The One That Didn’t Leave. Three Weeks Inside. A Perimeter That Did Not Push Back.
48,948 unique high-confidence indicators. 65 tracked clusters. 17 distinct MITRE ATT&CK techniques. On the surface, this week looks like a reprieve. Concurrent APT clusters collapsed from 33 to 8 — a seventy-five percent drop. Ransomware volume fell even harder, ninety-seven percent, from 540 indicators to 16. Two of the three warning tiers that lit up across Weeks 35-37 have gone quiet. But one has not. A single command-and-control operator — first flagged in Week 36, still there in Week 37, still there this week — has now been continuously inside the ecosystem for twenty-one consecutive days at industrial-scale production. Three weeks. One operator. 45,298 fresh indicators in the last seven days alone. Twenty-eight per minute, sustained.
Two possibilities compete for what this shape means. Either the elevated-adversary-pressure cycle from Weeks 35-37 is genuinely ending, and Week 39 will trend further down. Or this is the mid-cycle quiet between deployment waves — the calm inside the storm — and Week 39 will see the surge return. Both readings are supported by the data. The persistent operator’s continued activity leans hard against the “cycle ending” reading. Programs that stand down coverage this week on the assumption of ease will be the ones caught out if the returning cycle lands next Sunday.
Read time · 24 minutes · Data window · 14 – 20 September 2026 · Empirical basis · 5,619,605 records aggregated to 48,948 distinct high-confidence indicators
Executive Summary · What Changed This Week
The environment appeared to quiet — but that is precisely the shape of the trap. After three consecutive weeks of elevated APT concurrency (29 → 21 → 33 across Weeks 35-37), Week 38 collapsed to 8 concurrent clusters — seventy-five percent below the recent baseline. Ransomware volume fell even harder (540 → 16 IOCs, -97%). Read in isolation, this looks like breathing room. Read against the historical rhythm of adversary-deployment cycles, it looks a great deal more like the mid-cycle rest between deployment waves. The cycle either genuinely eased or it is between blows. There is no third reading of the data.
What did NOT consolidate — and why that is the story. The persistent command-and-control operator flagged in Weeks 36 and 37 has now entered its third consecutive week at 45,298 fresh indicators. Two-week persistence was already unusual in the trailing corpus; three-week persistence at this scale is empirical confirmation that the operator is a structural feature of the adversary-infrastructure market, not a transient spike. This operator is not going away. Their production rate — twenty-eight new attack indicators every minute, week after week — exceeds the block-listing capacity of any program still operating on individual-IP enforcement. CIDR-density enforcement is no longer an architectural upgrade. It is the only control that scales to the observed adversary.
Three actions before your next executive brief:
- Do not decommission any Sigma rule shipped during Weeks 35-37. The consolidation could reverse in Week 39. Rules kept live cost nothing; rules retired during quiet windows cost coverage when the next surge arrives.
- Extend the persistent-C2 CIDR block list update cadence. Week 3 of the operator means their infrastructure is now a durable target — the block list should be updated at least weekly, ideally daily, going forward.
- Use this week for Finalize catch-up. Consolidation weeks are the right time to pay down Hunt-Debt from prior high-cycle weeks. Any hunts closed without full Finalize deliverables during Weeks 35-37 should be back-filled now, while the surface is quiet.
The two anchoring numbers for a CISO update: 8 concurrent APT clusters (down 75%) and 45,298 C2 IOCs from one persistent operator (third consecutive week). The tension between them is the strategic signal — the environment eased in aggregate but not uniformly, and one operator continues to structurally exceed the reset.
What a CISO needs to see behind the aggregate numbers
The persistent command-and-control operator has now been inside the ecosystem — publicly documented, empirically confirmed, three consecutive weeks — for twenty-one days. That is longer than most incident-response engagements. Longer than most quarterly board cycles. And there is no evidence the operator is leaving. What they are building is production-grade, sustained, industrial. It is servicing downstream affiliates whose visibility rises and falls week to week; the operator does not.
If your program is still working from static IP block lists refreshed weekly, you have — as of this document — a specific, named, publicly-attributed threat actor that you cannot see and cannot block at the rate they are provisioning. That is no longer an aspirational-architecture problem. That is a specific, documented, defensible-in-a-board-risk-committee coverage gap. If your organisation is breached in the next thirty days and forensics traces the initial access back to infrastructure this operator supplied, the record will show that the coverage gap was public knowledge, in writing, dated 20 September 2026.
The APT concurrency drop and the 97% ransomware collapse this week are the parts of the story that read as reassuring. They are also the parts that will fool you. Historically, weeks like this — narrow surface, quiet aggregate, dormant tail — are the mid-cycle rest between deployment waves, not the end of the pressure cycle. If Week 39 lands back at pre-consolidation levels and your team has already stood down coverage on Week 38’s assumption of ease, the returning surge lands on a program that has just retired the exact rules it needs.
That is the shape of this week’s danger. Not the persistent operator alone. Not the aggregate quiet alone. The combination — one adversary getting quietly stronger while your attention is drawn to how quiet everything else looks. If you brief only the reassuring numbers to your board, and the returning cycle hits before your next review, the question that comes back will be a hard one to answer.
This document is one week’s snapshot. HuntIntel is the continuous surface.
Everything in this advisory — the 48,948 IOCs, the 65 cluster fingerprints, the persistent-C2 CIDR watchlist, the 17-TTP surface — is a Sunday-morning extract from a live corpus. The corpus keeps moving. HuntIntel is where operators go for the continuous view: per-cluster live fingerprints, actor migration timelines, live CIDR-density feed with per-operator persistence tracking, sector heatmap, country attribution atlas, Cohesive-IP view, AIaaS attack-infrastructure attribution.
If your program is still working from static IOC lists refreshed weekly, you are structurally under-covered against the operator this advisory documents.
Six statistics your CISO update can quote directly
- “APT concurrency dropped 75% week-over-week — but the persistent C2 operator entered its third consecutive week at ~45,000 IOCs.” Consolidation is uneven; single-operator persistence continues.
- “Ransomware volume collapsed 97% — from 540 IOCs to 16.” The affiliate-cohort surge that surfaced in Week 37 has ended, at least for the current cycle.
- “Only 17 distinct MITRE ATT&CK techniques observed this week — a 69% narrowing from Week 37’s 54.” Attack-surface breadth compressed materially; watch whether it stays narrow or re-widens in Week 39.
- “91% of domain-tier IOCs continued high-severity attribution.” Signal quality on the domain tier remained clean even as raw volume dropped — trust-the-tier posture unchanged.
- “Three consecutive weeks of the same persistent C2 operator at industrial-scale IOC production.” Structural feature confirmation. CIDR-density enforcement is now the load-bearing control against this operator.
- “Week 38 shape is either the elevated-cycle ending or the mid-cycle quiet before Week 39 surges.” Detection engineering should hold posture, not decommission. Week 39 will resolve which pattern is operating.
Weekly SOC Metrics · What Your Team Needs to Know Before Monday
Analyst-queue implications: the 97% ransomware collapse and 40% total-cluster contraction should produce a materially lighter alert queue for L2/L3 escalation this week. Use it as a Finalize catch-up window, not as a reason to reduce coverage. Do NOT reallocate hunter capacity away from the persistent-C2 hunt on the assumption that the surface is quiet overall. The persistent operator is structurally unrelated to the APT and ransomware quieting; they are running on their own clock, and their clock did not slow down. A program that pulls hunters off the C2 target because the alert queue got lighter is exactly the shape of program that shows up in a post-incident review three weeks later.
Coverage priority for the week: (1) refresh persistent-C2 CIDR block list — Week 3 of the same operator, mandatory update, (2) back-fill any Finalize deliverables missed during Weeks 35-37 pressure surge — Hunt-Debt paydown while surface is quiet, (3) audit which Sigma rules were shipped in prior 3 weeks and verify none regressed to test-tier during the quiet window.
01 · This Week at a Glance
Seven-day intelligence window (14–20 September 2026). Aggregated only — no adversary names, no infrastructure identifiers, no raw records exposed in prose.
Three anchoring numbers this week: 8 concurrent APT clusters (75% drop from Week 37’s 33), 45,298 IOCs from the persistent C2 operator (third consecutive week — structural persistence confirmed), and 16 total ransomware IOCs from 12 operators (surge cohort from Week 37 fully retreated). The mix of dramatic consolidation on some tiers and continued industrial-scale persistence on the C2 tier is this week’s diagnostic pattern.
02 · Five Headlines Worth Reading Before Monday
APT concurrency dropped 75% week-over-week — 33 → 8 clusters
The Threat Actor adversary type surfaced 1,085 IOCs from just 8 concurrent named clusters this week — a 75% drop from Week 37’s 33 concurrent clusters and the first below-baseline reading in five weeks. The three preceding weeks (29 → 21 → 33) confirmed a durable baseline shift; Week 38’s sharp reversal complicates that reading.
The persistent C2 operator continues into week three — 45,298 IOCs · same operator
Cluster A01 (flagged in Week 36 at 45,441 IOCs and Week 37 at 53,277 IOCs) continues into Week 38 with 45,298 IOCs across all seven days. Total three-week production from this single operator: 144,036 unique network addresses in 21 consecutive days, averaging ~228 fresh addresses per hour, sustained.
Ransomware surge collapsed — 540 IOCs → 16 IOCs (97% decrease)
Week 37’s ransomware surge (540 IOCs from 33 concurrent operators across 23 TTPs) has fully retreated. Week 38: 16 IOCs from 12 operators across 3 TTPs. The Ransomware-as-a-service category alone dropped from 484 IOCs to 16 — a 97% collapse. Operator count declined from 33 to 12, but the per-operator volume fell far more sharply.
Distinct MITRE TTP count narrowed from 54 to 17 — 69% narrowing
Week 37 observed 54 distinct MITRE ATT&CK techniques across the named-adversary surface. Week 38: 17 distinct techniques. This is one of the narrowest TTP surfaces in the recent trailing weeks. The top techniques did not change materially — T1105 (Ingress Tool Transfer, 1,417 events), T1071.001 (Web-Protocol C2, 1,304), T1059.001 (PowerShell, 829), T1204.002 (User Execution — Malicious File, 761), T1566.002 (Spearphishing Link, 712) — but the tail collapsed. Techniques that surfaced last week (T1078 Valid Accounts, T1486 Data Encrypted, T1657 Financial Theft) fell off the top-15 entirely.
Domain-tier signal quality held at 91% high-severity — attribution reliability persists across cycle shifts
Even with total IOC volume down 16% week-over-week and the wider surface consolidating, the domain-tier attribution quality held at 91% high-severity (Week 37 was 94%). Hash tier: 99% high-severity ratio. URL tier: 72%. Only the IP tier had a lower high-severity ratio (3% — heavily diluted by Cluster A01’s low-severity IP dump). Strip Cluster A01 out of the IP tier and the underlying non-concentrated IP high-severity ratio is meaningfully higher.
03 · The Cluster Footprint · Top 40 Anonymised Clusters
Every named adversary this week is anonymised into cluster labels (A01–A40). Identifiers rotate weekly — Cluster A01 here is the same persistent C2 operator flagged in Weeks 36 and 37 (deliberate consistency for the persistence signal). All other identifiers should be treated as new.
Cluster A01 alone accounts for 45,298 IOCs (93% of the week’s total distinct IOCs). The other 39 clusters combined contribute under 3,700 IOCs. The extreme long-tail shape is now a three-week pattern.
| Cluster | Adversary Type | Category | IOCs | IOC Types | First Seen | Last Seen |
|---|---|---|---|---|---|---|
| Cluster A01 | C2 | C&C | 45,298 | 1 | 2026-09-14 | 2026-09-20 |
| Cluster A02 | Threat Actor | APT | 1,012 | 1 | 2026-09-20 | 2026-09-20 |
| Cluster A03 | Malware campaign | Malware-Activity | 603 | 2 | 2026-09-15 | 2026-09-20 |
| Cluster A04 | Malware | Backdoor | 294 | 3 | 2026-09-20 | 2026-09-20 |
| Cluster A05 | C2 | C&C Server | 184 | 1 | 2026-09-14 | 2026-09-19 |
| Cluster A06 | Malware | Malware-Activity | 175 | 2 | 2026-09-17 | 2026-09-17 |
| Cluster A07 | Malware | Malware-Activity | 173 | 4 | 2026-09-17 | 2026-09-17 |
| Cluster A08 | C2 | Framework | 138 | 2 | 2026-09-16 | 2026-09-20 |
| Cluster A09 | Malware | Malware-Activity | 116 | 1 | 2026-09-17 | 2026-09-17 |
| Cluster A10 | Malware | Malware-Activity | 114 | 2 | 2026-09-17 | 2026-09-17 |
| Cluster A11 | Malware | RAT | 96 | 3 | 2026-09-20 | 2026-09-20 |
| Cluster A12 | Phishing Campaign | Phishing | 90 | 4 | 2026-09-15 | 2026-09-20 |
| Cluster A13 | Malware | Backdoor | 62 | 1 | 2026-09-15 | 2026-09-16 |
| Cluster A14 | Malware | RAT | 50 | 3 | 2026-09-17 | 2026-09-17 |
| Cluster A15 | Malware | RAT | 44 | 2 | 2026-09-17 | 2026-09-20 |
| Cluster A16 | Malware | Backdoor | 35 | 3 | 2026-09-17 | 2026-09-17 |
| Cluster A17 | Malware | Malware-Activity | 28 | 3 | 2026-09-17 | 2026-09-17 |
| Cluster A18 | Malware | Botnet | 27 | 2 | 2026-09-18 | 2026-09-18 |
| Cluster A19 | Malware | Trojan | 25 | 2 | 2026-09-15 | 2026-09-15 |
| Cluster A20 | Malware | C&C Server | 24 | 2 | 2026-09-17 | 2026-09-17 |
| Cluster A21 | Threat Actor | APT | 22 | 5 | 2026-09-17 | 2026-09-17 |
| Cluster A22 | Malware | RAT | 19 | 2 | 2026-09-17 | 2026-09-17 |
| Cluster A23 | Phishing Campaign | Malware-Activity | 18 | 3 | 2026-09-15 | 2026-09-15 |
| Cluster A24 | Threat Actor | APT | 17 | 3 | 2026-09-17 | 2026-09-17 |
| Cluster A25 | Malware campaign | Supply Chain | 17 | 4 | 2026-09-20 | 2026-09-20 |
| Cluster A26 | Malware | Malicious-Infrastructure | 16 | 4 | 2026-09-17 | 2026-09-17 |
| Cluster A27 | Malware | Malware-Activity | 16 | 2 | 2026-09-17 | 2026-09-17 |
| Cluster A28 | Phishing Campaign | Phishing | 15 | 3 | 2026-09-17 | 2026-09-17 |
| Cluster A29 | Malware | Malware-Activity | 13 | 3 | 2026-09-20 | 2026-09-20 |
| Cluster A30 | C2 | C&C Server | 13 | 1 | 2026-09-14 | 2026-09-19 |
| Cluster A31 | Threat Actor | APT | 12 | 2 | 2026-09-20 | 2026-09-20 |
| Cluster A32 | Phishing Campaign | Phishing | 12 | 1 | 2026-09-20 | 2026-09-20 |
| Cluster A33 | Malware | RAT | 12 | 2 | 2026-09-15 | 2026-09-15 |
| Cluster A34 | Phishing Campaign | Phishing | 12 | 2 | 2026-09-17 | 2026-09-17 |
| Cluster A35 | Malware | Malware-Activity | 11 | 3 | 2026-09-20 | 2026-09-20 |
| Cluster A36 | Threat Actor | APT | 10 | 4 | 2026-09-20 | 2026-09-20 |
| Cluster A37 | Malware | Malware-Activity | 10 | 3 | 2026-09-17 | 2026-09-17 |
| Cluster A38 | Malware | RAT | 10 | 4 | 2026-09-17 | 2026-09-17 |
| Cluster A39 | SCAN | Vulnerability | 9 | 1 | 2026-09-17 | 2026-09-17 |
| Cluster A40 | Malware | Malware-Activity | 9 | 2 | 2026-09-20 | 2026-09-20 |
Interpretation notes:
- Cluster A01 — the persistent C2 operator. Third consecutive week at ~45k IOCs. Structural feature confirmed. Sustained infrastructure-as-a-service pipeline.
- Cluster A02 — top APT / Threat-Actor cluster this week at 1,012 IOCs concentrated on 2026-09-20 (single-day deployment). One of the 8 concurrent APT clusters — represents ~93% of the APT-tier IOC volume alone.
- Clusters A05, A08, A30 — three additional C2 operators (Cluster A05 at 184 IOCs, A08 at 138, A30 at 13). Alongside Cluster A01 they form the 4-operator C2 cohort.
- Clusters A04, A07, A11, A13, A14, A15, A16, A20 — the visible malware backdoor / RAT / trojan cohort. Together contributing ~800 IOCs. Mostly single-day burst deployments.
- Clusters A12, A23, A28, A32, A34 — the phishing-campaign tier (5 operators). Together contributing ~147 IOCs. Much smaller than Week 37’s phishing surface.
04 · Deep Dive · Headline 01 · The 75% APT Concurrency Drop
Two competing readings of the sharp reversal
Weeks 35, 36, and 37 established a durable baseline shift in concurrent APT / Threat-Actor cluster activity from the prior 8-week baseline of 11-15 to a 3-week trailing average of 27.7. Week 38’s 8 concurrent clusters — below even the pre-shift baseline — breaks the trend hard. Two interpretations compete:
Reading A · The elevated cycle is ending
Elevated APT-concurrency cycles in the historical corpus typically resolve within 2-4 weeks. Week 38 arrived at the tail end of a 3-week elevated period; if it is the first week of a returning-to-baseline trajectory, the pattern is consistent with cycle completion. Under this reading, Week 39 should also land below 15 and the current cycle’s operational tempo returns to prior norms.
Reading B · Mid-cycle deployment gap
Elevated cycles are not uniform — they contain deployment waves separated by consumption phases. During consumption phases, operators are running their deployed infrastructure and generating targeted-victim IOCs rather than broad new-infrastructure IOCs. Attribution volume can drop sharply during consumption phases even as underlying operational activity remains high. Under this reading, Week 39 could see a return to 25+ concurrent clusters as the next deployment wave begins.
The decisive signal
The tie-breaker is Cluster A01 — the persistent C2 operator. If the elevated cycle were genuinely ending across the ecosystem, we would expect the infrastructure-as-a-service C2 supplier to also throttle production (fewer downstream affiliates demanding infrastructure). Cluster A01’s continued Week-3 production at ~45k IOCs is inconsistent with an ecosystem-wide cycle end. That leans the interpretation toward Reading B — this is a mid-cycle deployment gap.
What defenders should do while we wait for Week 39 to resolve
Hold posture · do not reduce coverage
Neither reading justifies reducing detection coverage during Week 38. If Reading A is correct, extra coverage during quiet weeks costs nothing. If Reading B is correct, reducing coverage during the gap week and re-establishing it during the next surge is worse than sustained coverage. The right operational posture: keep every Sigma rule shipped in Weeks 35-37 live; treat Week 38 as a Finalize catch-up window; verify none of the rules regressed to test-tier during quiet.
Operational takeaway: consolidation weeks are Finalize weeks. Not decommission weeks.
Track the consolidation-vs-persistence tension live → HuntIntel shows the 8 concurrent APT clusters and the persistent C2 operator side by side, updated continuously as Week 39 unfolds. Ambient monitoring beats weekly snapshots.
05 · Deep Dive · Headline 02 · The Three-Week Persistent C2 Operator
Structural persistence confirmed · 144,036 IOCs · 21 consecutive days
Cluster A01’s three-week continuous production breaks the “one-week persistence is unusual” threshold decisively. Two weeks was already unprecedented in the recent corpus; three weeks confirms the operator is a structural feature of the current adversary-infrastructure market. The ecosystem contains at least one supplier operating at industrial-scale sustained cadence.
What sustained three-week production implies structurally
Sustained multi-week production at ~45k IOCs per week requires:
- Upstream capital supply — the operator has continuous access to fresh network address space at the provisioning rate required (roughly one address per ~13 seconds averaged over the week). This implies either owned infrastructure at scale OR a reseller / infrastructure-broker relationship with an upstream provider tolerant of the abuse volume.
- Downstream demand — 45k fresh addresses per week must be consumed by someone. Either the operator is running its own campaigns at that scale (unusual), or it is supplying downstream affiliates who consume the addresses for their own operations. The second is more likely given how weekly-observation volume in adjacent adversary tiers rises and falls independently.
- OPSEC to survive three weeks — most fast-rotating operators change identity every 5-14 days to complicate attribution. Sustained three-week attribution to the same operator identity means the operator has deliberately kept the same identity, either because attribution consequences are low or because rotating would disrupt the affiliate business.
Detection strategy for a durable structural operator
CIDR-density enforcement is now the load-bearing control
Individual IP-blocking cannot keep up with 228 fresh addresses per hour. The only viable detection architecture at this scale is CIDR-level enforcement fed by a continuously-updated CIDR-density feed that tracks the operator’s rental-pool infrastructure. A block-list refreshed weekly is minimum; daily is better; hourly is optimal for organisations with the automation infrastructure to support that cadence.
Operational takeaway: three consecutive weeks of the same operator means CIDR-density enforcement is no longer optional. It is architecturally required to have coverage against this operator class in the current environment.
What defenders can no longer ignore
Any hunt program that has not yet transitioned to CIDR-level enforcement — from IP-list-driven detection — is now structurally uncovered against a specific empirically-documented operator that has demonstrated three consecutive weeks of sustained industrial-scale production. This is no longer an “aspirational architecture upgrade” discussion; it is a specific-operator-specific-coverage-gap discussion that a CISO can defend to a board risk committee.
Cluster A01’s CIDR fingerprint is live in HuntIntel → The Cohesive-IP view exposes the current CIDR pool for the three-week persistent operator with per-block confidence scoring. Refreshed hourly. Exportable as CIDR block list.
06 · Deep Dive · Headline 03 · The 97% Ransomware Volume Collapse
Anatomy of a surge cycle ending — the 540 → 16 IOC pattern
Week 37 saw 540 ransomware IOCs from 33 concurrent operators — a 5.5× jump from Week 36 and the largest ransomware-tier surge in the trailing month. Week 38: 16 IOCs from 12 operators. The surge cohort has fully retreated. This is the shape of an affiliate-model market completing its deployment cycle.
The affiliate-cycle rhythm
Ransomware-as-a-service affiliate cohorts operate on 3-5 week deployment cycles typically:
- Preparation phase (1-2 weeks) — affiliate rents core encryption tooling, stages infrastructure, selects targets. Low visible IOC production.
- Deployment phase (5-14 days) — affiliate deploys against targets. High IOC production visible in threat intelligence corpora. This was Week 37.
- Consumption phase (1-3 weeks) — affiliate runs the deployed operation (encryption, negotiation, payment collection). Low visible IOC production because the operation is internal to the compromised target. This is Week 38.
- Rest phase (1-4 weeks) — affiliate resets, plans next cycle. Effectively zero IOC production.
What Week 38’s collapse does not mean
The 97% volume drop does NOT mean ransomware risk is 97% lower this week. The 12 operators still visible are producing continuously; the wider affiliate population is running compromised environments they entered during Week 37’s deployment surge. Detection posture should treat this week as a mid-cycle quiet, not a threat de-escalation.
The next cycle timing
Base case for the next surge · Week 40-42
If the Week 37 surge cohort follows the typical affiliate rhythm, they enter the consumption phase Weeks 38-39, the rest phase Week 40, and prepare next deployment for Weeks 41-42. Expect the next surge to hit somewhere in Weeks 40-42 timeframe. A new-affiliate cohort entering the market could shift that timing forward — Week 40 or earlier.
Operational takeaway: the ransomware precursor cascade rule (Sigma-04 in prior briefings) stays live during the quiet. Retire it now and it will miss the returning surge. This is exactly the “consolidation weeks are not decommission weeks” principle applied at rule-level.
When ransomware surges return, HuntIntel sees them first → Continuous multi-source correlation means new-affiliate-cohort surges are visible days before they reach weekly summaries. Set alerts on ransomware category threshold breaches.
07 · Deep Dive · Headline 04 · The 69% MITRE TTP Narrowing
17 techniques versus last week’s 54 · what narrowing means analytically
Week 37: 54 distinct MITRE ATT&CK techniques observed across the named-adversary surface. Week 38: 17 distinct techniques. That is a 69% narrowing in TTP-surface breadth from one week to the next — one of the sharpest single-week narrowings in the recent corpus.
What “narrowing” reflects
TTP narrowing week-over-week is a function of operator population diversity, not defender coverage improvement. When fewer operators are active, the TTP surface visible in weekly intelligence contracts because each operator brings its own tradecraft. Dormant operators take their unique TTP contributions with them. The narrowing does not mean the missing techniques have stopped working — it means the operators who deploy them are between deployment cycles.
The stable top techniques
The top-5 techniques did not change materially: T1105 (Ingress Tool Transfer, 1,417 events), T1071.001 (Web-Protocol C2, 1,304), T1059.001 (PowerShell, 829), T1204.002 (User Execution — Malicious File, 761), T1566.002 (Spearphishing Link, 712). These are the perennial-load-bearing techniques that appear in every weekly window. They stay high whether the wider surface expands or contracts.
The techniques that fell off
Week 37’s newer surface techniques (T1078 Valid Accounts · 410 events → 0 top-15 appearance) (T1486 Data Encrypted for Impact · 346 → 0) (T1657 Financial Theft · 188 → 0) all disappeared from the top-15 in Week 38. These correlate with the ransomware surge collapse — they are techniques the affiliate cohort was executing and that consumed with the cohort’s retreat.
Detection engineering implication
Coverage decisions on trailing 4-8 week baseline, not single-week counts
Detection coverage decisions must not be reactive to single-week TTP variance. A technique’s absence from this week’s top-15 is not evidence the technique is unused; it is evidence the operators who use it are dormant. Coverage should be sized to the trailing 4-8 week TTP frequency distribution to avoid oscillating with cycle rhythm. Cutting coverage on a technique that fell off this week and re-establishing it next month when it returns produces exactly the “shipped detection artefacts die” pattern that TaHiTI Level-3 discipline is designed to prevent.
Operational takeaway: technique coverage decisions on a 4-8 week rolling average, not a single-week count. This week’s narrow surface is not evidence to reduce coverage.
Trailing-baseline TTP coverage tracking → HuntIntel surfaces trailing 4-8 week technique frequency automatically so your detection-engineering team sizes coverage to rolling averages, not single-week snapshots. MITRE ATT&CK mapping baked in.
08 · Deep Dive · Headline 05 · Attribution Quality Held Across the Cycle Shift
Signal quality is durable · surface volume is not
One of the useful diagnostics for a hunt program is separating “raw intelligence volume” from “signal quality on the attributed tiers.” Week 38’s numbers make this distinction concretely: total distinct IOCs down 16% week-over-week (48,948 vs 57,981), but the domain-tier high-severity attribution ratio held at 91% (down slightly from 94%), hash-tier at 99%, URL-tier at 72%. The signal quality on the attributed tiers did not degrade with the volume drop.
Why this matters
Programs at maturity Level 1 or Level 2 tend to conflate “volume of intelligence” with “quality of intelligence.” When weekly volume drops, they interpret this as “the environment is quieter.” That is often wrong — the visible-operator population is a subset of the actual-operator population, and quiet weeks reflect subset composition, not adversary retreat. Programs at maturity Level 3+ separate the two metrics and monitor them independently.
The IP-tier caveat
The IP tier is the exception this week — high-severity ratio only 3% (1,458 of 47,109 IOCs). This is entirely explained by Cluster A01’s massive low-severity IP dump diluting the tier average. Strip Cluster A01 out and the underlying non-concentrated IP high-severity ratio would be materially higher. This is the same single-operator concentration effect described in Week 36 and 37 deep-dives — the IP tier’s headline ratios must always be interpreted with and without the dominant operator.
Practical use of this diagnostic
Track signal-quality metrics separately from volume metrics
The hunt program’s dashboard should show at least two independent metrics: (a) total distinct IOCs per week (volume metric), (b) high-severity attribution ratio per tier (quality metric). Movement in one without movement in the other is diagnostic. Volume down + quality stable = cycle-composition shift (this week). Volume up + quality down = new-noise-source event (upstream feed issue or bulk-attribution error). Volume up + quality up = genuine environmental expansion. Volume down + quality down = both cycle-composition shift AND source-signal degradation, requires investigation.
Operational takeaway: single-metric monitoring produces misdiagnosis. Track volume and quality separately.
Volume-vs-quality dashboards for Level-3+ programs → Two-metric monitoring (raw volume + high-severity attribution ratio) rendered as an operator-console dashboard, per tier, per week. This is the diagnostic hunt programs need to distinguish cycle-shift from source-degradation.
09 · Adversary-Type Breakdown
// WHERE THIS WEEK’S IOCs LIVE · adversary-type volume
The persistent C2 operator’s contribution swamps all other categories at the visible-volume level — same structural shape as Weeks 36 and 37. What consolidated in Week 38 is everything below C2. Threat Actor volume dropped from 972 to 1,085 (adversary count 33 → 8, so per-operator volume actually rose). Ransomware collapsed. The C2 tier persistence is the only unbroken pattern.
10 · IOC Type × Adversary Diversity
| IOC Type | Count | Distinct Adversaries | High-Severity | Read |
|---|---|---|---|---|
| IP | 47,109 | 35 | 1,458 | Dominant volume · but 45,298 come from Cluster A01 · low high-severity ratio is a single-operator concentration effect |
| DOMAIN | 895 | 26 | 814 | 91% high-severity ratio · quality signal held from Week 37 |
| HASH | 709 | 33 | 702 | 99% high-severity ratio · long-dwell-operator payload signature |
| URL | 226 | 31 | 163 | 72% high-severity · continued multi-operator URL churn · lower breadth than prior weeks |
| OTHERS | 10 | 3 | 10 | Long-tail · process names, registry paths, novel identifiers |
| 3 | 2 | 3 | Very small · targeted spearphishing recipient IOCs |
Note: the near-zero-volume URL tier (226 IOCs vs 715 in Week 37) is another surface-consolidation signal. Multi-operator URL churn was one of the wider-surface patterns from prior weeks; its retreat here confirms the cycle-composition shift rather than isolated adversary-type variance.
11 · Category-Level Attribution
| Category | IOCs | Distinct Adversaries |
|---|---|---|
| C&C | 45,298 | 1 (persistent operator week 3) |
| Malware-Activity | 1,328 | 18 |
| APT | 1,085 | 8 |
| Backdoor | 391 | 3 |
| RAT | 231 | 6 |
| C&C Server | 229 | 4 |
| Framework | 138 | 1 |
| Phishing | 132 | 5 |
| Botnet | 27 | 1 |
| Trojan | 25 | 1 |
| Malicious-Infrastructure | 24 | 4 |
| Supply Chain | 17 | 1 |
| Ransomware-as-a-service | 16 | 12 |
| Vulnerability | 11 | 2 |
The category-level breakdown confirms the wider surface consolidation. Ransomware-as-a-service dropped from 484 IOCs (Week 37) to 16. Phishing category dropped from 267 to 132. The three concentrated backdoor operators (391 IOCs from 3 operators) is a modest new-surface signal worth watching in Week 39. Framework category returned at 138 IOCs from 1 operator — likely the same operator visible in Week 37 continuing operations.
12 · ATT&CK Pressure Roll-Up
Seventeen distinct MITRE ATT&CK techniques observed — narrowest surface in recent weeks. Top fifteen by event volume:
| Technique | Name | Events | Tactic |
|---|---|---|---|
| T1105 | Ingress Tool Transfer | 1,417 | Command & Control |
| T1071.001 | Application Layer — Web Protocols | 1,304 | Command & Control |
| T1059.001 | Command & Scripting — PowerShell | 829 | Execution |
| T1204.002 | User Execution — Malicious File | 761 | Execution |
| T1566.002 | Phishing — Spearphishing Link | 712 | Initial Access |
| T1204.001 | User Execution — Malicious Link | 711 | Execution |
| T1027 | Obfuscated Files or Information | 629 | Defense Evasion |
| T1036 | Masquerading | 615 | Defense Evasion |
| T1189 | Drive-by Compromise | 615 | Initial Access |
| T1059 | Command & Scripting Interpreter | 494 | Execution |
| T1547.001 | Boot Autostart — Registry Run Keys | 372 | Persistence |
| T1070.004 | Indicator Removal — File Deletion | 356 | Defense Evasion |
| T1059.004 | Command & Scripting — Unix Shell | 321 | Execution |
| T1053 | Scheduled Task/Job | 294 | Persistence |
| T1547 | Boot Autostart Execution | 294 | Persistence |
Notably absent from the top-15 this week compared to Week 37: T1078 (Valid Accounts, was 410 events) · T1486 (Data Encrypted for Impact, was 346) · T1041 (Exfiltration Over C2, was 355) · T1657 (Financial Theft, was 188). All correlate with the ransomware surge collapse. Coverage on these techniques should NOT be reduced — they are dormant, not solved. Section 07 covers the analytical reasoning.
13 · Cross-Week Trend Analysis · Weeks 33 – 38
| Metric | W33 | W34 | W35 | W36 | W37 | W38 |
|---|---|---|---|---|---|---|
| Unique high-conf IOCs | 3,269 | 3,668 | 3,150 | 48,764 | 57,981 | 48,948 |
| Tracked clusters | 118 | 117 | 101 | 89 | 109 | 65 |
| APT / Threat-Actor clusters | 9+ | 11 | 29 | 21 | 33 | 8 |
| Concurrent ransomware operators | 14+ | 50 | 30 | 25 | 33 | 12 |
| Distinct MITRE TTPs | 65+ | 61 | 43 | 36 | 54 | 17 |
| Single-operator max IOCs | ~500 | 826 | 755 | 45,441 | 53,277 | 45,298 |
| Ransomware IOCs (total) | ~150 | 302 | 148 | 98 | 540 | 16 |
| Persistent-C2 operator weeks active | — | — | — | 1 | 2 | 3 |
Six-week narrative in three sentences: Weeks 33-35 were a fragmentation-and-surge phase (concurrent ransomware operators + phishing-kit surge). Weeks 36-37 pivoted to concentration (single persistent C2 operator + elevated APT concurrency + ransomware surge). Week 38 is a consolidation — APT concurrency dropped 75%, ransomware collapsed 97%, TTP surface narrowed 69% — but the persistent C2 operator did not consolidate, entering its third consecutive week.
Directional signals to watch in Week 39: whether the persistent operator makes it four weeks (structural confirmation), whether APT concurrency rebounds above 15 (mid-cycle gap thesis) or stays below (cycle-end thesis), whether ransomware surge returns (new-affiliate-cohort entry timing).
14 · Real-World Defensive Lessons From the Week
Lesson 1 · Consolidation weeks are Finalize weeks, not decommission weeks
Total volume down 16%, APT concurrency down 75%, ransomware down 97%. The temptation for under-resourced SOCs is to interpret this as “the environment eased, we can reduce coverage.” That interpretation is wrong. The operator population that produced the elevated weeks is dormant, not defeated — it will return. Use the quiet window to back-fill Finalize deliverables from prior cycles, not to reduce forward coverage.
Operational takeaway: never decommission a shipped detection artefact during a quiet week. The returning surge will make you pay for it.
Lesson 2 · Three-week single-operator persistence changes the CIDR-enforcement calculus
The persistent C2 operator crossing three weeks moves the “CIDR-density enforcement is a nice-to-have architectural upgrade” argument to “CIDR-density enforcement is now required to have coverage against a specific documented operator.” Programs that have not yet made this architectural transition are structurally uncovered against an empirically-documented threat. That is a defensible ERM-register entry, not an aspirational engineering wish-list item.
Operational takeaway: use the three-week persistence data to make the CIDR-enforcement business case concrete. Not “modern architecture.” Specific-operator-specific-coverage-gap.
Lesson 3 · Ransomware quiet weeks precede the next surge, not the end of the risk
The 97% ransomware collapse is a mid-cycle rest state for the surge cohort — they entered the compromised environments during Week 37 and are running the operations now. Detection posture should treat this week as “operations underway in already-compromised environments,” not “ransomware risk decreased.” Precursor-cascade detection stays live; incident-response readiness stays elevated; if an environment your team supports gets encrypted in the next 2-3 weeks, the compromise happened during Week 37’s surge and consumed in Weeks 38-39.
Operational takeaway: ransomware quiet windows correlate with active in-environment operations, not risk reduction. IR readiness should stay elevated.
Lesson 4 · Signal quality durability is a program-maturity diagnostic
Programs that track high-severity attribution ratio per tier separately from raw volume can distinguish cycle-composition shifts from source-signal degradation. Programs that conflate volume with signal quality react wrong to consolidation weeks — they see “less volume” and interpret “less risk” when the actual reading is “same risk, dormant operator subset.” Two-metric monitoring is a Level-2-to-Level-3 maturity gate.
Operational takeaway: separate volume and signal-quality dashboards. Movement in one without the other is diagnostic.
Lesson 5 · Technique-coverage decisions on a trailing 4-8 week baseline
The 69% TTP surface narrowing from Week 37 to Week 38 will tempt some programs to reduce coverage on the techniques that dropped out. That is exactly the “detection content dies” pattern that TaHiTI Level-3 discipline is designed to prevent. Coverage should be sized to the 4-8 week rolling technique frequency, not the current-week count. Techniques dormant this week will return; coverage kept live catches the return automatically.
Operational takeaway: technique coverage decisions on rolling baselines, not single-week counts.
15 · Predictive Intelligence · What to Expect in Week 39
Data-driven forecast for 21 – 27 September 2026
Confidence high · Persistent C2 operator continues into Week 4. Three-week persistence at industrial-scale IOC production is not consistent with an operator that disappears in Week 4. Base case: Week 39 sees 40,000-55,000 IOCs from this operator. Below 5,000 IOCs would be genuinely surprising and warrant immediate investigation.
Confidence medium · APT concurrency rebounds above 15. Reading B (mid-cycle deployment gap) is the operating hypothesis based on the persistent-operator signal. If correct, Week 39 sees APT concurrency return to the 20-35 range. If Reading A (cycle ending) is correct, Week 39 stays below 15 and returns to the pre-shift baseline. Reading B is our base case.
Confidence medium · Ransomware volume stays quiet for 1-2 more weeks. Typical affiliate rest-phase timing puts the next surge in Weeks 40-42. Week 39 base case: 20-100 total ransomware IOCs. A surge in Week 39 would indicate either a new-affiliate-cohort entry or an early redeployment by the Week 37 cohort.
Confidence lower · TTP surface re-expands to 30+ distinct techniques. If Reading B is correct and APT operators return, TTP breadth returns with them. If Reading A is correct and the current cycle is ending, TTP breadth stays narrow through the next cycle setup period.
Three specific things to watch for in Week 39
- Persistent-operator CIDR fingerprint rotation — has the operator changed CIDR sets meaningfully across the 21-day window? If yes, defenders’ CIDR block lists need daily-or-better refresh cadence. If no, weekly refresh remains sufficient.
- APT cluster identity rotation — do the 8 clusters visible this week return in Week 39, or do 8-25 different clusters appear? Identity turnover is a Reading-B signal (new deployment wave). Identity continuity is a Reading-A signal (same reduced-population operating baseline).
- Framework category continuity — the single Framework-category operator (138 IOCs this week) also appeared in Week 37. If they return in Week 39, that is another persistent-operator confirmation alongside Cluster A01.
What would surprise us
Cluster A01 disappearing between Week 38 and Week 39 would be genuinely surprising. Three weeks of sustained industrial-scale IOC production is not consistent with an operator that goes silent on one week’s notice. A disappearance likely means either upstream takedown (worth immediate open-source investigation) or strategic identity pivot (worth watching for a Cluster A-something-else with similar profile appearing).
16 · Risk Register Language for Enterprise Risk Management
Ready-to-Paste ERM Register Entries
Two register-entry drafts below. Adapt to your organisation’s taxonomy; risk IDs illustrative.
Threat intelligence has documented a single named command-and-control operator sustaining infrastructure production at industrial scale across three consecutive weekly intelligence windows (Weeks 36-38, 31 Aug – 20 Sept 2026), totalling approximately 144,036 network addresses at an average provisioning rate of one address per ~13 seconds sustained. The operator is consistent with an infrastructure-as-a-service adversary supplier serving multiple downstream affiliate operators. Individual IP-address-level enforcement controls scale below the operator’s provisioning rate by two orders of magnitude. Effective coverage requires CIDR-density enforcement architecture; organisations lacking this control are structurally uncovered against a specific documented operator that has demonstrated sustained multi-week production capability. Risk owner: Head of Security Architecture. Review cadence: monthly through Q1 2027. Treatment plan: prioritise CIDR-level enforcement capability in perimeter and egress control stack; documented in security-architecture roadmap.
Empirical evidence across Weeks 33-38 September 2026 demonstrates the current adversary-pressure environment operates on 3-4 week deployment-and-consumption cycles rather than a stable operating baseline. Concurrent APT / Threat-Actor cluster counts have varied from 8 to 33 across five consecutive weekly windows; concurrent ransomware operator counts from 12 to 50; distinct MITRE ATT&CK technique breadth from 17 to 65. Detection coverage sized to any single-week snapshot is structurally under-sized for cycle-peak weeks and over-sized for cycle-trough weeks. The organisation’s threat-hunting program must operate on trailing 4-8 week rolling baselines rather than single-week reactive sizing to avoid coverage gaps during elevated-cycle weeks. Risk owner: CISO. Treatment plan: adopt trailing-baseline coverage-sizing model per TaHiTI Maturity Doctrine Level-3+ discipline; documented in weekly-advisory-cycle response protocol.
If a breach in your environment traces to infrastructure supplied by the persistent operator documented in this cycle, the after-action review will note the following. (a) The operator’s presence was empirically documented across three consecutive weekly intelligence windows starting 31 August 2026, in publicly-available advisories, with volumetric detail sufficient to size a CIDR-density enforcement control. (b) The recommended architectural control (CIDR-level block-listing with weekly-or-better refresh) was explicitly named in advisories dated 13 September and 20 September 2026. (c) The record of when the organisation acquired coverage against this specific operator — or did not — will be visible in change-management logs, procurement records and detection-content commit history.
If the organisation dismissed the Week 38 consolidation as risk de-escalation and reduced coverage accordingly, the after-action will additionally note that the reduction happened after published advisories warned specifically against that response. Board-level questions in that scenario are not about the technical outcome; they are about why the documented, dated warnings were not acted on.
The single most durable insulation against that after-action is a documented weekly review of the persistent-operator CIDR feed, with sign-off, retained in a change-management system for at least the length of the regulatory retention window that applies to your industry. This is a five-person-minutes exercise that produces a paper trail. It costs almost nothing to do and quite a lot not to.
17 · Four Production-Ready Sigma Rules
Four rules matched to this week’s top-15 technique surface plus persistent-C2 coverage. All rules HTML-escaped for safe rendering.
title: Egress To CIDR Attributed To Multi-Week Persistent C2 Operator
id: hfl-2026-038-01
status: experimental
description: Detects outbound sessions to CIDRs currently attributed to persistent C2 operators active for 3+ consecutive weekly windows.
logsource:
category: network_connection
detection:
selection:
dst_cidr|in|persistent_c2_operator_watchlist: true
operator_persistence_weeks|gte: 3
connection_count|gte: 2
timeframe: 24h
condition: selection
fields: [src_host, dst_cidr, connection_count, operator_persistence_weeks]
level: high
tags: [attack.command_and_control, attack.t1105, attack.t1071_001]
title: PowerShell With Base64 or Obfuscated Argument Chain
id: hfl-2026-038-02
status: experimental
description: Detects PowerShell invocations with base64-encoded commands or characteristic obfuscation markers.
logsource:
category: process_creation
product: windows
detection:
selection_powershell:
Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
selection_obfuscation:
CommandLine|contains:
- '-enc'
- '-EncodedCommand'
- 'FromBase64String'
- '[char]'
- 'IEX(New-Object'
filter_admin:
User|contains: 'admin_scheduled_task_svc'
condition: selection_powershell and selection_obfuscation and not filter_admin
fields: [Image, CommandLine, ParentImage, User]
level: high
tags: [attack.execution, attack.t1059_001, attack.defense_evasion, attack.t1027]
title: Spearphishing Link Click Followed By Drive-By Payload Fetch
id: hfl-2026-038-03
status: experimental
description: Detects a mail-client link click quickly followed by an outbound HTTP fetch to a payload URL.
logsource:
category: proxy
detection:
selection_mail:
source_process|endswith:
- '\outlook.exe'
- '\thunderbird.exe'
selection_payload:
response_content_type|contains:
- 'application/octet-stream'
- 'application/x-msdownload'
timeframe: 5m
condition: selection_mail and selection_payload
fields: [src_user, dst_url, response_content_type, referer]
level: high
tags: [attack.initial_access, attack.t1566_002, attack.t1189]
title: Ransomware Precursor Cascade - Shadow-Copy Delete + Defender Disable
id: hfl-2026-038-04
status: experimental
description: Detects the canonical ransomware pre-encryption cascade. Family-agnostic; stays live across cycle-quiet weeks.
logsource:
category: process_creation
product: windows
detection:
selection_vssadmin:
Image|endswith: '\vssadmin.exe'
CommandLine|contains:
- 'delete shadows'
- 'resize shadowstorage'
selection_defender_off:
CommandLine|contains:
- 'Set-MpPreference -DisableRealtimeMonitoring'
- 'Set-MpPreference -DisableBehaviorMonitoring'
timeframe: 10m
condition: selection_vssadmin or selection_defender_off
fields: [Image, CommandLine, ParentImage, User]
level: critical
tags: [attack.impact, attack.t1486, attack.t1490, attack.defense_evasion, attack.t1562_001]
18 · The 60-Minute Ops Plan
What to do this week — before Wednesday
- MINUTES 0-10 · Refresh persistent-C2 CIDR block list — Week 3 of the same operator means the CIDR fingerprint has likely rotated at least once. Pull the current CIDR set from the HuntIntel Cohesive-IP view; diff against last week’s block list; append changes. Weekly minimum refresh cadence.
- MINUTES 10-20 · Verify all Weeks 35-37 Sigma rules remain production-tier — audit the deployment tier of every rule shipped during the elevated-cycle weeks. Any rule that regressed to test tier during quiet windows must be re-promoted immediately. Consolidation weeks are exactly when test-tier regressions happen unnoticed.
- MINUTES 20-30 · Back-fill any missed Finalize deliverables — pull the hunt-ticket list from Weeks 35-37, filter for tickets closed without complete Finalize deliverables (Findings Log · Detection Content · Runbook Update · Threat-Model Update · Backlog Re-Score). Assign to hunt leads for retroactive completion this week while the queue is quiet.
- MINUTES 30-40 · Ship persistent-C2 CIDR block list to Detection Engineering as a formal handoff — Sigma-01 template above. Detection Engineering should own the block list as a maintained artefact rather than the hunt team maintaining it ad-hoc.
- MINUTES 40-50 · Executive brief prep · the Week 38 consolidation narrative — Section 13 cross-week trend table (spanning W33-W38) is the boardroom slide for this week. Combined with Sections 04-06 deep dives on the consolidation-vs-persistence tension, this is a genuinely useful strategic-update artefact for a CISO. Schedule the brief within 48 hours.
- MINUTES 50-60 · TaHiTI abstract for Week-39 forecast validation — draft two hypothesis-based abstracts covering (a) the persistent-operator continuation validation and (b) the APT-concurrency-rebound-versus-return signal. Both hunts execute in Week 39 against fresh telemetry; both produce the Week 38 forecast resolution answer.
See this week’s threat surface inside the operator console
HuntIntel exposes the same corpus this advisory is built from — continuously updated. Per-cluster fingerprint, actor migration timeline, live CIDR-density feed, sector heatmap, country attribution atlas.
19 · Top IOCs per Indicator Type
Operator-grade extractions for the 14 – 20 September window · high-severity attributed indicators only · filtered to named-adversary sources. Rendered defanged per standard IOC-publishing practice (re-fang on import: [.] → .; hxxp → http).
hxxp/hxxps replacement.Top 15 · IP addresses · high-severity · named-adversary
// Backdoor · Botnet · RAT · APT · Malware-Activity attribution
| # | Indicator | Category | Severity |
|---|---|---|---|
| 1 | 1.14.76.115 |
Backdoor | HIGH |
| 2 | 1.14.100.25 |
Backdoor | HIGH |
| 3 | 101.35.219.220 |
APT | HIGH |
| 4 | 101.42.186.233 |
Backdoor | HIGH |
| 5 | 101.133.145.177 |
Botnet | HIGH |
| 6 | 101.189.155.57 |
Malware-Activity | HIGH |
| 7 | 102.220.88.241 |
Backdoor | HIGH |
| 8 | 102.220.160.198 |
RAT | HIGH |
| 9 | 102.220.163.36 |
RAT | HIGH |
| 10 | 103.17.90.61 |
Malware-Activity | HIGH |
| 11 | 103.106.191.160 |
Malware-Activity | HIGH |
| 12 | 103.124.157.49 |
Backdoor | HIGH |
| 13 | 103.150.112.246 |
Malware-Activity | HIGH |
| 14 | 103.163.47.202 |
Backdoor | HIGH |
| 15 | 103.170.217.184 |
Malware-Activity | HIGH |
Top 15 · Domains · high-severity · defanged
// Lookalike-domain fleets · C&C Server · Malware-Activity delivery domains
| # | Indicator (defanged) | Category | Severity |
|---|---|---|---|
| 1 | 02eiya9o[.]xn--ndux-kza[.]store |
Malware-Activity | HIGH |
| 2 | 086bn6e3[.]prostafene[.]com |
Malware-Activity | HIGH |
| 3 | 09xadksl[.]wismajoko[.]net |
Malware-Activity | HIGH |
| 4 | 0ijvvr6j[.]en-en--cardioslim[.]com |
Malware-Activity | HIGH |
| 5 | 0rr59n2[.]en-pegasus[.]com |
Malware-Activity | HIGH |
| 6 | 11168833[.]com |
C&C Server | HIGH |
| 7 | 11170011[.]com |
C&C Server | HIGH |
| 8 | 1862[.]cc |
C&C Server | HIGH |
| 9 | 1cfx1w5z[.]zen-sulin[.]com |
Malware-Activity | HIGH |
| 10 | 1dpxqjxq[.]larize[.]store |
Malware-Activity | HIGH |
| 11 | 1g5uv0u1[.]wisma138eula[.]org |
Malware-Activity | HIGH |
| 12 | 1khihj5o[.]bizne[.]store |
Malware-Activity | HIGH |
| 13 | 1xbitios[.]com |
Malware-Activity | HIGH |
| 14 | 1yyhju9i[.]noug[.]store |
Malware-Activity | HIGH |
| 15 | 208certain[.]workers[.]dev |
Backdoor | HIGH |
Top 15 · File hashes · SHA-256 · high-severity
// APT-attributed payloads · Backdoor samples · Malware-Activity variants
| # | SHA-256 | Category | Severity |
|---|---|---|---|
| 1 | 00aff1a72c5d5635ab36ce2eb370718a7f0557a0 |
APT | HIGH |
| 2 | 00ba0d5aea129f098b5a609633ac77cd642fddba8b64f6332e49e6d33294992e |
Malware-Activity | HIGH |
| 3 | 00e1cc0fb1355c196c069791a02b4a5f3b57ae94 |
APT | HIGH |
| 4 | 008e04a7807f9ed59d77942b1d268e4a93bb82316346f48e5f5b663233db3fff |
Malware-Activity | HIGH |
| 5 | 011cdd15e68b1c3b2c346bf52193081a518b92a68c588d7fbc238f08c2c9b3b9 |
Backdoor | HIGH |
| 6 | 013e24180954380a2cba9d2adb88ad13dbec1181a4a88406427709219b7b5582 |
Malware-Activity | HIGH |
| 7 | 013e587247324cfa3005443d2b8036f9a434cafafa1d8a56a6f5637b3dd9d3c1 |
Malware-Activity | HIGH |
| 8 | 018fca3266c87c10d4f46930878ffbe5155ae4a457c875d1e22682a80d7118a5 |
Malware-Activity | HIGH |
| 9 | 023a8a4e54dd9264a7d0cca3fd08cae15c661c91bb477dfc08a5c0f9939fb5cb |
APT | HIGH |
| 10 | 0242e4675a8c55d179341a617c074e6d8c5752ac4158f73cdbec8a400a9e306a |
Backdoor | HIGH |
| 11 | 02ac1914fcb4efae0699571751acd700ef0a1933312cd37e72bb7f37bacf4776 |
Malware-Activity | HIGH |
| 12 | 02dcc3832903e36db797539279400f40831ddc858e7d0d4242a69fd5910d8c4c |
Malware-Activity | HIGH |
| 13 | 032da34975f6e82ad8728a0197cb4153a75122b7 |
Backdoor | HIGH |
| 14 | 0409b0fd4172b73997eed91b27a9c75ad0052f344f0a5ee89e87d07b45597b1a |
Malware-Activity | HIGH |
| 15 | 02f8c0841d3fb9a4d13c8d0b8266b23949c0b8f1 |
Malware-Activity | HIGH |
Top 15 · URLs · high-severity · defanged
// Backdoor staging URLs · Ransomware-as-a-service infrastructure (including .onion)
| # | Indicator (defanged) | Category | Severity |
|---|---|---|---|
| 1 | hxxp[://]103[.]242[.]12[.]143:1234/?h=103[.]242[.]12[.]143&p=1234&t=ws&a=w64&stage=true |
Backdoor | HIGH |
| 2 | hxxp[://]103[.]242[.]12[.]143:1234/?h=103[.]242[.]12[.]143&p=1234&t=tcp&a=w64&stage=true |
Backdoor | HIGH |
| 3 | hxxp[://]107[.]161[.]168[.]217/?h=107[.]161[.]168[.]217&p=80&t=tcp&a=w64&stage=true |
Backdoor | HIGH |
| 4 | hxxp[://]107[.]161[.]168[.]217/?h=107[.]161[.]168[.]217&p=80&t=ws&a=w32&stage=true |
Backdoor | HIGH |
| 5 | hxxp[://]107[.]161[.]168[.]217/?h=107[.]161[.]168[.]217&p=80&t=ws&a=w64&stage=true |
Backdoor | HIGH |
| 6 | hxxp[://]156[.]238[.]224[.]156:5522/?h=156[.]238[.]224[.]156&p=5522&t=ws&a=w32&stage=true |
Backdoor | HIGH |
| 7 | hxxp[://]222[.]112[.]70[.]149:8084/?h=222[.]112[.]70[.]149&p=8084&t=tcp&a=w32&stage=true |
Backdoor | HIGH |
| 8 | hxxp[://]34[.]92[.]225[.]25:8084/?h=34[.]92[.]225[.]25&p=8084&t=tcp&a=w64&stage=true |
Backdoor | HIGH |
| 9 | hxxp[://]34[.]92[.]225[.]25:8084/?h=34[.]92[.]225[.]25&p=8084&t=ws&a=w32&stage=true |
Backdoor | HIGH |
| 10 | hxxp[://]3ytm3d25hfzvbylkxiwyqmpvzys5of7l4pbosm7ol7czlkplgukjq6yd[.]onion |
Ransomware-as-a-service | HIGH |
| 11 | hxxp[://]47[.]254[.]173[.]184:8443/?h=47[.]254[.]173[.]184&p=8443&t=tcp&a=w32&stage=true |
Backdoor | HIGH |
| 12 | hxxp[://]47[.]254[.]173[.]184:8443/?h=47[.]254[.]173[.]184&p=8443&t=tcp&a=w64&stage=true |
Backdoor | HIGH |
| 13 | hxxp[://]47[.]254[.]173[.]184:8443/?h=47[.]254[.]173[.]184&p=8443&t=ws&a=w32&stage=true |
Backdoor | HIGH |
| 14 | hxxp[://]5butbkrljkaorg5maepuca25oma7eiwo6a2rlhvkblb4v6mf3ki2ovid[.]onion/ |
Ransomware-as-a-service | HIGH |
| 15 | hxxp[://]89[.]34[.]227[.]96:8088/?h=89[.]34[.]227[.]96&p=8088&t=tcp&a=w32&stage=true |
Backdoor | HIGH |
Full-corpus access: the 48,948 unique IOCs surfaced this week (of which the above are the top-severity attributed samples) are available in the HuntIntel operator console under the Adversary Intel Search view. Filter by adversary_type, category, first_seen date range, and severity band; export as STIX, MISP, or CSV. Open the operator console →
20 · Frequently Asked Questions
Is the elevated APT cycle from Weeks 35-37 over?
Undetermined. Week 38’s sharp drop is consistent with either a cycle-ending trajectory or a mid-cycle deployment gap. The persistent C2 operator’s continued activity leans toward the gap interpretation (an ecosystem-wide cycle end would also see the infrastructure supplier throttle production). Week 39 will resolve which reading is correct. Do not reduce coverage in the meantime.
Should we treat the ransomware collapse as risk reduction?
No. The 97% volume drop reflects the affiliate cohort completing their deployment phase and entering consumption. The affiliates are now inside compromised environments running encryption and negotiation operations that produce zero external IOC volume. Ransomware risk is not lower this week; it is differently distributed.
How long can the persistent C2 operator continue?
Sustained multi-month production is empirically possible. Historical infrastructure-as-a-service C2 operators in the corpus have shown 6-12 month continuous operation windows. Three consecutive weeks is the confirmation threshold that this operator is in that class; assume the operator continues indefinitely until it doesn’t, and treat CIDR-density enforcement as required infrastructure.
Which Sigma rule should ship first this week?
Sigma-01 (T1105 + T1071.001 persistent-C2 CIDR contact). It addresses the specific documented three-week persistent operator directly. Sigma-04 (ransomware precursor cascade) stays live from prior weeks regardless of the volume collapse.
How do the anonymised Cluster IDs relate across weeks?
Cluster IDs generally rotate weekly, except where continuity is explicitly noted. Cluster A01 in this document and in Week 36/37 briefings refers to the same persistent C2 operator — this consistency is preserved specifically for the persistence-signal narrative. All other clusters (A02-A40) should be treated as fresh identifiers.
What is the correct posture for detection engineering during consolidation weeks?
Hold posture. Do not decommission any rule shipped during elevated-cycle weeks. Do not reduce coverage on TTPs that fell off this week’s top-15. Do use the quieter alert queue to back-fill Finalize deliverables from prior weeks and audit that no shipped rule regressed to test tier during the quiet window.
When does the next ransomware surge arrive?
Base case: Weeks 40-42, based on typical affiliate-cycle rhythm (1-3 week consumption + 1-4 week rest). Earlier than Week 40 would indicate either a new-affiliate cohort entering the market or an early redeployment by the Week 37 cohort. Later than Week 42 would indicate the current cohort is exiting the market entirely.
What is on the HuntIntel platform that this document does not show?
Live CIDR-density feed with per-operator persistence tracking. Actor migration timelines. Sector heatmaps at sub-industry level. Country attribution atlas. Cohesive-IP view. AIaaS attack-infrastructure attribution. Custom TaHiTI-abstract templates. Detection-content marketplace. This document is a weekly snapshot; the operator console is the continuous surface.
How do I subscribe to the weekly advisory distribution?
The weekly advisory publishes every Sunday at hackforlab.com under the Threat Intelligence category. RSS feed available for the category; bookmark the operator console at huntintel.hackforlab.com for continuous intelligence between briefings.
21 · Close
Consolidation across most of the surface. Persistence on the tier that matters most. Three consecutive weeks of the same industrial-scale command-and-control operator meets the empirical confirmation threshold for structural presence — this operator is no longer a hypothesis; it is a documented fact of the current threat environment. The APT concurrency drop and the ransomware collapse can be communicated as reassurance, but only if the operator persistence is communicated as the counter-fact in the same sentence. Anything else is a briefing that mis-shapes the reality.
Detection engineers: hold posture. Every rule shipped across Weeks 35-37 stays in production. Retiring detection content during a cycle-quiet window is how programs get caught out when the cycle returns — and if the returning cycle happens to bring the operators who use the techniques you just removed, the post-incident timeline will not read well.
CTI and hunt leads: draft two Week-39 hypothesis abstracts before Wednesday — one for persistent-operator continuation validation, one for APT-concurrency rebound-versus-return. Both hunts resolve the ambiguity in this week’s forecast. A team that lets Week 39 arrive before those abstracts exist has already forfeited the operational advantage that the current quiet window offers.
CISOs and risk officers: the consolidation-versus-persistence tension is boardroom-ready material — but only if you communicate both halves. Section 13’s cross-week trend table is the strategic slide. The three-week persistent-operator finding is what belongs in the enterprise risk register this cycle. If you brief only the reassuring numbers and skip the persistence signal, the follow-up question from the audit committee in Q1 will not be friendly. Use the wording provided in Section 16 verbatim — it was drafted to survive a board-level review.
Next week’s Week 39 briefing publishes on Sunday. Predictive framing is in Section 15. Bookmark huntintel.hackforlab.com for continuous intelligence between briefings.
The weekly advisory is one snapshot per week. HuntIntel is the operating surface.
Every metric in this document is downstream of a live corpus that updates continuously. The persistent C2 operator that entered Week 3 this cycle. The 8 concurrent APT clusters. The 17 distinct MITRE techniques. All of them are windows onto a moving system that publishes new attribution hourly.
For CISOs: the strategic dashboards — cycle-level metrics, trailing-baseline coverage, cluster-persistence tracking, category concentration heatmaps — surface the boardroom slides directly. For SOC directors: the operational feeds — live CIDR-density, actor migration timelines, sector heatmap, Cohesive-IP view — feed detection engineering pipelines. For hunt leads: the TaHiTI-aligned artefact templates, backlog-scoring math, hypothesis abstract library, and detection-content marketplace close the Finalize loop.
Cite this document as: HackForLab CTI Research. “Weekly Threat Advisory · September 14-20, 2026.” huntintel.hackforlab.com.
