Last Week in Threats Banner

Last Week in Threats: Week 36

Published on September 7, 2026 | By Focused Hunts

Bottom Line

What changed this week: Ransomware leak-site postings dropped 20 percent week over week, driven by a 64 percent retreat in Qilin activity, while datacenter hosting infrastructure accounted for 83 percent of the week's most-reported malicious IPs.

Who is most exposed: Organizations running Chromium-based browsers, AI infrastructure (LiteLLM), and Python web frameworks (Starlette) face newly cataloged exploitation paths, with all three vulnerabilities added to CISA's Known Exploited Vulnerabilities catalog this week.

Recommended action: Patch CVE-2026-85046 (Chromium V8), CVE-2026-59822 (LiteLLM), and CVE-2026-48710 (Starlette) by their September 16-18 due dates, and hunt for anomalous outbound connections from developer tooling and AI platforms that could indicate unauthorized access or data exfiltration.

The Week in Review

The week of August 31 to September 6, 2026 delivered a sharp decline in ransomware volume and a datacenter-heavy malicious IP landscape. Ransomware leak-site postings fell to 166 victims (ransomware.live, pulled 2026-09-07), down from 207 the prior week, with the once-dominant Qilin group retreating from 42 postings to just 15. At the same time, the week's most-reported malicious IPs clustered in hosting and transit networks rather than residential broadband, with three ASNs (Constantine Cybersecurity/Driftnet, DigitalOcean, and Sprint) each contributing two of the week's top addresses.

CISA added three vulnerabilities to the Known Exploited Vulnerabilities catalog (CISA KEV, pulled 2026-09-07): a type confusion flaw in Chromium V8 (CVE-2026-85046), an authentication bypass in the AI framework LiteLLM (CVE-2026-59822), and an HTTP smuggling vulnerability in Starlette (CVE-2026-48710). ThreatFox reported 564 fresh high-confidence command-and-control IOCs over a two-day window (ThreatFox, pulled 2026-09-07), led by IClickFix, ClearFake, and VShell families. The combination of slowing ransomware activity and rising exploitation of developer and AI tooling suggests attackers are diversifying their initial access methods beyond perimeter appliances.

Ransomware Leak-Site Activity

Ransomware groups posted 166 claimed victims during the week of August 31 to September 6, 2026, down 20 percent from the prior week's 207 postings (ransomware.live, pulled 2026-09-07). Qilin and Krybit tied for the most postings at 15 each, followed by IncRansom (13), Akira (11), and TheGentlemen (nine). The United States accounted for 59 of the 166 postings, maintaining its position as the most-targeted geography.

Qilin's sharp decline from 42 postings the prior week to 15 this week represents a 64 percent drop and signals either operational disruption or a seasonal slowdown. Krybit held steady at 15 postings (up from 13 the prior week), while IncRansom surged to 13 postings after fluctuating between six and 13 over the preceding four weeks. The week also saw continued activity from LockBit5 (nine postings), DireWolf (nine), and several groups with eight postings each: BrainCipher, SilentRansomGroup, and Storm.

Most Active Groups by Victim Postings

Qilin 15 Krybit 15 IncRansom 13 Akira 11 TheGentlemen 9 LockBit5 9

Technology Watch

The week's newly exploited vulnerabilities targeted developer and AI infrastructure. CISA added three CVEs to its Known Exploited Vulnerabilities catalog (CISA KEV, pulled 2026-09-07): CVE-2026-85046 (Google Chromium V8 type confusion, added September 4, due September 18), CVE-2026-59822 (BerriAI LiteLLM improper authentication, added September 2, due September 16), and CVE-2026-48710 (Kludex Starlette HTTP smuggling, added September 2, due September 16).

Organizations running Chromium-based browsers (Chrome, Edge, Opera) face remote code execution risk from CVE-2026-85046, which allows an attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. The LiteLLM flaw permits unauthenticated MCP session establishment, exposing AI platforms to unauthorized access. The Starlette vulnerability enables HTTP request/response smuggling that could bypass authentication in Python web applications. If your environment includes developer tooling, AI frameworks, or Python web services, prioritize patching these three CVEs and hunt for anomalous outbound connections that could indicate exploitation.

Most-Reported Malicious IPs

AbuseIPDB's 100% confidence list was dominated by datacenter and hosting infrastructure this week, led by two addresses with 53,828 and 44,491 reports. GreyNoise Community classified all five of the top addresses it checked as malicious scanners. Each enriched address is listed below with its network owner.

Attacker Infrastructure & Networks

Of the 18 enriched addresses, 15 sat on datacenter or hosting networks, two on residential ISPs, and one on a business network, per AbuseIPDB usage type, with ownership from AlienVault OTX. The networks AS211298, AS14061, and AS1239 held two addresses each. None matched known malware command-and-control or payload hosting in abuse.ch ThreatFox and URLhaus.

Hosting Providers

  • AS1239 Sprint: 62.60.130.253, 62.60.130.242
  • AS30823 Combahton GmbH: 195.178.110.218
  • AS141892 CV Andhika Pratama Sanggoro: 103.186.31.66
  • AS19527 Google LLC: 35.210.61.208
  • AS211298 Constantine Cybersecurity Ltd.: 193.163.125.54, 193.163.125.99
  • AS58791 GMO Internet: 160.251.202.248
  • AS134176 Rainbow Network Limited: 43.240.14.35
  • AS49581 Bil-Tim Bilgisayar Hizmetleri: 80.91.223.114
  • AS139220 Sichuan Chuanxn IDC: 203.25.208.110
  • AS14061 DigitalOcean LLC: 67.205.146.133, 159.89.88.188
  • ASN not resolved, ISP wcd: 213.177.179.139
  • AS20940 Akamai International B.V.: 172.235.246.35

Residential Networks

  • AS7552 Viettel Group: 125.212.217.143
  • AS12874 Fastweb SpA: 93.51.116.48

Business Networks

  • AS138456 Oceanblue Cloud Technology Limited: 156.225.1.18

Exploited Vulnerability Watch

CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalog this week (CISA KEV, pulled 2026-09-07):

  • CVE-2026-85046 (Google Chromium V8, type confusion, added September 4, due September 18): allows remote arbitrary code execution inside the browser sandbox via a crafted HTML page. Affects Chrome, Edge, Opera, and other Chromium-based browsers.
  • CVE-2026-59822 (BerriAI LiteLLM, improper authentication, added September 2, due September 16): permits unauthenticated MCP session establishment via the Streamable HTTP endpoint, exposing AI platforms to unauthorized bearer token authentication.
  • CVE-2026-48710 (Kludex Starlette, HTTP request/response smuggling, added September 2, due September 16): allows attackers to inject paths into the host part, prepending the actual path and potentially bypassing authentication in Python web applications.

AlienVault OTX pulse activity indicates varying weaponization signals (AlienVault OTX, queried 2026-09-07): CVE-2026-85046 appeared in two pulses (though cross-referenced with a separate MikroTik CVE), CVE-2026-59822 appeared in four pulses focused on AI infrastructure honeypot telemetry, and CVE-2026-48710 appeared in 14 catalog-style pulses with no campaign-specific threat intelligence. All three CVEs warrant immediate patching per CISA's due dates, with special attention to environments running developer tooling, AI frameworks, or Python web services.

Malware & C2

ThreatFox reported 564 fresh high-confidence command-and-control IOCs over a two-day window ending September 7, 2026 (ThreatFox, pulled 2026-09-07). The top malware families by IOC volume were IClickFix (783 IOCs), ClearFake (449), Unknown Loader (130), VShell (129), and Unknown malware (127), followed by Vidar (73), PureRAT (66), Unknown Stealer (65), Cobalt Strike (59), and php.shin_webshell (59).

IClickFix and ClearFake are both browser-based social-engineering campaigns that trick users into executing malicious PowerShell or JavaScript code by mimicking legitimate browser prompts or CAPTCHAs. VShell is a lightweight web shell used for post-compromise persistence, while Vidar is an information stealer targeting credentials and cryptocurrency wallets. The presence of Cobalt Strike and multiple unnamed loaders signals that adversaries continue to favor modular, multi-stage payloads that complicate attribution and detection.

The high IOC count for browser-based delivery mechanisms (IClickFix, ClearFake) aligns with the Chromium V8 vulnerability (CVE-2026-85046) added to CISA KEV this week, suggesting attackers are actively exploiting browser weaknesses as an initial access vector. Defenders should prioritize patching Chromium-based browsers and hunting for anomalous script execution from user directories or web-cache paths.

The Hunting Takeaway

This week's exploitation of developer and AI tooling (LiteLLM, Starlette) and the surge in browser-based delivery mechanisms (IClickFix, ClearFake) point to a single behavioral hunting angle: anomalous outbound connections from trusted internal applications. When an attacker compromises a Python web service via CVE-2026-48710 or establishes an unauthenticated session in an AI platform via CVE-2026-59822, the next step is lateral movement or data exfiltration, both of which produce network connections from processes that normally only listen for inbound traffic or communicate with a narrow set of internal dependencies.

Hunt for outbound connections from developer tooling, AI frameworks, and Python web services to unexpected external destinations, especially to known hosting networks (DigitalOcean, Linode, Driftnet) or to IP addresses with no prior communication history. Focus on processes running under service accounts or application pools, and look for connections to non-standard ports (anything other than 80, 443, or documented API endpoints). This behavioral pattern catches post-exploitation activity regardless of the specific CVE or malware family.

Splunk SPL

index=network sourcetype=firewall OR sourcetype=proxy OR sourcetype=pan:traffic
| where match(src_process, "(?i)(python|uvicorn|gunicorn|litellm|starlette)")
| where NOT (dest_ip="10.0.0.0/8" OR dest_ip="172.16.0.0/12" OR dest_ip="192.168.0.0/16")
| where dest_port!=80 AND dest_port!=443
| stats count by src_host, src_process, dest_ip, dest_port, dest_country
| where count < 5
| sort - count

Microsoft KQL

CommonSecurityLog
| where DeviceVendor has_any ("Palo Alto", "Cisco", "Fortinet", "Check Point")
| where ProcessName has_any ("python", "uvicorn", "gunicorn", "litellm", "starlette")
| where DestinationIP !startswith "10." and DestinationIP !startswith "172.16." and DestinationIP !startswith "192.168."
| where DestinationPort != 80 and DestinationPort != 443
| summarize ConnectionCount = count() by SourceIP, ProcessName, DestinationIP, DestinationPort, DestinationCountry
| where ConnectionCount < 5
| order by ConnectionCount desc

Note: These queries were generated with AI assistance and are a starting point, not a verdict. A query that returns no results does not mean the threat is absent. Confirm that the referenced indexes, sourcetypes, and field names exist in your environment, that the relevant data is actually being ingested, and that names match your schema (watch for spelling and naming drift). Validate against your own ingest and audit trails before drawing conclusions.

Check Your Environment

Use these queries to check your own telemetry for this week's high-confidence malicious IPs and newly exploited vulnerabilities. The IP list is parameterized with the top addresses from AbuseIPDB's confidence-100 blacklist (AbuseIPDB, generated 2026-09-07). Check your vulnerability inventory against the three new CISA KEV entries: CVE-2026-85046 (Chromium V8), CVE-2026-59822 (LiteLLM), and CVE-2026-48710 (Starlette).

Splunk SPL Sweep

index=network sourcetype=firewall OR sourcetype=proxy OR sourcetype=pan:traffic OR sourcetype=cisco:asa
| where dest_ip IN ("62.60.130.253", "62.60.130.242", "195.178.110.218", "103.186.31.66", "35.210.61.208", "125.212.217.143", "160.251.202.248", "193.163.125.54", "193.163.125.99", "43.240.14.35", "80.91.223.114", "203.25.208.110", "93.51.116.48", "156.225.1.18", "67.205.146.133")
   OR src_ip IN ("62.60.130.253", "62.60.130.242", "195.178.110.218", "103.186.31.66", "35.210.61.208", "125.212.217.143", "160.251.202.248", "193.163.125.54", "193.163.125.99", "43.240.14.35", "80.91.223.114", "203.25.208.110", "93.51.116.48", "156.225.1.18", "67.205.146.133")
| stats count by _time, src_ip, dest_ip, dest_port, action
| sort - _time

Microsoft KQL Sweep

let MaliciousIPs = dynamic(["62.60.130.253", "62.60.130.242", "195.178.110.218", "103.186.31.66", "35.210.61.208", "125.212.217.143", "160.251.202.248", "193.163.125.54", "193.163.125.99", "43.240.14.35", "80.91.223.114", "203.25.208.110", "93.51.116.48", "156.225.1.18", "67.205.146.133"]);
CommonSecurityLog
| where DestinationIP in (MaliciousIPs) or SourceIP in (MaliciousIPs)
| summarize ConnectionCount = count() by TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction
| order by TimeGenerated desc

Note: These queries were generated with AI assistance and are a starting point, not a verdict. A query that returns no results does not mean the threat is absent. Confirm that the referenced indexes, sourcetypes, and field names exist in your environment, that the relevant data is actually being ingested, and that names match your schema (watch for spelling and naming drift). Validate against your own ingest and audit trails before drawing conclusions.

Related Focused Hunts Resources

Appendix: Data Tables

Top Ransomware Groups

ransomware.live, pulled 2026-09-07

Group Victims Profile
Qilin15View
Krybit15View
IncRansom13View
Akira11View
TheGentlemen9View
LockBit59View
DireWolf9View
BrainCipher8View
SilentRansomGroup8View
Storm8View

Most-Reported Malicious IPs

AbuseIPDB confidence 100, generated 2026-09-07; network context from AlienVault OTX, AbuseIPDB, queried 2026-09-07

IP Address Country Reports Users ASN Origin Type Check
62.60.130.253LT53,828848AS1239 SprinthostingView
62.60.130.242LT44,491884AS1239 SprinthostingView
195.178.110.218NL23,4061,336AS30823 CombahtonhostingView
103.186.31.66ID6,9681,257AS141892 CV AndhikahostingView
35.210.61.208BE6,3061,116AS19527 GooglehostingView
125.212.217.143VN4,28679AS7552 ViettelresidentialView
160.251.202.248JP2,714696AS58791 GMO InternethostingView
193.163.125.54GB2,585122AS211298 DriftnethostingView
193.163.125.99GB2,433124AS211298 DriftnethostingView
43.240.14.35HK1,980149AS134176 RainbowhostingView

Attacker Networks

AlienVault OTX for ASN, AbuseIPDB for usage type, queried 2026-09-07

ASN Network Name IP Count Origin Class Example ISP
AS211298Constantine Cybersecurity Ltd.2hostingDriftnet Ltd
AS14061DigitalOcean LLC2hostingDigitalOcean, LLC
AS1239Sprint2hostingCIPHER OPERATIONS DOO BEOGRAD

New KEV Additions

CISA KEV, pulled 2026-09-07; weaponization signal from AlienVault OTX, queried 2026-09-07

CVE Vendor/Product Date Added Due Date OTX Pulses
CVE-2026-85046Google Chromium V82026-09-042026-09-182
CVE-2026-59822BerriAI LiteLLM2026-09-022026-09-164
CVE-2026-48710Kludex Starlette2026-09-022026-09-1614

Methodology & Sources

Last Week in Threats aggregates open-source threat intelligence feeds to provide a retrospective view of the week that just ended. Each edition pulls ransomware leak-site postings, malicious IP blacklists, newly exploited vulnerabilities, and command-and-control IOCs from their respective authoritative sources, cross-references the data for context, and retains a point-in-time snapshot for reproducibility. All figures are aggregate public statistics captured during a defined collection window, not detections from Focused Hunts client environments.

Week-over-week trends appear once successive snapshots exist; until then, editions report baseline figures only. When feed coverage is incomplete, affected totals are reported as a floor with the covered range disclosed inline. Source classes that are unavailable during a given week are omitted rather than estimated. Actor claims (such as ransomware group postings) are kept separate from independently confirmed listings (such as CISA KEV entries). Every displayed figure carries an inline attribution to its upstream provider and pull date, and every published number traces back to a row in the retained snapshot stored at output/weekly/data/[WEEK_ID].json.

← Back to Last Week in Threats