Unknown Threats

Between May and July 2026, security researchers deployed an unauthenticated Model Context Protocol (MCP) honeypot server to observe how threat actors exploit AI agent infrastructure. Of approximately 1,000 sources that reached the decoy, 596 spoke the protocol and 24 proceeded to actively exploit it. These operators executed 628 shell commands, 255 file reads, and 248 secrets-store lookups, with 19 hunting credentials and 4 attempting container escapes. Activity escalated from 39 tool calls in May to 877 by mid-July. Three stolen credentials were subsequently used against a live AWS account, with two cases involving Bedrock model invocation for LLMjacking. The attacks demonstrated automated reconnaissance, credential harvesting, container escape attempts, backdoor account creation, and Kubernetes enumeration, revealing that exposed MCP servers represent a growing attack surface as AI agent infrastructure proliferates.

Between mid-2025 and mid-2026, threat actors using tradecraft associated with ShinyHunters targeted customer SaaS applications, particularly Salesforce instances, through three primary intrusion paths. Voice phishing campaigns impersonated IT support to trick employees into authorizing malicious OAuth applications. Supply chain compromises leveraged trusted integrations including Salesloft, Gainsight, and Klue to obtain OAuth tokens for downstream customer access. Misconfigured guest access enabled exploitation of Aura framework functionality for unauthorized data queries. These techniques abused legitimate OAuth relationships to inherit user and application privileges, enabling enumeration and exfiltration of CRM data while evading authentication detections. The campaigns targeted multiple industries including retail, education, and manufacturing, highlighting risks in OAuth-connected applications and third-party integrations.

KRVTZ-NET IDS alerts for 2026-06-28

KRVTZ-NET IDS alerts for 2026-06-27

KRVTZ-NET IDS alerts for 2026-05-24

The KRVTZ-NET IDS alerts for 2026-05-23 report observed network reconnaissance activity identified through OSINT sources. The alerts primarily indicate outbound traffic associated with Baidu Spider Crawler User-Agent IP addresses. No specific vulnerabilities or exploits are identified, and no affected product versions are noted. There is no patch or remediation required as this is an observation of network scanning or crawling activity. The severity is assessed as low given the nature of the activity and lack of confirmed exploitation.

KRVTZ-NET IDS alerts for 2026-05-22

The KRVTZ-NET IDS alerts from 2026-05-21 report network activity consistent with reconnaissance targeting Fortigate VPN devices. Specifically, multiple IP addresses were observed making repeated GET requests to the /remote/logincheck endpoint, which is associated with CVE-2023-27997, a known vulnerability in Fortigate VPN. Several other IPs exhibited suspicious or test user-agent strings, indicating scanning or probing behavior. No active exploitation or confirmed compromises are reported. The activity is categorized as low severity due to its reconnaissance nature without evidence of exploitation.

KRVTZ-NET IDS alerts for 2026-05-19

The KRVTZ-NET IDS alerts for 2026-05-17 report multiple network reconnaissance and scanning activities, including repeated exploit attempts against Fortigate VPN (CVE-2023-27997) and a React Server Components vulnerability (CVE-2025-55182). Several IP addresses were observed making suspicious requests such as repeated GET requests to /remote/logincheck and attempts to access hidden environment files. These activities are indicative of preliminary probing rather than confirmed exploitation. No known exploits in the wild or confirmed breaches have been reported. The overall severity is assessed as low due to the absence of confirmed successful attacks.

KRVTZ-NET IDS alerts for 2026-05-16

KRVTZ-NET IDS alerts for 2026-05-15

KRVTZ-NET IDS alerts for 2026-05-14

The KRVTZ-NET IDS alerts for 2026-05-13 report network reconnaissance activity primarily involving scanning by Exabot webcrawler user agents. Some IP addresses are associated with attempts to probe known vulnerabilities, including CVE-2023-27997 targeting Fortigate VPN's /remote/logincheck endpoint and CVE-2025-55182 related to unsafe property access in React Server Components (React2Shell). There is no evidence of confirmed exploitation or active attacks in this data. The activity is informational and categorized as low severity.

KRVTZ-NET IDS alerts for 2026-05-12

KRVTZ-NET IDS alerts for 2026-05-11

KRVTZ-NET IDS alerts for 2026-05-10

KRVTZ-NET IDS alerts for 2026-05-09