Reporting on cyberattacks against Japanese entities rose 48% between Q2 and Q3 2026, encompassing ransomware, exploitation of vulnerabilities, credential leaks, and service disruptions. Significant incidents exposed millions of customer records and disrupted operations across multiple sectors, with attacks on shared service providers extending the impact to downstream organizations. Further incidents in October 2026 indicate that these trends have persisted into Q4. This report examines potential contributing factors, including demand for Japanese personal information, legacy systems, software vulnerabilities, weak API controls, and AI’s likely role in lowering technical and language barriers. New incident-reporting requirements under Japan’s Active Cyber Defense (ACD) law, effective October 1, may further increase the number of disclosures of incidents affecting Japanese organizations.
Two critical remote code execution vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619 (nicknamed “PHP2Shell”), are reportedly being targeted in active exploitation attempts following the leak of technical details ahead of PHP’s October 21, 2026, security release. Because the flaws affect PHP itself rather than a specific application, websites running vulnerable PHP versions may be exposed, including those built on WordPress, Drupal, and Joomla.
This post covers PHP’s advisories, exploitation reports, public proof-of-concept exploits, exposure data, and patching guidance, along with details from the TTP Instance Insikt Group® published to customers. Attack Surface Intelligence signatures for CVE-2026-109618 and CVE-2026-109619 are available to Recorded Future customers. Organizations running PHP should patch immediately.
The threat actor linked to recent AI-assisted attacks on South Korean financial institutions was testing infrastructure and assembling attack tools as early as August 2026, weeks before the banking campaign became public, according to new research from Recorded Future’s Insikt Group. Subsequent public reporting indicated that the breaches exposed personal data belonging to at least 68,000 people across at least seven financial institutions.
Insikt Group’s investigation expands the known timeline and capabilities of the actor, tracked as TAG-217. Insikt Group uncovered tools designed to steal cryptocurrency wallet files, gain greater access to Linux systems, and test weaknesses in mobile devices. The findings illustrate the “jagged edge” of AI-enabled attacks: threat actors realizing significant gains while committing basic operational security mistakes. AI helps attackers pursue more targets across more environments, but does not prevent them from making the security mistakes that allowed Recorded Future to uncover preparations and capabilities beyond the reported banking campaign. Those mistakes give defenders opportunities to identify related activity and disrupt operations.
Targeting South Korean Banks
In early October 2026, South Korea’s Financial Services Commission (FSC) disclosed that multiple financial institutions had been hit by cyberattacks. The attacks had compromised different systems and allowed unauthorized access to different data at each victim entity, with one breach exposing the personal information of an outsourced developer and another resulting in the theft of customer data. Industry sources reported that the attacks involved the use of ARTEX, a Chinese-language, open-source AI penetration testing framework. The variety of targets at each financial institution likely demonstrates an advantage of AI over human operators: the ability to opportunistically test for weaknesses at scale until a valuable target is found.
On October 7, 2026, public analysis of the incident identified that the threat actor, suspected to be a Chinese speaker, used several AI tools as part of their campaign, including Claude Code, DeepSeek, Grok, and Zhipu AI. Other reports shared network infrastructure indicators used in the campaign, including a primary server running ARTEX and the use of residential proxies, likely to obfuscate the origin of the activity.
Recorded Future investigated this infrastructure to better understand the actor’s operations and tracked this activity under the designation TAG-217.
Putting Together a More Complete Timeline for TAG-217
Differentiating between agentic and human-operated attacks can be difficult, especially when skilled threat actors use AI to enhance operational effectiveness. Agentic attacks use the same tactics and techniques as human operators, though faster and at scale. In the case of TAG-217, operational security mistakes allowed Insikt Group to piece together how the threat actor used AI tools to amplify their intrusion attempts across multiple environments and to uncover earlier preparations and a broader set of capabilities than public reporting revealed.
TAG-217 routed its traffic through residential internet connections, likely to reduce the chances of detection. Recorded Future analysts used open directories within TAG-217 infrastructure to further understand its operations (Source: Recorded Future)
Although Recorded Future was founded by Swedish scientists and innovators, our HQ has always been a key part of the Somerville and Boston tech startup scene. Recognized for our award-winning platform and amazing culture, the team and our HQ have changed quite a bit over the years.
Initially established in Somerville, MA, north of Boston, the Futurists' headquarters was once a laundromat. Twelve years after we set up camp there, it is time for the next chapter. Our HQ has moved to downtown Boston in Post Office Square — and we’re ready to make new memories there.
Somerville Office laundromat sign | Boston Office (Current) on Franklin Street
Key functions operate out of our Boston-based office, including customer success, security, data engineering, product, and marketing. Nearly 200 Futurists call the Boston office their home base, and many others travel for team meetings and strategic onsites.
“In 2019, when I started, we were about 300 people globally — now we’re almost 200 just in the Boston office!”
Lacey Maddalena
Global Office Operations & Facilities Director
“We’ve grown to more than 1,000 employees, and let’s just say the days of one-person teams are behind us!”
Joint research by Cisco Talos and Recorded Future’s Insikt Group examined sustained cyber-espionage activity by TAG-193 targeting government organizations across Central Asia and the wider Commonwealth of Independent States (CIS). Tracked by Cisco Talos as UAT-6275 and also known as Silent Lynx, TAG-193 combines diplomatic and economic targeting with an interest in environmental policy, water resources, and forestry. Exposed infrastructure provided new visibility into its malware, operational practices, and evolving delivery techniques. The findings point to possible links to Kazakhstan, but questions remain about the group’s origins. This post highlights how TAG-193’s operations reflect the intelligence value of regional diplomacy and resource management, and how its expanding toolkit supports that mission.
Government Targeting across the Region
TAG-193’s targeting extends across government institutions responsible for diplomacy, economic development, agriculture, and environmental management. These organizations hold information that can inform negotiations, economic planning, and regional security decisions. Across Central Asia, shared river systems and interconnected energy and transport infrastructure give such information particular strategic value.
In September 2026, Insikt Group® identified 94 high-impact vulnerabilities to prioritize for remediation, 59 of which had a Very Critical Recorded Future Risk Score. This represents a 29% increase from last month. 43 of these vulnerabilities were surfaced through the US Cybersecurity and Infrastructure Security Agency (CISA)’s Known Exploited Vulnerabilities (KEV) catalog, 37 were reported in open sources and validated by Insikt Group, and 14 were exclusively surfaced through honeypot data.
The 94 vulnerabilities identified affected products from 58 vendors, with Linux and Microsoft together accounting for approximately 13% of the vulnerabilities. The remaining exposures spanned network edge and security management appliances; operating systems (OS) and mobile devices; collaboration, content management, and enterprise platforms; artificial intelligence (AI), developer, and automation tools; and operational technology and industrial systems.
September reporting also highlighted zero-day exploitation of CVE-2026-88771 and CVE-2026-88772 (NetScaler), as well as renewed exploitation of CVE-2026-35273 (PeopleSoft) against unpatched systems.
Quick reference: September 2026 vulnerability table
All 80 vulnerabilities below were actively exploited or operationally weaponized in September 2026.This table does not include the 14 CVEs that were exclusively surfaced through honeypot data, which are available to Recorded Future Intelligence Platform customers via the CVE Monthly report.The table below also provides examples of public PoCs identified by Insikt Group. These PoCs were not tested for accuracy or efficacy. Vulnerability management teams should exercise caution and verify the validity of PoCs before testing.
Table 1:List of vulnerabilities that were actively exploited in September 2026 based on Recorded Future data (excluding honeypot-sourced CVEs).
Key trends: September 2026
September reporting linked NightEagle and UNC3569 to GhostContainer and GRAYRABBIT deployments, while Cisco FMC exploitation by three threat clusters led to credential theft, Cyclops Blink deployment, and Qilin ransomware.
A suspected Chinese-speaking actor used a SecFlow-based environment with Claude-, Qwen-, and DeepSeek-backed workers, and a suspected Russian-speaking actor used hundreds of AI agents to compromise at least 440 PaperCut NG/MF instances associated with 395 organizations.
47 of the 94 vulnerabilities enabled remote code execution (RCE). Network-edge and security-management products were the most affected product type. Apache and Google represented the largest share of vendors, with three RCE vulnerabilities each.
Insikt Group identified public proof-of-concept (PoC) exploits or scanners for 75 of the 94 vulnerabilities identified in September.
The most common weakness class was CWE-306 (Missing Authentication for Critical Function), with seven vulnerabilities, followed by CWE-22 (Path Traversal), with six. CWE-78 (OS Command Injection), CWE-89 (SQL Injection), and CWE-94 (Code Injection) each affected five vulnerabilities.
Eight of the 94 vulnerabilities were at least five years old, and the oldest was approximately 12 years old.
Trend analysis
AI-assisted campaigns combine older flaws with post-compromise tooling
Insikt Group detailed a suspected Chinese-speaking actor using a SecFlow-based operations environment with Claude-, Qwen-, and DeepSeek-backed workers to support reconnaissance, exploitation, post-exploitation, and collection across Asian targets. The threat actor tested or staged workflows for CVE-2014-6271, CVE-2020-1938, CVE-2022-22965, CVE-2016-4437, CVE-2021-43798, CVE-2024-4956, CVE-2021-29441, and CVE-2021-44228. The workflow routed candidate findings to vulnerability-specific playbooks, but not every attempt produced confirmed access.
A separate September report described a suspected Russian-speaking threat actor using hundreds of AI agents in a campaign targeting PaperCut NG/MF. The campaign exploited CVE-2026-81578 and CVE-2026-82078, compromising at least 440 instances associated with 395 organizations.
Figure 1:Risk Rules history on theVulnerability Intelligence Card®for CVE-2022-22965 in Recorded Future (Source: Recorded Future)
One malware hash can turn a vague alert into a concrete investigation. Analysts can search endpoints for the exact file, trace where it appeared, and determine whether related activity exists elsewhere. But if the attacker changes the file, the hash changes too. Domains and Internet Protocol (IP) addresses can also lose relevance as attackers rotate infrastructure.
This is why malware indicators of compromise work best as evidence within a larger investigation, not as isolated entries on a blocklist. Their value grows when analysts can establish where an indicator came from, how recently it was observed, what threats are connected to it, and whether those connections matter to their organization.
Malware indicators of compromise are technical artifacts or observations that suggest malicious activity. They help security teams detect, investigate, and contain threats, but an IoC is most useful when analysts can assess its source, timing, confidence, and relationship to other threat activity.
Key takeaways
Malware indicators can include file-based artifacts, network infrastructure, and other technical evidence associated with malicious activity.
IoCs do not exclusively describe past attacks. They can point to malicious activity that may be underway or has already occurred.
Indicator types have different defensive lifespans. An IP address may quickly lose relevance, while a file hash remains an exact identifier for the same sample even if attackers create a new version.
Threat intelligence can add context that helps analysts prioritize IoCs, connect related activity, and move from an isolated match toward a wider investigation.
What are malware indicators of compromise?
An indicator of compromise (IoC) is a technical artifact or observable that suggests malicious activity. The National Institute of Standards and Technology (NIST) defines IoCs broadly enough to include signs that an attack may be imminent, underway, or that a compromise may already have occurred.
For a security operations center (SOC) analyst or incident responder, an IoC can help answer a practical question: Have we seen evidence associated with this threat in our environment?
Analysts can use malware IoCs to validate an alert, search logs and endpoints for related activity, or scope an incident after malicious activity is confirmed. They can also use an indicator as a starting point for investigating connected infrastructure, malware, or attacker behavior.
An IoC does not automatically prove that an organization has been compromised. Context matters. Finding a malware hash executing on an endpoint carries a different meaning from finding the same hash in an intelligence feed.
IoCs and TTPs serve different purposes
Indicators of compromise identify observable evidence associated with malicious activity. Tactics, techniques, and procedures (TTPs) describe how an adversary operates.
A specific command-and-control domain is an IoC. The techniques an attacker repeatedly uses to establish persistence or move through a network are TTPs.
Atomic indicators are often easier to match against security telemetry, but attackers may be able to change them quickly. TTP-based detection can be harder to evade when it focuses on established attacker behavior, but it can also demand richer telemetry and more detection engineering.
Security teams do not need to choose one or the other. An IoC can provide the first concrete lead, while TTPs can help analysts search for related activity after an attacker changes a domain or recompiles malware.
The most common types of malware indicators
Malware indicators generally appear either in files and host activity or in network communications. Each gives analysts a different view of what the malware has done.
File-based IoCs
File hashes such as SHA-256 fingerprints allow security tools to identify an exact known file. They provide a precise match, but attackers can alter a malware sample and generate a new hash.
Other file and host artifacts can reveal how malware operates after reaching a system. Analysts may examine suspicious file names and paths along with changes malware makes to the operating system, such as registry activity or mutex creation.
These artifacts can help investigators determine whether the same malware has appeared elsewhere in the environment.
Network-based IoCs
Network indicators show where malware connects or where malicious content is hosted.
These may include IP addresses associated with command-and-control infrastructure, domains used to distribute malware, or URLs connected to malicious activity. Analysts can also examine characteristics of network traffic when those characteristics are specific enough to the threat.
Network IoCs can help teams find infected systems that contacted known malicious infrastructure. Their usefulness can change over time because infrastructure may be abandoned, reassigned, or shared with legitimate services.
Why raw IoCs have limits
The main problem with raw malware indicators is not that they are useless. It is that the indicator alone often does not tell an analyst enough to make a good decision.
Indicators can lose defensive value quickly
Threat actors can move command-and-control infrastructure, register new domains, or change malware files to avoid known indicators. This makes some IoCs highly time-sensitive.
It is more accurate to think in terms of defensive lifespan than to assume every IoC simply expires. A hash continues to identify the same file, for example, but it stops detecting new versions once an attacker changes the sample.
A malicious label does not provide organizational context
An IP address listed as malicious does not tell a SOC whether its own systems communicated with it, whether the activity is current, or what defensive action is appropriate.
This is where raw feeds can create unnecessary analyst work. Teams must investigate why an indicator was flagged and decide whether that evidence applies to their environment.
Recorded Future recommends combining external indicator context with internal network data and subjecting indicators to organizational vetting before using them for detection in its guidance on indicators of compromise.
More indicators can create more noise
Threat intelligence feeds can contain overlapping, stale, or irrelevant information. Adding feeds without a way to assess their quality can increase alert volume without giving analysts better evidence.
Volume can still matter when a source provides useful threat coverage. It should not serve as the only measure of intelligence quality. Timeliness, confidence, provenance, and relevance also affect whether an indicator deserves attention.
IoCs do not provide complete threat visibility
Threat intelligence can tell analysts a great deal about an indicator that has already been observed. It cannot provide context for infrastructure or malware that its collection sources have never seen.
Better information about known IoCs can improve interpretation, but it does not guarantee complete threat visibility.
How threat intelligence makes malware indicators more useful
Security teams can get more value from IoCs by connecting individual observations to evidence that explains why they matter.
Recorded Future malware intelligence connects malware samples with associated IoCs and threat context. It also supports automated YARA rule generation for malware hunting.
Add context before taking action
Useful context can show when an indicator was observed, what malware is associated with it, and what other infrastructure or activity is connected to it.
Recorded Future uses Risk Scores to help analysts prioritize indicators. These scores can help determine what deserves attention, but they should inform security decisions rather than replace organizational context.
Automate repetitive IoC work
Large indicator volumes make manual lookup difficult. Application programming interfaces (APIs) and security integrations can automate IoC lookup, add threat context, and bring external intelligence into existing security workflows.
Recorded Future Cyber Operations supports these workflows through threat intelligence, APIs, and integrations.
Automation does not need to mean automatic blocking. Teams can automate research and prioritization while applying stronger requirements before an indicator triggers a direct enforcement action.
Turn individual indicators into threat-hunting leads
An IoC often becomes more useful when it leads analysts to related activity.
A malware sample can point investigators toward related variants, behaviors, and infrastructure. Recorded Future malware intelligence includes Auto YARA, which analyzes malware samples for distinctive patterns and generates YARA rules that analysts can use in malware hunting.
This lets teams move beyond searching only for a known hash and look for related files that share useful characteristics. Recorded Future University's guide to malware hunting provides more detail on how threat hunters approach that work.
Best practices for an IoC-driven security program
A useful IoC program should focus on the quality of security decisions rather than the size of the indicator database.
Check context before enforcement. Establish the source, confidence, and timing of an indicator before deciding whether it should trigger blocking or containment.
Match automation to the consequence. Automating lookup and prioritization carries less operational risk than automatically blocking infrastructure. Raise the confidence requirement as the action becomes harder to reverse.
Connect external intelligence with internal evidence. External threat data can show why an indicator deserves attention. Internal telemetry shows whether that threat has reached systems that matter to your organization.
Review active indicator sets over time. An indicator that no longer belongs in an active detection or blocking rule may still have value for historical investigation. Removing it from active enforcement does not mean deleting the intelligence.
Recorded Future's research into malware and vulnerability trends provides further context on changing malware activity and the threats defenders need to watch.
The future of IoC detection
Attackers can change hashes, IP addresses, and domains to evade known indicators. Security teams, therefore, need ways to connect individual IoCs to related malware activity and attacker behavior.
Automated malware analysis and detection-rule generation can help teams move from a new observation to a broader hunt with less manual work. This does not make atomic indicators obsolete. It gives teams another way to use them alongside behavioral detections and threat context.
Recorded Future combines malware analysis with threat intelligence so security teams can investigate individual IoCs in the context of related malware, infrastructure, and behavior.
Ready to spend less time chasing stale or low-value indicators? Request a demo to see how Recorded Future can help your team add context to malware IoCs and put threat intelligence into existing security workflows.
FAQs about using malware IoCs in security operations
Are YARA rules the same as malware IoCs?
No. An IoC is an observable artifact or piece of evidence associated with malicious activity. A YARA rule is detection logic that searches files or other data for defined patterns. Analysts can create YARA rules from characteristics found during malware analysis, allowing them to search for related samples rather than relying on one exact file hash.
How are malware indicators of compromise collected and shared?
IoCs can come from malware analysis, incident investigations, security telemetry, threat research, and intelligence-sharing communities. Organizations can share structured threat information using standards such as Structured Threat Information Expression (STIX), while Trusted Automated Exchange of Intelligence Information (TAXII) supports the exchange of that information between systems.
Are indicators of attack the same as indicators of compromise?
No, although the distinction is not simply that one predicts an attack and the other describes the past. Indicators of attack (IoAs) focus on behaviors or activity associated with attacker intent or an attack in progress. IoCs identify technical evidence associated with malicious activity, which may relate to activity that is ongoing or has already occurred.
Can two intelligence sources assess the same IoC differently?
Yes. Intelligence sources may rely on different observations, collection methods, scoring systems, and timeframes. Infrastructure can also change ownership or use over time. Analysts should consider the source, supporting evidence, and observation dates rather than assuming every malicious classification carries the same meaning.
Today, Recorded Future is announcing AI Infrastructure Indicator Lists, curated datasets for security teams to identify, monitor, and implement controls for AI-related network traffic. AI Infrastructure Indicator Lists are included for free for Recorded Future customers with a Cyber Operations license.
Artificial intelligence has increasingly become enterprise infrastructure and organizations are now confronting unsanctioned tool use (also known as shadow AI), data exposure, and autonomous behavior that their controls cannot always see.
Recorded Future's AI Infrastructure Indicator Lists focus on closing this gap across risk, IT, and GRC teams whether the goal is policy enforcement, data loss prevention, or detecting shadow AI.
AI is accumulating security debt
The hidden risks of an abundance of AI within an organization are often overshadowed by the daily threats that have to be prioritized by a security team. Last year, we reported on how security debt has been accrued by almost every organization, and the unaddressed risks are piling up faster than teams can service them. As a result, blind spots in AI governance are also increasing.
Take, for example, agentic AI. Its adoption is accelerating rapidly and agents are operating across interconnected systems, giving threat actors more room to exploit vulnerabilities at the organizational level and across supply chains.
Consider a free, viral AI assistant that an employee discovers on social media and installs on their own machine to boost productivity. No procurement process, no security review, no IT visibility.
That's not a hypothetical. OpenClaw, a free open-source AI assistant, saw explosive adoption earlier this year with almost no organizational oversight. Multiply that across a workforce and security teams left trying to govern tools they don't know exist.
By 2027, an estimated 75% of employees are expected to adopt or build technology outside IT governance. As agents become more ubiquitous, defenders need to ensure they can identify which technologies are living on their networks, and begin to track and manage access permissions for autonomous processes in the same way they manage permissions for human users.
Introducing AI Infrastructure Indicator Lists
While many threat feeds give you a wall of indicators and leave you to figure out what they are and whether to trust them, Recorded Future’s AI Infrastructure Indicator Lists do the opposite.
AI Infrastructure Indicator Lists are curated, regularly refreshed datasets that map the AI infrastructure your users, developers, and adversaries are actually reaching for. Indicators include IP addresses, CIDR ranges, and domains, carrying their own Risk Scores and comment fields with service attribution.
Recorded Future provides two distinct AI-related lists: the AI infrastructure list and the Chinese AI infrastructure list. The lists cover a comprehensive range of tools, including general-purpose AI assistants, AI coding assistants, vibe-coding tools, AI search tools, voice and audio AI tools, AI video tools, Chinese-domiciled AI tools, and autonomous AI agents.
Figure 1: List of AI tools monitored in AI Infrastructure Indicator Lists
Login
