NexusMalware
Last reported yesterday, by Help Net Security31 reports
ATT&CK techniques
6 of 10 · each with the sentence it comes from- T1684Social Engineering
“The attackers used tailored social engineering tactics, weaponizing recruitment lures aimed at Iraqi software developers and engineers.”
- T1036Masquerading
“We discovered that an Iranian state-aligned threat actor has been masquerading as the Dubai Airports IT department to deliver trojanized coding challenges to high-value targets.”
- T1047Windows Management Instrumentation
“Windows Management Instrumentation (WMI)”
- T1110.004Credential Stuffing
“Mastodon credential stuffing attack: Mastodon has been hit by a credential stuffing attack, looking for users who reuse their passwords across sites.”
- T1127Trusted Developer Utilities Proxy Execution
“This technique is classified as Trusted Developer Utilities Proxy Execution.”
- T1176.001Browser Extensions
“…igence with browser-native protection, helping organizations stop post-click phishing and malicious URLs in the browser, malicious browser extensions, OAuth phishing, credential theft, session hijacking, and other browser-borne attacks.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
31 reports · the newest 20, newest first · the exact sentence from each-
New infosec products of the week: October 23, 2026“ThreatModeler has announced the launch of NexusAI, its new AI-powered threat modeling partner within the ThreatModeler Nexus platform.”
-
What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers“…provisioning: Cisco Business Process Automation (BPA), Cisco Catalyst Center (formerly DNA Center), Cisco Catalyst SD-WAN Manager, Cisco Nexus Dashboard Insights, Cisco WAN Automation Engine (WAE)”
-
Generative AI Is Erasing Behavioral Tells, Weakening Behavior-Only Detection, Proofpoint Reports“The company announced its Nexus Intent-Based Detection Model in September as part of what it calls the Agentic Collaboration Security system.”
-
Risky Bulletin: Hacker hijacks 10% of Tor exit nodes“According to 404 Media, the hackers found a way to access an internal Staples app named Nexus.”
-
ThreatModeler NexusAI tracks architectural changes and proposes security updates“ThreatModeler has announced the launch of NexusAI, its new AI-powered threat modeling partner within the ThreatModeler Nexus platform.”
-
Desbordamiento de búfer basado en montículo en NX-OS Software de Cisco“Cisco Nexus 3000 Series Switches con la función NX-API habilitada;”
-
September 2026 Dark Web Breach Incident Trend Report“…국 에콰도르 사우디아라비아 프랑스 한국 아랍에미리트 아르헨티나 아프가니스탄 싱가포르 Japan law-firm Libya logistics Malaysia Manufacturing MEXICO Military Myanmar Netherlands Nexus Nigeria npm OT Pakistan Panama Paraguay Peru Pharmaceutical Poland Ransomware RDP RMM Russia Saudi-Arabia Settra ShinyHunters Singapore s…”
-
Critical Cisco NX-OS Flaws Threaten Nexus Switches“Critical Cisco NX-OS Flaws Threaten Nexus Switches”
-
Cisco Patches a Dozen Critical Vulnerabilities“The remaining three issues, CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501, can only be triggered on Nexus 3000 and Nexus 9000 series switches that have Next Generation OAM (NGOAM) enabled.”
-
Cisco NX-OS Software Control Plane Denial of Service Vulnerability“Enter a release number-for example, 10.4(4) for Cisco Nexus 3000 Series Switches or 16.0(8e) for Cisco NX-OS Software in ACI mode.”
-
Cisco NX-OS Software NX-API Remote Code Execution Vulnerability“Note: The NX-API feature is disabled by default for Cisco Nexus 3000 and 9000 Series Switches.”
-
Cisco Nexus 3000 and 9000 Series Switches NGOAM Remote Code Execution Vulnerabilities“Cisco Nexus 3000 and 9000 Series Switches NGOAM Remote Code Execution Vulnerabilities”
-
Cisco Nexus 9000 Series Fabric Switches in ACI Mode Endpoint Group Contract Bypass Vulnerability“Cisco Nexus 9000 Series Fabric Switches in ACI Mode Endpoint Group Contract Bypass Vulnerability”
-
Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability“Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability”
-
Cisco NX-OS Software Python Sandbox Escape Vulnerability“…rding Python execution privileges, see product-specific documentation, such as the Cisco NX-OS Security with Python section of the Cisco Nexus 9000 Series NX-OS Programmability Guide.”
-
Blinder Tunnel Campaign Targets Iraqi Infrastructure“Attribution to the Iranian Nexus”
-
Proofpoint on Why AI Security Must Focus on Intent“Proofpoint's Nexus Intent-Based Detection Model instead evaluates what a message is trying to accomplish and whether that objective makes sense in the context of the relationship.”
-
Cisco Advance Notification for Publication of October 7, 2026, Security Advisories“NX-OS Software for MDS 9000, Nexus 3000, 7000, and 9000 Series Switches, Nexus 9000 in ACI mode, and UCS Fabric Interconnects (security hardening release)”
-
Proofpoint Banks on Intent‑Based Detection“Layered on top is the Nexus Intent‑Based Detection Model, which uses multi‑stage analysis to interpret the purpose behind each interaction.”
-
Cisco Nexus 9000 Series Switches Silicon One Remote Code Execution Vulnerability“Cisco Nexus 9000 Series Switches Silicon One Remote Code Execution Vulnerability”
Indicators in its reports
named in the reports above- infosec[.]exchangein 1 report
- hxxps://api.github[.]com/repos/peakyblinders-tm/myLic/contents/in 1 report
- 91.107.156[.]29in 1 report
- 6e7d9b33f1e72ea1…de9ecd1fd239in 1 report
- f5b12772db6817f7…4a372a410fc9in 1 report
- 53f35e49eb9b271f…be0363daa402in 1 report
- 3fd810a3aa003999…0887cdd3ed13in 1 report
- 76273382e4252c1f…891762c0682ein 1 report
- d3561bd4aad003dc…08ab1d4e8260in 1 report
- 65.109.214[.]145in 1 report
- f5ba1645694c62f5…37e72803b4bdin 1 report
- 87.248.129[.]239in 1 report
- 7cc571aca6d8715d…7c5d00a1f875in 1 report
- 38.180.136[.]127in 1 report
- googeldrive[.]camin 1 report
- drivegoogel[.]camin 1 report
- googelmeet[.]onlinein 1 report
- meetonline[.]camin 1 report
- asdfafadafg[.]onlinein 1 report
- hxxps://github[.]com/peakyblinders-tmin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.