Last Week in Threats: Week 39
Bottom Line
What changed: Attacks against self-hosted AI and LLM service endpoints surged, with 422 malicious IPs active during the week, 100 new. Model Context Protocol scanners dominated the threat landscape alongside credential harvesters targeting exposed API keys.
Who is most exposed: Organizations running self-hosted Ollama, LiteLLM, OpenAI-compatible, or LM Studio endpoints; edge appliance operators (Citrix NetScaler, MikroTik RouterOS, F5 BIG-IP, Check Point gateways) facing 11 new KEV exploits; and technology and manufacturing firms hit by 146 ransomware attacks.
Recommended action: Audit AI/LLM service exposure, restrict unauthenticated access, and patch the Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) by September 30.
The Week in Review
The week of September 22 to 28, 2026 marked a turning point in adversary reconnaissance patterns. Self-hosted AI and machine learning service endpoints became the dominant scanning target, with 422 attacker IPs probing Ollama, LiteLLM, OpenAI-compatible, and LM Studio honeypots. Model Context Protocol scanners accounted for 159 of those IPs, searching for exposed inference endpoints. Credential harvesters added another 86 IPs targeting API key paths and environment files. This shift reflects the growing adoption of self-hosted LLM infrastructure and the adversary awareness that these endpoints often run without authentication.
Edge appliances faced a concentrated wave of exploitation pressure. CISA added 11 vulnerabilities to the KEV catalog, including two Citrix NetScaler zero-days enabling remote code execution, a MikroTik RouterOS authentication bypass, two Check Point security gateway flaws, and an F5 BIG-IP heap overflow. The edge device concentration signals adversaries prioritizing perimeter footholds over internal lateral movement this week. Ransomware volume dropped 21 percent week-over-week to 146 victims, down from 185 the prior week.
Ransomware Activity
Ransomware groups posted 146 victims this week, down 21 percent from the prior week's 185 (ransomware.live, 2026-09-28). Qilin led with 17 postings, followed by metaencryptor and akira with nine each. The United States absorbed the highest victim count (50), followed by unknown locations (31) and Italy (six).
Most Active Groups by Victim Postings
- Victim postings this week: 146 (vs 185 last week, down 21%)
- Most active groups: qilin (17), metaencryptor (nine), akira (nine), incransom (eight), SilentRansomGroup (eight)
- Top victim countries: US (50), Unknown (31), IT (six), BR (five), FR (four)
Sector & Technology Watch
Technology firms faced 32 ransomware attacks this week, followed by manufacturing (28), professional services (21), healthcare (15), and construction (12). The edge appliance exploitation wave put organizations running Citrix NetScaler, MikroTik RouterOS, F5 BIG-IP, and Check Point gateways in the crosshairs. If you run Ollama, LiteLLM, OpenAI-compatible APIs, or LM Studio endpoints, audit authentication controls and restrict access to trusted networks.
- Most-targeted industries: Technology (32 victims), Manufacturing (28), Professional Services (21), Healthcare (15), Construction (12)
- Technology in the crosshairs: Edge/VPN appliances, AI/LLM services, security gateways, SD-WAN orchestrators, API gateways, collaboration platforms, web platforms
- If you run edge appliances or AI endpoints: Patch the Citrix NetScaler zero-days by September 30, audit AI/LLM service authentication, and hunt for unauthenticated external access to non-public services
Most-Reported Malicious IPs
AbuseIPDB listed 100 addresses at 100% confidence this week, led by a Korea Telecom residential address and an Indonesian hosting address with more than 6,000 reports each. Activity centered on port scanning, SSH brute-force, and web-application attacks, and GreyNoise Community flagged 11 of the top 15 as malicious scanners. The Censys address listed below is a benign scanner and belongs out of block lists.
- 103.191.14.243: ASN not resolved, ISP PT NAWASENA WASA ANUGERAH, hosting, 6,311 reports
- 211.51.132.104: AS4766 Korea Telecom, residential, 6,261 reports
- 134.209.120.216: ASN not resolved, ISP DigitalOcean, LLC, hosting, 5,850 reports
- 199.45.154.191: AS398324 Censys Inc, business, 5,496 reports
- 45.148.10.40: AS48090 Pptechnology Limited, ISP TECHOFF SRV LIMITED, hosting, 2,053 reports
- 116.135.67.93: AS4837 China United Network Communications, residential, 1,572 reports
- 61.129.41.146: ASN not resolved, ISP Bank Of China, residential, 1,260 reports
- 174.78.139.165: AS22773 Cox Communications, residential, 591 reports
- 101.36.108.202: ASN not resolved, ISP UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, hosting, 440 reports
- 35.205.224.26: ASN not resolved, ISP Google LLC, hosting, 135 reports
- 47.79.207.47: ASN not resolved, ISP Alibaba Cloud LLC, hosting, 128 reports
- 109.160.32.178: AS209371 Private Network, ISP Global Communication Net Plc, hosting, 100 reports
- 98.58.154.60: AS7922 Comcast, residential, 92 reports
- 109.160.32.137: AS209371 Private Network, ISP Global Communication Net Plc, hosting, 74 reports
- 196.250.67.161: ASN not resolved, ISP GVA-UG-1, residential, 48 reports
Attacker Infrastructure & Networks
Of the 15 enriched addresses, eight sat on hosting networks, six on residential ISPs, and one on a business network, the Censys scanner, per AbuseIPDB usage type, with ownership from AlienVault OTX. The residential share points to compromised endpoints, while the hosting networks with heavy report volume warrant separate attention. None matched known malware command-and-control or payload hosting in abuse.ch ThreatFox and URLhaus.
Hosting Providers
- ASN not resolved, ISP PT NAWASENA WASA ANUGERAH: 103.191.14.243
- ASN not resolved, ISP DigitalOcean, LLC: 134.209.120.216
- AS48090 Pptechnology Limited: 45.148.10.40
- ASN not resolved, ISP UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED: 101.36.108.202
- AS209371 Private Network: 109.160.32.178, 109.160.32.137
- ASN not resolved, ISP Google LLC: 35.205.224.26
- ASN not resolved, ISP Alibaba Cloud LLC: 47.79.207.47
Residential Networks
- AS4766 Korea Telecom: 211.51.132.104
- AS4837 China United Network Communications: 116.135.67.93
- ASN not resolved, ISP Bank Of China: 61.129.41.146
- AS22773 Cox Communications: 174.78.139.165
- AS7922 Comcast: 98.58.154.60
- ASN not resolved, ISP GVA-UG-1: 196.250.67.161
Business Networks
- AS398324 Censys Inc: 199.45.154.191
Exploited-Vuln Watch
CISA added 11 vulnerabilities to the Known Exploited Vulnerabilities catalog this week, including two Citrix NetScaler zero-days (CVE-2026-88772, CVE-2026-88771) enabling remote code execution (due September 30), a MikroTik RouterOS authentication bypass (CVE-2026-67279, due September 28), and Microsoft SharePoint code injection (CVE-2026-65660, due September 28). (CISA KEV, 2026-09-27 catalog)
- New KEV additions this week: 11
- Citrix NetScaler zero-days: CVE-2026-88772 (buffer overflow RCE), CVE-2026-88771 (input validation RCE), both due 2026-09-30
- Other critical adds: CVE-2026-67279 (MikroTik RouterOS), CVE-2026-65660 (Microsoft SharePoint), CVE-2026-87902 (WordPress Core RFI), CVE-2026-5430 (WSO2), CVE-2026-94127 (F5 BIG-IP APM), two Check Point flaws (CVE-2026-93616, CVE-2026-85102)
- Weaponized-CVE signal: AlienVault OTX pulse counts confirm in-the-wild weaponization for CVE-2026-88772 (three pulses), CVE-2026-88771 (three pulses), CVE-2026-67279 (four pulses), CVE-2026-65660 (four pulses) (AlienVault OTX, 2026-09-28)
The edge appliance concentration is notable: Citrix NetScaler, MikroTik RouterOS, F5 BIG-IP APM, and two Check Point products all received KEV additions within a six-day window. For full CVE details and patch guidance, see the CISA KEV catalog.
Malware & C2
ThreatFox cataloged 6,182 indicators over a two-day window, with 593 fresh C2 IOCs added (ThreatFox, 2026-09-28). AsyncRAT dominated with 3,785 indicators, a near-quadruple increase from the prior week's 974. Unknown Loader added 1,004 indicators, followed by ClearFake (279), Cobalt Strike (113), and Mirai (109).
- Fresh C2 IOCs this week: 593 (vs 440 last week)
- Top malware families: AsyncRAT (3,785 indicators), Unknown Loader (1,004), ClearFake (279), Cobalt Strike (113), Mirai (109)
- AsyncRAT surge: 3,785 indicators (vs 974 last week), reflecting sustained infrastructure buildout by multiple operators
Attacks on AI Infrastructure
Self-hosted AI and LLM service endpoints faced 422 attacker IPs during the week, with 100 new and 322 persistent from prior weeks (AI Honeypot Observatory, 2026-09-28).
AI-Endpoint Attacker Categories
- Attacker IPs active this week: 422 (100 new, 322 persistent)
- Dominant categories: MCP-SCANNER (159 IPs probing Model Context Protocol endpoints), CREDENTIAL-HARVESTER (86 IPs), SCANNER-MASS (88 IPs)
- Top MITRE ATT&CK techniques: T1046 Network Service Discovery (422 IPs), T1190 Exploit Public-Facing Application (159 IPs), T1552.001 Unsecured Credentials (88 IPs)
If you expose Ollama, LiteLLM, OpenAI-compatible, or LM Studio endpoints, enforce authentication on all paths, restrict access to trusted networks only, monitor for prompt injection attempts, and audit for exposed environment variables or API keys in public-facing directories.
The Hunting Takeaway
The AI infrastructure attack surge and the edge appliance KEV concentration both point to the same hunting angle: externally reachable services with weak or absent authentication. Hunt for unauthenticated external access to non-public services. Look for successful authentication to internal services from external IPs, web requests to admin or API paths without corresponding authentication events, and requests to paths commonly associated with service metadata or configuration (e.g., /api/health, /v1/models, /.env, /api/keys). Cross-reference successful external access against your asset inventory: if the service was never intended for public exposure, investigate immediately.
For AI/LLM endpoints specifically, look for prompt submission patterns without a corresponding internal user context, repeated model enumeration requests, and API key reuse across multiple source IPs (shadow relay pool signal). The telemetry is in your web proxy logs, firewall permit logs, and application authentication logs.
Check Your Environment
Use these IOCs and CVEs to sweep your environment. Each query targets this week's high-confidence threats.
Malicious IP Sweep
Splunk SPL
index=* (sourcetype=stream:http OR sourcetype=fortigate_traffic OR sourcetype=paloalto:traffic OR sourcetype=cisco:asa OR sourcetype=aws:cloudfront:accesslogs)
| search src_ip IN ("45.148.10.40","211.51.132.104","103.191.14.243","134.209.120.216","116.135.67.93","174.78.139.165","109.160.32.137","109.160.32.178","196.250.67.161","61.129.41.146","101.36.108.202","35.205.224.26","47.79.207.47","98.58.154.60")
| table _time, src_ip, dest_ip, dest_port, action, bytes
| sort - _time
Malicious IP Sweep
Microsoft KQL
union CommonSecurityLog, AzureDiagnostics, SigninLogs, OfficeActivity
| where SourceIP in ("45.148.10.40","211.51.132.104","103.191.14.243","134.209.120.216","116.135.67.93","174.78.139.165","109.160.32.137","109.160.32.178","196.250.67.161","61.129.41.146","101.36.108.202","35.205.224.26","47.79.207.47","98.58.154.60")
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, Activity, SentBytes
| sort by TimeGenerated desc
Vulnerability Check
Cross-reference this week's KEV additions against your asset inventory. For CVE details and patch guidance, see the Exploited-Vuln Watch section above and the CISA KEV catalog.
Note: These queries were generated with AI assistance and are a starting point, not a verdict. A query that returns no results does not mean the threat is absent. Confirm that the referenced indexes, sourcetypes, and field names exist in your environment, that the relevant data is actually being ingested, and that names match your schema (watch for spelling and naming drift). Validate against your own ingest and audit trails before drawing conclusions.
Appendix: Raw Data Tables
Top Ransomware Groups
ransomware.live, pulled 2026-09-28
| Group | Victims This Week |
|---|---|
| qilin | 17 |
| metaencryptor | 9 |
| akira | 9 |
| incransom | 8 |
| SilentRansomGroup | 8 |
| Wallstreet | 7 |
| Storm | 6 |
| everest | 6 |
| thegentlemen | 5 |
| Booba Project | 5 |
Most-Reported Malicious IPs
AbuseIPDB (confidence 100), pulled 2026-09-28
| IP | Country | Reports | Users | Origin Type |
|---|---|---|---|---|
| 211.51.132.104 | KR | 6261 | 1221 | Residential |
| 103.191.14.243 | ID | 6311 | 1190 | Hosting |
| 134.209.120.216 | US | 5850 | 1177 | Hosting |
| 199.45.154.191 | HK | 5496 | 207 | Business (Censys) |
| 45.148.10.40 | NL | 2053 | 665 | Hosting |
| 116.135.67.93 | CN | 1572 | 617 | Residential |
| 61.129.41.146 | CN | 1260 | 554 | Residential |
| 174.78.139.165 | US | 591 | 167 | Residential |
| 101.36.108.202 | HK | 440 | 143 | Hosting |
| 35.205.224.26 | BE | 135 | 62 | Hosting |
Top Networks
AlienVault OTX (ASN), AbuseIPDB (usage type), pulled 2026-09-28
| ASN | Network Name | Origin Class | IP Count |
|---|---|---|---|
| AS209371 | Private Network | Hosting | 2 |
| AS48090 | Pptechnology Limited | Hosting | 1 |
| AS7922 | Comcast | Residential | 1 |
| AS4766 | Korea Telecom | Residential | 1 |
| AS398324 | Censys Inc | Business | 1 |
| AS4837 | China United Network Communications | Residential | 1 |
| AS22773 | Cox Communications | Residential | 1 |
New KEV Additions
CISA Known Exploited Vulnerabilities, catalog 2026.09.27
| CVE | Vendor | Product | Due Date |
|---|---|---|---|
| CVE-2026-88772 | Citrix | NetScaler | 2026-09-30 |
| CVE-2026-88771 | Citrix | NetScaler | 2026-09-30 |
| CVE-2026-67279 | MikroTik | RouterOS | 2026-09-28 |
| CVE-2026-65660 | Microsoft | SharePoint | 2026-09-28 |
| CVE-2026-87902 | WordPress | Core | 2026-09-28 |
| CVE-2026-5430 | WSO2 | Multiple Products | 2026-09-27 |
| CVE-2026-71362 | Adobe | Commerce/Magento | 2026-09-27 |
| CVE-2026-93952 | Arista | VeloCloud Orchestrator | 2026-09-25 |
| CVE-2026-94127 | F5 | BIG-IP APM | 2026-09-25 |
| CVE-2026-93616 | Check Point | Multiple Products | 2026-09-25 |
| CVE-2026-85102 | Check Point | Multiple Products | 2026-09-25 |
Top AI Attacker Categories
AI Honeypot Observatory (ai-honeypots.com), pulled 2026-09-28
| Category | IP Count |
|---|---|
| MCP-SCANNER | 159 |
| SCANNER-MASS | 88 |
| CREDENTIAL-HARVESTER | 86 |
| RELAY-CUSTOMER | 41 |
| SCANNER-ENUM | 35 |
| IDENTITY-PROBER | 9 |
| RELAY-VERIFIER | 4 |
Methodology & Sources
This weekly recap aggregates open-source threat intelligence from public feeds, cross-referenced and captured point-in-time during the week of September 22 to 28, 2026. All figures are aggregate public statistics rather than Focused Hunts detections and trace back to the retained snapshot at output/weekly/data/2026-W39.json. Week-over-week trends reflect successive snapshot comparisons. Partial-coverage totals are reported as a floor with disclosed date ranges; unavailable source classes are omitted rather than estimated. Actor claims are kept separate from confirmed listings.
Feed attribution is inline throughout the body and appendix. Ransomware victim data: ransomware.live ledger, aggregated via scripts/aggregate-week.py. Malicious IP data: AbuseIPDB blacklist (confidence 100, top 100), with GreyNoise Community tags and infrastructure context from AlienVault OTX (ASN) and AbuseIPDB (usage type). Exploited vulnerabilities: CISA Known Exploited Vulnerabilities catalog. Malware/C2 indicators: ThreatFox (abuse.ch), two-day window. Weaponized-CVE signal: AlienVault OTX pulse search. AI infrastructure attacks: AI Honeypot Observatory 28-day feed, sliced to the ISO week window. All feeds pulled 2026-09-28 unless otherwise noted. GreyNoise and AlienVault OTX operate on community-tier access; Censys is a legitimate security research scanner and excluded from malicious counts. Enrichment includes cross-correlation against ThreatFox and URLhaus for C2/malware-host flagging; none of this week's top IPs matched.