feat: CTI pipeline hunts — 2026-07-11

[triw0lf]

Source articles

• GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware — Microsoft Threat Intelligence, 2026-07-09
• The 'Ghost' in the Database: Recovering Active ADFS Signing Keys via Machine DPAPI — Mandiant / Google Threat Intelligence, 2026-07-07
• Cavern Manticore: Exposing Iran-Linked Modular C2 Framework — Check Point Research, 2026-07-06
• UAT-7810 continues building ORB networks using new malware — Cisco Talos, 2026-07-07
• No Manners Here: The Ruthless Rise of The Gentlemen Ransomware — Unit 42, 2026-07-10
• FSB's matryoshka #3/3: Gamaredon's GammaSteel — Sekoia, 2026-06-04
• The Sharp Taste of Mimo'lette: Mimo targeting Craft CMS — Sekoia, 2025-05-27

New hunts

From "GigaWiper: Anatomy of a destructive backdoor"

• H222 — Destructive disk wipe via raw physical-drive writes and IOCTL_DISK_CREATE_DISK partition reinitialization (T1561.001, T1561.002)

From "Recovering Active ADFS Signing Keys via Machine DPAPI"

• H223 — AD FS active token-signing key theft from machine DPAPI enabling Golden SAML forgery (T1606.002, T1552.004)

From "Cavern Manticore: Iran-Linked Modular C2 Framework"

• H224 — Cavern Agent C2 detection via encoded HTTP protocol fingerprint (X-User-token…00, fixed URIs) (T1132.001)

From "FSB's matryoshka #3/3: Gamaredon's GammaSteel"

• H225 — USB-triggered document collection via WMI removable-drive event subscription (T1120, T1025)

From "The Sharp Taste of Mimo'lette: Mimo targeting Craft CMS"

• H226 — Linux residential-proxy bandwidth hijacking (proxyjacking) via proxyware ELF execution (T1496.002)

From "UAT-7810 continues building ORB networks"

• M027 — Perimeter device acting as an ORB external-proxy relay, volumetric detection (T1090.002)

From "No Manners Here: The Gentlemen Ransomware"

• B030 — Baseline internal SMB/NTLM authentication to surface coerced/reflected auth, CVE-2025-33073 (T1210)

Category breakdown

• Flames: 5 · Embers: 1 · Alchemy: 1