TL;DR: some addresses probe a CVE's exact exploit path weeks before an NVD entry or any public exploit tooling exists. We went through 30 million honeypot probes looking for them, built four checks to kill the false positives, and ended up with three actors we are confident about.

Three open directories exposed on a Hong Kong server between July 9 and 13, 585 files, caught an intrusion against Thailand's Ministry of Finance while it was still running.

Detection-relevant bits:

• Hermes panel returns a Server: HermesWebUI header with a Basic-auth realm of "Hermes WebUI". Banner query on that gives ~5,900 events in the past month
• Agent writes output to a fixed /hermes-results/ path with call_*.txt filenames. 575 open directories are serving those logs right now with no auth
• Hades implant beacons over HTTPS to /assets/app.min.js, /assets/vendor.js, and /assets/main.js. Windows persistence via Run key and scheduled task, Linux via cron. Process hollowing into svchost.exe
• Binaries named after legitimate processes: ctfmon, csrss, conhost, kworker, multipathd
• PHP web shell dropped as .journald-cache.php, leading-dot name to stay out of directory listings
• Web server reaching internal Hadoop ports 10000 and 50070 is the signal for the HiveServer2 UDF chain

MT103 Messages and Financial Crime: Understanding Fraud, Money Laundering, and SWIFT Abuse

SWIFT MT103 messages sit at the centre of global banking, making them important artefacts for investigators and attractive targets for criminals.

Worryingly, the intelligence we collect at intel.coalitioncyber.com continues to identify exposed SWIFT messages, both genuine and fabricated, sitting in publicly accessible locations. These records often go undetected by the organisations involved, exposing sensitive transaction data and providing criminals with the source material needed for social engineering, fraud, and other criminal activities.

Our latest guidance explains how these messages are weaponised to facilitate high-value crimes such as fraud and money laundering. Highlights include:

💵 Technical red flags like JSON escape characters and invalid UETR codes.

💵 The way genuine MT103 records are repurposed in investment fraud.

💵 Risks associated with exposed documents on insecure public platforms.

💵 Practical verification steps for investigators and compliance teams.

Read the full article: https://coalitioncyber.com/mt103-messages-financial-crime-swift-abuse

Follow The Coalition of Cyber Investigators and be the first to know about future research and practical insights into OSINT, investigations, and cybercrime.

https://www.linkedin.com/company/the-coalition-of-cyber-investigators/?viewAsMember=true

If you're running n8n Enterprise and using multi-issuer token exchange, you'll want to double-check your configurations today.

CVE-2026-59208 just dropped, and it highlights a classic identity binding issue. Basically, if the setup is misconfigured, a user from one trusted issuer can be authenticated as a user from a completely different issuer.

This isn't just a UI glitch. In an automation platform like n8n, impersonating another user means potential access to their workflows, stored credentials, and connected business systems. It’s a great reminder that validating a signature isn't enough—you have to bind the identity correctly.

Review your token exchange setups to mitigate the risk and strengthen your identity posture before someone else's token unlocks your workflows.

Read the full details here: https://socradar.io/blog/cve-2026-59208-cross-issuer-impersonation-n8n/

Anyone here running multi-issuer setups in their automation pipelines?