minutes", "actor": null, "malware": null, "source": "Microsoft Threat Intelligence", "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/", "tags": ["hunt", "medium", "ipv4"]}, {"indicator": "85.215.73.250", "type": "IP", "action": "hunt", "score": 2, "firstSeen": "2026-11-03", "lastSeen": "2026-11-04", "expiration": "2026-11-11", "campaign": "Node-RED CVE-2026-58115 : RCE non authentifiée exploitée pour déployer un bot Linux", "actor": null, "malware": null, "source": "Help Net Security", "sourceUrl": "https://www.helpnetsecurity.com/2026/11/03/node-red-cve-2026-58115-exploitation/", "tags": ["hunt", "medium", "ipv4"]}, {"indicator": "85.239.62.36", "type": "IP", "action": "hunt", "score": 2, "firstSeen": "2026-11-02", "lastSeen": "2026-11-02", "expiration": "2026-11-09", "campaign": "PolinRider (Corée du Nord) remonte à 2025 : paquets npm itsa-* détournés", "actor": null, "malware": null, "source": "OpenSourceMalware", "sourceUrl": "https://opensourcemalware.com/blog/polinrider-malware-found-in-2025-npm-packages", "tags": ["hunt", "medium", "ipv4"]}, {"indicator": "89.116.89.18", "type": "IP", "action": "hunt", "score": 2, "firstSeen": "2026-11-07", "lastSeen": "2026-11-07", "expiration": "2026-11-14", "campaign": "SSHole (CVE-2026-123158) : OpenSSH sur musl accepte n'importe quel mot de passe long pour les comptes verrouillés", "actor": null, "malware": null, "source": "CERT-FR", "sourceUrl": "https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-015/", "tags": ["hunt", "medium", "ipv4"]}, {"indicator": "89.44.9.186", "type": "IP", "action": "hunt", "score": 2, "firstSeen": "2026-11-04", "lastSeen": "2026-11-04", "expiration": "2026-11-11", "campaign": "Gorbag (ESET) : groupe aligné sur la Russie, WinRAR CVE-2025-8088 et BeautyStealer contre l'Ukraine", "actor": null, "malware": null, "source": "ESET WeLiveSecurity", "sourceUrl": "https://www.welivesecurity.com/en/eset-research/gorbag-orcs-border-harvesting-intelligence-ukraine/", "tags": ["hunt", "medium", "ipv4"]}, {"indicator": "e505d4ffa21cf494a5dc2d7c8f4f1236", "type": "File", "action": "hunt", "score": 2, "firstSeen": "2026-11-07", "lastSeen": "2026-11-07", "expiration": "2027-05-06", "campaign": null, "actor": null, "malware": null, "source": "QiAnXin XLab", "sourceUrl": "https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/", "tags": ["hunt", "medium", "md5"]}, {"indicator": "33d60d42472a83d0d2cf4ee6640c615313c29b18ce1e8ab06e41f4bba558a34b", "type": "File", "action": "hunt", "score": 2, "firstSeen": "2026-11-02", "lastSeen": "2026-11-02", "expiration": "2027-05-01", "campaign": null, "actor": null, "malware": null, "source": "vx-underground", "sourceUrl": "https://t.me/vxunderground/9541", "tags": ["hunt", "medium", "sha256"]}, {"indicator": "57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279", "type": "File", "action": "hunt", "score": 2, "firstSeen": "2026-11-01", "lastSeen": "2026-11-01", "expiration": "2027-04-30", "campaign": "VOLTA : un infostealer qui confie à un LLM le tri de ses victimes", "actor": null, "malware": null, "source": "Cisco Talos", "sourceUrl": "https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/", "tags": ["hunt", "medium", "sha256"]}, {"indicator": "c9dab995cf61a066db149c8d5d4ce171fb9d20d246994a1fa4f27a5885088bbb", "type": "File", "action": "hunt", "score": 2, "firstSeen": "2026-11-01", "lastSeen": "2026-11-01", "expiration": "2027-04-30", "campaign": null, "actor": null, "malware": null, "source": "OpenSourceMalware", "sourceUrl": "https://opensourcemalware.com/blog/polinrider-malware-found-in-2025-npm-packages", "tags": ["hunt", "medium", "sha256"]}, {"indicator": "ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15", "type": "File", "action": "hunt", "score": 2, "firstSeen": "2026-10-31", "lastSeen": "2026-11-06", "expiration": "2027-05-05", "campaign": null, "actor": null, "malware": null, "source": "OpenSourceMalware", "sourceUrl": "https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor", "tags": ["hunt", "medium", "sha256"]}, {"indicator": "fe4a5658080a612fde27044a68957d68c59fae3ca1bff42037da20c6d906acd1", "type": "File", "action": "hunt", "score": 2, "firstSeen": "2026-11-02", "lastSeen": "2026-11-04", "expiration": "2027-05-03", "campaign": null, "actor": null, "malware": null, "source": "vx-underground", "sourceUrl": "https://t.me/vxunderground/9555", "tags": ["hunt", "medium", "sha256"]}, {"indicator": "http://134.209.82.225:8099/beacon", "type": "URL", "action": "hunt", "score": 2, "firstSeen": "2026-11-01", "lastSeen": "2026-11-06", "expiration": "2026-11-20", "campaign": null, "actor": null, "malware": null, "source": "OpenSourceMalware", "sourceUrl": "https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor", "tags": ["hunt", "medium", "url"]}, {"indicator": "http://136.0.141.71/static/cwpsrv_update.sh", "type": "URL", "action": "hunt", "score": 2, "firstSeen": "2026-11-07", "lastSeen": "2026-11-07", "expiration": "2026-11-21", "campaign": null, "actor": null, "malware": null, "source": "QiAnXin XLab", "sourceUrl": "https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/", "tags": ["hunt", "medium", "url"]}]