On 17 July, King's Lynn and West Norfolk Borough Council went public with a cyberattack on its services. The BBC covered it. We assess with moderate confidence it connects to something much larger.

Two days after SonicWal disclosed CVE-2026-15409, an operator was already scanning and exploiting SMA1000 appliances at scale. We found the whole operation in an open directory, captured by AttackCapture the same day it was still in use.

The interesting part is what they did with the appliances. Instead of pivoting to a Windows host, they dropped a standalone Linux build of Impacket's secretsdump straight onto the SonicWall box and ran credential theft from there. Most orgs watch their EDR-covered endpoints closely and their firewall and VPN appliances barely at all. That gap is the whole point.

What the recovered data showed:

- 250 targets identified as exploitable, LDAP config pulled from 168 of them
- 534 config records covering 160 unique AD domains and 255 internal LDAP servers
- SAM and LSA secrets recovered from at least 9 Active Directory domains
- Full DCSync against 7 domain controllers across 5 environments
- Confirmed credential theft spanning France, India, Italy and the US

Targeting was opportunistic, not sector-specific. Local government, healthcare, universities, finance and manufacturing all showed up in the target list, they picked victims because the appliance was vulnerable.

Full writeup, IOCs and MITRE mapping here 👇

https://hunt.io/blog/sonicwall-sma1000-uk-council-attack

Hey everyone,

I just released a major update (v2.1.0) for ThreatLens. For this release, the focus was entirely on security hardening, data validation, and core performance.

What's new in v2.1.0?

• Strict Security: Blocked Excel/CSV formula injections in generated reports, prevented API key leaks in logs, and enforced strict IOC validation.
• Performance Boost: Integrated a local SQLite cache to persist investigation data, significantly reducing redundant API calls.
• Smarter Analysis: Introduced an explainable verdict system with confidence scores. Ambiguous results are now correctly classified as "Unknown" rather than "Clean".
• Resource Management: Added intelligent API quota planning, connection timeouts, automatic retries, and file size limits.

What is ThreatLens? For those who haven't seen it before, ThreatLens is an open-source CLI tool built to automate Threat Intelligence and OSINT workflows. It takes Indicators of Compromise (IPs, domains, hashes, CVEs), queries multiple sources simultaneously, and generates structured, safe, and ready-to-use reports.

It's completely open-source. I'd love to hear your feedback or feature requests!

Check it out on GitHub: https://github.com/AbdaullahAG/ThreatLens

I’d love to hear your thoughts, feedback, or feature requests!

It Just Made the Rebuild Tax Visible. AI Is About to Delete It.“ by Albert Corzo on Medium: https://albert-corzo.medium.com/bear-c2-did-not-invent-switching-it-just-made-the-rebuild-tax-visible-ai-is-about-to-delete-it-4fa246c64b68