Threat video1:00
NCSC CTO Weekly Summary (Sep 13): Detection & IOCs
Cisco FMC CVE-2026-20079 leads 13 flaws in this week's NCSC roundup, with 9 detection rules, 26 IOCs and a free Splunk SPL rule.
Read the full threat intel for NCSC CTO Weekly Summary (Sep 13): Detection & IOCs →
Chapters
- 0:00The hook440+ instances exploited.
- 0:04The storyExploitation started August thirtieth.
- 0:10Attack pathExploit PaperCut with in-memory implants.
- 0:24AttributionAttributed to APT31.
- 0:29Indicators of compromise23 indicators to hunt: 12 IPs, 4 domains and 4 SHA-256 hashes, and more.
- 0:38MITRE ATT&CK techniques18 ATT&CK techniques, from initial access to command and control.
- 0:43Remediation6 steps now: Apply Cisco hotfixes.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00440+ instances exploited.
0:05Exploitation started August thirtieth.
0:07AI agents reached Domain Admin.
0:11Exploit PaperCut with in-memory implants.
0:14AI agents dumped LSASS and credentials.
0:17Escalated with noPac and DCSync.
0:20Ligolo tunnels persisted across victims.
0:25Attributed to APT31. Confidence: medium.
0:3023 indicators to hunt: 12 IPs, 4 domains and 4 SHA-256 hashes, and more.
0:3918 ATT&CK techniques, from initial access to command and control.
0:446 steps now: Apply Cisco hotfixes.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.